dataiku-sdk 3.4.0 → 3.6.0

package/README.md

@@ -8,7 +8,7 @@ The SDK and CLI include scenario run management; project, recipe, and dataset me
 
 The [DSS 15 coverage matrix](docs/API-COVERAGE-DSS-15.md) maps documented operations to SDK methods and CLI actions, records documentation discrepancies, and identifies remaining gaps. A [machine-readable matrix](docs/API-COVERAGE-DSS-15.json) is also available. Coverage is not full DSS parity or live compatibility certification: availability depends on DSS version, permissions, licensing, and installed capabilities. One known documentation discrepancy: `plugin git-branches` is served by GET on DSS 15 (the same route rejects POST with 405 `rawMethodPOSTnotsupported`, contrary to the public docs).
 
-Metadata setters replace the complete metadata object: fetch it, edit it, then submit the replacement. Metadata previews expose that replacement under `next`. New mutation previews (`--plan` and `--dry-run`) make no DSS requests; sensitive payloads may be represented by redacted summaries rather than literal request bodies. LLM completions and embeddings are cost-bearing operations, and macros execute plugin code. Review their contracts before execution.
+Metadata setters replace the complete metadata object: fetch it, edit it, then submit the replacement. Metadata previews expose that replacement under `next`. Mutation previews differ: `--plan` builds the request shape offline and makes no DSS requests, with sensitive payloads possibly represented by redacted summaries rather than literal request bodies, while `--dry-run` may read live DSS state per command (`recipe run` resolves its outputs). LLM completions and embeddings are cost-bearing operations, and macros execute plugin code. Review their contracts before execution.
 
 ML training and macro waits bound status requests by the remaining wait deadline, including response bodies and retries. The client `requestTimeoutMs` still caps each request: an overall wait budget can shorten that cap, never extend it. An individual request timeout propagates as an error until the overall wait budget expires. Future and Project Git waits use adaptive polling by default; explicit polling intervals remain fixed. Early CLI usage errors load at most the selected resource definitions, not the full command runtime.
 
@@ -16,7 +16,7 @@ Malformed user/group listings and scenario run histories fail explicitly instead
 
 ## Platform support
 
-The published `dss` CLI requires Bun >= 1.4.0 and supports Linux, macOS, and Windows. The release gate runs Bun 1.4.0 on all three operating systems. The runtime dependency is pure JavaScript, so the same package also runs on every Bun-supported x64 and ARM64 system.
+The published `dss` CLI requires Bun >= 1.4.0 and supports Linux, macOS, and Windows. CI runs the minimum (Bun 1.4.0) and the latest release (1.4.2) on all three operating systems. The runtime dependency is pure JavaScript, so the same package also runs on every Bun-supported x64 and ARM64 system.
 
 Run directly with Bun:
 
@@ -267,7 +267,7 @@ DSS_TOKENIZER_MODULE=/absolute/path/to/oh-my-pi/packages/natives/native/index.js
 
 When configured, the native module also accelerates ordinary OpenAI token measurements after parity checks against the pinned JavaScript model. The JS fingerprint and independent cross-model reference checks remain authoritative; reserved special-token validation is preserved. Without this variable, measurements use JavaScript and only the native cross-model case is skipped. A configured missing/incompatible module fails instead of silently falling back. The cross-model gate permits 10% growth over recorded text baselines. Claude counts use ctok reconstructions, not an official tokenizer; counts exclude provider framing. No native dependency is added to the CLI.
 
-For a known resource, `dss agent contract --fields commands.actions.dataset` lists action names in **64 tokens**, versus **1,575** for the global index. For known writes, fetch the full action entry directly once: `dataset.create` costs **1,059 tokens**, versus **1,415** for compact discovery followed by the required full entry. Use compact `usage,description,flags,examples` projections for reads when those fields suffice. This is selective disclosure, not lossless compression. Scoped discovery constructs only requested action entries and materializes schemas only when requested; action-name indexes avoid payload schemas, while full registry exports and recovery hints retain their existing content. Metadata-only paths defer SDK runtime/schema imports.
+For a known resource, `dss agent contract --fields commands.actions.dataset` lists only its action names, far smaller than the global index; for known writes, fetch the full action entry directly once rather than compact discovery followed by the full entry. `bun run test:tokens` pins the current figures. Use compact `usage,description,flags,examples` projections for reads when those fields suffice. This is selective disclosure, not lossless compression. Scoped discovery constructs only requested action entries and materializes schemas only when requested; action-name indexes avoid payload schemas, while full registry exports and recovery hints retain their existing content. Metadata-only paths defer SDK runtime/schema imports.
 
 Boolean flags accept bare flags or explicit `=true`/`=false` values, including aliases. Invalid boolean values fail before dispatch. Direct, batch, and local commands share execution-mode resolution; `--plan --dry-run` returns a plan with `plannedAndDryRun:true` when both modes are supported. Unreadable JSON/text payload files produce `validation_failed` usage errors (exit 1) with the flag, path, and filesystem cause.
 
