dataiku-sdk 3.1.0 → 3.3.0

package/dist/src/cli/commands/connection.js

@@ -1,4 +1,81 @@
-import { UsageError, } from "../usage.js";
+import { sanitizeErrorSecrets, sanitizeSecrets, } from "../../utils/secret-sanitize.js";
+import { requiredJsonInput, } from "../coerce.js";
+import { executionMode, } from "../flags.js";
+import { readIfExists, skipResult, } from "../output.js";
+import { requireArgs, UsageError, } from "../usage.js";
+/**
+ * Keys of a connection payload that carry credentials. CLI plan/error/output
+ * layers replace these with `[redacted]`; the SDK resource layer forwards
+ * values verbatim to DSS (over TLS) and returns server responses unmodified.
+ * Keys are matched after stripping `-`/`_` and lowercasing. The connection
+ * policy is deliberately broader than the user/project-git tables.
+ */
+const SENSITIVE_CONNECTION_KEYS = {
+    accesstoken: true,
+    accesskey: true,
+    apikey: true,
+    apitoken: true,
+    apisecret: true,
+    authorization: true,
+    clientsecret: true,
+    credential: true,
+    credentials: true,
+    password: true,
+    privatekey: true,
+    refreshtoken: true,
+    secret: true,
+    secretkey: true,
+    sharesecret: true,
+    token: true,
+};
+export function sanitizeConnectionSecrets(value, secrets = []) {
+    return sanitizeSecrets(value, { sensitiveKeys: SENSITIVE_CONNECTION_KEYS, secrets, });
+}
+/** Extract exact secret values (e.g. `params.password`) for error scrubbing. */
+export function connectionSecretsFromBody(body) {
+    if (body === undefined || body === null || typeof body !== "object" || Array.isArray(body)) {
+        return [];
+    }
+    const found = [];
+    const visit = (value) => {
+        if (Array.isArray(value)) {
+            value.forEach(visit);
+            return;
+        }
+        if (value !== null && typeof value === "object") {
+            for (const [key, item,] of Object.entries(value)) {
+                const normalizedKey = key.replace(/[-_]/g, "").toLowerCase();
+                if (SENSITIVE_CONNECTION_KEYS[normalizedKey] === true && typeof item === "string") {
+                    found.push(item);
+                }
+                else {
+                    visit(item);
+                }
+            }
+        }
+    };
+    visit(body);
+    return found;
+}
+/**
+ * DSS validation errors can echo the submitted connection body (including
+ * credentials). Scrub error text and body before it reaches stderr or a
+ * structured failure.
+ */
+export function sanitizeConnectionError(error, secrets) {
+    return sanitizeErrorSecrets(error, { sensitiveKeys: SENSITIVE_CONNECTION_KEYS, secrets, });
+}
+function requiredConnectionJson(flags, usage) {
+    return requiredJsonInput(flags, `--data, --data-file, or --stdin is required (connection definition). Usage: ${usage}`);
+}
+/** Connection identifiers must be non-empty before any request or dry-run preview. */
+function requireConnectionName(value, usage) {
+    const trimmed = value?.trim() ?? "";
+    if (trimmed.length === 0) {
+        throw new UsageError(`connection name must be a non-empty string.\nUsage: ${usage}`, "validation_failed");
+    }
+    return trimmed;
+}
 export const connectionCommands = {
     list: {
         handler: (c, _a, f) => c.connections.list({
@@ -17,6 +94,118 @@ export const connectionCommands = {
         description: "List connections with inferred types and metadata.",
         examples: ["dss connection infer", "dss connection infer --mode rich",],
     },
+    get: {
+        handler: async (c, a) => {
+            const usage = "dss connection get <name>";
+            requireArgs(a, 1, usage);
+            const details = await c.connections.adminGet(requireConnectionName(a[0], usage));
+            return sanitizeConnectionSecrets(details);
+        },
+        usage: "dss connection get <name>",
+        description: "Get a connection by name (admin). Credential-bearing params (e.g. params.password) are redacted in output.",
+        examples: ["dss connection get postgres",],
+    },
+    create: {
+        handler: async (c, _a, f) => {
+            const usage = "dss connection create (--data JSON|--data-file PATH|--stdin)";
+            const body = requiredConnectionJson(f, usage);
