dataiku-sdk 3.0.0 → 3.2.0

package/dist/src/cli/env.d.ts

@@ -1,2 +1,11 @@
+export type EnvFileProvenance = "project" | "install";
+/**
+ * Provenance of an environment variable injected by loadEnvFile:
+ * - "project": set from the invocation directory's `.env` (working tree, untrusted)
+ * - "install": set from the CLI install/root directory's `.env` (shipped defaults)
+ * Native environment variables (present before loadEnvFile runs) are not
+ * recorded here and resolve to their default source.
+ */
+export declare function envFileProvenance(name: string): EnvFileProvenance | undefined;
 export declare function dataikuEnvironmentEnabled(): boolean;
 export declare function loadEnvFile(): void;

package/dist/src/cli/env.js

@@ -1,6 +1,22 @@
 import { readFileSync, } from "node:fs";
 import { dirname, resolve, } from "node:path";
 import { fileURLToPath, } from "node:url";
+const projectEnvVars = new Set();
+const installEnvVars = new Set();
+/**
+ * Provenance of an environment variable injected by loadEnvFile:
+ * - "project": set from the invocation directory's `.env` (working tree, untrusted)
+ * - "install": set from the CLI install/root directory's `.env` (shipped defaults)
+ * Native environment variables (present before loadEnvFile runs) are not
+ * recorded here and resolve to their default source.
+ */
+export function envFileProvenance(name) {
+    if (projectEnvVars.has(name))
+        return "project";
+    if (installEnvVars.has(name))
+        return "install";
+    return undefined;
+}
 export function dataikuEnvironmentEnabled() {
     return process.env.DATAIKU_DISABLE_ENV !== "1";
 }
@@ -14,7 +30,7 @@ export function loadEnvFile() {
         process.cwd(),
         resolve(dirname(fileURLToPath(import.meta.url)), "..", ".."),
     ];
-    for (const dir of dirs) {
+    for (const [index, dir,] of dirs.entries()) {
         try {
             const content = readFileSync(resolve(dir, ".env"), "utf-8");
             for (const line of content.split("\n")) {
@@ -26,8 +42,10 @@ export function loadEnvFile() {
                     continue;
                 const key = trimmed.slice(0, eq).trim();
                 const val = trimmed.slice(eq + 1).trim().replace(/^['"]|['"]$/g, "");
-                if (!process.env[key])
+                if (!process.env[key]) {
                     process.env[key] = val;
+                    (index === 0 ? projectEnvVars : installEnvVars).add(key);
+                }
             }
         }
         catch {

package/dist/src/cli/flags.d.ts

@@ -1,3 +1,7 @@
+export declare function executionMode(flags: Record<string, string | boolean>): {
+    readonly plan: boolean;
+    readonly dryRun: boolean;
+};
 export declare const BOOLEAN_FLAGS: Set<string>;
 export declare const SHORT_FLAGS: Record<string, string>;
 /** Long-flag aliases: these are normalized to the canonical name in parseArgs. */

