dataiku-sdk 2.0.0 → 3.1.0

package/dist/src/cli/commands/project-library.js

@@ -1,24 +1,12 @@
 import * as fs from "node:fs";
-import { readStdinText, } from "../coerce.js";
-import { encodedProjectEndpoint, planResult, } from "../output.js";
+import { encodeLibraryPath, EXPECT_SHA256_PATTERN, validateLibraryDestinationPath, validateLibraryName, validateLibraryPath, } from "../../resources/project-library.js";
+import { numFlag, readStdinText, sha256Hex, } from "../coerce.js";
+import { encodedProjectEndpoint, planResult, skipResult, } from "../output.js";
 import { requireArgs, UsageError, } from "../usage.js";
 const PROJECT_LIBRARY_EXIT_CODES = { usage: 1, error: 2, transient: 3, };
-function normalizeLibraryPath(path) {
-    const normalized = path.replace(/^\/+/, "");
-    if (!normalized)
-        throw new Error("Project library path is required");
-    return normalized;
-}
-function normalizeLibraryDestinationPath(path) {
-    if (path === "/")
-        return "/";
-    return `/${normalizeLibraryPath(path)}`;
-}
-function encodeLibraryPath(path) {
-    return normalizeLibraryPath(path)
-        .split("/")
-        .map((segment) => encodeURIComponent(segment))
-        .join("/");
+const PUT_FLAG_ERROR_HINT = "Pass a 64-character SHA-256 hex digest (lowercase or uppercase).";
+function sha256BytesHex(bytes) {
+    return new Bun.CryptoHasher("sha256").update(bytes).digest("hex");
 }
 function projectLibraryContentsEndpoint(client, projectKey, path) {
     return encodedProjectEndpoint(client, projectKey, `/libraries/contents/${encodeLibraryPath(path)}`);
@@ -29,22 +17,53 @@ function projectLibraryFolderEndpoint(client, projectKey, path) {
 function projectLibraryActionEndpoint(client, projectKey, action) {
     return encodedProjectEndpoint(client, projectKey, `/libraries/contents-actions/${action}`);
 }
-function projectLibraryPutPayload(flags) {
-    if (typeof flags["content"] === "string")
-        return { contentSource: "flag", };
-    if (typeof flags["file"] === "string")
-        return { contentSource: "file", file: flags["file"], };
-    return { contentSource: "stdin", };
+/**
+ * Put-input metadata for plans and reports. Plans must never include content
+ * bytes: this helper reports only the source, byte count, and SHA-256 digest —
+ * and only when they are available without consuming stdin (dry-run keeps
+ * stdin unread, so the stdin source carries no size/hash).
+ */
+export function projectLibraryPutPayload(flags) {
+    const expectSha256 = expectSha256FromFlags(flags);
+    if (typeof flags["content"] === "string") {
+        const text = flags["content"];
+        return {
+            contentSource: "flag",
+            bytes: Buffer.byteLength(text, "utf8"),
+            sha256: sha256Hex(text),
+            ...(expectSha256 ? { expectSha256, } : {}),
+        };
+    }
+    if (typeof flags["file"] === "string") {
+        const bytes = fs.readFileSync(flags["file"]);
+        return {
+            contentSource: "file",
+            file: flags["file"],
+            bytes: bytes.length,
+            sha256: sha256BytesHex(bytes),
+            ...(expectSha256 ? { expectSha256, } : {}),
+        };
+    }
+    return { contentSource: "stdin", ...(expectSha256 ? { expectSha256, } : {}), };
 }
 function projectLibraryPlan(action, options) {
     return planResult("project-library", action, {
         ...options,
+        idempotency: options.idempotency ?? "none",
         asyncKind: "none",
         exitCodesOnFailure: PROJECT_LIBRARY_EXIT_CODES,
-        idempotency: "none",
         plannedAndDryRun: true,
     });
 }
+function expectSha256FromFlags(flags) {
+    const value = flags["expect-sha256"];
+    if (value === undefined || value === false)
+        return undefined;
+    if (typeof value !== "string" || !EXPECT_SHA256_PATTERN.test(value)) {
+        throw new UsageError("--expect-sha256 must be a 64-character SHA-256 hex digest.", "validation_failed", PUT_FLAG_ERROR_HINT);
+    }
+    return value;
+}
 export const projectLibraryCommands = {
     list: {
         handler: (c, _a, f) => c.projectLibrary.listContents(f["project-key"]),
@@ -55,6 +74,7 @@ export const projectLibraryCommands = {
     get: {
         handler: (c, a, f) => {
