dataiku-sdk 3.7.0 → 3.9.0

package/dist/src/utils/secret-sanitize.js

@@ -7,8 +7,10 @@
  * - optionally redacts userinfo embedded in HTTP(S) URL authorities
  *   (`https://user:pass@host/...` -> `https://[redacted]@host/...`).
  *
- * The SDK resource layer forwards values verbatim to DSS over TLS; sanitization
- * is a CLI presentation concern and must never leak secret material instead.
+ * The SDK resource layer forwards values verbatim to DSS over TLS; sanitizing
+ * structured output is a CLI presentation concern and must never leak secret
+ * material instead. DSS-produced read text that consumers never need secrets
+ * from (job logs) is scrubbed at the SDK download via `redactCredentialPairs`.
  */
 /** Marker replacing every redacted value or secret occurrence. */
 export const SECRET_REDACTED = "[redacted]";
@@ -92,6 +94,24 @@ const CREDENTIAL_KEY_FRAGMENTS = [
 ];
 /** Keys naming how credentials work (`credentialsMode`, `passwordType`), not secrets. */
 const CREDENTIAL_SETTING_SUFFIXES = ["mode", "type", "policy",];
+/** Credential-like key (normalized fragment match, minus credential settings). */
+function isCredentialKey(key) {
+    const normalized = normalizeSecretKey(key);
+    if (CREDENTIAL_SETTING_SUFFIXES.some((suffix) => normalized.endsWith(suffix)))
+        return false;
+    return CREDENTIAL_KEY_FRAGMENTS.some((fragment) => normalized.includes(fragment));
+}
+/** JSON-style `"key": "value"` pair with escape-aware string bodies. */
+const JSON_STRING_PAIR = /"((?:[^"\\\n]|\\.)*)"(\s*:\s*)"((?:[^"\\\n]|\\.)*)"/g;
+/**
+ * Redact the string value of every JSON-style `"key":"value"` pair in free
+ * text whose key is credential-like (e.g. the `jobTicketSecret` DSS writes
+ * into job logs). Bare `key` fields are not redacted here: in log text they
+ * name ordinary identifiers far more often than secrets.
+ */
+export function redactCredentialPairs(text) {
+    return text.replace(JSON_STRING_PAIR, (pair, key, separator, value) => value.length > 0 && isCredentialKey(key) ? `"${key}"${separator}"${SECRET_REDACTED}"` : pair);
+}
 /**
  * Every string value under a credential-like key (any depth), plus bare
  * `key` fields such as `authRealm.key`. Collected from a command's own JSON
@@ -114,10 +134,7 @@ export function credentialValues(value) {
         if (node === null || typeof node !== "object")
             return;
         for (const [key, item,] of Object.entries(node)) {
-            const normalized = normalizeSecretKey(key);
-            const setting = CREDENTIAL_SETTING_SUFFIXES.some((suffix) => normalized.endsWith(suffix));
-            visit(item, sensitive || (!setting && (normalized === "key"
-                || CREDENTIAL_KEY_FRAGMENTS.some((fragment) => normalized.includes(fragment)))));
+            visit(item, sensitive || isCredentialKey(key) || normalizeSecretKey(key) === "key");
         }
     };
     visit(value, false);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "dataiku-sdk",
-	"version": "3.7.0",
+	"version": "3.9.0",
 	"description": "Dataiku DSS SDK and CLI for programmatic access to DSS REST APIs",
 	"repository": {
 		"type": "git",
@@ -48,12 +48,12 @@
 		"node-stream-zip": "^1.16.0"
 	},
 	"devDependencies": {
-		"@oxlint/plugins": "1.86.0",
+		"@oxlint/plugins": "1.87.0",
 		"@types/bun": "^1.4.2",
 		"cross-env": "^10.1.0",
-		"dprint": "^0.60.1",
+		"dprint": "^0.61.1",
 		"js-tiktoken": "1.0.21",
-		"oxlint": "1.86.0",
+		"oxlint": "1.87.0",
 		"typescript": "^7.0.2"
 	},
 	"bundleDependencies": [

package/plugin.json

@@ -1,7 +1,7 @@
 {
 	"$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
 	"name": "dataiku-sdk",
-	"version": "3.7.0",
+	"version": "3.9.0",
 	"description": "Dataiku DSS SDK and agent-oriented CLI for programmatic access to DSS REST APIs.",
 	"homepage": "https://github.com/clssck/dataiku-sdk",
 	"repository": "https://github.com/clssck/dataiku-sdk",

package/skills/dataiku-dss/references/discovery.md

@@ -3,12 +3,12 @@
 ## Contract
 
 - Stdout: exactly one compact JSON value; void success: `{ok:true}`. No prompts, help screens, tables, banners, or prose.
-- Dispatch/runtime failure: stdout error object (`type:"error"`, `ok:false`, `error`, `code`, `category`, `exitCode`), nonzero exit. `doctor`/`batch`/`cleanup` failures instead return direct result objects; inspect exit code and fields.
+- Dispatch/runtime failure: stdout error object (`type:"error"`, `error`, `code`, `category`, `exitCode`; `projectKey` when resolved), nonzero exit. `doctor`/`batch`/`cleanup` failures instead return direct result objects; inspect exit code and fields.
 - Stderr: JSONL diagnostics only; `type:"warning"` / `type:"trace"` for warnings / `--verbose` HTTP traces, flushed before success or failure output.
 - Exits: 0 success, 1 usage/configuration, 2 DSS/internal/permission-or-environment, 3 transient/retryable DSS error, 4 failed long-running result/assertion.
 - Recipe payload stdout: JSON string. With `--output PATH`: exact bytes to file, JSON string equal to `PATH` on stdout.
 - General `--fields a,b,c`: object projection, element-wise for object arrays. Dotted paths traverse nested objects; missing fields become `null`; strings/scalars pass through.
-- `*.list`: compact items (ids, kind, next-step fields such as recipe `inputs`/`outputs`); `--full`/`--fields` use DSS objects. `--contains TEXT` filters ids; `--limit N` caps (`list_truncated` warning).
+- Compact by default: `*.list` (ids, kind, next-step fields such as recipe `inputs`/`outputs`), `job get` (no log tail), `dataset get`/`info`, `project get`; `--full`/`--fields` use DSS objects. Lists: `--contains TEXT` filters ids; `--limit N` caps (`list_truncated` warning).
 