package/dist/src/cli/flags.js

@@ -1,4 +1,17 @@
+import { parseBooleanOption, } from "./coerce.js";
 import { unsupportedHelpFlag, UsageError, } from "./usage.js";
+/** Planning wins dispatch; dryRun remains set for combined plan metadata. */
+const EXECUTION_MODES = [
+    Object.freeze({ plan: false, dryRun: false, }),
+    Object.freeze({ plan: false, dryRun: true, }),
+    Object.freeze({ plan: true, dryRun: false, }),
+    Object.freeze({ plan: true, dryRun: true, }),
+];
+export function executionMode(flags) {
+    const plan = parseBooleanOption(flags["plan"], "--plan") ?? false;
+    const dryRun = parseBooleanOption(flags["dry-run"], "--dry-run") ?? false;
+    return EXECUTION_MODES[(plan ? 2 : 0) + (dryRun ? 1 : 0)];
+}
 export const BOOLEAN_FLAGS = new Set([
     "verbose",
     "version",
@@ -46,6 +59,8 @@ export const BOOLEAN_FLAGS = new Set([
     "no-add-to-python-path",
     "delete-directory",
     "peek",
+    "raw-data",
+    "all",
 ]);
 export const SHORT_FLAGS = {
     v: "verbose",
@@ -96,6 +111,7 @@ export const VALUE_FLAGS = new Set([
     "env-version",
     "expect-hash",
     "expect-project-incarnation",
+    "expect-sha256",
     "expected",
     "expect-version",
     "data-file",
@@ -105,6 +121,7 @@ export const VALUE_FLAGS = new Set([
     "file-name",
     "file-type",
     "env",
+    "evaluate-standards-checks",
     "install-core-packages",
     "fuzzy-on",
     "fuzzy-distance",
@@ -121,6 +138,10 @@ export const VALUE_FLAGS = new Set([
     "join-type",
     "package",
     "packages",
+    "published-service-id",
+    "published-project-key",
+    "release-notes",
+    "scenarios",
     "local",
     "login",
     "manifest-version",
@@ -156,6 +177,7 @@ export const VALUE_FLAGS = new Set([
     "path",
     "path-in-repository",
     "preview",
+    "render",
     "prediction-type",
     "project-key",
     "recipe",
@@ -264,7 +286,13 @@ export function parseArgs(argv) {
             if (eqIdx !== -1) {
                 const raw = arg.slice(2, eqIdx);
                 const flagName = normalizeLongFlag(raw);
-                setParsedFlagValue(flags, flagName, arg.slice(eqIdx + 1));
+                const value = arg.slice(eqIdx + 1);
+                if (BOOLEAN_FLAGS.has(flagName)) {
+                    flags[flagName] = parseBooleanOption(value, `--${flagName}`);
+                }
+                else {
+                    setParsedFlagValue(flags, flagName, value);
+                }
             }
             else {
                 const rawFlagName = arg.slice(2);

package/dist/src/cli/helpers/cleanup.js

@@ -1,12 +1,51 @@
+import { readFileSync, } from "node:fs";
 import { resultRecord, stringField, } from "../coerce.js";
 export function projectArg(projectKey) {
     return projectKey ? ["--project-key", projectKey,] : [];
 }
-export function cleanupLedgerEntry(resource, action, args, flags, result, projectKey) {
-    if (!(action.startsWith("create") || action === "clone" || action === "duplicate"
-        || action === "import" || action === "upload"))
+/** Snapshot of the create input for actions whose identifiers live in the JSON
+ * payload rather than positional args (e.g. `workspace.create`). Only
+ * `--data`/`--data-file` are inspected: restating `--stdin` would re-read a
+ * stream the command already consumed, so a stdin-backed create cannot pin
+ * identifiers here and the caller must skip it.
+ */
+function createInputFromFlags(flags) {
+    const text = typeof flags["data"] === "string"
+        ? flags["data"]
+        : typeof flags["data-file"] === "string"
+            ? (() => {
+                try {
+                    return readFileSync(flags["data-file"], "utf-8");
+                }
+                catch {
+                    return undefined;
+                }
+            })()
+            : undefined;
+    if (text === undefined)
+        return undefined;
+    try {
+        const parsed = JSON.parse(text);
+        return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)
+            ? parsed
+            : undefined;
+    }
+    catch {
+        // An unparsable input cannot pin the resource: no entry, no guess.
         return undefined;
+    }
+}
+export function cleanupLedgerEntry(resource, action, args, flags, result, projectKey) {
     const record = resultRecord(result);
+    // A notebook save is ledger-eligible only when it created the notebook:
+    // an update overwrote something that already existed, so there is nothing
+    // for cleanup to remove, and a dry run never mutated anything.
+    const isCreatedNotebookSave = (action === "save-jupyter" || action === "save-sql")
+        && record.created === true;
+    if (!isCreatedNotebookSave
+        && !(action.startsWith("create") || action === "clone" || action === "duplicate"
+            || action === "import" || action === "upload"))
+        return undefined;
     if (record.skipped !== undefined)
         return undefined;
     // Only an explicit `cleanupEligible:false` suppresses the ledger: absent or
@@ -183,6 +222,44 @@ export function cleanupLedgerEntry(resource, action, args, flags, result, projec
                 cleanup: { argv: ["code-env", "delete", lang, name, "--if-exists",], },
             };
         }
+        case "streaming-endpoint.create": {
+            const id = args[0];
+            return {
+                ...base,
+                id,
+                cleanup: { argv: ["streaming-endpoint", "delete", id, ...withProject,], },
+            };
+        }
+        case "meaning.create": {
+            const id = args[0];
+            return {
+                ...base,
+                id,
+                name: args[1],
+                cleanup: { argv: ["meaning", "delete", id, "--if-exists",], },
+            };
+        }
+        case "workspace.create": {
+            const input = resultRecord(createInputFromFlags(flags));
+            const workspaceKey = stringField(input, ["workspaceKey",]);
+            if (!workspaceKey)
+                return undefined;
+            return {
+                ...base,
+                id: workspaceKey,
+                name: stringField(input, ["displayName",]),
+                cleanup: { argv: ["workspace", "delete", workspaceKey,], },
+            };
+        }
+        case "project-library.create-file":
+        case "project-library.create-folder": {
+            const path = args[0];
+            return {
+                ...base,
+                path,
+                cleanup: { argv: ["project-library", "delete", path, ...withProject,], },
+            };
+        }
         case "folder.upload":
             return {
                 ...base,
@@ -190,6 +267,30 @@ export function cleanupLedgerEntry(resource, action, args, flags, result, projec
                 path: args[1],
                 cleanup: { argv: ["folder", "delete-file", args[0], args[1], ...withProject,], },
             };
+        case "notebook.save-jupyter": {
+            const name = args[0];
+            if (!name)
+                return undefined;
+            return {
+                ...base,
+                name,
+                cleanup: {
+                    argv: ["notebook", "delete-jupyter", name, "--if-exists", ...withProject,],
+                },
+            };
+        }
+        case "notebook.save-sql": {
+            const id = args[0];
+            if (!id)
+                return undefined;
+            return {
+                ...base,
+                id,
+                cleanup: {
+                    argv: ["notebook", "delete-sql", id, "--if-exists", ...withProject,],
+                },
+            };
+        }
         case "project.import": {
             const usedProjectKey = stringField(record, ["usedProjectKey",]);
             const recordedIncarnation = stringField(record, ["projectIncarnationHash",]);