+            if (executionMode(f).dryRun) {
+                return {
+                    dryRun: true,
+                    action: "create",
+                    resource: "connection",
+                    connectionName: typeof body.name === "string" ? body.name : undefined,
+                    method: "POST",
+                    endpoint: "/public/api/admin/connections",
+                    payload: sanitizeConnectionSecrets(body),
+                };
+            }
+            try {
+                return await c.connections.adminCreate(body);
+            }
+            catch (error) {
+                throw sanitizeConnectionError(error, connectionSecretsFromBody(body));
+            }
+        },
+        usage: "dss connection create (--data JSON|--data-file PATH|--stdin) [--dry-run]",
+        description: 'Create a connection (admin). Body is the Connection definition, e.g. {"name":"new-connection","type":"PostgreSQL","params":{"host":"...","user":"...","password":"..."}}. Secrets are never echoed in errors or output.',
+        examples: [
+            `dss connection create --data '{"name":"new-connection","type":"PostgreSQL","params":{"db":"dbname","user":"myuser","password":"s3cret"}}'`,
+        ],
+    },
+    update: {
+        handler: async (c, a, f) => {
+            const usage = "dss connection update <name> (--data JSON|--data-file PATH|--stdin) [--dry-run]";
+            requireArgs(a, 1, usage);
+            const name = requireConnectionName(a[0], usage);
+            const body = requiredConnectionJson(f, usage);
+            const secrets = connectionSecretsFromBody(body);
+            if (executionMode(f).dryRun) {
+                return {
+                    dryRun: true,
+                    action: "update",
+                    resource: "connection",
+                    name,
+                    method: "PUT",
+                    endpoint: `/public/api/admin/connections/${encodeURIComponent(name)}`,
+                    payload: sanitizeConnectionSecrets(body),
+                    note: "PUT replaces the whole Connection object; the body must come from `dss connection get`. No GET was issued in dry-run.",
+                };
+            }
+            try {
+                const result = await c.connections.adminUpdate(name, body);
+                return sanitizeConnectionSecrets(result, secrets);
+            }
+            catch (error) {
+                throw sanitizeConnectionError(error, secrets);
+            }
+        },
+        usage: "dss connection update <name> (--data JSON|--data-file PATH|--stdin) [--dry-run]",
+        description: "Update a connection (admin). The body MUST be the Connection object obtained from `dss connection get` (PUT semantics); type and name cannot be modified. Use --dry-run to preview the merged result without writing.",
+        examples: [
+            `dss connection update postgres --data '{"type":"PostgreSQL","name":"postgres","allowWrite":true,"params":{"db":"dbname","user":"myuser","password":"s3cret"}}'`,
+        ],
+    },
+    delete: {
+        handler: async (c, a, f) => {
+            const usage = "dss connection delete <name> [--if-exists] [--dry-run]";
+            requireArgs(a, 1, usage);
+            const name = requireConnectionName(a[0], usage);
+            if (executionMode(f).dryRun) {
+                return {
+                    dryRun: true,
+                    action: "delete",
+                    resource: "connection",
+                    name,
+                    method: "DELETE",
+                    endpoint: `/public/api/admin/connections/${encodeURIComponent(name)}`,
+                    ...(f["if-exists"] === true
+                        ? { note: "Existence not checked in dry-run; live --if-exists issues a GET probe first.", }
+                        : {}),
+                };
+            }
+            if (f["if-exists"] === true) {
+                const current = await readIfExists(() => c.connections.adminGet(name));
+                if (!current)
+                    return skipResult("connection", name, "missing");
+            }
+            return c.connections.adminDelete(name);
+        },