             requireArgs(a, 1, "dss project-library get <path> [--project-key KEY]");
+            validateLibraryPath(a[0]);
             return c.projectLibrary.getFile(a[0], f["project-key"]);
         },
         usage: "dss project-library get <path> [--project-key KEY]",
@@ -69,7 +89,7 @@ export const projectLibraryCommands = {
                 throw new UsageError("--output PATH is required.", "missing_required_flag");
             const bytes = await c.projectLibrary.getFileBytes(a[0], f["project-key"]);
             const written = await Bun.write(out, bytes, { createPath: false, });
-            return { path: out, bytes: written, };
+            return { path: out, bytes: written, sha256: sha256BytesHex(bytes), };
         },
         usage: "dss project-library get-bytes <path> --output PATH [--project-key KEY]",
         description: "Download a project library file's raw bytes to a local file.",
@@ -77,44 +97,62 @@ export const projectLibraryCommands = {
     },
     "create-file": {
         handler: async (c, a, f) => {
-            requireArgs(a, 1, "dss project-library create-file <path> [--dry-run] [--project-key KEY]");
+            requireArgs(a, 1, "dss project-library create-file <path> [--if-not-exists] [--dry-run] [--project-key KEY]");
             const pk = f["project-key"];
+            validateLibraryPath(a[0]);
             if (f["dry-run"] === true) {
                 return projectLibraryPlan("create-file", {
                     method: "POST",
                     endpoint: projectLibraryContentsEndpoint(c, pk, a[0]),
                     identifiers: { path: a[0], },
+                    idempotency: "if-not-exists",
                 });
             }
+            if (f["if-not-exists"] === true) {
+                const exists = await c.projectLibrary.hasLibraryItem(a[0], pk);
+                if (exists) {
+                    return skipResult("project-library", a[0], "exists", { kind: "file", });
+                }
+            }
             await c.projectLibrary.addFile(a[0], pk);
             return { created: a[0], };
         },
-        usage: "dss project-library create-file <path> [--dry-run] [--project-key KEY]",
-        description: "Create an empty file in the project library.",
-        examples: ["dss project-library create-file python/mylib/new.py",],
+        usage: "dss project-library create-file <path> [--if-not-exists] [--dry-run] [--project-key KEY]",
+        description: "Create an empty file in the project library; refuses to overwrite an existing item.",
+        examples: ["dss project-library create-file python/mylib/new.py --if-not-exists",],
     },
     "create-folder": {
         handler: async (c, a, f) => {
-            requireArgs(a, 1, "dss project-library create-folder <path> [--dry-run] [--project-key KEY]");
+            requireArgs(a, 1, "dss project-library create-folder <path> [--if-not-exists] [--dry-run] [--project-key KEY]");
             const pk = f["project-key"];
+            validateLibraryPath(a[0]);
             if (f["dry-run"] === true) {
                 return projectLibraryPlan("create-folder", {
                     method: "POST",
                     endpoint: projectLibraryFolderEndpoint(c, pk, a[0]),
                     identifiers: { path: a[0], },
+                    idempotency: "if-not-exists",
                 });
             }
+            if (f["if-not-exists"] === true) {
+                const exists = await c.projectLibrary.hasLibraryItem(a[0], pk);
+                if (exists) {
+                    return skipResult("project-library", a[0], "exists", { kind: "folder", });
+                }
+            }
             await c.projectLibrary.addFolder(a[0], pk);
             return { created: a[0], };
         },
-        usage: "dss project-library create-folder <path> [--dry-run] [--project-key KEY]",
-        description: "Create a folder in the project library.",
-        examples: ["dss project-library create-folder python/mylib",],
+        usage: "dss project-library create-folder <path> [--if-not-exists] [--dry-run] [--project-key KEY]",
+        description: "Create a folder in the project library; refuses to overwrite an existing item.",
