dataiku-sdk 3.6.0 → 3.7.0

package/README.md

@@ -4,7 +4,7 @@ Agent-only TypeScript SDK and `dss` CLI for Dataiku DSS automation.
 
 ## API coverage
 
-The SDK and CLI include scenario run management; project, recipe, and dataset metadata; managed datasets, lineage, and table imports; external saved models and MLflow imports; LLM completions and embeddings; knowledge banks; project folders and data collections; users, groups, connections, macros, and plugin administration. Discover exact inputs with `dss commands run` and scoped command contracts rather than assuming flags from API field names. MLflow archive/folder imports and evaluations resolve the external container config explicitly: DSS 15 requires the `containerExecConfigName` parameter, so the SDK/CLI send `NONE` rather than omitting it (the plan surface matches the executed request).
+The SDK and CLI include scenario run management; project, recipe, and dataset metadata; managed datasets, lineage, and table imports; flow schema propagation and documentation; grouping and prepare recipes built from flags; Visual ML tasks, model diagnostics (subpopulation analyses, partial dependencies, time series residuals) and model documentation for lab models and saved-model versions; external saved models, MLflow imports, and the MLflow experiment-tracking extension; Project Deployer infrastructures, deployments, and published projects; LLM completions and embeddings; knowledge banks; project folders and data collections; users, groups, connections, macros, and plugin administration. Discover exact inputs with `dss commands run` and scoped command contracts rather than assuming flags from API field names. MLflow archive/folder imports and evaluations resolve the external container config explicitly: DSS 15 requires the `containerExecConfigName` parameter, so the SDK/CLI send `NONE` rather than omitting it (the plan surface matches the executed request).
 
 The [DSS 15 coverage matrix](docs/API-COVERAGE-DSS-15.md) maps documented operations to SDK methods and CLI actions, records documentation discrepancies, and identifies remaining gaps. A [machine-readable matrix](docs/API-COVERAGE-DSS-15.json) is also available. Coverage is not full DSS parity or live compatibility certification: availability depends on DSS version, permissions, licensing, and installed capabilities. One known documentation discrepancy: `plugin git-branches` is served by GET on DSS 15 (the same route rejects POST with 405 `rawMethodPOSTnotsupported`, contrary to the public docs).
 
@@ -16,7 +16,7 @@ Malformed user/group listings and scenario run histories fail explicitly instead
 
 ## Platform support
 
-The published `dss` CLI requires Bun >= 1.4.0 and supports Linux, macOS, and Windows. CI runs the minimum (Bun 1.4.0) and the latest release (1.4.2) on all three operating systems. The runtime dependency is pure JavaScript, so the same package also runs on every Bun-supported x64 and ARM64 system.
+The published `dss` CLI requires Bun >= 1.4.2 and supports Linux, macOS, and Windows. CI runs Bun 1.4.2 on all three operating systems. The runtime dependency is pure JavaScript, so the same package also runs on every Bun-supported x64 and ARM64 system.
 
 Run directly with Bun:
 
@@ -29,7 +29,7 @@ Or install the npm binary:
 ```text
 npm install --global dataiku-sdk
 ```
-The installed `dss` bin bootstraps Bun with automatic `.env` preloading disabled, so Bun >= 1.4.0 must be on `PATH`; the CLI's own `.env` handling stays authoritative. `bunx --bun` forces Bun's Node-compatibility mode, which provides the same no-preload guarantee across operating systems.
+The installed `dss` bin bootstraps Bun with automatic `.env` preloading disabled, so Bun >= 1.4.2 must be on `PATH`; the CLI's own `.env` handling stays authoritative. `bunx --bun` forces Bun's Node-compatibility mode, which provides the same no-preload guarantee across operating systems.
 