+        usage: "dss connection delete <name> [--if-exists] [--dry-run]",
+        description: "Delete a connection (admin). Destructive: per the DSS docs no check is performed that the connection is not in use by a dataset.",
+        examples: ["dss connection delete old-conn", "dss connection delete old-conn --if-exists",],
+    },
+    test: {
+        handler: async (c, a) => {
+            const usage = "dss connection test <name>";
+            requireArgs(a, 1, usage);
+            const result = await c.connections.adminTest(requireConnectionName(a[0], usage));
+            return sanitizeConnectionSecrets(result);
+        },
+        usage: "dss connection test <name>",
+        description: "Test whether a connection is available (uses the same GET /connections/{name}/test route as the official Python client; returns connectionOK, errors when testing is unsupported for the type). Credential-bearing fields are redacted in output.",
+        examples: ["dss connection test postgres",],
+    },
     schemas: {
         handler: (c, _a, f) => {
             const connection = f["connection"];
@@ -51,4 +240,81 @@ export const connectionCommands = {
             "dss connection tables --connection ATHENA_CONN --schema analytics --project-key MYPROJ",
         ],
     },
+    "prepare-import": {
+        handler: async (c, _a, f) => {
+            const usage = "dss connection prepare-import (--data JSON|--data-file PATH|--stdin) [--project-key KEY]";
+            const body = requiredJsonInput(f, `--data, --data-file, or --stdin is required (tables-import request). Usage: ${usage}`);
+            const keys = body["keys"];
+            if (!Array.isArray(keys) || keys.length === 0) {
+                throw new UsageError('Body must include a non-empty keys array (e.g. [{"connectionName":"postgres","name":"my_table"}]).', "validation_failed", `Usage: ${usage}`);
+            }
+            for (const key of keys) {
+                const k = key;
+                const connectionName = k["connectionName"];
+                const name = k["name"];
+                if (typeof connectionName !== "string" || connectionName.trim().length === 0
+                    || typeof name !== "string" || name.trim().length === 0) {
+                    throw new UsageError('Each key must carry non-empty string connectionName and name (e.g. {"connectionName":"postgres","name":"my_table"}).', "validation_failed", `Usage: ${usage}`);
+                }
+            }
+            if (executionMode(f).dryRun) {
+                return {
+                    dryRun: true,
+                    action: "prepare-import",
+                    resource: "connection",
+                    keyCount: keys.length,
+                    method: "POST",
+                    endpoint: `/public/api/projects/${encodeURIComponent(c.resolveProjectKey(f["project-key"]))}/datasets/tables-import/actions/prepare-from-keys`,
+                    payload: { keys, },
+                };
+            }
+            return c.connections.prepareTablesImport({
+                keys: keys,
+                projectKey: f["project-key"],
+            });
+        },
+        usage: "dss connection prepare-import (--data JSON|--data-file PATH|--stdin) [--project-key KEY] [--dry-run]",
+        description: 'Prepare the import of selected SQL or Hive tables (WRITE_CONF). Body is {"keys":[...]} per the DSS tables-import docs. Returns a DSS future; poll with `dss future wait <jobId>`.',
+        examples: [
+            `dss connection prepare-import --data '{"keys":[{"connectionName":"postgres","name":"my_table"}]}' --project-key MYPROJ`,
+        ],
+    },
+    "execute-import": {
+        handler: async (c, _a, f) => {
+            const usage = "dss connection execute-import (--data JSON|--data-file PATH|--stdin) [--project-key KEY]";
+            const body = requiredJsonInput(f, `--data, --data-file, or --stdin is required (tables-import request). Usage: ${usage}`);
+            const sql = body["sqlImportCandidates"];
+            const hive = body["hiveImportCandidates"];
+            const hasSql = Array.isArray(sql) && sql.length > 0;
+            const hasHive = Array.isArray(hive) && hive.length > 0;