package/dist/src/cli/helpers/flow-zone.d.ts

@@ -20,6 +20,7 @@ export interface FlowZoneOrganizeZonePlan {
     items: FlowZoneItemInput[];
 }
 export interface FlowZoneOrganizePlan {
+    topologyFingerprint?: string;
     zones: FlowZoneOrganizeZonePlan[];
 }
 export interface FlowZoneOrganizeValidationIssue {
@@ -56,6 +57,8 @@ export declare function readFlowZoneOrganizePlan(flags: Record<string, string |
 export declare function findFlowZoneForPlan(zones: FlowZone[], plan: FlowZoneOrganizeZonePlan): FlowZone | undefined;
 export declare function ensureFlowZonePlanTarget(plan: FlowZoneOrganizeZonePlan, existing: FlowZone | undefined): void;
 export declare function flowZoneExplicitItems(zone: FlowZone): FlowZoneItemInput[];
+export declare function flowZonePlanFromZones(zones: FlowZone[], topologyFingerprint: string): FlowZoneOrganizePlan;
+export declare function flowZoneMoveDelta(existing: FlowZone | undefined, plannedItems: FlowZoneItemInput[]): FlowZoneItemInput[];
 export declare function flowZonePruneItems(existing: FlowZone | undefined, plannedItemKeys: Set<string>): FlowZoneItemInput[];
 export declare function flowZoneOrganizeStep(plan: FlowZoneOrganizeZonePlan, existing: FlowZone | undefined, sync: boolean, plannedItemKeys: Set<string>): Record<string, unknown>;
 export declare function flowZoneValidationBucket(index: FlowZoneOrganizeValidationIndex, objectType: FlowZoneObjectType): Set<string>;