+        examples: ["dss project-library create-folder python/mylib --if-not-exists",],
     },
     put: {
         handler: async (c, a, f) => {
-            requireArgs(a, 1, "dss project-library put <path> (--content TEXT|--file PATH|--stdin) [--dry-run] [--project-key KEY]");
+            requireArgs(a, 1, "dss project-library put <path> (--content TEXT|--file PATH|--stdin) [--expect-sha256 SHA256] [--dry-run] [--project-key KEY]");
             const pk = f["project-key"];
+            const expectSha256 = expectSha256FromFlags(f);
+            validateLibraryPath(a[0]);
             if (f["dry-run"] === true) {
                 return projectLibraryPlan("put", {
                     method: "POST",
@@ -126,19 +164,48 @@ export const projectLibraryCommands = {
             const content = typeof f["content"] === "string"
                 ? f["content"]
                 : typeof f["file"] === "string"
-                    ? fs.readFileSync(f["file"], "utf-8")
+                    ? fs.readFileSync(f["file"])
+                    : await readStdinText();
+            const result = await c.projectLibrary.addOrUpdateFile(a[0], content, pk, expectSha256 !== undefined ? { expectSha256, } : undefined);
+            return {
+                updated: result.path,
+                bytes: result.bytes,
+                sha256: result.sha256,
+                ...(result.beforeSha256 !== undefined ? { beforeSha256: result.beforeSha256, } : {}),
+            };
+        },
+        usage: "dss project-library put <path> (--content TEXT|--file PATH|--stdin) [--expect-sha256 SHA256] [--dry-run] [--project-key KEY]",
+        description: "Create or overwrite a project library file with text or binary content; reports the written byte count and sha256.",
+        examples: [
+            "dss project-library put python/mylib/utils.py --file ./utils.py",
+            "dss project-library put python/mylib/utils.py --file ./utils.py --expect-sha256 <previous-sha256>",
+        ],
+    },
+    diff: {
+        handler: async (c, a, f) => {
+            requireArgs(a, 1, "dss project-library diff <path> (--content TEXT|--file PATH|--stdin) [--max-lines N] [--project-key KEY]");
+            const pk = f["project-key"];
+            validateLibraryPath(a[0]);
+            const maxLines = numFlag(f, ["max-lines",]);
+            const local = typeof f["content"] === "string"
+                ? f["content"]
+                : typeof f["file"] === "string"
+                    ? fs.readFileSync(f["file"])
                     : await readStdinText();
-            await c.projectLibrary.addOrUpdateFile(a[0], content, pk);
-            return { updated: a[0], };
+            return c.projectLibrary.diffFile(a[0], local, pk, maxLines !== undefined ? { maxLines, } : {});
         },
-        usage: "dss project-library put <path> (--content TEXT|--file PATH|--stdin) [--dry-run] [--project-key KEY]",
-        description: "Create or overwrite a project library file with raw text content.",
-        examples: ["dss project-library put python/mylib/utils.py --file ./utils.py",],
+        usage: "dss project-library diff <path> (--content TEXT|--file PATH|--stdin) [--max-lines N] [--project-key KEY]",
+        description: "Diff a project library file against local content; capped unified text diff, binary files detected instead of dumped.",
+        examples: [
+            "dss project-library diff python/mylib/utils.py --file ./utils.py",
+            "dss project-library diff python/mylib/utils.py --content 'print(1)' --max-lines 50",
+        ],
     },
     delete: {
         handler: async (c, a, f) => {
             requireArgs(a, 1, "dss project-library delete <path> [--dry-run] [--project-key KEY]");
             const pk = f["project-key"];
+            validateLibraryPath(a[0]);
             if (f["dry-run"] === true) {
                 return projectLibraryPlan("delete", {
                     method: "DELETE",
@@ -157,16 +224,18 @@ export const projectLibraryCommands = {
         handler: async (c, a, f) => {
             requireArgs(a, 2, "dss project-library rename <path> <new-name> [--dry-run] [--project-key KEY]");
             const pk = f["project-key"];
+            const validPath = validateLibraryPath(a[0]);
