dataiku-sdk 3.9.0 → 4.0.0

package/README.md

@@ -16,7 +16,7 @@ Malformed user/group listings and scenario run histories fail explicitly instead
 
 ## Platform support
 
-The published `dss` CLI requires Bun >= 1.4.2 and supports Linux, macOS, and Windows. CI runs Bun 1.4.2 on all three operating systems. The runtime dependency is pure JavaScript, so the same package also runs on every Bun-supported x64 and ARM64 system.
+The published `dss` CLI requires Bun >= 1.4.3 and supports Linux, macOS, and Windows. CI runs Bun 1.4.3 on all three operating systems. The runtime dependency is pure JavaScript, so the same package also runs on every Bun-supported x64 and ARM64 system.
 
 Run directly with Bun:
 
@@ -29,7 +29,7 @@ Or install the npm binary:
 ```text
 npm install --global dataiku-sdk
 ```
-The installed `dss` bin bootstraps Bun with automatic `.env` preloading disabled, so Bun >= 1.4.2 must be on `PATH`; the CLI's own `.env` handling stays authoritative. `bunx --bun` forces Bun's Node-compatibility mode, which provides the same no-preload guarantee across operating systems.
+The installed `dss` bin bootstraps Bun with automatic `.env` preloading disabled, so Bun >= 1.4.3 must be on `PATH`; the CLI's own `.env` handling stays authoritative. `bunx --bun` forces Bun's Node-compatibility mode, which provides the same no-preload guarantee across operating systems.
 
 Bun is the only supported runtime and the package manager. Examples below assume an installed `dss` binary. From a checkout, use `bun --no-env-file src/cli.ts ...` or the packaged launcher `bun --no-env-file ./bin/dss.js ...`. From another working directory, pass the checkout's absolute `bin/dss.js` path to Bun.
 `--no-env-file` disables Bun's automatic preloading only; the CLI still applies its documented `.env` handling unless `DATAIKU_DISABLE_ENV=1` is set.
@@ -181,7 +181,7 @@ then update `tests/live-coverage.ts` when the
 registry changes; catalogue drift fails the offline gate. Plan/dry-run calls do not count
 as executed live coverage.
 
-Regular `bun run check` and `bun run lint` include the live runner and fixtures.
+Regular `bun run verify` and `bun run lint` include the live runner and fixtures.
 Lint includes project-owned rules in `tools/oxlint/index.ts`: accumulator-copy, widen-then-assert, and chained-assertion errors, alongside the native accumulating-spread check.
 For focused verification:
 

package/dist/build-metadata.json

@@ -1 +1 @@
-{"format":1,"buildRevision":"3f9f0582b0fa45ee3708215954761d75f6edf9b7"}
+{"format":1,"buildRevision":"ab176cb1de853bfbdc58627b38a131ce1fc1681d"}

package/dist/packages/types/src/index.d.ts

@@ -284,6 +284,10 @@ export declare const JobWaitResultSchema: import("@sinclair/typebox").TObject<{
     pollCount: import("@sinclair/typebox").TNumber;
     success: import("@sinclair/typebox").TBoolean;
     timedOut: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+    /** Present on a wait timeout: the wait never cancels the job, so this is `false`. */
+    cancelled: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TBoolean>;
+    /** CLI only, on a wait timeout: the command that resumes waiting for the still-running job. */
+    resume: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     progress: import("@sinclair/typebox").TObject<{
         done: import("@sinclair/typebox").TNumber;
         failed: import("@sinclair/typebox").TNumber;

package/dist/packages/types/src/index.js

@@ -308,6 +308,10 @@ export const JobWaitResultSchema = Type.Object({
     pollCount: Type.Number(),
     success: Type.Boolean(),
     timedOut: Type.Optional(Type.Boolean()),
+    /** Present on a wait timeout: the wait never cancels the job, so this is `false`. */
+    cancelled: Type.Optional(Type.Boolean()),
+    /** CLI only, on a wait timeout: the command that resumes waiting for the still-running job. */
+    resume: Type.Optional(Type.String()),
     progress: Type.Object({
         done: Type.Number(),
         failed: Type.Number(),