package/dist/src/cli/helpers/flow-zone.js

@@ -1,4 +1,5 @@
 import { readFileSync, } from "node:fs";
+import { compareStrings, } from "../../utils/stable-hash.js";
 import { finiteNumberField, jsonInput, optionalStringField, parseJsonObject, plainRecord, requiredStringArray, splitCsvFlag, } from "../coerce.js";
 import { UsageError, } from "../usage.js";
 export function flowZoneId(value) {
@@ -201,10 +202,15 @@ export function validateUniqueFlowZoneAssignments(plan) {
 }
 export function parseFlowZoneOrganizePlan(input) {
     const zones = input.zones;
-    if (!Array.isArray(zones) || zones.length === 0) {
-        throw new UsageError("Flow zone organize plan must include a non-empty zones array.", "validation_failed");
+    if (!Array.isArray(zones)) {
+        throw new UsageError("Flow zone organize plan must include a zones array.", "validation_failed");
+    }
+    const topologyFingerprint = optionalStringField(input, ["topologyFingerprint",]);
+    if (topologyFingerprint !== undefined && !/^[0-9a-f]{64}$/.test(topologyFingerprint)) {
+        throw new UsageError("topologyFingerprint must be a lowercase SHA-256 hash.", "validation_failed");
     }
     const plan = {
+        ...(topologyFingerprint ? { topologyFingerprint, } : {}),
         zones: zones.map((value, index) => {
             const source = `zones[${index}]`;
             const record = plainRecord(value);
@@ -284,6 +290,29 @@ export function flowZoneExplicitItems(zone) {
         ...(item.projectKey ? { projectKey: item.projectKey, } : {}),
     }));
 }
+export function flowZonePlanFromZones(zones, topologyFingerprint) {
+    return {
+        topologyFingerprint,
+        zones: [...zones,]
+            .sort((a, b) => compareStrings(a.id, b.id))
+            .map((zone) => {
+            const position = flowZoneCurrentPosition(zone);
+            return {
+                id: zone.id,
+                name: zone.name,
+                ...(zone.color ? { color: zone.color, } : {}),
+                ...(position ? { position, } : {}),
+                items: flowZoneExplicitItems(zone).sort((a, b) => compareStrings(flowZoneItemKey(a), flowZoneItemKey(b))),
+            };
+        }),
+    };
+}
+export function flowZoneMoveDelta(existing, plannedItems) {
+    if (!existing)
+        return plannedItems;
+    const existingKeys = new Set(flowZoneExplicitItems(existing).map(flowZoneItemKey));
+    return plannedItems.filter((item) => !existingKeys.has(flowZoneItemKey(item)));
+}
 export function flowZonePruneItems(existing, plannedItemKeys) {
     if (!existing)
         return [];
@@ -301,6 +330,7 @@ export function flowZoneOrganizeStep(plan, existing, sync, plannedItemKeys) {
         update.position = plan.position;
     }
     const pruneItems = sync ? flowZonePruneItems(existing, plannedItemKeys) : [];
+    const moveItems = flowZoneMoveDelta(existing, plan.items);
     return {
         target: {
             ...(plan.id ? { id: plan.id, } : {}),
@@ -310,7 +340,7 @@ export function flowZoneOrganizeStep(plan, existing, sync, plannedItemKeys) {
         },
         ...(existing ? { existing: flowZoneSummary(existing), } : { create: true, }),
         ...(Object.keys(update).length > 0 ? { update, } : {}),
-        moveItems: plan.items,
+        moveItems,
         ...(pruneItems.length > 0 ? { pruneItems, } : {}),
     };
 }

package/dist/src/cli/helpers/recipe.d.ts

@@ -1,4 +1,24 @@
 export declare function recipeBackupPath(recipeName: string, backupDir: string): string;
+/**
+ * Prepare the backup directory as an owner-only, symlink-free directory.
+ *
+ * Every untrusted component is checked with `lstat` and must be a real
+ * directory — `mkdir { recursive: true, }` would silently traverse a symlink
+ * planted along the path (e.g. `.dss-backups` pointing at an attacker-chosen
+ * home) and create with ambient permissions. Missing components are created
+ * one at a time with mode 0700, and the final directory is clamped to 0700
+ * through a no-follow descriptor so the verification cannot be raced by a swap.
+ */
+export declare function ensureRecipeBackupDir(backupDir: string): void;
+/**
+ * Write a recipe backup file as a brand-new owner-only file.
+ *
+ * `O_EXCL` refuses any pre-existing destination (including a planted symlink)
+ * instead of clobbering it, `O_NOFOLLOW` blocks a symlink destination, and the
+ * file is created with mode 0600 — the payload must never sit on disk under
+ * ambient (umask-derived) permissions.
+ */
+export declare function writeRecipeBackup(backupPath: string, content: string): void;
 export declare function recipeCodeEnv(recipe: Record<string, unknown>): unknown;
 export declare function recipeGraph(recipe: Record<string, unknown>): Record<string, unknown>;
 export declare function recipeBackupDocument(recipeName: string, projectKey: string | undefined, current: {