+            const validName = validateLibraryName(a[1]);
             if (f["dry-run"] === true) {
                 return projectLibraryPlan("rename", {
                     method: "POST",
                     endpoint: projectLibraryActionEndpoint(c, pk, "rename/"),
-                    identifiers: { path: a[0], newName: a[1], },
-                    payload: { oldPath: `/${normalizeLibraryPath(a[0])}`, newName: a[1], },
+                    identifiers: { path: validPath, newName: validName, },
+                    payload: { oldPath: `/${validPath}`, newName: validName, },
                 });
             }
-            await c.projectLibrary.rename(a[0], a[1], pk);
-            return { renamed: a[0], to: a[1], };
+            await c.projectLibrary.rename(validPath, validName, pk);
+            return { renamed: validPath, to: validName, };
         },
         usage: "dss project-library rename <path> <new-name> [--dry-run] [--project-key KEY]",
         description: "Rename a project library file or folder within its parent.",
@@ -176,19 +245,21 @@ export const projectLibraryCommands = {
         handler: async (c, a, f) => {
             requireArgs(a, 2, "dss project-library move <path> <destination-folder> [--dry-run] [--project-key KEY]");
             const pk = f["project-key"];
+            const validPath = validateLibraryPath(a[0]);
+            const destination = validateLibraryDestinationPath(a[1]);
             if (f["dry-run"] === true) {
                 return projectLibraryPlan("move", {
                     method: "POST",
                     endpoint: projectLibraryActionEndpoint(c, pk, "move"),
-                    identifiers: { path: a[0], destinationFolder: a[1], },
+                    identifiers: { path: validPath, destinationFolder: destination, },
                     payload: {
-                        oldPath: `/${normalizeLibraryPath(a[0])}`,
-                        newPath: normalizeLibraryDestinationPath(a[1]),
+                        oldPath: `/${validPath}`,
+                        newPath: destination,
                     },
                 });
             }
-            await c.projectLibrary.move(a[0], a[1], pk);
-            return { moved: a[0], to: a[1], };
+            await c.projectLibrary.move(validPath, destination, pk);
+            return { moved: validPath, to: destination, };
         },
         usage: "dss project-library move <path> <destination-folder> [--dry-run] [--project-key KEY]",
         description: "Move a project library file or folder into another folder.",

package/dist/src/cli/commands/project.js

@@ -6,6 +6,13 @@ import { jsonInput, num, requiredJsonInput, requiredStringFlag, } from "../coerc
 import { CommandResultFailure, } from "../output.js";
 import { requireArgs, UsageError, } from "../usage.js";
 const INSPECT_ARCHIVE_USAGE = "dss project inspect-archive <file>";
+function flowRenderFormat(value) {
+    if (value === undefined)
+        return undefined;
+    if (value === "ascii" || value === "mermaid")
+        return value;
+    throw new UsageError("--render must be ascii or mermaid.", "invalid_enum");
+}
 /** Local, DSS-free archive inspection shared by the local handler and the command handler. */
 function inspectArchiveCommand(args) {
     requireArgs(args, 1, INSPECT_ARCHIVE_USAGE);
@@ -42,12 +49,19 @@ export const projectCommands = {
             maxNodes: num(f["max-nodes"], "--max-nodes"),
             maxEdges: num(f["max-edges"], "--max-edges"),
             includeRaw: f["include-raw"] === true,
+            render: flowRenderFormat(f["render"]),
         }),
-        usage: "dss project map [--max-nodes N] [--max-edges N] [--include-raw] [--project-key KEY]",
-        description: "Get a summarized, truncated flow map.",
+        validate: (_a, f) => {
+            flowRenderFormat(f["render"]);
+            num(f["max-nodes"], "--max-nodes");
+            num(f["max-edges"], "--max-edges");
+        },
+        usage: "dss project map [--max-nodes N] [--max-edges N] [--include-raw] [--render ascii|mermaid] [--project-key KEY]",
+        description: "Get an analyzed flow map with zones, layers, components, and diagnostics.",
         examples: [