package/dist/src/cli/coerce.d.ts

@@ -21,6 +21,12 @@ export declare function parseJsonObject(text: string, source: string): Record<st
 export declare function json(v: string | boolean | undefined, source?: string): Record<string, unknown> | undefined;
 export declare function readStdinText(): string;
 export declare function readInputText(path: string, flag: string): string;
+/**
+ * Async UTF-8 read of a user-supplied path (BOM kept, like `readFileSync`).
+ * Stays on node:fs: Bun 1.4.3 `Bun.file(path)` reads of a missing path ended the
+ * process on Windows CI instead of rejecting with ENOENT.
+ */
+export declare function readTextFile(path: string): Promise<string>;
 export declare function seenJsonInputCredentials(): readonly string[];
 export declare function jsonInput(flags: Record<string, string | boolean>): Record<string, unknown> | undefined;
 export declare function unknownJsonInput(flags: Record<string, string | boolean>): unknown;

package/dist/src/cli/coerce.js

@@ -1,4 +1,5 @@
 import { readFileSync, } from "node:fs";
+import { readFile, } from "node:fs/promises";
 import { credentialValues, } from "../utils/secret-sanitize.js";
 import { UsageError, } from "./usage.js";
 function safeValuePreview(value) {
@@ -174,6 +175,14 @@ export function readInputText(path, flag) {
         throw new UsageError(`Could not read ${flag} file: ${path}`, "validation_failed", "Verify that the path names an existing, readable file.", { flag, path, ...(cause ? { cause, } : {}), });
     }
 }
+/**
+ * Async UTF-8 read of a user-supplied path (BOM kept, like `readFileSync`).
+ * Stays on node:fs: Bun 1.4.3 `Bun.file(path)` reads of a missing path ended the
+ * process on Windows CI instead of rejecting with ENOENT.
+ */
+export async function readTextFile(path) {
+    return readFile(path, "utf-8");
+}
 /**
  * Credential values seen in this process's JSON inputs. DSS error text can
  * echo the request payload, so error reports redact these.

package/dist/src/cli/commands/app.js

@@ -754,7 +754,7 @@ export const appCommands = withUsage("app", {
             const usage = commandUsage("app", "permissions-diff");
             requireNoArgs(_a, usage);
             const file = requiredStringFlag(f, "file", usage);
-            const snapshot = readAppPermissionsSnapshot(file);
+            const snapshot = await readAppPermissionsSnapshot(file);
             const projectKey = c.resolveProjectKey(f["project-key"]);
             assertAppPermissionsSnapshotBinding(snapshot, projectKey, c.getBaseUrl());
             const currentProjectIncarnationHash = await requireProjectIncarnationHash(c, projectKey);
@@ -779,7 +779,7 @@ export const appCommands = withUsage("app", {
             const usage = commandUsage("app", "permissions-restore");
             requireNoArgs(_a, usage);
             const file = requiredStringFlag(f, "file", usage);
-            const snapshot = readAppPermissionsSnapshot(file);
+            const snapshot = await readAppPermissionsSnapshot(file);
             const projectKey = c.resolveProjectKey(f["project-key"]);
             assertAppPermissionsSnapshotBinding(snapshot, projectKey, c.getBaseUrl());
             const currentProjectIncarnationHash = await requireProjectIncarnationHash(c, projectKey);

package/dist/src/cli/commands/code-env.js

@@ -1,7 +1,6 @@
-import { readFileSync, writeFileSync, } from "node:fs";
 import { ClientValidationError, } from "../../errors.js";
 import { SHA256_HEX_PATTERN, stableHash, } from "../../utils/stable-hash.js";
-import { json, jsonInput, num, numFlag, parseBooleanOption, } from "../coerce.js";
+import { json, jsonInput, num, numFlag, parseBooleanOption, readTextFile, } from "../coerce.js";
 import { executionMode, } from "../flags.js";
 import { enqueueCliWarning, isNotFoundError, readIfExists, skipResult, } from "../output.js";
 import { commandUsage, withUsage, } from "../syntax.js";
@@ -49,9 +48,9 @@ function splitPackageSpec(raw) {
  * (set-packages replaces specPackageList wholesale); only a call with no
  * package source flag at all is a usage error.
  */
-function codeEnvPackageList(flags) {
+async function codeEnvPackageList(flags) {
     const file = flags["file"];
-    const packages = typeof file === "string" ? splitPackageSpec(readFileSync(file, "utf-8")) : [];
+    const packages = typeof file === "string" ? splitPackageSpec(await readTextFile(file)) : [];
     if (typeof flags["packages"] === "string") {
         packages.push(...splitPackageSpec(flags["packages"]));
     }
@@ -122,7 +121,7 @@ export const codeEnvCommands = withUsage("code-env", {
             });
             const output = f["output"];
             if (typeof output === "string" && output.trim().length > 0) {
-                writeFileSync(output, result.log, "utf-8");
+                await Bun.write(output, result.log);
                 if (result.truncated || result.tailed) {
                     const limits = [
                         result.tailed ? `tail limited to ${maxLines ?? 500} lines` : undefined,
@@ -257,7 +256,7 @@ export const codeEnvCommands = withUsage("code-env", {
             const usage = commandUsage("code-env", "set-packages");
             requireArgs(a, 2, usage);
             const envLang = requireEnvLang(a[0], usage);
-            const packages = codeEnvPackageList(f);
+            const packages = await codeEnvPackageList(f);
             const installCorePackages = parseBooleanOption(f["install-core-packages"], "--install-core-packages");
             const expectHash = validateExpectHash(f["expect-hash"]);
             if (executionMode(f).dryRun) {