+            if (!hasSql && !hasHive) {
+                throw new UsageError('Body must include sqlImportCandidates and/or hiveImportCandidates arrays (e.g. {"sqlImportCandidates":[{"connectionName":"pgsql","table":"t","checked":false,"datasetName":"imported","existingDatasetsNames":[]}]}).', "validation_failed", `Usage: ${usage}`);
+            }
+            if (executionMode(f).dryRun) {
+                return {
+                    dryRun: true,
+                    action: "execute-import",
+                    resource: "connection",
+                    sqlCandidates: hasSql ? sql.length : undefined,
+                    hiveCandidates: hasHive ? hive.length : undefined,
+                    method: "POST",
+                    endpoint: `/public/api/projects/${encodeURIComponent(c.resolveProjectKey(f["project-key"]))}/datasets/tables-import/actions/execute-from-candidates`,
+                    payload: {
+                        ...(hasSql ? { sqlImportCandidates: sql, } : {}),
+                        ...(hasHive ? { hiveImportCandidates: hive, } : {}),
+                    },
+                };
+            }
+            return c.connections.executeTablesImport({
+                sqlImportCandidates: hasSql ? sql : undefined,
+                hiveImportCandidates: hasHive ? hive : undefined,
+                projectKey: f["project-key"],
+            });
+        },
+        usage: "dss connection execute-import (--data JSON|--data-file PATH|--stdin) [--project-key KEY] [--dry-run]",
+        description: "Perform an import from SQL/Hive table candidates (WRITE_CONF). Body carries sqlImportCandidates and/or hiveImportCandidates per the DSS tables-import docs. Returns a DSS future.",
+        examples: [
+            `dss connection execute-import --data '{"sqlImportCandidates":[{"connectionName":"pgsql","table":"my_table","checked":false,"datasetName":"imported_from_db","existingDatasetsNames":[]}]}' --project-key MYPROJ`,
+        ],
+    },
 };

package/dist/src/cli/commands/dashboard.js

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import { ClientValidationError, } from "../../errors.js";
 import { deepMerge, } from "../../utils/deep-merge.js";
 import { jsonInput, parseBooleanOption, } from "../coerce.js";
+import { executionMode, } from "../flags.js";
 import { readIfExists, skipResult, } from "../output.js";
 import { requireArgs, UsageError, } from "../usage.js";
 export const dashboardCommands = {
@@ -106,12 +107,12 @@ export const dashboardCommands = {
             if (listed !== undefined)
                 payload.listed = listed;
             const pk = f["project-key"];
-            if (f["if-not-exists"] === true || f["dry-run"] === true) {
+            if (f["if-not-exists"] === true || executionMode(f).dryRun) {
                 const existing = (await c.dashboards.list(pk)).find((dashboard) => dashboard.name === name);
-                if (existing && f["if-not-exists"] === true && f["dry-run"] !== true) {
+                if (existing && f["if-not-exists"] === true && !executionMode(f).dryRun) {
                     return skipResult("dashboard", existing.id, "exists", { current: existing, });
                 }
-                if (f["dry-run"] === true) {
+                if (executionMode(f).dryRun) {
                     return {
                         dryRun: true,
                         action: "create",
@@ -146,7 +147,7 @@ export const dashboardCommands = {
             if (name === undefined && listed === undefined && !data) {
                 throw new UsageError("--name, --listed, --data, --data-file, or --stdin is required.");
             }
-            if (f["dry-run"] === true) {
+            if (executionMode(f).dryRun) {
                 const current = await c.dashboards.get(a[0], f["project-key"]);
                 const next = deepMerge(current, data ?? {});
                 if (name !== undefined)
@@ -170,11 +171,11 @@ export const dashboardCommands = {
         handler: async (c, a, f) => {
             requireArgs(a, 1, "dss dashboard delete <id>");
             const pk = f["project-key"];
-            if (f["dry-run"] === true || f["if-exists"] === true) {
+            if (executionMode(f).dryRun || f["if-exists"] === true) {