 Bun is the only supported runtime and the package manager. Examples below assume an installed `dss` binary. From a checkout, use `bun --no-env-file src/cli.ts ...` or the packaged launcher `bun --no-env-file ./bin/dss.js ...`. From another working directory, pass the checkout's absolute `bin/dss.js` path to Bun.
 `--no-env-file` disables Bun's automatic preloading only; the CLI still applies its documented `.env` handling unless `DATAIKU_DISABLE_ENV=1` is set.
@@ -201,21 +201,29 @@ essentials: exactly one compact JSON value on stdout per command (void success i
 failures as one structured JSON error object on stdout with a nonzero exit code, stderr reserved
 for JSONL diagnostics only, and exit codes `0` success / `1` usage error / `2` DSS or internal
 error / `3` transient DSS error / `4` failed long-running result or assertion. `--retries N`
-controls idempotent GET retries only; `dss sql query --start-retries N` retries transient failures
+controls idempotent GET retries only, and only transient failures (408/425/429, 5xx without a known
+non-transient cause, connection resets, timeouts) are retried: a refused connection, unknown host,
+bad URL, or untrusted certificate fails at once. `dss sql query --start-retries N` retries transient failures
 while starting a query. For portable multi-step mutations, prefer `dss batch`; shell chaining and
 pipeline exit semantics differ across platforms.
 
+`*.list` commands print compact items (identifiers, kind, next-step fields) by default; `--full`
+returns the DSS objects, `--contains TEXT` filters on identifiers, and `--limit N` caps the count
+with a `list_truncated` warning.
+
 Discover the command surface with scoped calls:
 
 ```text
 dss commands run
+dss commands run --contains "propagate schema"
 dss commands run --fields dataset.create.usage,dataset.create.description,dataset.create.flags,dataset.create.examples
 dss commands run --output commands.json
 dss agent contract --fields protocol,agentContractVersion,cli,stdio,planning,compatibility
 ```
 
-`dss commands run` prints the compact resource/action summary; registry entries never dump to stdout — they travel only via `--output PATH`. See the canonical skill for
-the full `--fields` projection rules and planning workflow.
+`dss commands run` prints the compact resource/action summary, and `--contains TEXT` finds the top 5
+actions for a concept; registry entries never dump to stdout — they travel only via `--output PATH`.
+See the canonical skill for the full `--fields` projection rules and planning workflow.
 
 ## Agent skill installation
 

package/bin/bun-version.js

@@ -0,0 +1,14 @@
+/**
+ * Whether a Bun version string is at least `minimum`, comparing only the
+ * release part (major.minor.patch). Canary builds print e.g.
+ * `1.4.3-canary.12+abc`; npm-style semver ranges (and Bun.semver) reject every
+ * prerelease, which would lock out anyone on a canary channel.
+ */
+export function versionAtLeast(actual, minimum,) {
+	const a = actual.split(/[-+]/,)[0].split(".",).map(Number,);
+	const m = minimum.split(".",).map(Number,);
+	for (let i = 0; i < m.length; i++) {
+		if ((a[i] ?? 0) !== m[i]) return (a[i] ?? 0) > m[i];
+	}
+	return true;
+}

package/bin/dss.js

@@ -7,6 +7,7 @@ import { spawnSync, } from "node:child_process";
 import { readFileSync, } from "node:fs";
 import * as path from "node:path";
 import { fileURLToPath, pathToFileURL, } from "node:url";
+import { versionAtLeast, } from "./bun-version.js";
 
 const runningUnderBun = typeof process.versions.bun === "string";
 const bunNodeCompatibilityMode = runningUnderBun
@@ -26,21 +27,33 @@ const MINIMUM_BUN = JSON.parse(
 ).engines.bun.replace(/^>=/, "",);
 