package/dist/src/cli/commands/code.js

@@ -115,19 +115,33 @@ export const codeCommands = withUsage("code", {
                 maxLogBytes: run.maxLogBytes,
                 cleanup: run.cleanup,
                 ...(run.timedOut === true ? { timedOut: true, timeoutMs: run.timeoutMs, } : {}),
+                ...(run.outputTruncated === true ? { outputTruncated: true, } : {}),
+                ...(run.outputOmittedBytes !== undefined
+                    ? { outputOmittedBytes: run.outputOmittedBytes, }
+                    : {}),
             };
             if (f["full-log"] === true || run.output === undefined) {
                 result.log = run.log;
             }
+            if (run.outputTruncated === true) {
+                enqueueCliWarning({
+                    code: "code_run_output_truncated",
+                    hint: run.outputOmittedBytes !== undefined
+                        ? `Script output exceeded the capture budget; the first ${run.outputOmittedBytes} bytes were dropped and \`output\` holds the last part. Raise --max-log-bytes (the budget is a quarter of it) or print less.`
+                        : "The run log exceeded --max-log-bytes, so the start of the script output was cut and `output` holds the last part. Raise --max-log-bytes or print less.",
+                    ...(run.outputOmittedBytes !== undefined ? { omittedBytes: run.outputOmittedBytes, } : {}),
+                    maxLogBytes: run.maxLogBytes,
+                });
+            }
             if (run.cleanup.status === "failed") {
                 reportCleanupFailure({ scenarioId: run.scenarioId, error: run.cleanup.error ?? "unknown", });
             }
             return result;
         },
-        description: "Run Python through a throwaway custom-python scenario and return captured output plus outcome. --timeout caps waiting; --max-log-bytes caps logs; --full-log returns the capped raw log. Exits 4 unless outcome is SUCCESS.",
+        description: "Run Python through a throwaway custom-python scenario and return captured output plus outcome. --timeout caps waiting; --max-log-bytes caps the log tail read (script output keeps its last quarter; a code_run_output_truncated warning reports cuts); --full-log returns the capped raw log. Exits 4 unless outcome is SUCCESS.",
         examples: [
             "dss code run --file inspect.py",
-            "dss code run --file inspect.py --env py39_pandas",
+            "dss code run --file inspect.py --env py311_pandas",
             "cat snippet.py | dss code run --stdin",
             "dss code run --file inspect.py --full-log",
         ],

package/dist/src/cli/commands/dashboard.js

@@ -1,4 +1,3 @@
-import * as fs from "node:fs";
 import { ClientValidationError, } from "../../errors.js";
 import { deepMerge, } from "../../utils/deep-merge.js";
 import { jsonInput, parseBooleanOption, } from "../coerce.js";
@@ -73,7 +72,7 @@ export const dashboardCommands = withUsage("dashboard", {
             if (!isPdf) {
                 throw new ClientValidationError("DSS dashboard export did not return a PDF.", "validation_failed", "Confirm DSS graphics export is configured and retry the export.");
             }
-            fs.writeFileSync(outputPath, bytes);
+            await Bun.write(outputPath, bytes);
             return {
                 path: outputPath,
                 bytes: bytes.length,

package/dist/src/cli/commands/flow-zone.js

@@ -275,7 +275,7 @@ export const flowZoneCommands = withUsage("flow-zone", {
         handler: async (c, _a, f) => {
             const usage = commandUsage("flow-zone", "organize");
             const pk = f["project-key"];
-            const parsed = readFlowZoneOrganizePlan(f, usage);
+            const parsed = await readFlowZoneOrganizePlan(f, usage);
             const sync = f["sync"] === true;
             const validateObjects = f["validate-objects"] === true;
             const recreateOnMove = f["recreate-on-move"] === true;