                 const current = await readIfExists(() => c.dashboards.get(a[0], pk));
                 if (!current)
                     return skipResult("dashboard", a[0], "missing");
-                if (f["dry-run"] === true) {
+                if (executionMode(f).dryRun) {
                     return { dryRun: true, action: "delete", resource: "dashboard", id: a[0], current, };
                 }
             }

package/dist/src/cli/commands/data-collection.d.ts

@@ -0,0 +1,2 @@
+import type { CommandMeta } from "../types.js";
+export declare const dataCollectionCommands: Record<string, CommandMeta>;

package/dist/src/cli/commands/data-collection.js

@@ -0,0 +1,164 @@
+import { requiredJsonInput, } from "../coerce.js";
+import { executionMode, } from "../flags.js";
+import { planResult, } from "../output.js";
+import { requireArgs, UsageError, } from "../usage.js";
+const PLAN_FAILURE_CODES = { usage: 1, error: 2, transient: 3, };
+function collectionEndpoint(dataCollectionId, suffix = "") {
+    return `/public/api/data-collections/${encodeURIComponent(dataCollectionId)}${suffix}`;
+}
+export const dataCollectionCommands = {
+    list: {
+        handler: (c) => c.dataCollections.list(),
+        usage: "dss data-collection list",
+        description: "List data collections on which the API key has READ privilege.",
+        examples: ["dss data-collection list",],
+    },
+    get: {
+        handler: (c, a) => {
+            requireArgs(a, 1, "dss data-collection get <dataCollectionId>");
+            return c.dataCollections.get(a[0]);
+        },
+        usage: "dss data-collection get <dataCollectionId>",
+        description: "Get collection settings. Permissions are omitted for non-admins.",
+        examples: ["dss data-collection get OjVsTQ3O",],
+    },
+    create: {
+        handler: async (c, _a, f) => {
+            const body = requiredJsonInput(f, "--data, --data-file, or --stdin is required (collection definition).");
+            if (executionMode(f).dryRun) {
+                return planResult("data-collection", "create", {
+                    asyncKind: "none",
+                    method: "POST",
+                    endpoint: "/public/api/data-collections/",
+                    payload: body,
+                    idempotency: "none",
+                    exitCodesOnFailure: PLAN_FAILURE_CODES,
+                    plannedAndDryRun: true,
+                });
+            }
+            return c.dataCollections.create(body);
+        },
+        usage: "dss data-collection create (--data JSON|--data-file PATH|--stdin) [--dry-run]",
+        description: "Create a collection (creator becomes admin; requires mayCreateDataCollections).",
+        examples: [
+            'dss data-collection create --data \'{"displayName":"My Collection"}\'',
+        ],
+    },
+    "settings-set": {
+        handler: async (c, a, f) => {
+            requireArgs(a, 1, "dss data-collection settings-set <dataCollectionId> (--data JSON|--data-file PATH|--stdin) [--dry-run]");
+            const settings = requiredJsonInput(f, "--data, --data-file, or --stdin is required (collection settings).");
+            if (executionMode(f).dryRun) {
+                return planResult("data-collection", "settings-set", {
+                    asyncKind: "none",
+                    method: "PUT",
+                    endpoint: collectionEndpoint(a[0]),
+                    identifiers: { dataCollectionId: a[0], },
+                    payload: settings,
+                    idempotency: "none",
+                    exitCodesOnFailure: PLAN_FAILURE_CODES,
+                    plannedAndDryRun: true,
+                });
+            }
+            const updated = await c.dataCollections.update(a[0], settings);
+            return { updated: a[0], resource: "data-collection", ...updated, };
+        },
+        usage: "dss data-collection settings-set <dataCollectionId> (--data JSON|--data-file PATH|--stdin) [--dry-run]",
+        description: "Update collection settings; only send settings obtained through get. Admin required.",
+        examples: [
+            "dss data-collection settings-set OjVsTQ3O --data-file settings.json",
+        ],
+    },