 if (!runningUnderBun) {
-	const result = spawnSync(
-		"bun",
-		["--no-env-file", fileURLToPath(import.meta.url,), ...process.argv.slice(2,),],
-		{ stdio: "inherit", env: process.env, },
-	);
+	// Check before spawning: an old Bun may reject --no-env-file during argument
+	// parsing, before any launcher code could report a JSON error.
+	const probe = spawnSync("bun", ["--version",], { encoding: "utf-8", },);
+	const found = probe.error ? undefined : probe.stdout.trim();
+	const result = found !== undefined && versionAtLeast(found, MINIMUM_BUN,)
+		? spawnSync(
+			"bun",
+			["--no-env-file", fileURLToPath(import.meta.url,), ...process.argv.slice(2,),],
+			{ stdio: "inherit", env: process.env, },
+		)
+		: {
+			error: new Error(
+				found ? `Bun ${found} is older than the required ${MINIMUM_BUN}.` : "bun not found",
+			),
+		};
 	if (result.error) {
 		process.stdout.write(`${
 			JSON.stringify({
 				type: "error",
 				ok: false,
-				error: "Unable to start the required Bun runtime.",
+				error: `Unable to start the required Bun runtime: ${result.error.message}`,
 				code: "internal_error",
 				category: "internal",
 				exitCode: 2,
-				hint: `Install Bun >= ${MINIMUM_BUN} and ensure \`bun\` is on PATH.`,
+				hint: found
+					? `Update Bun to ${MINIMUM_BUN} or newer: run \`bun upgrade\`.`
+					: `Install Bun ${MINIMUM_BUN} or newer (https://bun.sh) and ensure \`bun\` is on PATH.`,
 			},)
 		}\n`,);
 		process.exitCode = 2;
@@ -49,7 +62,7 @@ if (!runningUnderBun) {
 	} else {
 		process.exitCode = result.status ?? 1;
 	}
-} else if (!Bun.semver.satisfies(Bun.version, `>=${MINIMUM_BUN}`,)) {
+} else if (!versionAtLeast(Bun.version, MINIMUM_BUN,)) {
 	process.stdout.write(`${
 		JSON.stringify({
 			type: "error",
@@ -58,7 +71,7 @@ if (!runningUnderBun) {
 			code: "internal_error",
 			category: "internal",
 			exitCode: 2,
-			hint: `Upgrade Bun to >= ${MINIMUM_BUN} (bun upgrade).`,
+			hint: `Update Bun to ${MINIMUM_BUN} or newer: run \`bun upgrade\`.`,
 		},)
 	}\n`,);
 	process.exitCode = 2;
@@ -91,7 +104,6 @@ if (!runningUnderBun) {
 	// build revision; only a full lowercase hexadecimal revision is accepted, so an
 	// inherited or corrupt variable never stands in for packaged metadata.
 	if (usesDistCli) {
-		process.env.DSS_LOAD_SOURCE = "dist";
 		delete process.env.DSS_BUILD_REVISION;
 		try {
 			const metadata = await Bun.file(path.resolve(here, "../dist/build-metadata.json",),).json();
@@ -103,8 +115,7 @@ if (!runningUnderBun) {
 			// Dist without build metadata: provenance still reports dist source.
 		}
 	} else {
-		// Provenance is the launcher's to assert; never trust inherited values.
-		delete process.env.DSS_LOAD_SOURCE;
+		// Only a dist run may carry a build revision; never trust an inherited one.
 		delete process.env.DSS_BUILD_REVISION;
 	}
 

package/dist/build-metadata.json

@@ -1 +1 @@
-{"format":1,"buildRevision":"7a89c248d112072b3699f7f9d2774edca72ee0a9"}
+{"format":1,"buildRevision":"a980b6ec9bd11f68d319f7034152d7f9dd4ccd83"}