 ## Discovery
 

package/skills/dataiku-dss/references/flow-maps.md

@@ -7,6 +7,6 @@ dss flow-zone organize --file flow-zones.json --dry-run --project-key MYPROJ
 dss flow-zone organize --file flow-zones.json --project-key MYPROJ
 ```
 
-`project map`: zones, SCC-safe layers, weak components, diagnostics, full-flow fingerprint; rendering in `rendering.content`. DSS exposes zone positions, not node pixels.
+`project map`: zones, SCC-safe layers, weak components, diagnostics, fingerprint; rendering in `rendering.content`.
 
-Feed `flow-zone plan` to `flow-zone organize`; inspect dry-run first. Organize checks topology before/after writes and skips unchanged moves. Audit recipe payloads separately: layout commands neither fetch nor analyze code.
+Feed `flow-zone plan` (`unassigned`: to place) to `flow-zone organize`; dry-run first. Recipe outputs follow their recipe. DSS positions a zone only at creation; `--recreate-on-move` moves it (new id). Layout commands never read recipe code.

package/skills/dataiku-dss/references/troubleshooting.md

@@ -3,8 +3,8 @@
 ## Platform, builds, data
 
 - Code/SQL: use `--file`/`--sql-file`; shells, especially PowerShell, mangle quotes, `$`, and multiline text. Non-UTF-8 consoles (e.g. Windows cp1252): write non-ASCII results to UTF-8 files or `--output PATH`, not the console.
-- Build errors: `dss job log <id> --errors-only` selects errors/tracebacks. For full logs, use `--output PATH` without `--errors-only`. Logs may arrive as one JVM-noisy line; `Error in Python process: At line <N>` identifies the payload source line.
-- Schemas: code recipes set output schemas at run time. Visual/SQL query recipes: `recipe create` fills created or empty outputs (`outputSchemaUpdated`); `recipe set-payload` updates empty or DSS-derived ones, warns `recipe_output_schema_outdated` for hand-edited ones. Apply with `dss recipe update-schema NAME` (one recipe), `dss flow propagate-schema DATASET --wait` (every downstream recipe), or build `--auto-update-schema`. `built_dataset_has_no_columns`: the DONE build wrote nothing. Manual columns: `dss dataset refresh-schema NAME --data-file columns.json`. `dss dataset validate-build` catches file-backed misconfiguration.
+- Build errors: `dss job log <id> --errors-only` selects errors/tracebacks. Plain `job log` prints the last 100 lines (`log_truncated`); for full logs, use `--output PATH` without `--errors-only`. Logs may arrive as one JVM-noisy line; `Error in Python process: At line <N>` identifies the payload source line.
+- Schemas: code recipes set output schemas at run time. Visual/SQL query recipes: `recipe create` fills created or empty outputs (`outputSchemaUpdated`); `recipe set-payload` updates empty or DSS-derived ones, warns `recipe_output_schema_outdated` for hand-edited ones. Apply with `dss recipe update-schema NAME` (one recipe), `dss flow propagate-schema DATASET --wait` (every downstream recipe), or build `--auto-update-schema`. `built_dataset_has_no_columns`: the DONE build wrote nothing. `nothing_to_build` (exit 4): no recipe writes the managed target. Manual columns: `dss dataset refresh-schema NAME --data-file columns.json`. `dss dataset validate-build` catches file-backed misconfiguration.
 - `Inline` (editable) datasets: the public API cannot write rows, so `dataset create` rejects them; use `UploadedFiles` + `dataset upload-file`, or a python recipe output. `code run` is a scenario step; some DSS versions refuse dataset writes there.
 - `dss dataset download`: default 100k rows; result `{ path, rows, truncated, limit }`. If truncated, raise `--limit`. Specify `--output` or read the `dataset_download_default_location` path warning. CSV is spreadsheet-safe; `--raw-data` retains formula prefixes. For large tables, aggregate in SQL or use a recipe.
 - `dss dashboard create`/`update`: before POST/PUT, every `INSIGHT` tile needs agreeing/resolvable `insightId` and `targetInsightId`; any `datasetSmartName` must resolve. Missing/stale references: `validation_failed`. Cross-project `PROJECT.DATASET` needs dataset-project read permission; `403` blocks saving an unverifiable dashboard.
@@ -22,7 +22,7 @@
 
 Dispatch/runtime failure: one compact stdout error:
 ```json
-{"type":"error","ok":false,"error":"Missing API key.","code":"missing_required_flag","category":"usage","exitCode":1,"resource":"dataset","action":"list"}
+{"type":"error","error":"Missing API key.","code":"missing_required_flag","category":"usage","exitCode":1}
 ```
 
 `doctor`/`batch`/`cleanup` command failures return direct stdout result objects; check nonzero exit before interpreting. Recover from structured `code`, `category`, `exitCode`, `retryable`, `status`, `details`, never message scraping.