+    delete: {
+        validate: (a) => {
+            const usage = "dss data-collection delete <dataCollectionId> [--dry-run]";
+            requireArgs(a, 1, usage);
+            if (a[0].trim().length === 0) {
+                throw new UsageError(`<dataCollectionId> must be a non-empty identifier. Usage: ${usage}`);
+            }
+        },
+        handler: async (c, a, f) => {
+            if (executionMode(f).dryRun) {
+                return planResult("data-collection", "delete", {
+                    asyncKind: "none",
+                    method: "DELETE",
+                    endpoint: collectionEndpoint(a[0]),
+                    identifiers: { dataCollectionId: a[0], },
+                    idempotency: "none",
+                    exitCodesOnFailure: PLAN_FAILURE_CODES,
+                    plannedAndDryRun: true,
+                });
+            }
+            await c.dataCollections.delete(a[0]);
+            return { deleted: a[0], resource: "data-collection", };
+        },
+        usage: "dss data-collection delete <dataCollectionId> [--dry-run]",
+        description: "Permanently delete a collection. Admin required.",
+        examples: ["dss data-collection delete OjVsTQ3O --dry-run",],
+    },
+    "list-objects": {
+        handler: (c, a) => {
+            requireArgs(a, 1, "dss data-collection list-objects <dataCollectionId>");
+            return c.dataCollections.listObjects(a[0]);
+        },
+        usage: "dss data-collection list-objects <dataCollectionId>",
+        description: "List the objects in a collection.",
+        examples: ["dss data-collection list-objects OjVsTQ3O",],
+    },
+    "add-object": {
+        handler: async (c, a, f) => {
+            const object = requiredJsonInput(f, "--data, --data-file, or --stdin is required (collection object reference).");
+            const collectionId = a[0]
+                ?? (typeof object.dataCollectionId === "string" ? object.dataCollectionId : undefined);
+            if (!collectionId) {
+                throw new UsageError("Usage: dss data-collection add-object <dataCollectionId> (--data JSON|--data-file PATH|--stdin)");
+            }
+            const reference = { ...object, };
+            delete reference.dataCollectionId;
+            if (executionMode(f).dryRun) {
+                return planResult("data-collection", "add-object", {
+                    asyncKind: "none",
+                    method: "POST",
+                    endpoint: `${collectionEndpoint(collectionId)}/objects`,
+                    identifiers: { dataCollectionId: collectionId, },
+                    payload: reference,
+                    idempotency: "none",
+                    exitCodesOnFailure: PLAN_FAILURE_CODES,
+                    plannedAndDryRun: true,
+                });
+            }
+            await c.dataCollections.addObject(collectionId, reference);
+            return { added: reference.id, dataCollectionId: collectionId, resource: "data-collection", };
+        },
+        usage: "dss data-collection add-object <dataCollectionId> (--data JSON|--data-file PATH|--stdin) [--dry-run]",
+        description: "Add an object (e.g. {type:'DATASET',projectKey:'K',id:'name'}) to a collection. Contributor required.",
+        examples: [
+            'dss data-collection add-object OjVsTQ3O --data \'{"type":"DATASET","projectKey":"MYPROJECT","id":"orders"}\'',
+        ],
+    },
+    "remove-dataset": {
+        handler: async (c, a, f) => {
+            requireArgs(a, 3, "dss data-collection remove-dataset <dataCollectionId> <projectKey> <datasetName> [--dry-run]");
+            if (executionMode(f).dryRun) {
+                return planResult("data-collection", "remove-dataset", {
+                    asyncKind: "none",
+                    method: "DELETE",
+                    endpoint: `${collectionEndpoint(a[0])}/objects/dataset/${encodeURIComponent(a[1])}/${encodeURIComponent(a[2])}`,
+                    identifiers: {
+                        dataCollectionId: a[0],
+                        projectKey: a[1],
+                        datasetName: a[2],
+                    },
+                    idempotency: "none",
+                    exitCodesOnFailure: PLAN_FAILURE_CODES,