package/dist/packages/types/src/index.d.ts

@@ -166,6 +166,24 @@ export declare const RecipeCreateOptionsSchema: import("@sinclair/typebox").TObj
     fuzzyNormalize: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
     projectKey: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     outputFolder: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    /** Grouping: key columns. */
+    groupBy: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    /** Grouping: `COL:FN[+FN]` specs (count, countDistinct, sum, avg, min, max, median, stddev, first, last, concat, ...). */
+    aggregate: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    /** Grouping: ordering column for first/last aggregates. */
+    orderBy: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    /** Prepare: `OLD=NEW` column renames. */
+    rename: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    /** Prepare: `COL=VALUE` fills for empty cells. */
+    fillEmpty: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    /** Prepare: one `NAME=GREL_EXPRESSION` computed column. */
+    formula: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    /** Prepare: keep only rows where this GREL expression is true. */
+    filter: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    /** Prepare: columns to remove. */
+    dropColumns: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    /** Prepare: the only columns to keep. */
+    keepColumns: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
 }>;
 export type RecipeCreateOptions = Static<typeof RecipeCreateOptionsSchema>;
 export declare const RecipeCreateResultSchema: import("@sinclair/typebox").TObject<{
@@ -173,13 +191,68 @@ export declare const RecipeCreateResultSchema: import("@sinclair/typebox").TObje
     type: import("@sinclair/typebox").TString;
     createdDatasets: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
     joinConfigured: import("@sinclair/typebox").TBoolean;
+    /** Grouping keys/aggregates or prepare steps from flags were written to the payload. */
+    payloadConfigured: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
     outputProvisioningFallbackUsed: import("@sinclair/typebox").TBoolean;
     outputFolder: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     temporaryOutputDataset: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     temporaryOutputDatasetDeleted: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
-    syncOutputSchemaPropagated: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    /** Output datasets whose schema DSS computed and the client applied after creation. */
+    outputSchemaUpdated: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    /** Why DSS could not compute the output schema; the recipe itself was created. */
+    outputSchemaUpdateError: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
 }>;
 export type RecipeCreateResult = Static<typeof RecipeCreateResultSchema>;
+/** One output from GET /recipes/{name}/schema-update (dataikuapi compute_schema_updates). */
+export declare const RecipeSchemaUpdateComputableSchema: import("@sinclair/typebox").TObject<{
+    type: import("@sinclair/typebox").TString;
+    id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    datasetName: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+    previousSchemaWasEmpty: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+    incompatibilities: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+    newSchema: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        columns: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TUnknown>>;
+    }>>;
+}>;
+export type RecipeSchemaUpdateComputable = Static<typeof RecipeSchemaUpdateComputableSchema>;
+export declare const RecipeSchemaUpdatesSchema: import("@sinclair/typebox").TObject<{
+    totalIncompatibilities: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TNumber>;
+    computables: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        type: import("@sinclair/typebox").TString;
+        id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        datasetName: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        previousSchemaWasEmpty: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        incompatibilities: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        newSchema: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+            columns: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TUnknown>>;
+        }>>;
+    }>>;
+    recipeChanges: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnknown>>;
+}>;
+export type RecipeSchemaUpdates = Static<typeof RecipeSchemaUpdatesSchema>;
+export declare const RecipeUpdateSchemaResultSchema: import("@sinclair/typebox").TObject<{
+    recipeName: import("@sinclair/typebox").TString;
+    /** Output ids whose schema was replaced by the DSS-computed schema. */
+    updated: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    /** Output ids whose schema differs from the computed one but was left as is (`derivedOutputs`, `dryRun`). */
+    pending: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    /** Output ids whose current schema already matches. */
+    unchanged: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    totalIncompatibilities: import("@sinclair/typebox").TNumber;
+    computables: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        type: import("@sinclair/typebox").TString;
+        id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        datasetName: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        previousSchemaWasEmpty: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+        incompatibilities: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>>;
+        newSchema: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+            columns: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TUnknown>>;
+        }>>;
+    }>>;
+    /** `datasetsNeedingAction` entries from the DSS apply responses. */
+    datasetsNeedingAction: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TUnknown>>;
+}>;
+export type RecipeUpdateSchemaResult = Static<typeof RecipeUpdateSchemaResultSchema>;
 export declare const JobSummarySchema: import("@sinclair/typebox").TObject<{
     def: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
         id: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;