package/dist/src/cli/commands/job.js

@@ -1,9 +1,10 @@
-import { mkdir, writeFile, } from "node:fs/promises";
-import { dirname, resolve, } from "node:path";
-import { ClientValidationError, DataikuError, } from "../../errors.js";
+import { resolve, } from "node:path";
+import { ClientValidationError, DataikuError, dataikuErrorCode, } from "../../errors.js";
 import { asRecord, } from "../../utils/records.js";
 import { jobBuildTargetTypeFromFlags, jobLogFilterFromFlag, maxLogLinesFromFlags, num, } from "../coerce.js";
 import { executionMode, } from "../flags.js";
+import { compactValue, } from "../list-output.js";
+import { COMPACT_LIST_FIELDS, } from "../list-shapes.js";
 import { encodedProjectEndpoint, enqueueCliWarning, } from "../output.js";
 import { commandUsage, withUsage, } from "../syntax.js";
 import { requireArgs, UsageError, } from "../usage.js";
@@ -33,6 +34,24 @@ function tailJobLogForStdout(log, limit) {
     const tail = lines.slice(-shown).join("\n");
     return hasTrailingLineBreak ? `${tail}\n` : tail;
 }
+const RESPONSE_TOO_LARGE_STATUS_TEXT = "Response Too Large";
+/** POSIX-shell quoting for a resume command argument. */
+function shellArg(value) {
+    return /^[\w.:@%+=,/-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}
+/** Command that resumes waiting for a job whose wait timed out. */
+function jobWaitResumeCommand(jobId, projectKey) {
+    return `dss job wait ${shellArg(jobId)}${projectKey ? ` --project-key ${shellArg(projectKey)}` : ""}`;
+}
+/**
+ * A wait that timed out only stopped polling: the job is still running in DSS.
+ * Attach the command that resumes waiting; other results pass through.
+ */
+function withWaitResume(result, projectKey) {
+    if (result.timedOut !== true)
+        return result;
+    return { ...result, resume: jobWaitResumeCommand(result.jobId, projectKey), };
+}
 /**
  * With an empty output schema DSS ends a dataset build DONE after writing no
  * columns and no rows, without an error. Flag that after a successful build so
@@ -120,8 +139,9 @@ function jobSummaryType(job) {
         ?? "unknown";
 }
 function jobSummaryState(job) {
+    const listState = compactValue(job, COMPACT_LIST_FIELDS["job"]["state"]);
     return stringPath(job, ["baseStatus", "state",])
-        ?? stringPath(job, ["state",])
+        ?? (typeof listState === "string" ? listState : undefined)
         ?? "unknown";
 }
 function filteredJobList(jobs, flags) {
@@ -202,7 +222,19 @@ function jobDurationMs(details) {
 }
 async function jobInspectionSummary(client, jobId, flags) {
     const projectKey = flags["project-key"];
-    const details = await client.jobs.get(jobId, projectKey);
+    // A job-detail body over the buffered response cap must not sink the whole
+    // summary: keep the log part and report the details failure structurally.
+    let details = {};
+    let detailsError;
+    try {
+        details = await client.jobs.get(jobId, projectKey);
+    }
+    catch (error) {
+        if (!(error instanceof DataikuError && error.statusText === RESPONSE_TOO_LARGE_STATUS_TEXT)) {
+            throw error;
+        }
+        detailsError = { code: dataikuErrorCode(error.category), message: error.message, };
+    }
     let log;
     let logError;
     try {
@@ -233,6 +265,7 @@ async function jobInspectionSummary(client, jobId, flags) {
         jobId: jobSummaryId(details, jobId),
         state: jobSummaryState(details),
         type: jobSummaryType(details),
+        ...(detailsError ? { detailsError, } : {}),
         ...(durationMs !== undefined ? { durationMs, } : {}),
         ...(outputs !== undefined ? { outputs, } : {}),
         warnings: jobWarningSummary(details, log),
@@ -253,7 +286,7 @@ async function jobInspectionSummary(client, jobId, flags) {
 export const jobCommands = withUsage("job", {
     list: {
         handler: async (c, _a, f) => filteredJobList(await c.jobs.list(f["project-key"]), f),
-        description: "List recent jobs, optionally filtered for automation.",
+        description: "List recent jobs, optionally filtered for automation. In-progress jobs, which DSS lists without a state, show RUNNING; `job get` has the exact phase.",
         examples: ["dss job list --state DONE --latest", "dss job list --contains WLM225S --limit 10",],
     },
     get: {
@@ -282,18 +315,34 @@ export const jobCommands = withUsage("job", {
                 ?? f["output-file"];
             const requestedLines = maxLogLinesFromFlags(f);
             // Stdout is tailed here (not in the SDK) so the total can be reported.
-            const log = await c.jobs.log(a[0], {
+            const details = await c.jobs.logDetails(a[0], {
                 activity: f["activity"],
                 logId: f["log-id"],
                 logFilter,
                 maxLogLines: outputFile ? requestedLines : -1,
                 projectKey: f["project-key"],
             });
+            const log = details.text;