             "dss project map",
             "dss project map --max-nodes 50 --max-edges 100",
+            "dss project map --render mermaid",
             "dss project map --include-raw",
         ],
     },

package/dist/src/cli/commands/recipe.js

@@ -1,18 +1,42 @@
 import { readFileSync, } from "node:fs";
-import { mkdir, writeFile, } from "node:fs/promises";
+import { writeFile, } from "node:fs/promises";
 import { join, } from "node:path";
 import { deepMerge, } from "../../utils/deep-merge.js";
 import { jobLogFilterFromFlag, jsonInput, maxLogLinesFromFlags, normalizeLineEndings, num, recipeInputDatasetsFromFlags, requiredStringFlag, rewritePairsFromFlags, sha256Hex, splitCsvFlag, stableHash, } from "../coerce.js";
 import { moveCreatedItemsToZone, resolveFlowZoneIdFromFlags, } from "../helpers/flow-zone.js";
-import { readRecipeBackup, recipeBackupDocument, recipeBackupPath, recipeCodeEnv, recipeGraph, recipeInputItemRef, recipeRoleInputItems, recipeRunShouldWait, } from "../helpers/recipe.js";
+import { ensureRecipeBackupDir, readRecipeBackup, recipeBackupDocument, recipeBackupPath, recipeCodeEnv, recipeGraph, recipeInputItemRef, recipeRoleInputItems, recipeRunShouldWait, writeRecipeBackup, } from "../helpers/recipe.js";
 import { encodedProjectEndpoint, readIfExists, skipResult, } from "../output.js";
 import { requireArgs, UsageError, } from "../usage.js";
+/** Read a local recipe file before any DSS request, mapping read failures to usage validation. */
+function readRecipeFile(filePath, flagName) {
+    try {
+        return readFileSync(filePath, "utf-8");
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new UsageError(`Could not read ${flagName} ${filePath}: ${reason}.`, "not_found", "Verify the file path and that it is readable.");
+    }
+}
+/** Read a set-payload backup file before any DSS request, mapping read failures to usage validation. */
+function readRecipeBackupFile(backupPath) {
+    try {
+        return readRecipeBackup(backupPath);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new UsageError(`Could not read --backup ${backupPath}: ${reason}.`, "not_found", "Verify the backup file path and that it is readable.");
+    }
+}
 function formatLineDiff(remoteName, localPath, remoteContent, localContent) {
-    if (localContent === remoteContent) {
+    // Line-ending differences are not content differences: compare and split on
+    // CRLF-normalized text, mirroring assert-unchanged's normalized payload hash.
+    const normalizedLocal = normalizeLineEndings(localContent);
+    const normalizedRemote = normalizeLineEndings(remoteContent);
+    if (normalizedLocal === normalizedRemote) {
         return "No differences.";
     }
-    const localLines = localContent.split("\n");
-    const remoteLines = remoteContent.split("\n");
+    const localLines = normalizedLocal.split("\n");
+    const remoteLines = normalizedRemote.split("\n");
     const lines = [`--- remote:${remoteName}`, `+++ local:${localPath}`, "",];
     const maxLen = Math.max(localLines.length, remoteLines.length);
     for (let i = 0; i < maxLen; i++) {
@@ -104,7 +128,7 @@ export const recipeCommands = {
             return c.recipes.run(a[0], options);
         },
         usage: "dss recipe run <name> [--wait|--no-wait] [--build-mode MODE] [--include-logs] [--log-filter stdout|stderr|user|errors] [--summary] [--max-log-lines N] [--timeout MS] [--poll-interval MS] [--partition PARTITION] [--dry-run] [--project-key KEY]",
-        description: "Run a recipe by resolving its outputs and submitting the correct dataset or managed-folder build job.",
+        description: "Run a recipe by resolving its outputs and submitting the correct dataset or managed-folder build job. --timeout defaults to 120000 ms and --poll-interval to 2000 ms.",
         examples: [
             "dss recipe run compute_orders --wait",
             "dss recipe run compute_exports --include-logs --log-filter stdout --summary --timeout 600000",
@@ -344,6 +368,8 @@ export const recipeCommands = {
             if (!filePath) {
                 throw new UsageError("--file is required. Usage: dss recipe diff <name> --file PATH");
             }
+            // Read and validate the local file before any DSS request.