package/dist/packages/types/src/index.js

@@ -211,17 +211,69 @@ export const RecipeCreateOptionsSchema = Type.Object({
     fuzzyNormalize: Type.Optional(Type.Boolean()),
     projectKey: Type.Optional(Type.String()),
     outputFolder: Type.Optional(Type.String()),
+    /** Grouping: key columns. */
+    groupBy: Type.Optional(Type.Array(Type.String())),
+    /** Grouping: `COL:FN[+FN]` specs (count, countDistinct, sum, avg, min, max, median, stddev, first, last, concat, ...). */
+    aggregate: Type.Optional(Type.Array(Type.String())),
+    /** Grouping: ordering column for first/last aggregates. */
+    orderBy: Type.Optional(Type.String()),
+    /** Prepare: `OLD=NEW` column renames. */
+    rename: Type.Optional(Type.Array(Type.String())),
+    /** Prepare: `COL=VALUE` fills for empty cells. */
+    fillEmpty: Type.Optional(Type.Array(Type.String())),
+    /** Prepare: one `NAME=GREL_EXPRESSION` computed column. */
+    formula: Type.Optional(Type.String()),
+    /** Prepare: keep only rows where this GREL expression is true. */
+    filter: Type.Optional(Type.String()),
+    /** Prepare: columns to remove. */
+    dropColumns: Type.Optional(Type.Array(Type.String())),
+    /** Prepare: the only columns to keep. */
+    keepColumns: Type.Optional(Type.Array(Type.String())),
 });
 export const RecipeCreateResultSchema = Type.Object({
     recipeName: Type.String(),
     type: Type.String(),
     createdDatasets: Type.Array(Type.String()),
     joinConfigured: Type.Boolean(),
+    /** Grouping keys/aggregates or prepare steps from flags were written to the payload. */
+    payloadConfigured: Type.Optional(Type.Boolean()),
     outputProvisioningFallbackUsed: Type.Boolean(),
     outputFolder: Type.Optional(Type.String()),
     temporaryOutputDataset: Type.Optional(Type.String()),
     temporaryOutputDatasetDeleted: Type.Optional(Type.Boolean()),
-    syncOutputSchemaPropagated: Type.Optional(Type.Array(Type.String())),
+    /** Output datasets whose schema DSS computed and the client applied after creation. */
+    outputSchemaUpdated: Type.Optional(Type.Array(Type.String())),
+    /** Why DSS could not compute the output schema; the recipe itself was created. */
+    outputSchemaUpdateError: Type.Optional(Type.String()),
+});
+/** One output from GET /recipes/{name}/schema-update (dataikuapi compute_schema_updates). */
+export const RecipeSchemaUpdateComputableSchema = Type.Object({
+    type: Type.String(),
+    id: Type.Optional(Type.String()),
+    datasetName: Type.Optional(Type.String()),
+    previousSchemaWasEmpty: Type.Optional(Type.Boolean()),
+    incompatibilities: Type.Optional(Type.Array(Type.String())),
+    newSchema: Type.Optional(Type.Object({
+        columns: Type.Array(Type.Record(Type.String(), Type.Unknown())),
+    }, { additionalProperties: true, })),
+}, { additionalProperties: true, });
+export const RecipeSchemaUpdatesSchema = Type.Object({
+    totalIncompatibilities: Type.Optional(Type.Number()),
+    computables: Type.Array(RecipeSchemaUpdateComputableSchema),
+    recipeChanges: Type.Optional(Type.Array(Type.Unknown())),
+}, { additionalProperties: true, });
+export const RecipeUpdateSchemaResultSchema = Type.Object({
+    recipeName: Type.String(),
+    /** Output ids whose schema was replaced by the DSS-computed schema. */
+    updated: Type.Array(Type.String()),
+    /** Output ids whose schema differs from the computed one but was left as is (`derivedOutputs`, `dryRun`). */
+    pending: Type.Array(Type.String()),
+    /** Output ids whose current schema already matches. */
+    unchanged: Type.Array(Type.String()),
+    totalIncompatibilities: Type.Number(),
+    computables: Type.Array(RecipeSchemaUpdateComputableSchema),
+    /** `datasetsNeedingAction` entries from the DSS apply responses. */
+    datasetsNeedingAction: Type.Optional(Type.Array(Type.Unknown())),
 });
 // ---------------------------------------------------------------------------
 // Jobs