+            if (details.truncated) {
+                enqueueCliWarning({
+                    code: "log_truncated",
+                    reason: "byte_cap",
+                    earlyLinesDropped: true,
+                    maxLogBytes: details.maxLogBytes,
+                    hint: "Only the most recent part of the log was retrieved; early lines (and any earlier errors) were dropped. Use `dss job get` for job-level and per-activity errors.",
+                });
+            }
+            if (logFilter === "errors" && log.length === 0) {
+                enqueueCliWarning({
+                    code: "no_error_lines",
+                    scannedLines: details.scannedLines,
+                    hint: `No error lines matched in ${details.scannedLines} scanned log lines. Run \`dss job get ${a[0]}\` for the job-level and per-activity errors, or \`dss job log ${a[0]}\` without --errors-only for the full log.`,
+                });
+            }
             if (!outputFile)
                 return tailJobLogForStdout(log, requestedLines ?? DEFAULT_STDOUT_LOG_LINES);
             const outputPath = resolve(outputFile);
-            await mkdir(dirname(outputPath), { recursive: true, });
-            await writeFile(outputPath, log.endsWith("\n") ? log : `${log}\n`, "utf-8");
+            await Bun.write(outputPath, log.endsWith("\n") ? log : `${log}\n`);
             return outputPath;
         },
         description: "Get public API job log output (last 100 lines by default; --max-lines N, 0 = all); find why a job failed. Use --errors-only for error/traceback lines and --output PATH to write it to a file (stdout returns the path). --log-id is accepted for UI parity; API keys cannot read browser-only cat-activity-log files.",
@@ -349,7 +398,7 @@ export const jobCommands = withUsage("job", {
                 };
             }
             if (f["wait"] === true) {
-                const result = await c.jobs.buildAndWait(a[0], { ...options, projectKey: pk, });
+                const result = withWaitResume(await c.jobs.buildAndWait(a[0], { ...options, projectKey: pk, }), pk);
                 await warnIfBuiltDatasetHasNoColumns(c, a[0], options.targetType, result.success, pk);
                 return result;
             }
@@ -389,7 +438,7 @@ export const jobCommands = withUsage("job", {
                     method: "POST",
                 };
             }
-            const result = await c.jobs.buildAndWait(a[0], { ...options, projectKey: pk, });
+            const result = withWaitResume(await c.jobs.buildAndWait(a[0], { ...options, projectKey: pk, }), pk);
             await warnIfBuiltDatasetHasNoColumns(c, a[0], options.targetType, result.success, pk);
             return result;
         },
@@ -402,17 +451,19 @@ export const jobCommands = withUsage("job", {
         ],
     },
     wait: {
-        handler: (c, a, f) => {
+        handler: async (c, a, f) => {
             requireArgs(a, 1, commandUsage("job", "wait"));
-            return c.jobs.wait(a[0], {
+            const projectKey = f["project-key"];
+            const result = await c.jobs.wait(a[0], {
                 includeLogs: f["include-logs"] === true,
                 logFilter: jobLogFilterFromFlag(f["log-filter"]),
                 maxLogLines: maxLogLinesFromFlags(f),
                 pollIntervalMs: num(f["poll-interval"], "--poll-interval"),
                 timeoutMs: num(f["timeout"], "--timeout"),
                 summary: f["summary"] === true,
-                projectKey: f["project-key"],
+                projectKey,
             });
+            return withWaitResume(result, projectKey);
         },
         description: "Wait for an existing job to complete.",
         examples: [
@@ -432,7 +483,7 @@ export const jobCommands = withUsage("job", {
                 summary: f["summary"] !== false,
                 projectKey: f["project-key"],
             };
-            const jobs = await Promise.all(a.map((jobId) => c.jobs.wait(jobId, options)));
+            const jobs = await Promise.all(a.map(async (jobId) => withWaitResume(await c.jobs.wait(jobId, options), options.projectKey)));
             return aggregateJobWaitResults(jobs, String(f["until"] ?? "all-done"));
         },
         description: "Monitor one or more existing jobs and summarize progress counters from logs.",
@@ -450,7 +501,7 @@ export const jobCommands = withUsage("job", {
                 summary: true,
                 projectKey: f["project-key"],
             };
-            const jobs = await Promise.all(a.map((jobId) => c.jobs.wait(jobId, options)));
+            const jobs = await Promise.all(a.map(async (jobId) => withWaitResume(await c.jobs.wait(jobId, options), options.projectKey)));
             return aggregateJobWaitResults(jobs, String(f["until"] ?? "all-done"));
         },
         description: "Watch one or more existing jobs with progress extraction enabled.",