+            const localContent = readRecipeFile(filePath, "--file");
             const result = await c.recipes.get(a[0], {
                 includePayload: true,
                 projectKey: f["project-key"],
@@ -351,7 +377,6 @@ export const recipeCommands = {
             if (!result.payload) {
                 throw new Error(`Recipe "${a[0]}" has no code payload to diff.`);
             }
-            const localContent = readFileSync(filePath, "utf-8");
             return formatLineDiff(a[0], filePath, result.payload, localContent);
         },
         usage: "dss recipe diff <name> --file PATH [--project-key KEY]",
@@ -506,7 +531,7 @@ export const recipeCommands = {
             const filePath = f["file"];
             if (!filePath)
                 throw new UsageError("--file is required.");
-            const content = readFileSync(filePath, "utf-8");
+            const content = readRecipeFile(filePath, "--file");
             const pk = f["project-key"];
             const shouldBackup = f["no-backup"] !== true;
             const backupDir = shouldBackup
@@ -530,8 +555,8 @@ export const recipeCommands = {
                 };
             }
             if (backupDir && backupPath) {
-                await mkdir(backupDir, { recursive: true, });
-                await writeFile(backupPath, `${JSON.stringify(recipeBackupDocument(a[0], pk, current), null, 2)}\n`, "utf-8");
+                ensureRecipeBackupDir(backupDir);
+                writeRecipeBackup(backupPath, `${JSON.stringify(recipeBackupDocument(a[0], pk, current), null, 2)}\n`);
             }
             await c.recipes.replace(a[0], { ...current, payload: content, }, pk);
             return {
@@ -555,7 +580,7 @@ export const recipeCommands = {
             const usage = "dss recipe restore <name> --backup FILE [--payload-only] [--dry-run] [--project-key KEY]";
             requireArgs(a, 1, usage);
             const backupPath = requiredStringFlag(f, "backup", usage);
-            const backup = readRecipeBackup(backupPath);
+            const backup = readRecipeBackupFile(backupPath);
             const payload = typeof backup.payload === "string" ? backup.payload : "";
             const pk = f["project-key"];
             const current = await c.recipes.get(a[0], { includePayload: true, projectKey: pk, });
@@ -598,7 +623,7 @@ export const recipeCommands = {
             const usage = "dss recipe assert-unchanged <name> --since BACKUP [--project-key KEY]";
             requireArgs(a, 1, usage);
             const backupPath = requiredStringFlag(f, "since", usage);
-            const backup = readRecipeBackup(backupPath);
+            const backup = readRecipeBackupFile(backupPath);
             const current = await c.recipes.get(a[0], {
                 includePayload: true,
                 projectKey: f["project-key"],

package/dist/src/cli/commands/sql.d.ts

@@ -1,2 +1,12 @@
 import type { CommandMeta } from "../types.js";
+export declare function resolveSqlInput(args: string[], flags: Record<string, string | boolean>): string;
+export interface SqlQueryInvocation {
+    query: string;
+    connection?: string;
+    datasetFullName?: string;
+    database?: string;
+    projectKey?: string;
+    type: "sql";
+}
+export declare function resolveSqlQueryInvocation(args: string[], flags: Record<string, string | boolean>, projectKeyOverride?: string): SqlQueryInvocation;
 export declare const sqlCommands: Record<string, CommandMeta>;

package/dist/src/cli/commands/sql.js

@@ -2,6 +2,7 @@ import { readFileSync, } from "node:fs";
 import { mkdir, writeFile, } from "node:fs/promises";
 import { dirname, resolve, } from "node:path";
 import { readStdinText, stripUtf8Bom, } from "../coerce.js";
+import { enqueueCliWarning, } from "../output.js";
 import { UsageError, } from "../usage.js";
 const SQL_QUERY_USAGE = "dss sql query (SQL | --sql QUERY | --sql-file PATH | --sql - | --stdin) (--connection CONN | --dataset FULL_NAME) [--database DB] [--output PATH|--output-file PATH] [--preview N] [--start-retries N] [--request-timeout MS] [--project-key KEY]";
 const DEFAULT_SQL_PREVIEW_ROWS = 5;
@@ -34,7 +35,7 @@ function parseSqlStartRetries(value) {
     }
     return parsed;
 }
-function resolveSqlInput(args, flags) {
+export function resolveSqlInput(args, flags) {
     const sources = [];
     if (typeof flags["sql"] === "string") {
         sources.push({
@@ -69,34 +70,55 @@ function resolveSqlInput(args, flags) {
     }
     return query;
 }
+export function resolveSqlQueryInvocation(args, flags, projectKeyOverride) {
+    const connection = flags["connection"];
+    const datasetFullName = flags["dataset"];