package/dist/src/cli/helpers/recipe.js

@@ -1,12 +1,167 @@
-import { readFileSync, } from "node:fs";
-import { join, } from "node:path";
+import * as fs from "node:fs";
+import { tmpdir, } from "node:os";
+import { join, parse as parsePath, relative as relativePath, resolve as resolvePath, sep, } from "node:path";
 import { sanitizeFileName, } from "../../utils/sanitize.js";
 import { normalizeLineEndings, sha256Hex, stableHash, } from "../coerce.js";
 import { UsageError, } from "../usage.js";
+/** Backups may embed recipe payloads with secrets: keep them owner-only. */
+const RECIPE_BACKUP_DIR_MODE = 0o700;
+const RECIPE_BACKUP_FILE_MODE = 0o600;
+/**
+ * Backup files are created exclusively — an existing destination is a conflict
+ * (a stale file, or a pre-planted symlink), never something to overwrite — and
+ * O_NOFOLLOW refuses a symlink at the destination itself.
+ */
+const RECIPE_BACKUP_FILE_OPEN_FLAGS = fs.constants.O_WRONLY | fs.constants.O_CREAT
+    | fs.constants.O_EXCL
+    | (typeof fs.constants.O_NOFOLLOW === "number" ? fs.constants.O_NOFOLLOW : 0);
+/** Verify the backup directory through a descriptor that rejects symlinking. */
+const RECIPE_BACKUP_DIR_OPEN_FLAGS = fs.constants.O_RDONLY
+    | (typeof fs.constants.O_DIRECTORY === "number" ? fs.constants.O_DIRECTORY : 0)
+    | (typeof fs.constants.O_NOFOLLOW === "number" ? fs.constants.O_NOFOLLOW : 0);
 export function recipeBackupPath(recipeName, backupDir) {
     const stamp = new Date().toISOString().replace(/[:.]/g, "-");
     return join(backupDir, `${sanitizeFileName(recipeName, "recipe")}-${stamp}.recipe-backup.json`);
 }
+/**
+ * Split a backup directory into a trusted base and the untrusted tail that is
+ * verified component by component.
+ *
+ * Only two prefixes are trusted, and only after canonicalisation: the
+ * invocation directory (the CLI already reads its `.env`) and the OS temp
+ * directory. Canonicalising absorbs OS-level links the user never named —
+ * macOS `/var -> /private/var`, Windows 8.3 temp aliases — while every
+ * component the user's path introduces beneath that prefix is still walked
+ * with `lstat`, which is where a planted `.dss-backups` symlink lives. A path
+ * under neither prefix is walked in full from its volume root.
+ */
+function splitBackupDir(absolute) {
+    for (const trusted of [process.cwd(), tmpdir(),]) {
+        let canonical;
+        try {
+            canonical = fs.realpathSync(trusted);
+        }
+        catch {
+            continue;
+        }
+        const literal = resolvePath(trusted);
+        const bases = literal === canonical ? [canonical,] : [literal, canonical,];
+        for (const candidateBase of bases) {
+            const rel = relativePath(candidateBase, absolute);
+            if (rel === "" || rel.startsWith("..") || parsePath(rel).root)
+                continue;
+            return { base: canonical, tail: rel.split(sep).filter((part) => part.length > 0), };
+        }
+    }
+    const { root, } = parsePath(absolute);
+    return {
+        base: root,
+        tail: relativePath(root, absolute).split(sep).filter((part) => part.length > 0),
+    };
+}
+/**
+ * Prepare the backup directory as an owner-only, symlink-free directory.
+ *
+ * Every untrusted component is checked with `lstat` and must be a real
+ * directory — `mkdir { recursive: true, }` would silently traverse a symlink
+ * planted along the path (e.g. `.dss-backups` pointing at an attacker-chosen
+ * home) and create with ambient permissions. Missing components are created
+ * one at a time with mode 0700, and the final directory is clamped to 0700
+ * through a no-follow descriptor so the verification cannot be raced by a swap.
+ */
+export function ensureRecipeBackupDir(backupDir) {
+    const absolute = resolvePath(backupDir);
+    if (parsePath(absolute).root === absolute) {
+        throw new UsageError(`Recipe backup directory "${backupDir}" is the filesystem root. Choose a dedicated backup directory.`, "usage_error");