package/dist/src/cli/coerce.d.ts

@@ -20,6 +20,7 @@ export declare function expectJsonObject(value: unknown, source: string): Record
 export declare function parseJsonObject(text: string, source: string): Record<string, unknown>;
 export declare function json(v: string | boolean | undefined, source?: string): Record<string, unknown> | undefined;
 export declare function readStdinText(): string;
+export declare function seenJsonInputCredentials(): readonly string[];
 export declare function jsonInput(flags: Record<string, string | boolean>): Record<string, unknown> | undefined;
 export declare function unknownJsonInput(flags: Record<string, string | boolean>): unknown;
 export declare function schemaColumnsInput(flags: Record<string, string | boolean>, usage: string): Array<{

package/dist/src/cli/coerce.js

@@ -1,4 +1,5 @@
 import { readFileSync, } from "node:fs";
+import { credentialValues, } from "../utils/secret-sanitize.js";
 import { UsageError, } from "./usage.js";
 function safeValuePreview(value) {
     return value.length <= 32 ? value : `${value.slice(0, 32)}…`;
@@ -173,31 +174,34 @@ function readInputText(path, flag) {
         throw new UsageError(`Could not read ${flag} file: ${path}`, "validation_failed", "Verify that the path names an existing, readable file.", { flag, path, ...(cause ? { cause, } : {}), });
     }
 }
+/**
+ * Credential values seen in this process's JSON inputs. DSS error text can
+ * echo the request payload, so error reports redact these.
+ */
+const jsonInputCredentials = [];
+export function seenJsonInputCredentials() {
+    return jsonInputCredentials;
+}
+function parseJsonSource(text, source, kind) {
+    const value = kind === "object" ? parseJsonObject(text, source) : parseJsonValue(text, source);
+    jsonInputCredentials.push(...credentialValues(value));
+    return value;
+}
 function resolveJsonSourceText(flags, kind) {
     const source = selectSingleSource(flags, JSON_SOURCE_FLAGS);
     if (source === undefined)
         return undefined;
-    if (source === "stdin") {
-        const jsonText = readStdinText();
-        return kind === "object"
-            ? parseJsonObject(jsonText, "stdin")
-            : parseJsonValue(jsonText, "stdin");
-    }
+    if (source === "stdin")
+        return parseJsonSource(readStdinText(), "stdin", kind);
     if (source === "data-file") {
         const fileValue = flags["data-file"];
         if (typeof fileValue === "string") {
-            const jsonText = readInputText(fileValue, "--data-file");
-            return kind === "object"
-                ? parseJsonObject(jsonText, fileValue)
-                : parseJsonValue(jsonText, fileValue);
+            return parseJsonSource(readInputText(fileValue, "--data-file"), fileValue, kind);
         }
     }
     const dataValue = flags["data"];
-    if (typeof dataValue === "string") {
-        return kind === "object"
-            ? parseJsonObject(dataValue, "--data")
-            : parseJsonValue(dataValue, "--data");
-    }
+    if (typeof dataValue === "string")
+        return parseJsonSource(dataValue, "--data", kind);
     throw new UsageError("JSON input source is present but has no value.", "invalid_flag_value");
 }
 export function jsonInput(flags) {