@@ -282,7 +282,7 @@ Eligible transient retries honor `Retry-After` delta-seconds and HTTP dates, wai
 Use environment variables for ephemeral runs. For disposable agent tests, set `DSS_CONFIG_DIR` to a temporary directory so saved credentials never touch your real profile.
 Credential precedence is flags first, then `DATAIKU_*` environment variables, then saved credentials in `DSS_CONFIG_DIR` or the platform config directory.
 Set `DATAIKU_DISABLE_ENV=1` when a test must ignore both `.env` files and `DATAIKU_*` environment variables.
-When `.env` loading is enabled, the CLI reads `.env` from the CLI build/root directory and from the command's current working directory; put test-specific `.env` files in the directory where you invoke `dss`.
+When `.env` loading is enabled, the CLI reads `.env` from the CLI build/root directory and from the command's current working directory; put test-specific `.env` files in the directory where you invoke `dss`. Only `DATAIKU_*`, `NODE_TLS_REJECT_UNAUTHORIZED`, and `NODE_EXTRA_CA_CERTS` are read from `.env`; other keys are ignored.
 
 POSIX shell:
 

package/bin/dss.js

@@ -4,6 +4,7 @@
 // disabled; `bunx --bun` enters Bun's Node-compatibility mode, which disables
 // that loading before this module runs.
 import { spawnSync, } from "node:child_process";
+import { readFileSync, } from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath, pathToFileURL, } from "node:url";
 
@@ -19,6 +20,10 @@ const bunNodeCompatibilityMode = runningUnderBun
 	);
 const envFileAutoloadDisabled = process.execArgv.includes("--no-env-file",)
 	|| bunNodeCompatibilityMode;
+// The one source of the minimum is package.json engines.bun (">=X.Y.Z").
+const MINIMUM_BUN = JSON.parse(
+	readFileSync(fileURLToPath(new URL("../package.json", import.meta.url,),), "utf-8",),
+).engines.bun.replace(/^>=/, "",);
 
 if (!runningUnderBun) {
 	const result = spawnSync(
@@ -35,7 +40,7 @@ if (!runningUnderBun) {
 				code: "internal_error",
 				category: "internal",
 				exitCode: 2,
-				hint: "Install Bun >= 1.4.0 and ensure `bun` is on PATH.",
+				hint: `Install Bun >= ${MINIMUM_BUN} and ensure \`bun\` is on PATH.`,
 			},)
 		}\n`,);
 		process.exitCode = 2;
@@ -44,6 +49,19 @@ if (!runningUnderBun) {
 	} else {
 		process.exitCode = result.status ?? 1;
 	}
+} else if (!Bun.semver.satisfies(Bun.version, `>=${MINIMUM_BUN}`,)) {
+	process.stdout.write(`${
+		JSON.stringify({
+			type: "error",
+			ok: false,
+			error: `Bun ${Bun.version} is older than the required ${MINIMUM_BUN}.`,
+			code: "internal_error",
+			category: "internal",
+			exitCode: 2,
+			hint: `Upgrade Bun to >= ${MINIMUM_BUN} (bun upgrade).`,
+		},)
+	}\n`,);
+	process.exitCode = 2;
 } else if (!envFileAutoloadDisabled) {
 	process.stdout.write(`${
 		JSON.stringify({
@@ -61,7 +79,11 @@ if (!runningUnderBun) {
 	const here = import.meta.dir;
 	const distCliPath = path.resolve(here, "../dist/src/cli.js",);
 	const sourceCliPath = path.resolve(here, "../src/cli.ts",);
-	const usesDistCli = await Bun.file(distCliPath,).exists();
+	// A source checkout always runs its source, like bin/dss; a leftover dist/
+	// would otherwise silently shadow every edit. The published package ships
+	// no src/, so installs run dist.
+	const usesDistCli = !(await Bun.file(sourceCliPath,).exists())
+		&& await Bun.file(distCliPath,).exists();
 	const cliPath = usesDistCli ? distCliPath : sourceCliPath;
 
 	// Published dist carries dist/build-metadata.json with the revision it was
@@ -80,6 +102,10 @@ if (!runningUnderBun) {
 		} catch {
 			// Dist without build metadata: provenance still reports dist source.
 		}
+	} else {
+		// Provenance is the launcher's to assert; never trust inherited values.
+		delete process.env.DSS_LOAD_SOURCE;
+		delete process.env.DSS_BUILD_REVISION;
 	}
 
 	// Same process, same argv: the CLI sees process.argv.slice(2) exactly as before.

package/dist/build-metadata.json

@@ -1 +1 @@
-{"format":1,"buildRevision":"c2f0acd7beed8f8256bfa72bfaa99794237a0a24"}
+{"format":1,"buildRevision":"7a89c248d112072b3699f7f9d2774edca72ee0a9"}

package/dist/src/cli/coerce.d.ts

@@ -10,7 +10,6 @@ export declare function normalizeLineEndings(value: string): string;
 export declare function splitCsvFlag(v: string | boolean | undefined): string[];
 export declare function recipeInputDatasetsFromFlags(flags: Record<string, string | boolean>): string[] | undefined;
 export declare function rewritePairsFromFlags(flags: Record<string, string | boolean>, flagName: string): Record<string, string>;
-export declare function plainRecord(value: unknown): Record<string, unknown> | undefined;
 export declare function requiredStringFlag(flags: Record<string, string | boolean>, name: string, usage: string): string;
 export declare function optionalStringField(record: Record<string, unknown>, keys: string[]): string | undefined;
 export declare function requiredStringArray(value: unknown, source: string): string[];

package/dist/src/cli/coerce.js

@@ -85,11 +85,6 @@ export function rewritePairsFromFlags(flags, flagName) {
     }
     return rewrites;
 }
-export function plainRecord(value) {
-    return value && typeof value === "object" && !Array.isArray(value)
-        ? value
-        : undefined;
-}
 export function requiredStringFlag(flags, name, usage) {
     const value = flags[name];
     if (typeof value !== "string" || value.trim().length === 0) {