Add direct-mode bundle support for AI Gateway securables

acceptance/bundle/deployment/bind/mcp_service/databricks.yml

@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle
+
+resources:
+  mcp_services:
+    mcp1:
+      parent: schemas/main.myschema
+      mcp_service_id: mysvc
+      comment: bound service
+

acceptance/bundle/deployment/bind/mcp_service/output.txt

@@ -0,0 +1,30 @@
+
+>>> [CLI] bundle deployment bind mcp1 main.myschema.mysvc --auto-approve
+Successfully bound mcp_service with an id 'main.myschema.mysvc'
+Run 'bundle deploy' to deploy changes to your workspace
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  MCP services:
+    mcp1:
+      Name: mysvc
+      URL:  (not deployed)
+
+>>> [CLI] bundle deployment unbind mcp1
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  MCP services:
+    mcp1:
+      Name: mysvc
+      URL:  (not deployed)

acceptance/bundle/deployment/bind/mcp_service/script

@@ -0,0 +1,5 @@
+trace $CLI bundle deployment bind mcp1 main.myschema.mysvc --auto-approve
+trace $CLI bundle summary
+
+trace $CLI bundle deployment unbind mcp1
+trace $CLI bundle summary

acceptance/bundle/deployment/bind/mcp_service/test.toml

@@ -0,0 +1,18 @@
+# AI Gateway securables are direct-engine only.
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+
+Cloud = false
+
+Ignore = [
+    ".databricks",
+]
+
+# The bind flow issues a GET to confirm the remote resource exists before binding.
+[[Server]]
+Pattern = "GET /api/2.1/unity-catalog/mcp-services/{name}"
+Response.Body = '''
+{
+  "name": "mcp-services/main.myschema.mysvc",
+  "comment": "bound service"
+}
+'''

acceptance/bundle/deployment/bind/model_provider_service/databricks.yml

@@ -0,0 +1,16 @@
+bundle:
+  name: test-bundle
+
+resources:
+  model_provider_services:
+    mps1:
+      parent: schemas/main.myschema
+      model_provider_service_id: mysvc
+      comment: bound service
+      config:
+        provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM
+        custom:
+          direct:
+            base_url: https://api.example.com/v1
+            api_key:
+              plaintext: dummy-api-key

acceptance/bundle/deployment/bind/model_provider_service/output.txt

@@ -0,0 +1,30 @@
+
+>>> [CLI] bundle deployment bind mps1 main.myschema.mysvc --auto-approve
+Successfully bound model_provider_service with an id 'main.myschema.mysvc'
+Run 'bundle deploy' to deploy changes to your workspace
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Model provider services:
+    mps1:
+      Name: mysvc
+      URL:  (not deployed)
+
+>>> [CLI] bundle deployment unbind mps1
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Model provider services:
+    mps1:
+      Name: mysvc
+      URL:  (not deployed)

acceptance/bundle/deployment/bind/model_provider_service/script

@@ -0,0 +1,5 @@
+trace $CLI bundle deployment bind mps1 main.myschema.mysvc --auto-approve
+trace $CLI bundle summary
+
+trace $CLI bundle deployment unbind mps1
+trace $CLI bundle summary

acceptance/bundle/deployment/bind/model_provider_service/test.toml

@@ -0,0 +1,18 @@
+# AI Gateway securables are direct-engine only.
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+
+Cloud = false
+
+Ignore = [
+    ".databricks",
+]
+
+# The bind flow issues a GET to confirm the remote resource exists before binding.
+[[Server]]
+Pattern = "GET /api/2.1/unity-catalog/model-provider-services/{name}"
+Response.Body = '''
+{
+  "name": "model-provider-services/main.myschema.mysvc",
+  "comment": "bound service"
+}
+'''

acceptance/bundle/deployment/bind/model_service/databricks.yml

@@ -0,0 +1,10 @@
+bundle:
+  name: test-bundle
+
+resources:
+  model_services:
+    ms1:
+      parent: schemas/main.myschema
+      model_service_id: mysvc
+      comment: bound service
+

acceptance/bundle/deployment/bind/model_service/output.txt

@@ -0,0 +1,30 @@
+
+>>> [CLI] bundle deployment bind ms1 main.myschema.mysvc --auto-approve
+Successfully bound model_service with an id 'main.myschema.mysvc'
+Run 'bundle deploy' to deploy changes to your workspace
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Model services:
+    ms1:
+      Name: mysvc
+      URL:  (not deployed)
+
+>>> [CLI] bundle deployment unbind ms1
+
+>>> [CLI] bundle summary
+Name: test-bundle
+Target: default
+Workspace:
+  User: [USERNAME]
+  Path: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+Resources:
+  Model services:
+    ms1:
+      Name: mysvc
+      URL:  (not deployed)