+    if ((connection ? 1 : 0) + (datasetFullName ? 1 : 0) !== 1) {
+        throw new UsageError(`Pass exactly one of --connection or --dataset. Usage: ${SQL_QUERY_USAGE}`);
+    }
+    return {
+        query: resolveSqlInput(args, flags),
+        connection,
+        datasetFullName,
+        database: flags["database"],
+        projectKey: projectKeyOverride ?? flags["project-key"],
+        type: "sql",
+    };
+}
 export const sqlCommands = {
     query: {
         handler: async (c, a, f) => {
-            const connection = f["connection"];
-            const datasetFullName = f["dataset"];
-            if ((connection ? 1 : 0) + (datasetFullName ? 1 : 0) !== 1) {
-                throw new UsageError(`Pass exactly one of --connection or --dataset. Usage: ${SQL_QUERY_USAGE}`);
-            }
             const outputFile = f["output"]
                 ?? f["output-file"];
             const previewProvided = f["preview"] !== undefined;
-            if (previewProvided && !outputFile) {
-                throw new UsageError(`--preview requires --output or --output-file. Usage: ${SQL_QUERY_USAGE}`, "validation_failed");
-            }
             const previewCount = previewProvided
                 ? parseSqlPreviewCount(f["preview"])
                 : DEFAULT_SQL_PREVIEW_ROWS;
-            const query = resolveSqlInput(a, f);
             const result = await c.sql.query({
-                query,
-                connection,
-                datasetFullName,
-                database: f["database"],
-                projectKey: f["project-key"],
+                ...resolveSqlQueryInvocation(a, f),
                 retryMaxAttempts: parseSqlStartRetries(f["start-retries"]),
             });
-            if (!outputFile)
+            if (!outputFile && !previewProvided)
                 return result;
+            if (!outputFile) {
+                const truncated = result.rows.length > previewCount;
+                if (truncated) {
+                    enqueueCliWarning({
+                        code: "sql_preview_truncated",
+                        rowCount: result.rows.length,
+                        previewRows: previewCount,
+                        hint: "Use --output PATH to write the full result without placing it on stdout.",
+                    });
+                }
+                return {
+                    queryId: result.queryId,
+                    schema: result.schema,
+                    columns: result.columns ?? result.schema,
+                    rowCount: result.rows.length,
+                    preview: result.rows.slice(0, previewCount),
+                    truncated,
+                };
+            }
             const outputPath = resolve(outputFile);
             await mkdir(dirname(outputPath), { recursive: true, });
             await writeFile(outputPath, `${JSON.stringify(result, null, 2)}\n`, "utf-8");
@@ -111,7 +133,7 @@ export const sqlCommands = {
             };
         },
         usage: SQL_QUERY_USAGE,
-        description: "Run a SQL query against a DSS connection or dataset. --start-retries may execute the SQL more than once; use it only when repetition is safe.",
+        description: "Run potentially mutating SQL against a DSS connection or dataset. Use --preview N for bounded stdout or --output PATH for full rows. --start-retries may execute SQL more than once; use it only when repetition is safe.",
         examples: [
             "dss sql query 'SELECT * FROM orders LIMIT 10' --connection my_pg",
             "dss sql query --sql-file query.sql --connection my_pg",

package/dist/src/cli/commands/webapp.js

@@ -1,5 +1,18 @@
-import { requiredJsonInput, } from "../coerce.js";
+import { ClientValidationError, } from "../../errors.js";
+import { deepMerge, } from "../../utils/deep-merge.js";
+import { stableHash, } from "../../utils/stable-hash.js";
+import { num, requiredJsonInput, } from "../coerce.js";
 import { requireArgs, } from "../usage.js";
+const UPDATE_SETTINGS_USAGE = "dss webapp update-settings <webappId> (--data JSON|--data-file PATH|--stdin) [--expect-hash SHA256] [--dry-run] [--project-key KEY]";
+const RESTART_USAGE = "dss webapp restart-backend <webappId> [--wait] [--timeout MS] [--poll-interval MS] [--project-key KEY]";
+function validateExpectHash(value) {
+    if (value === undefined || value === false)
+        return undefined;
+    if (typeof value !== "string" || !/^[0-9a-fA-F]{64}$/.test(value)) {
+        throw new ClientValidationError("Expected webapp hash must be a 64-character SHA-256 hex digest.", "validation_failed", "Run this update with --dry-run and capture currentHash before retrying.");
+    }