+                    plannedAndDryRun: true,
+                });
+            }
+            await c.dataCollections.removeDataset(a[0], a[1], a[2]);
+            return { removed: a[2], projectKey: a[1], dataCollectionId: a[0], resource: "data-collection", };
+        },
+        usage: "dss data-collection remove-dataset <dataCollectionId> <projectKey> <datasetName> [--dry-run]",
+        description: "Remove a dataset from a collection. Contributor required.",
+        examples: ["dss data-collection remove-dataset OjVsTQ3O MYPROJECT DATASET1",],
+    },
+};

package/dist/src/cli/commands/data-quality.js

@@ -1,5 +1,6 @@
 import { deepMerge, } from "../../utils/deep-merge.js";
 import { num, parseBooleanOption, requiredJsonInput, } from "../coerce.js";
+import { executionMode, } from "../flags.js";
 import { encodedProjectEndpoint, readIfExists, skipResult, } from "../output.js";
 import { requireArgs, UsageError, } from "../usage.js";
 /**
@@ -52,20 +53,20 @@ export const dataQualityCommands = {
                 : typeof config.displayName === "string"
                     ? config.displayName
                     : undefined;
-            if (f["if-not-exists"] === true || f["dry-run"] === true) {
+            if (f["if-not-exists"] === true || executionMode(f).dryRun) {
                 const existing = identity
                     ? (await c.dataQuality.listRules(a[0], pk)).find((rule) => rule.id === identity || rule.displayName === identity)
                     : undefined;
-                if (existing && f["if-not-exists"] === true && f["dry-run"] !== true) {
+                if (existing && f["if-not-exists"] === true && !executionMode(f).dryRun) {
                     return skipResult("data-quality", identity ?? existing.id, "exists", {
                         dataset: a[0],
                         current: existing,
                     });
                 }
-                if (f["if-not-exists"] === true && !identity && f["dry-run"] !== true) {
+                if (f["if-not-exists"] === true && !identity && !executionMode(f).dryRun) {
                     throw new UsageError("--if-not-exists requires rule id or displayName in the rule JSON.");
                 }
-                if (f["dry-run"] === true) {
+                if (executionMode(f).dryRun) {
                     return {
                         dryRun: true,
                         action: "create-rule",
@@ -97,7 +98,7 @@ export const dataQualityCommands = {
         handler: async (c, a, f) => {
             requireArgs(a, 2, "dss data-quality update-rule <dataset> <rule-id> --data JSON");
             const data = requiredJsonInput(f, "--data, --data-file, or --stdin is required.");
-            if (f["dry-run"] === true) {
+            if (executionMode(f).dryRun) {
                 const current = await c.dataQuality.getRule(a[0], a[1], f["project-key"]);
                 const next = deepMerge(current, data);
                 return {
@@ -125,11 +126,11 @@ export const dataQualityCommands = {
         handler: async (c, a, f) => {
             requireArgs(a, 2, "dss data-quality delete-rule <dataset> <rule-id>");
             const pk = f["project-key"];
-            if (f["dry-run"] === true || f["if-exists"] === true) {
+            if (executionMode(f).dryRun || f["if-exists"] === true) {
                 const current = await readIfExists(() => c.dataQuality.getRule(a[0], a[1], pk));
                 if (!current)
                     return skipResult("data-quality", a[1], "missing", { dataset: a[0], });
-                if (f["dry-run"] === true) {
+                if (executionMode(f).dryRun) {
                     return {
                         dryRun: true,
                         action: "delete-rule",
@@ -248,7 +249,7 @@ export const dataQualityCommands = {
                 projectKey: pk,
                 timeoutMs: num(f["timeout"], "--timeout"),
             };
-            if (f["dry-run"] === true) {
+            if (executionMode(f).dryRun) {
                 const params = new URLSearchParams();
                 params.set("partition", options.partition?.trim() ? options.partition : "NP");
                 if (options.ruleId !== undefined)