+    }
+    const { base, tail, } = splitBackupDir(absolute);
+    let current = base;
+    for (const part of tail) {
+        current = join(current, part);
+        let stats;
+        try {
+            stats = fs.lstatSync(current);
+        }
+        catch {
+            fs.mkdirSync(current, { mode: RECIPE_BACKUP_DIR_MODE, });
+            continue;
+        }
+        if (stats.isSymbolicLink()) {
+            throw new UsageError(`Recipe backup directory "${backupDir}" traverses the symlink "${current}". Refusing to write backups through a symlink.`, "usage_error");
+        }
+        if (!stats.isDirectory()) {
+            throw new UsageError(`Recipe backup path component "${current}" is not a directory.`, "usage_error");
+        }
+    }
+    const target = current;
+    let dirFd;
+    try {
+        dirFd = fs.openSync(target, RECIPE_BACKUP_DIR_OPEN_FLAGS);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ELOOP" || code === "ENOTDIR") {
+            throw new UsageError(`Recipe backup directory "${backupDir}" is not a real, non-symlinked directory.`, "usage_error");
+        }
+        throw error;
+    }
+    try {
+        // Windows has no POSIX directory modes and fchmod on a directory
+        // descriptor fails with EPERM; the owner-only guarantee there comes from
+        // the user profile ACLs, so only the identity verification below applies.
+        if (process.platform !== "win32")
+            fs.fchmodSync(dirFd, RECIPE_BACKUP_DIR_MODE);
+        const verified = fs.fstatSync(dirFd);
+        if (!verified.isDirectory()) {
+            throw new UsageError(`Recipe backup path "${target}" is not a directory.`, "usage_error");
+        }
+    }
+    finally {
+        fs.closeSync(dirFd);
+    }
+}
+/** Drain a backup payload: one `writeSync` may cover only part of the buffer. */
+function writeAllSync(fd, payload) {
+    let offset = 0;
+    while (offset < payload.length) {
+        const written = fs.writeSync(fd, payload, offset, payload.length - offset, offset);
+        if (written <= 0) {
+            throw new Error(`Stalled writing recipe backup at byte ${offset}.`);
+        }
+        offset += written;
+    }
+}
+/**
+ * Write a recipe backup file as a brand-new owner-only file.
+ *
+ * `O_EXCL` refuses any pre-existing destination (including a planted symlink)
+ * instead of clobbering it, `O_NOFOLLOW` blocks a symlink destination, and the
+ * file is created with mode 0600 — the payload must never sit on disk under
+ * ambient (umask-derived) permissions.
+ */
+export function writeRecipeBackup(backupPath, content) {
+    const payload = Buffer.from(content, "utf-8");
+    let fd;
+    try {
+        fd = fs.openSync(backupPath, RECIPE_BACKUP_FILE_OPEN_FLAGS, RECIPE_BACKUP_FILE_MODE);
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "EEXIST" || code === "ELOOP") {
+            throw new UsageError(`Recipe backup destination already exists: ${backupPath}. Refusing to overwrite an existing path.`, "usage_error");
+        }
+        throw error;
+    }
+    try {
+        // O_EXCL guarantees a fresh inode; clamp the mode so the payload is never
+        // published under wider permissions even if creation flags change.
+        fs.fchmodSync(fd, RECIPE_BACKUP_FILE_MODE);
+        writeAllSync(fd, payload);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
 export function recipeCodeEnv(recipe) {
     const params = recipe.params;
     if (!params || typeof params !== "object" || Array.isArray(params))
@@ -36,7 +191,7 @@ export function recipeBackupDocument(recipeName, projectKey, current) {
     };
 }
 export function readRecipeBackup(backupPath) {
-    const raw = readFileSync(backupPath, "utf-8");
+    const raw = fs.readFileSync(backupPath, "utf-8");
     try {
         const parsed = JSON.parse(raw);
         if (parsed && typeof parsed === "object" && parsed.resource === "recipe")