package/dist/src/cli/commands/plugin.js

@@ -1,7 +1,7 @@
-import * as fs from "node:fs";
+import { readFile, } from "node:fs/promises";
 import { validatedPluginGitUrl, validatePluginDestinationPath, validatePluginId, validatePluginName, validatePluginPath, } from "../../resources/plugins.js";
 import { writeResponseToFile, } from "../../utils/response-file.js";
-import { num, readStdinText, sha256Hex, } from "../coerce.js";
+import { num, readStdinText, readTextFile, sha256Hex, } from "../coerce.js";
 import { executionMode, } from "../flags.js";
 import { planResult, } from "../output.js";
 import { commandUsage, withUsage, } from "../syntax.js";
@@ -281,7 +281,7 @@ export const pluginCommands = withUsage("plugin", {
             requireArgs(a, 1, SETTINGS_SET_USAGE);
             const pluginId = validatePluginId(a[0]);
             const mode = executionMode(f);
-            const settings = readSettingsInput(f);
+            const settings = await readSettingsInput(f);
             if (mode.dryRun) {
                 return pluginPlan("settings-set", {
                     method: "POST",
@@ -330,7 +330,7 @@ export const pluginCommands = withUsage("plugin", {
         },
         description: "Create the code env of a plugin. Returns the DSS future (jobId); --wait polls it to completion.",
         examples: [
-            "dss plugin code-env-create my-plugin --python-interpreter PYTHON36",
+            "dss plugin code-env-create my-plugin --python-interpreter PYTHON311",
             "dss plugin code-env-create my-plugin --conda --wait --timeout 300000",
         ],
     },
@@ -629,7 +629,7 @@ export const pluginCommands = withUsage("plugin", {
                 });
             }
             const content = typeof f["file"] === "string"
-                ? fs.readFileSync(f["file"])
+                ? await readFile(f["file"])
                 : typeof f["content"] === "string"
                     ? f["content"]
                     : await readStdinText();
@@ -738,10 +738,10 @@ function normalizeCreationMode(value) {
     }
     throw new UsageError("--creation-mode must be one of EMPTY, GIT_CLONE, GIT_EXPORT.", "invalid_enum");
 }
-function readSettingsInput(flags) {
+async function readSettingsInput(flags) {
     let text;
     if (typeof flags["file"] === "string") {
-        text = fs.readFileSync(flags["file"], "utf-8");
+        text = await readTextFile(flags["file"]);
     }
     else if (typeof flags["content"] === "string") {
         text = flags["content"];

package/dist/src/cli/commands/project-library.js

@@ -159,7 +159,7 @@ export const projectLibraryCommands = withUsage("project-library", {
             const content = typeof f["content"] === "string"
                 ? f["content"]
                 : typeof f["file"] === "string"
-                    ? fs.readFileSync(f["file"])
+                    ? await fs.promises.readFile(f["file"])
                     : await readStdinText();
             const result = await c.projectLibrary.addOrUpdateFile(a[0], content, pk, expectSha256 !== undefined ? { expectSha256, } : undefined);
             return {
@@ -184,7 +184,7 @@ export const projectLibraryCommands = withUsage("project-library", {
             const local = typeof f["content"] === "string"
                 ? f["content"]
                 : typeof f["file"] === "string"
-                    ? fs.readFileSync(f["file"])
+                    ? await fs.promises.readFile(f["file"])
                     : await readStdinText();
             return c.projectLibrary.diffFile(a[0], local, pk, maxLines !== undefined ? { maxLines, } : {});
         },

