dataiku-sdk 3.8.0 → 4.0.0

package/dist/src/cli/commands/project.js

@@ -4,10 +4,13 @@ import { inspectProjectArchive, } from "../../utils/project-archive.js";
 import { projectIncarnationHash, } from "../../utils/project-incarnation.js";
 import { jsonInput, num, requiredJsonInput, requiredStringFlag, } from "../coerce.js";
 import { executionMode, } from "../flags.js";
-import { CommandResultFailure, } from "../output.js";
+import { CommandResultFailure, enqueueCliWarning, } from "../output.js";
+import { compactProjectMapOutput, } from "../project-map-output.js";
 import { commandUsage, withUsage, } from "../syntax.js";
 import { requireArgs, UsageError, } from "../usage.js";
 const INSPECT_ARCHIVE_USAGE = commandUsage("project", "inspect-archive");
+/** Maximum credential inventory entries echoed in the export warning. */
+const EXPORT_CREDENTIAL_INVENTORY_LIMIT = 100;
 function flowRenderFormat(value) {
     if (value === undefined)
         return undefined;
@@ -28,7 +31,7 @@ export const projectCommands = withUsage("project", {
     },
     get: {
         handler: (c, _a, f) => c.projects.get(f["project-key"]),
-        description: "Get project settings and metadata.",
+        description: "Get project settings and metadata (compact by default: empty values, metrics/version/image metadata dropped, permission flags collapsed to deniedPermissions; --full returns the raw DSS object).",
         examples: ["dss project get", "dss project get --project-key MYPROJ",],
     },
     metadata: {
@@ -42,13 +45,13 @@ export const projectCommands = withUsage("project", {
         examples: ["dss project flow", "dss project flow --project-key MYPROJ",],
     },
     map: {
-        handler: (c, _a, f) => c.projects.map({
+        handler: async (c, _a, f) => compactProjectMapOutput(await c.projects.map({
             projectKey: f["project-key"],
             maxNodes: num(f["max-nodes"], "--max-nodes"),
             maxEdges: num(f["max-edges"], "--max-edges"),
             includeRaw: f["include-raw"] === true,
             render: flowRenderFormat(f["render"]),
-        }),
+        })),
         validate: (_a, f) => {
             flowRenderFormat(f["render"]);
             num(f["max-nodes"], "--max-nodes");
@@ -161,9 +164,24 @@ export const projectCommands = withUsage("project", {
             if (!out)
                 throw new UsageError("--output PATH is required.", "missing_required_flag");
             await c.projects.exportArchive(a[0], out, jsonInput(f));
-            return { path: out, };
+            const inspection = await inspectProjectArchive(out);
+            const findings = inspection.credentialFindings;
+            if (findings.length > 0) {
+                enqueueCliWarning({
+                    code: "export_contains_credentials",
+                    message: `The exported archive '${out}' contains ${findings.length} credential-bearing structure(s) `
+                        + "(member paths and key names only; values are never printed). "
+                        + "DSS exports credentials, API keys and secret-named variables verbatim.",
+                    hint: "Sanitize the archive before sharing or uploading it. Overwriting an object in versioned storage does not erase its retained versions: "
+                        + "once an unsanitized archive is uploaded, rotate the exposed credentials.",
+                    total: findings.length,
+                    shown: Math.min(findings.length, EXPORT_CREDENTIAL_INVENTORY_LIMIT),
+                    findings: findings.slice(0, EXPORT_CREDENTIAL_INVENTORY_LIMIT),
+                });
+            }
+            return { path: out, credentialFindings: findings.length, };
         },
-        description: "Export a project to a local archive (.zip).",
+        description: "Export a project to a local archive (.zip). The written archive is inspected locally; credential-bearing structures (apikeys.json, secret-named variables, apiKey/token/password fields) raise an export_contains_credentials warning listing member paths and key names only, and the result reports credentialFindings. The archive is not redacted.",
         examples: ["dss project export MY_PROJ --output ./my_proj.zip",],
     },
     import: {
@@ -201,7 +219,7 @@ export const projectCommands = withUsage("project", {
     "inspect-archive": {
         handler: async (_c, a) => inspectArchiveCommand(a),
         localHandler: inspectArchiveCommand,
-        description: "Read-only local inspection of a project export archive: member names, sizes, manifest validity, archive issues, and the source project key. Never contacts DSS.",
+        description: "Read-only local inspection of a project export archive: member names, sizes, manifest validity, archive issues (including credential_structure and residue_scan_skipped warnings), a credentialFindings inventory of credential-bearing member paths and key names (values are never reported), and the source project key. Never contacts DSS.",
         examples: ["dss project inspect-archive ./my_proj.zip",],
     },
     "permissions-set": {