package/dist/src/cli/output.d.ts

@@ -38,6 +38,7 @@ export declare function skipResult(resource: string, id: string, reason: "exists
 export declare function planResult(resource: string, action: string, options: {
     asyncKind: string;
     endpoint?: string;
+    exact?: boolean;
     exitCodesOnFailure: Record<string, number>;
     identifiers?: Record<string, unknown>;
     idempotency: string;
@@ -45,6 +46,7 @@ export declare function planResult(resource: string, action: string, options: {
     payload?: unknown;
     localWrites?: unknown;
     plannedAndDryRun?: boolean;
+    reason?: string;
     requests?: unknown;
     wait?: unknown;
 }): Record<string, unknown>;

package/dist/src/cli/output.js

@@ -23,11 +23,16 @@ export function flushCliWarnings() {
 function resolveFieldPath(source, field) {
     let current = source;
     for (const segment of field.split(".")) {
-        if (current === null || typeof current !== "object" || Array.isArray(current))
-            return null;
-        current = current[segment];
+        if (current === null || typeof current !== "object" || Array.isArray(current)) {
+            return { found: false, value: null, };
+        }
+        const record = current;
+        if (!Object.prototype.hasOwnProperty.call(record, segment)) {
+            return { found: false, value: null, };
+        }
+        current = record[segment];
     }
-    return current ?? null;
+    return { found: true, value: current ?? null, };
 }
 export function pickResultFields(item, fields) {
     if (!item || typeof item !== "object" || Array.isArray(item))
@@ -35,24 +40,44 @@ export function pickResultFields(item, fields) {
     const source = item;
     const picked = {};
     for (const field of fields)
-        picked[field] = resolveFieldPath(source, field);
+        picked[field] = resolveFieldPath(source, field).value;
     return picked;
 }
+function projectionRecords(result) {
+    const items = Array.isArray(result) ? result : [result,];
+    return items.filter((item) => item !== null && typeof item === "object" && !Array.isArray(item));
+}
+function warnUnknownProjectionFields(result, fields) {
+    const records = projectionRecords(result);
+    if (records.length === 0)
+        return;
+    const unknownFields = fields.filter((field) => !records.some((record) => resolveFieldPath(record, field).found));
+    if (unknownFields.length === 0)
+        return;
+    const availableFields = [...new Set(records.flatMap((record) => Object.keys(record))),].sort();
+    enqueueCliWarning({
+        code: "field_projection_missing",
+        fields: unknownFields,
+        availableFields,
+        hint: "Use fields from the command's schemas.output contract or an unprojected result.",
+    });
+}
 /**
  * Project the top-level fields callers asked for via --fields. Arrays are mapped
  * element-wise; scalars and string results pass through untouched. Requested keys
  * that are absent become null so every row keeps a stable, predictable shape.
  */
 export function projectResultFields(result, fields) {
+    warnUnknownProjectionFields(result, fields);
     if (Array.isArray(result))
         return result.map((item) => pickResultFields(item, fields));
     return pickResultFields(result, fields);
 }
 export function writeCommandResult(result) {
-    flushCliWarnings();
     const projected = outputFieldProjection
         ? projectResultFields(result, outputFieldProjection)
         : result;
+    flushCliWarnings();
     process.stdout.write(`${JSON.stringify(projected ?? { ok: true, })}\n`);
 }
 export function transientBodyWithTargetContext(body, target, elapsedMs) {
@@ -187,6 +212,8 @@ export function planResult(resource, action, options) {
         action,
         resource,
         ...(options.plannedAndDryRun ? { plannedAndDryRun: true, } : {}),
+        ...(options.exact !== undefined ? { exact: options.exact, } : {}),
+        ...(options.reason !== undefined ? { reason: options.reason, } : {}),
         ...options.identifiers,
         ...(options.method ? { method: options.method, } : {}),
         ...(options.endpoint ? { endpoint: options.endpoint, } : {}),