package/dist/src/cli/commands/project.js

@@ -4,11 +4,13 @@ import { inspectProjectArchive, } from "../../utils/project-archive.js";
 import { projectIncarnationHash, } from "../../utils/project-incarnation.js";
 import { jsonInput, num, requiredJsonInput, requiredStringFlag, } from "../coerce.js";
 import { executionMode, } from "../flags.js";
-import { CommandResultFailure, } from "../output.js";
+import { CommandResultFailure, enqueueCliWarning, } from "../output.js";
 import { compactProjectMapOutput, } from "../project-map-output.js";
 import { commandUsage, withUsage, } from "../syntax.js";
 import { requireArgs, UsageError, } from "../usage.js";
 const INSPECT_ARCHIVE_USAGE = commandUsage("project", "inspect-archive");
+/** Maximum credential inventory entries echoed in the export warning. */
+const EXPORT_CREDENTIAL_INVENTORY_LIMIT = 100;
 function flowRenderFormat(value) {
     if (value === undefined)
         return undefined;
@@ -162,9 +164,24 @@ export const projectCommands = withUsage("project", {
             if (!out)
                 throw new UsageError("--output PATH is required.", "missing_required_flag");
             await c.projects.exportArchive(a[0], out, jsonInput(f));
-            return { path: out, };
+            const inspection = await inspectProjectArchive(out);
+            const findings = inspection.credentialFindings;
+            if (findings.length > 0) {
+                enqueueCliWarning({
+                    code: "export_contains_credentials",
+                    message: `The exported archive '${out}' contains ${findings.length} credential-bearing structure(s) `
+                        + "(member paths and key names only; values are never printed). "
+                        + "DSS exports credentials, API keys and secret-named variables verbatim.",
+                    hint: "Sanitize the archive before sharing or uploading it. Overwriting an object in versioned storage does not erase its retained versions: "
+                        + "once an unsanitized archive is uploaded, rotate the exposed credentials.",
+                    total: findings.length,
+                    shown: Math.min(findings.length, EXPORT_CREDENTIAL_INVENTORY_LIMIT),
+                    findings: findings.slice(0, EXPORT_CREDENTIAL_INVENTORY_LIMIT),
+                });
+            }
+            return { path: out, credentialFindings: findings.length, };
         },
-        description: "Export a project to a local archive (.zip).",
+        description: "Export a project to a local archive (.zip). The written archive is inspected locally; credential-bearing structures (apikeys.json, secret-named variables, apiKey/token/password fields) raise an export_contains_credentials warning listing member paths and key names only, and the result reports credentialFindings. The archive is not redacted.",
         examples: ["dss project export MY_PROJ --output ./my_proj.zip",],
     },
     import: {
@@ -202,7 +219,7 @@ export const projectCommands = withUsage("project", {
     "inspect-archive": {
         handler: async (_c, a) => inspectArchiveCommand(a),
         localHandler: inspectArchiveCommand,
-        description: "Read-only local inspection of a project export archive: member names, sizes, manifest validity, archive issues, and the source project key. Never contacts DSS.",
+        description: "Read-only local inspection of a project export archive: member names, sizes, manifest validity, archive issues (including credential_structure and residue_scan_skipped warnings), a credentialFindings inventory of credential-bearing member paths and key names (values are never reported), and the source project key. Never contacts DSS.",
         examples: ["dss project inspect-archive ./my_proj.zip",],
     },
     "permissions-set": {