package/dist/src/cli/commands/recipe.js

@@ -1,10 +1,8 @@
-import { readFileSync, } from "node:fs";
-import { writeFile, } from "node:fs/promises";
 import { join, } from "node:path";
 import { ClientValidationError, DataikuError, } from "../../errors.js";
 import { recipeCreateWarnings, recipeOutputSchemaIsComputable, schemaUpdateComputableId, schemaUpdateIsPending, } from "../../resources/recipe-create.js";
-import { deepMerge, } from "../../utils/deep-merge.js";
-import { jobLogFilterFromFlag, jsonInput, maxLogLinesFromFlags, normalizeLineEndings, num, recipeInputDatasetsFromFlags, requiredJsonInput, requiredStringFlag, rewritePairsFromFlags, sha256Hex, splitCsvFlag, stableHash, } from "../coerce.js";
+import { buildRecipeUpdate, } from "../../resources/recipes.js";
+import { jobLogFilterFromFlag, jsonInput, maxLogLinesFromFlags, normalizeLineEndings, num, readTextFile, recipeInputDatasetsFromFlags, requiredJsonInput, requiredStringFlag, rewritePairsFromFlags, sha256Hex, splitCsvFlag, stableHash, } from "../coerce.js";
 import { executionMode, } from "../flags.js";
 import { moveCreatedItemsToZone, resolveFlowZoneIdFromFlags, } from "../helpers/flow-zone.js";
 import { ensureRecipeBackupDir, readRecipeBackup, recipeBackupDocument, recipeBackupPath, recipeCodeEnv, recipeGraph, recipeInputItemRef, recipeRoleInputItems, recipeRunShouldWait, writeRecipeBackup, } from "../helpers/recipe.js";
@@ -12,9 +10,9 @@ import { encodedProjectEndpoint, enqueueCliWarning, readIfExists, skipResult, }
 import { commandUsage, withUsage, } from "../syntax.js";
 import { requireArgs, UsageError, } from "../usage.js";
 /** Read a local recipe file before any DSS request, mapping read failures to usage validation. */
-function readRecipeFile(filePath, flagName) {
+async function readRecipeFile(filePath, flagName) {
     try {
-        return readFileSync(filePath, "utf-8");
+        return await readTextFile(filePath);
     }
     catch (error) {
         const reason = error instanceof Error ? error.message : String(error);
@@ -507,7 +505,7 @@ export const recipeCommands = withUsage("recipe", {
                 throw new UsageError(`--file is required. Usage: ${commandUsage("recipe", "diff")}`);
             }
             // Read and validate the local file before any DSS request.
-            const localContent = readRecipeFile(filePath, "--file");
+            const localContent = await readRecipeFile(filePath, "--file");
             const result = await c.recipes.get(a[0], {
                 includePayload: true,
                 projectKey: f["project-key"],
@@ -530,23 +528,17 @@ export const recipeCommands = withUsage("recipe", {
             const pk = f["project-key"];
             if (executionMode(f).dryRun) {
                 const current = await c.recipes.get(a[0], { projectKey: pk, includePayload: true, });
-                const currentRecipe = current.recipe;
-                const next = {
-                    ...current,
-                    ...data,
-                    recipe: deepMerge(currentRecipe, (data.recipe && typeof data.recipe === "object" && !Array.isArray(data.recipe))
-                        ? data.recipe
-                        : {}),
-                };
+                const next = buildRecipeUpdate(current, data);
                 return { dryRun: true, action: "update", resource: "recipe", name: a[0], current, next, };
             }
             await c.recipes.update(a[0], data, pk);
             return { updated: a[0], resource: "recipe", };
         },
-        description: "Update recipe settings via JSON merge. Recipe definition fields must be nested under a top-level recipe key.",
+        description: "Update recipe settings via JSON merge. Recipe definition fields must be nested under a top-level recipe key. recipe.params.envSelection, when present, replaces the existing envSelection object (include envMode; no stale envName is kept) and is only accepted under recipe.params.",
         examples: [
             "dss recipe update compute_orders --data-file settings.json --dry-run",
-            'dss recipe update compute_orders --data \'{"recipe":{"params":{"envSelection":{"envMode":"EXPLICIT_ENV","envName":"python39"}}}}\'',
+            'dss recipe update compute_orders --data \'{"recipe":{"params":{"envSelection":{"envMode":"EXPLICIT_ENV","envName":"py311_env"}}}}\'',
+            'dss recipe update compute_orders --data \'{"recipe":{"params":{"envSelection":{"envMode":"INHERIT"}}}}\'',
             "cat settings.json | dss recipe update compute_orders --stdin",
         ],
     },
@@ -636,7 +628,7 @@ export const recipeCommands = withUsage("recipe", {
                 projectKey: f["project-key"],
             });
             if (typeof f["output"] === "string") {
-                await writeFile(f["output"], payload, "utf-8");
+                await Bun.write(f["output"], payload);
                 return f["output"];
             }
             return payload;
@@ -663,7 +655,7 @@ export const recipeCommands = withUsage("recipe", {
             const filePath = f["file"];
             if (!filePath)
                 throw new UsageError("--file is required.");
-            const content = readRecipeFile(filePath, "--file");
+            const content = await readRecipeFile(filePath, "--file");
             const pk = f["project-key"];
             const shouldBackup = f["no-backup"] !== true;
             const backupDir = shouldBackup