acceptance/bundle/deployment/bind/model_service/script

@@ -0,0 +1,5 @@
+trace $CLI bundle deployment bind ms1 main.myschema.mysvc --auto-approve
+trace $CLI bundle summary
+
+trace $CLI bundle deployment unbind ms1
+trace $CLI bundle summary

acceptance/bundle/deployment/bind/model_service/test.toml

@@ -0,0 +1,18 @@
+# AI Gateway securables are direct-engine only.
+EnvMatrix.DATABRICKS_BUNDLE_ENGINE = ["direct"]
+
+Cloud = false
+
+Ignore = [
+    ".databricks",
+]
+
+# The bind flow issues a GET to confirm the remote resource exists before binding.
+[[Server]]
+Pattern = "GET /api/2.1/unity-catalog/model-services/{name}"
+Response.Body = '''
+{
+  "name": "model-services/main.myschema.mysvc",
+  "comment": "bound service"
+}
+'''

acceptance/bundle/invariant/configs/mcp_service.yml.tmpl

@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  mcp_services:
+    foo:
+      parent: schemas/main.default
+      mcp_service_id: test-mcp-service-$UNIQUE_NAME
+      comment: test mcp service

acceptance/bundle/invariant/configs/model_provider_service.yml.tmpl

@@ -0,0 +1,20 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  model_provider_services:
+    foo:
+      parent: schemas/main.default
+      model_provider_service_id: test-model-provider-service-$UNIQUE_NAME
+      comment: test model provider service
+      config:
+        provider_type: EXTERNAL_MODEL_PROVIDER_TYPE_CUSTOM
+        targets:
+          - model: gpt-4o
+            native_api_types:
+              - openai/v1/chat/completions
+        custom:
+          direct:
+            base_url: https://api.example.com/v1
+            api_key:
+              plaintext: dummy-api-key

acceptance/bundle/invariant/configs/model_service.yml.tmpl

@@ -0,0 +1,9 @@
+bundle:
+  name: test-bundle-$UNIQUE_NAME
+
+resources:
+  model_services:
+    foo:
+      parent: schemas/main.default
+      model_service_id: test-model-service-$UNIQUE_NAME
+      comment: test model service

acceptance/bundle/invariant/migrate/test.toml

@@ -16,6 +16,10 @@ EnvMatrixExclude.no_genie_space = ["INPUT_CONFIG=genie_space.yml.tmpl"]
 EnvMatrixExclude.no_instance_pool = ["INPUT_CONFIG=instance_pool.yml.tmpl"]
 # Cluster policies are direct-only; the terraform deploy that seeds the migration fails for them.
 EnvMatrixExclude.no_cluster_policy = ["INPUT_CONFIG=cluster_policy.yml.tmpl"]
+# AI Gateway securables are direct-only; the terraform deploy that seeds the migration fails for them.
+EnvMatrixExclude.no_model_service = ["INPUT_CONFIG=model_service.yml.tmpl"]
+EnvMatrixExclude.no_mcp_service = ["INPUT_CONFIG=mcp_service.yml.tmpl"]
+EnvMatrixExclude.no_model_provider_service = ["INPUT_CONFIG=model_provider_service.yml.tmpl"]
 
 # Cross-resource permission references (e.g. ${resources.jobs.job_b.permissions[0].level})
 # don't work in terraform mode: the terraform interpolator converts the path to

acceptance/bundle/invariant/test.toml

@@ -76,6 +76,9 @@ EnvMatrix.INPUT_CONFIG = [
     "volume_external.yml.tmpl",
     "volume_path_job_ref.yml.tmpl",
     "volume_uppercase_name.yml.tmpl",
+    "model_service.yml.tmpl",
+    "mcp_service.yml.tmpl",
+    "model_provider_service.yml.tmpl",
 ]
 
 EnvMatrixExclude.no_alert_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=alert.yml.tmpl"]
@@ -106,6 +109,12 @@ EnvMatrixExclude.no_external_location_on_cloud = ["CONFIG_Cloud=true", "INPUT_CO
 EnvMatrixExclude.no_external_volume_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=volume_external.yml.tmpl"]
 # Telemetry requires a real model, which cloud invariant tests do not provision.
 EnvMatrixExclude.no_model_serving_endpoint_telemetry_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=model_serving_endpoint_telemetry.yml.tmpl"]
+# AI Gateway securables (direct-only) need a real routing target / provider config /
+# UC connection to create on cloud, which the invariant tests don't provision; the
+# local mock server accepts them, so these run locally only.
+EnvMatrixExclude.no_model_service_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=model_service.yml.tmpl"]
+EnvMatrixExclude.no_mcp_service_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=mcp_service.yml.tmpl"]
+EnvMatrixExclude.no_model_provider_service_on_cloud = ["CONFIG_Cloud=true", "INPUT_CONFIG=model_provider_service.yml.tmpl"]
 # Fake SQL endpoint for local tests
 
 [[Server]]