package/dist/src/cli/commands/recipe.js

@@ -1,10 +1,8 @@
-import { readFileSync, } from "node:fs";
-import { writeFile, } from "node:fs/promises";
 import { join, } from "node:path";
 import { ClientValidationError, DataikuError, } from "../../errors.js";
 import { recipeCreateWarnings, recipeOutputSchemaIsComputable, schemaUpdateComputableId, schemaUpdateIsPending, } from "../../resources/recipe-create.js";
-import { deepMerge, } from "../../utils/deep-merge.js";
-import { jobLogFilterFromFlag, jsonInput, maxLogLinesFromFlags, normalizeLineEndings, num, recipeInputDatasetsFromFlags, requiredJsonInput, requiredStringFlag, rewritePairsFromFlags, sha256Hex, splitCsvFlag, stableHash, } from "../coerce.js";
+import { buildRecipeUpdate, } from "../../resources/recipes.js";
+import { jobLogFilterFromFlag, jsonInput, maxLogLinesFromFlags, normalizeLineEndings, num, readTextFile, recipeInputDatasetsFromFlags, requiredJsonInput, requiredStringFlag, rewritePairsFromFlags, sha256Hex, splitCsvFlag, stableHash, } from "../coerce.js";
 import { executionMode, } from "../flags.js";
 import { moveCreatedItemsToZone, resolveFlowZoneIdFromFlags, } from "../helpers/flow-zone.js";
 import { ensureRecipeBackupDir, readRecipeBackup, recipeBackupDocument, recipeBackupPath, recipeCodeEnv, recipeGraph, recipeInputItemRef, recipeRoleInputItems, recipeRunShouldWait, writeRecipeBackup, } from "../helpers/recipe.js";
@@ -12,9 +10,9 @@ import { encodedProjectEndpoint, enqueueCliWarning, readIfExists, skipResult, }
 import { commandUsage, withUsage, } from "../syntax.js";
 import { requireArgs, UsageError, } from "../usage.js";
 /** Read a local recipe file before any DSS request, mapping read failures to usage validation. */
-function readRecipeFile(filePath, flagName) {
+async function readRecipeFile(filePath, flagName) {
     try {
-        return readFileSync(filePath, "utf-8");
+        return await readTextFile(filePath);
     }
     catch (error) {
         const reason = error instanceof Error ? error.message : String(error);
@@ -507,7 +505,7 @@ export const recipeCommands = withUsage("recipe", {
                 throw new UsageError(`--file is required. Usage: ${commandUsage("recipe", "diff")}`);
             }
             // Read and validate the local file before any DSS request.
-            const localContent = readRecipeFile(filePath, "--file");
+            const localContent = await readRecipeFile(filePath, "--file");
             const result = await c.recipes.get(a[0], {
                 includePayload: true,
                 projectKey: f["project-key"],
@@ -530,23 +528,17 @@ export const recipeCommands = withUsage("recipe", {
             const pk = f["project-key"];
             if (executionMode(f).dryRun) {
                 const current = await c.recipes.get(a[0], { projectKey: pk, includePayload: true, });
-                const currentRecipe = current.recipe;
-                const next = {
-                    ...current,
-                    ...data,
-                    recipe: deepMerge(currentRecipe, (data.recipe && typeof data.recipe === "object" && !Array.isArray(data.recipe))
-                        ? data.recipe
-                        : {}),
-                };
+                const next = buildRecipeUpdate(current, data);
                 return { dryRun: true, action: "update", resource: "recipe", name: a[0], current, next, };
             }
             await c.recipes.update(a[0], data, pk);
             return { updated: a[0], resource: "recipe", };
         },
-        description: "Update recipe settings via JSON merge. Recipe definition fields must be nested under a top-level recipe key.",
+        description: "Update recipe settings via JSON merge. Recipe definition fields must be nested under a top-level recipe key. recipe.params.envSelection, when present, replaces the existing envSelection object (include envMode; no stale envName is kept) and is only accepted under recipe.params.",
         examples: [
             "dss recipe update compute_orders --data-file settings.json --dry-run",
-            'dss recipe update compute_orders --data \'{"recipe":{"params":{"envSelection":{"envMode":"EXPLICIT_ENV","envName":"python39"}}}}\'',
+            'dss recipe update compute_orders --data \'{"recipe":{"params":{"envSelection":{"envMode":"EXPLICIT_ENV","envName":"py311_env"}}}}\'',
+            'dss recipe update compute_orders --data \'{"recipe":{"params":{"envSelection":{"envMode":"INHERIT"}}}}\'',
             "cat settings.json | dss recipe update compute_orders --stdin",
         ],
     },
@@ -636,7 +628,7 @@ export const recipeCommands = withUsage("recipe", {
                 projectKey: f["project-key"],
             });
             if (typeof f["output"] === "string") {
-                await writeFile(f["output"], payload, "utf-8");
+                await Bun.write(f["output"], payload);
                 return f["output"];
             }
             return payload;
@@ -663,7 +655,7 @@ export const recipeCommands = withUsage("recipe", {
             const filePath = f["file"];
             if (!filePath)
                 throw new UsageError("--file is required.");
-            const content = readRecipeFile(filePath, "--file");
+            const content = await readRecipeFile(filePath, "--file");
             const pk = f["project-key"];
             const shouldBackup = f["no-backup"] !== true;
             const backupDir = shouldBackup

package/dist/src/cli/commands/scenario.js

@@ -233,11 +233,9 @@ export const scenarioCommands = withUsage("scenario", {
             const outputFile = f["output"]
                 ?? f["output-file"];
             if (outputFile) {
-                const { mkdir, writeFile, } = await import("node:fs/promises");
-                const { dirname, resolve, } = await import("node:path");
+                const { resolve, } = await import("node:path");
                 const outputPath = resolve(outputFile);
-                await mkdir(dirname(outputPath), { recursive: true, });
-                await writeFile(outputPath, result.text, "utf-8");
+                await Bun.write(outputPath, result.text);
                 return { path: outputPath, truncated: result.truncated, };
             }
             return result.text;