package/dist/src/cli/commands/scenario.js

@@ -233,11 +233,9 @@ export const scenarioCommands = withUsage("scenario", {
             const outputFile = f["output"]
                 ?? f["output-file"];
             if (outputFile) {
-                const { mkdir, writeFile, } = await import("node:fs/promises");
-                const { dirname, resolve, } = await import("node:path");
+                const { resolve, } = await import("node:path");
                 const outputPath = resolve(outputFile);
-                await mkdir(dirname(outputPath), { recursive: true, });
-                await writeFile(outputPath, result.text, "utf-8");
+                await Bun.write(outputPath, result.text);
                 return { path: outputPath, truncated: result.truncated, };
             }
             return result.text;

package/dist/src/cli/contract.js

@@ -248,6 +248,13 @@ const ALLOWED_CLEANUP_ACTIONS = new Set([
     "project-library delete",
     "streaming-endpoint delete",
     "workspace delete",
+    "saved-model delete",
+    "project-folder delete",
+    "data-collection delete",
+    "plugin delete",
+    "connection delete",
+    "user delete",
+    "group delete",
 ]);
 export function isAllowedCleanupAction(resource, action) {
     return ALLOWED_CLEANUP_ACTIONS.has(`${resource} ${action}`);
@@ -391,7 +398,7 @@ function structuredExamples(examples, examplePayload) {
  * (`dss commands run`, `dss agent contract`) never loads the TypeBox graph.
  * The content matches `typeBoxCommandOutputSchemas()` exactly; parity and
  * freshness are enforced by tests/cli/discovery-output-schemas.test.ts and
- * `bun run check`.
+ * `bun run verify`.
  */
 const actionOutputSchemas = actionOutputSchemasMetadata
     .schemas;
@@ -764,6 +771,20 @@ const STRING_OUTPUT_ACTIONS = new Set([
     "log",
     "log-url",
 ]);
+/**
+ * `resource.action` shapes that differ from the bare-action-name sets above:
+ * `contents`/`usages`/`project-timeline` are array-named elsewhere, and
+ * `download`/`diff` are string-named elsewhere, but these handlers return the
+ * opposite shape. Pinned by tests/cli/output-shapes.test.ts.
+ */
+const SCOPED_OUTPUT_SHAPES = {
+    "folder.contents": "array",
+    "plugin.usages": "object",
+    "plugin.download": "object",
+    "dataset.download": "object",
+    "project-library.get": "string",
+    "project-library.diff": "object",
+};
 function inferOutputShape(resource, action) {
     if (resource === "project-git") {
         if (action === "branches" || action === "tags" || action === "list-libraries")
@@ -777,14 +798,15 @@ function inferOutputShape(resource, action) {
         || resource === "version") {
         return "object";
     }
+    // Resource-scoped rules come first: the bare-name sets below classify by
+    // action alone and would otherwise misfile same-named actions elsewhere.
+    const scoped = SCOPED_OUTPUT_SHAPES[`${resource}.${action}`];
+    if (scoped !== undefined)
+        return scoped;
     if (/^list(-|$)/.test(action))
         return "array";
     if (ARRAY_OUTPUT_ACTIONS.has(action))
         return "array";
-    if (resource === "dataset" && action === "download")
-        return "object";
-    if (resource === "project-library" && action === "get")
-        return "string";
     if (STRING_OUTPUT_ACTIONS.has(action))
         return "string";
     return "object";
@@ -1400,11 +1422,10 @@ function commandRegistryJsonSchema() {
 function errorEnvelopeJsonSchema() {
     return {
         type: "object",
-        required: ["type", "ok", "error", "code", "category", "exitCode",],
+        required: ["type", "error", "code", "category", "exitCode",],
         additionalProperties: true,
         properties: {
             type: { const: "error", },
-            ok: { const: false, },
             error: { type: "string", },
             code: { type: "string", },
             category: { enum: ["usage", "permission_or_environment", "dss", "internal",], },
@@ -1414,8 +1435,6 @@ function errorEnvelopeJsonSchema() {
             retryable: { type: "boolean", },
             requestId: { type: "string", },
             details: { type: "object", additionalProperties: true, },
-            resource: { type: "string", },
-            action: { type: "string", },
             projectKey: { type: "string", },
         },
     };
@@ -1526,7 +1545,7 @@ export function buildAgentContract() {
                 failure: "structured-error-object",
                 failureResultDetailLimitBytes: 65_536,
                 fieldProjection: "Missing --fields paths: null on stdout; field_projection_missing on stderr.",
-                lists: "*.list: compact items; --full/--fields use DSS objects; --contains/--limit filter (list_truncated warning).",
+                compactResults: "*.list, job get, dataset get/info, project get: compact; --full/--fields use DSS objects; lists take --contains/--limit (list_truncated warning).",
                 richFailureResults: "doctor/batch/cleanup failures: own compact {ok:false,...} result on stdout and command exit code; no wrapper.",
             },
             stderr: {