+    return value;
+}
 export const webappCommands = {
     list: {
         handler: (c, _a, f) => c.webapps.list(f["project-key"]),
@@ -26,14 +39,45 @@ export const webappCommands = {
         examples: ["dss webapp create --data-file webapp.json",],
     },
     "update-settings": {
-        handler: (c, a, f) => {
-            requireArgs(a, 1, "dss webapp update-settings <webappId> (--data JSON|--data-file PATH|--stdin) [--project-key KEY]");
+        handler: async (c, a, f) => {
+            requireArgs(a, 1, UPDATE_SETTINGS_USAGE);
             const body = requiredJsonInput(f, "--data, --data-file, or --stdin is required (webapp settings).");
-            return c.webapps.updateSettings(a[0], body, f["project-key"]);
+            const projectKey = f["project-key"];
+            const expectHash = validateExpectHash(f["expect-hash"]);
+            if (f["dry-run"] === true) {
+                const current = await c.webapps.getSettings(a[0], projectKey);
+                const currentHash = stableHash(current);
+                if (expectHash !== undefined && currentHash !== expectHash.toLowerCase()) {
+                    throw new ClientValidationError(`The webapp ${JSON.stringify(a[0])} changed since it was read.`, "validation_failed", "Re-read the webapp settings and retry with the current hash value.", {
+                        id: a[0],
+                        expectedHash: expectHash.toLowerCase(),
+                        actualHash: currentHash,
+                    });
+                }
+                const next = deepMerge(current, body);
+                return {
+                    dryRun: true,
+                    action: "update-settings",
+                    resource: "webapp",
+                    id: a[0],
+                    current,
+                    next,
+                    currentHash,
+                    nextHash: stableHash(next),
+                    ...(expectHash !== undefined
+                        ? { expectHash: expectHash.toLowerCase(), provenanceVerified: true, }
+                        : {}),
+                };
+            }
+            const updated = await c.webapps.updateSettings(a[0], body, projectKey, { expectHash, });
+            return { updated: a[0], ...updated, };
         },
-        usage: "dss webapp update-settings <webappId> (--data JSON|--data-file PATH|--stdin) [--project-key KEY]",
-        description: "Replace a webapp's settings.",
-        examples: ["dss webapp update-settings WEBAPP_ID --data-file webapp.json",],
+        usage: UPDATE_SETTINGS_USAGE,
+        description: "Merge supplied fields into a webapp's settings (GET-merge-PUT) and PUT the full object, so fields outside the patch are never dropped. --expect-hash refuses the write when the object changed since it was fetched; --dry-run reports current, next, and both hashes without writing.",
+        examples: [
+            "dss webapp update-settings WEBAPP_ID --data-file webapp.json",
+            'dss webapp update-settings WEBAPP_ID --dry-run --data=\'{"params":{"designOptions":{"namingRule":"x"}}}\'',
+        ],
     },
     "stop-backend": {
         handler: async (c, a, f) => {
@@ -47,13 +91,23 @@ export const webappCommands = {
     },
     "restart-backend": {
         handler: async (c, a, f) => {
-            requireArgs(a, 1, "dss webapp restart-backend <webappId> [--project-key KEY]");
-            await c.webapps.startOrRestartBackend(a[0], f["project-key"]);
-            return { restarted: true, };
+            requireArgs(a, 1, RESTART_USAGE);
+            const projectKey = f["project-key"];
+            if (f["wait"] === true) {
+                return c.webapps.restartBackendAndWait(a[0], projectKey, {
+                    pollIntervalMs: num(f["poll-interval"], "--poll-interval"),
+                    timeoutMs: num(f["timeout"], "--timeout"),
+                });
+            }
+            const future = await c.webapps.startOrRestartBackend(a[0], projectKey);
+            return { restarted: true, future, };
         },
-        usage: "dss webapp restart-backend <webappId> [--project-key KEY]",
-        description: "Start or restart a webapp's backend.",
-        examples: ["dss webapp restart-backend WEBAPP_ID",],
+        usage: RESTART_USAGE,
+        description: "Start or restart a webapp's backend. The documented endpoint returns a restart future; --wait settles it and returns the FutureWaitResult.",
+        examples: [
+            "dss webapp restart-backend WEBAPP_ID",
+            "dss webapp restart-backend WEBAPP_ID --wait --timeout=60000",
+        ],
     },
     "backend-state": {
         handler: (c, a, f) => {