package/dist/src/cli/env.js

@@ -1,6 +1,5 @@
 import { readFileSync, } from "node:fs";
-import { dirname, resolve, } from "node:path";
-import { fileURLToPath, } from "node:url";
+import { resolve, } from "node:path";
 const projectEnvVars = new Set();
 const installEnvVars = new Set();
 /**
@@ -42,7 +41,7 @@ export function loadEnvFile() {
     // CLI. First writer wins below, so cwd must be listed first.
     const dirs = [
         process.cwd(),
-        resolve(dirname(fileURLToPath(import.meta.url)), "..", ".."),
+        resolve(import.meta.dir, "..", ".."),
     ];
     for (const [index, dir,] of dirs.entries()) {
         try {

package/dist/src/cli/helpers/app-permissions.d.ts

@@ -43,7 +43,7 @@ export declare function buildAppPermissionsSnapshot(projectKey: string, dssUrl:
 export declare function writeAppPermissionsSnapshot(filePath: string, snapshot: AppPermissionsSnapshot): void;
 /** Validate envelope shape, version, and hash integrity. Never echoes permission payloads. */
 export declare function parseAppPermissionsSnapshot(text: string, source: string): AppPermissionsSnapshot;
-export declare function readAppPermissionsSnapshot(filePath: string): AppPermissionsSnapshot;
+export declare function readAppPermissionsSnapshot(filePath: string): Promise<AppPermissionsSnapshot>;
 /**
  * Refuse to use a snapshot outside the exact project *and* DSS server it was captured
  * from. Access-control rules are server-scoped: the same project key, users, and groups

package/dist/src/cli/helpers/app-permissions.js

@@ -153,10 +153,10 @@ export function parseAppPermissionsSnapshot(text, source) {
         permissions,
     };
 }
-export function readAppPermissionsSnapshot(filePath) {
+export async function readAppPermissionsSnapshot(filePath) {
     let text;
     try {
-        text = fs.readFileSync(filePath, "utf-8");
+        text = await fs.promises.readFile(filePath, "utf-8");
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);

package/dist/src/cli/helpers/cleanup.d.ts

@@ -1,3 +1,5 @@
 import type { CleanupLedgerEntry } from "../../utils/cleanup-ledger.js";
 export declare function projectArg(projectKey: string | undefined): string[];
+/** Input field that identifies the created object, when the result does not. */
+export declare function cleanupInputIdentifierField(resource: string, action: string): string | undefined;
 export declare function cleanupLedgerEntry(resource: string, action: string, args: string[], flags: Record<string, string | boolean>, result: unknown, projectKey: string | undefined): CleanupLedgerEntry | undefined;

package/dist/src/cli/helpers/cleanup.js

@@ -35,6 +35,30 @@ function createInputFromFlags(flags) {
         return undefined;
     }
 }
+/**
+ * Creates whose DSS response carries no identifier: the cleanup ledger pins the
+ * created object from this field of the `--data`/`--data-file` input instead.
+ * `--stdin` cannot be replayed, so the CLI rejects it with `--record-cleanup`
+ * before mutating.
+ */
+const CLEANUP_INPUT_IDENTIFIER_FIELDS = {
+    "workspace.create": "workspaceKey",
+    "connection.create": "name",
+    "user.create": "login",
+    "group.create": "name",
+};
+/** Input field that identifies the created object, when the result does not. */
+export function cleanupInputIdentifierField(resource, action) {
+    return CLEANUP_INPUT_IDENTIFIER_FIELDS[`${resource}.${action}`];
+}
+function inputIdentifier(resource, action, flags) {
+    const field = cleanupInputIdentifierField(resource, action);
+    if (!field)
+        return undefined;
+    const input = resultRecord(createInputFromFlags(flags));
+    const identifier = stringField(input, [field,]);
+    return identifier ? { identifier, input, } : undefined;
+}
 export function cleanupLedgerEntry(resource, action, args, flags, result, projectKey) {
     const record = resultRecord(result);
     // A notebook save is ledger-eligible only when it created the notebook:
@@ -77,6 +101,22 @@ export function cleanupLedgerEntry(resource, action, args, flags, result, projec
                 cleanup: { argv: ["dataset", "delete", name, "--if-exists", ...withProject,], },
             };
         }
+        case "dataset.create-managed": {
+            // The handler returns `created` as the dataset name and the project
+            // DSS created it in, which wins over the requested project key.
+            const name = stringField(record, ["created", "name",]) ?? flags["name"];
+            if (!name)
+                return undefined;
+            const landedProject = stringField(record, ["projectKey",]) ?? project;
+            return {
+                ...base,
+                ...(landedProject ? { projectKey: landedProject, } : {}),
+                name,
+                cleanup: {
+                    argv: ["dataset", "delete", name, "--if-exists", ...projectArg(landedProject),],
+                },
+            };
+        }
         case "recipe.create": {
             const name = stringField(record, ["created", "recipeName", "name",])
                 ?? flags["name"];
@@ -199,6 +239,78 @@ export function cleanupLedgerEntry(resource, action, args, flags, result, projec
                 cleanup: { argv: ["ml-task", "delete", analysisId, taskId, ...withProject,], },
             };
         }
+        case "ml-task.create-for-dataset": {
+            // This create opens a new visual analysis around the task, so cleanup
+            // removes the whole analysis rather than leaving an empty one behind.
+            const analysisId = stringField(record, ["analysisId",]);
+            if (!analysisId)
+                return undefined;
+            return {
+                ...base,
+                id: analysisId,
+                cleanup: { argv: ["analysis", "delete", analysisId, "--if-exists", ...withProject,], },
+            };
+        }
+        case "saved-model.create-external": {
+            const id = stringField(record, ["id",]);
+            if (!id)
+                return undefined;
+            const landedProject = stringField(record, ["projectKey",]) ?? project;
+            return {
+                ...base,
+                ...(landedProject ? { projectKey: landedProject, } : {}),
+                id,
+                name: args[0],
+                cleanup: {
+                    argv: ["saved-model", "delete", id, "--if-exists", ...projectArg(landedProject),],
+                },
+            };
+        }
+        case "project-folder.create-child": {
+            // `created` falls back to the requested name when DSS omits the id,
+            // and a name cannot address a folder delete: only `id` pins it.
+            const id = stringField(record, ["id",]);
+            if (!id)
+                return undefined;
+            return {
+                ...base,
+                id,
+                name: flags["name"],
+                cleanup: { argv: ["project-folder", "delete", id, "--if-exists",], },
+            };
+        }
+        case "data-collection.create": {
+            const id = stringField(record, ["id",]);
+            if (!id)
+                return undefined;
+            return {
+                ...base,
+                id,
+                cleanup: { argv: ["data-collection", "delete", id,], },
+            };
+        }
+        case "plugin.create-dev": {
+            const id = stringField(record, ["created",]) ?? args[0];
+            if (!id)
+                return undefined;
+            return {
+                ...base,
+                id,
+                cleanup: { argv: ["plugin", "delete", id,], },
+            };
+        }
+        case "connection.create":
+        case "user.create":
+        case "group.create": {
+            const pinned = inputIdentifier(resource, action, flags);
+            if (!pinned)
+                return undefined;
+            return {
+                ...base,
+                name: pinned.identifier,
+                cleanup: { argv: [resource, "delete", pinned.identifier, "--if-exists",], },
+            };
+        }
         case "data-quality.create-rule": {
             const ruleId = stringField(record, ["id", "created",]);
             if (!ruleId)
@@ -222,8 +334,11 @@ export function cleanupLedgerEntry(resource, action, args, flags, result, projec
                 cleanup: { argv: ["code-env", "delete", lang, name, "--if-exists",], },
             };
         }
-        case "streaming-endpoint.create": {
-            const id = args[0];
+        case "streaming-endpoint.create":
+        case "streaming-endpoint.create-managed": {
+            const id = stringField(record, ["created",]) ?? args[0];
+            if (!id)
+                return undefined;
             return {
                 ...base,
                 id,
@@ -240,15 +355,14 @@ export function cleanupLedgerEntry(resource, action, args, flags, result, projec
             };
         }
         case "workspace.create": {
-            const input = resultRecord(createInputFromFlags(flags));
-            const workspaceKey = stringField(input, ["workspaceKey",]);
-            if (!workspaceKey)
+            const pinned = inputIdentifier(resource, action, flags);
+            if (!pinned)
                 return undefined;
             return {
                 ...base,
-                id: workspaceKey,
-                name: stringField(input, ["displayName",]),
-                cleanup: { argv: ["workspace", "delete", workspaceKey,], },
+                id: pinned.identifier,
+                name: stringField(pinned.input, ["displayName",]),
+                cleanup: { argv: ["workspace", "delete", pinned.identifier,], },
             };
         }
         case "project-library.create-file":

package/dist/src/cli/helpers/flow-zone.d.ts

@@ -56,7 +56,7 @@ export declare function dedupeFlowZonePlanItems(items: FlowZoneItemInput[]): Flo
 export declare function flowZonePlanItemKeys(plan: FlowZoneOrganizePlan): Set<string>;
 export declare function validateUniqueFlowZoneAssignments(plan: FlowZoneOrganizePlan): void;
 export declare function parseFlowZoneOrganizePlan(input: Record<string, unknown>): FlowZoneOrganizePlan;
-export declare function readFlowZoneOrganizePlan(flags: Record<string, string | boolean>, usage: string): FlowZoneOrganizePlan;
+export declare function readFlowZoneOrganizePlan(flags: Record<string, string | boolean>, usage: string): Promise<FlowZoneOrganizePlan>;
 export declare function findFlowZoneForPlan(zones: FlowZone[], plan: FlowZoneOrganizeZonePlan): FlowZone | undefined;
 export declare function ensureFlowZonePlanTarget(plan: FlowZoneOrganizeZonePlan, existing: FlowZone | undefined): void;
 export declare function flowZoneExplicitItems(zone: FlowZone): FlowZoneItemInput[];

package/dist/src/cli/helpers/flow-zone.js

@@ -1,8 +1,7 @@
-import { readFileSync, } from "node:fs";
 import { ClientValidationError, } from "../../errors.js";
 import { asRecord, } from "../../utils/records.js";
 import { compareStrings, } from "../../utils/stable-hash.js";
-import { finiteNumberField, jsonInput, optionalStringField, parseJsonObject, requiredStringArray, splitCsvFlag, } from "../coerce.js";
+import { finiteNumberField, jsonInput, optionalStringField, parseJsonObject, readTextFile, requiredStringArray, splitCsvFlag, } from "../coerce.js";
 import { commandUsage, } from "../syntax.js";
 import { UsageError, } from "../usage.js";
 export function flowZoneId(value) {
@@ -257,9 +256,9 @@ export function parseFlowZoneOrganizePlan(input) {
     validateUniqueFlowZoneAssignments(plan);
     return plan;
 }
-export function readFlowZoneOrganizePlan(flags, usage) {
+export async function readFlowZoneOrganizePlan(flags, usage) {
     const data = typeof flags["file"] === "string"
-        ? parseJsonObject(readFileSync(flags["file"], "utf-8"), flags["file"])
+        ? parseJsonObject(await readTextFile(flags["file"]), flags["file"])
         : jsonInput(flags);
     if (!data) {
         throw new UsageError(`--data, --data-file, --file, or --stdin is required. Usage: ${usage}`, "missing_required_flag");

package/dist/src/cli/list-output.d.ts

@@ -1,3 +1,7 @@
+import { type CompactListField } from "./list-shapes.js";
+type Item = Record<string, unknown>;
+/** One compact field of a DSS list item, as `RESOURCE.list` prints it. */
+export declare function compactValue(item: Item, spec: CompactListField): unknown;
 /**
  * Shape a `*.list` result for agents: `--contains` filters on identifier
  * fields, `--limit` caps the count (a `list_truncated` warning reports the
@@ -5,3 +9,4 @@
  * `--full` or `--fields` asks for the DSS objects.
  */
 export declare function shapeListResult(resource: string, result: unknown, flags: Record<string, string | boolean>): unknown;
+export {};

package/dist/src/cli/list-output.js

@@ -4,10 +4,19 @@ import { enqueueCliWarning, } from "./output.js";
 function record(value) {
     return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function compactValue(item, spec) {
+function valueAt(item, path) {
     let value = item;
-    for (const key of spec.path.split("."))
+    for (const key of path.split("."))
         value = record(value)[key];
+    return value;
+}
+/** One compact field of a DSS list item, as `RESOURCE.list` prints it. */
+export function compactValue(item, spec) {
+    const value = valueAt(item, spec.path);
+    if (value === undefined && spec.fallback
+        && valueAt(item, spec.fallback.when) === spec.fallback.equals) {
+        return spec.fallback.value;
+    }
     if (spec.roleRefs !== true)
         return value;
     // Dataset refs across every role of recipe inputs/outputs (`{main:{items:[{ref}]}}`).

package/dist/src/cli/list-shapes.d.ts

@@ -9,6 +9,12 @@ export interface CompactListField {
     path: string;
     /** Flatten recipe roles (`{main:{items:[{ref}]}}`) to the dataset refs. */
     roleRefs?: true;
+    /** Value when `path` is absent and the item's `when` path equals `equals`. */
+    fallback?: {
+        when: string;
+        equals: unknown;
+        value: unknown;
+    };
     schema: Record<string, unknown>;
 }
 /**

package/dist/src/cli/list-shapes.js

@@ -51,7 +51,12 @@ export const COMPACT_LIST_FIELDS = {
         id: field("def.id", STRING),
         name: field("def.name", STRING),
         type: field("def.type", STRING),
-        state: field("state", STRING),
+        // DSS lists in-progress jobs with `stableState: false` and no `state`
+        // (COMPUTING_DEPS or RUNNING); `job get` reports the exact phase.
+        state: {
+            ...field("state", STRING),
+            fallback: { when: "stableState", equals: false, value: "RUNNING", },
+        },
         startTime: field("startTime", NUMBER),
         endTime: field("endTime", NUMBER),
     },
@@ -83,6 +88,7 @@ export const COMPACT_LIST_FIELDS = {
         id: field("id", STRING),
         version: field("version", STRING),
         label: field("meta.label", STRING),
+        isDev: field("isDev", BOOLEAN),
     },
     macro: {
         runnableType: field("runnableType", STRING),

package/dist/src/cli/output-schemas.d.ts

@@ -3,7 +3,7 @@
  * the single source of truth for `src/generated/action-output-schemas.json`,
  * which discovery reads as plain data so no TypeBox schema graph loads on the
  * discovery path. Regenerate with
- * `bun scripts/generate-action-output-schemas.mjs`; `bun run check` fails when
+ * `bun scripts/generate-action-output-schemas.mjs`; `bun run verify` fails when
  * the generated file is stale. SDK validation keeps using the TypeBox schema
  * objects from `packages/types` directly and never depends on the generated file.
  */