dataiku-sdk 3.9.0 → 4.0.0

package/dist/src/resources/projects.js

@@ -188,7 +188,7 @@ export class ProjectsResource extends BaseResource {
                         && settings.targetProjectKey.trim() !== ""
                         ? { targetProjectKey: settings.targetProjectKey, }
                         : {}),
-                });
+                }, { cause: error, });
             }
             throw error;
         }
@@ -246,7 +246,7 @@ export class ProjectsResource extends BaseResource {
         catch (error) {
             if (error instanceof DataikuError
                 && (error.status === 404 || error.status === 0 || error.status >= 500)) {
-                throw new ClientValidationError(`DSS reported import success for project ${usedProjectKey}, but the project could not be re-read for verification.`, "ambiguous_outcome", PROJECT_IMPORT_AMBIGUOUS_REMEDIATION, { importId, usedProjectKey, });
+                throw new ClientValidationError(`DSS reported import success for project ${usedProjectKey}, but the project could not be re-read for verification.`, "ambiguous_outcome", PROJECT_IMPORT_AMBIGUOUS_REMEDIATION, { importId, usedProjectKey, }, { cause: error, });
             }
             throw error;
         }

package/dist/src/resources/recipes.d.ts

@@ -65,6 +65,14 @@ export interface RecipeCloneResult {
     payloadTextRewrites: Record<string, string>;
     copiedOutputDatasets: string[];
 }
+/**
+ * Validate an update patch against the current recipe document and return the
+ * document to PUT. `recipe` is deep-merged, except `recipe.params.envSelection`,
+ * which the patch replaces wholesale so no stale `envName` survives an
+ * EXPLICIT_ENV to INHERIT switch. `envSelection` outside `recipe.params` is
+ * rejected: neither DSS nor the CLI reads it there.
+ */
+export declare function buildRecipeUpdate(current: Record<string, unknown>, data: Record<string, unknown>): Record<string, unknown>;
 export declare class RecipesResource extends BaseResource {
     /** List all recipes in a project. */
     list(projectKey?: string): Promise<RecipeSummary[]>;
@@ -136,7 +144,10 @@ export declare class RecipesResource extends BaseResource {
     }): Promise<RecipeUpdateSchemaResult>;
     /**
      * Update a recipe by merging the patch into the current definition.
-     * The `recipe` sub-object is deep-merged to preserve nested fields.
+     * The `recipe` sub-object is deep-merged to preserve nested fields, except
+     * `recipe.params.envSelection`: when the patch provides it, the whole object
+     * is replaced (not merged), so switching EXPLICIT_ENV to INHERIT cannot leave
+     * a stale `envName` behind. `envSelection` outside `recipe.params` is rejected.
      */
     update(recipeName: string, data: Record<string, unknown>, projectKey?: string): Promise<void>;
     /** Replace a full recipe API document. */

package/dist/src/resources/recipes.js

@@ -1,4 +1,3 @@
-import { writeFile, } from "node:fs/promises";
 import { resolve, } from "node:path";
 import { ClientValidationError, DataikuError, nonJsonResponseBody, unexpectedResponseError, } from "../errors.js";
 import { ProjectMetadataSchema, RecipeSchemaUpdatesSchema, RecipeSummaryArraySchema, } from "../schemas.js";
@@ -40,6 +39,37 @@ const RECIPE_DEFINITION_FIELDS = new Set(["params", "inputs", "outputs", "script
 function rootRecipeDefinitionFields(data) {
     return Object.keys(data).filter((key) => RECIPE_DEFINITION_FIELDS.has(key));
 }
+/**
+ * Validate an update patch against the current recipe document and return the
+ * document to PUT. `recipe` is deep-merged, except `recipe.params.envSelection`,
+ * which the patch replaces wholesale so no stale `envName` survives an
+ * EXPLICIT_ENV to INHERIT switch. `envSelection` outside `recipe.params` is
+ * rejected: neither DSS nor the CLI reads it there.
+ */
+export function buildRecipeUpdate(current, data) {
+    const currentRecipe = asRecord(current.recipe) ?? {};
+    const recipePatch = asRecord(data.recipe) ?? {};
+    const misplacedEnvSelection = [
+        ...("envSelection" in data ? ["envSelection",] : []),
+        ...("envSelection" in recipePatch ? ["recipe.envSelection",] : []),
+    ];
+    if (misplacedEnvSelection.length > 0) {
+        throw new ClientValidationError(`envSelection at ${misplacedEnvSelection.join(" and ")} is ignored; it only applies under recipe.params. Example: {"recipe":{"params":{"envSelection":{"envMode":"EXPLICIT_ENV","envName":"py311_env"}}}}`, "validation_failed");
+    }
+    const misplacedRecipeFields = rootRecipeDefinitionFields(data);
+    if (misplacedRecipeFields.length > 0) {
+        throw new ClientValidationError(`Recipe fields ${misplacedRecipeFields.join(", ")} must be nested under "recipe". Example: {"recipe":{"outputs":{...},"params":{...}}}`, "validation_failed");
+    }
+    const mergedRecipe = deepMerge(currentRecipe, recipePatch);
+    const paramsPatch = asRecord(recipePatch.params);
+    if (paramsPatch && "envSelection" in paramsPatch) {
+        mergedRecipe.params = {
+            ...asRecord(mergedRecipe.params),
+            envSelection: paramsPatch.envSelection,
+        };
+    }
+    return { ...current, ...data, recipe: mergedRecipe, };
+}
 function normalizeRecipeOutputType(value) {
     if (typeof value !== "string")
         return undefined;
@@ -823,22 +853,19 @@ export class RecipesResource extends BaseResource {
     }
     /**
      * Update a recipe by merging the patch into the current definition.
-     * The `recipe` sub-object is deep-merged to preserve nested fields.
+     * The `recipe` sub-object is deep-merged to preserve nested fields, except
+     * `recipe.params.envSelection`: when the patch provides it, the whole object
+     * is replaced (not merged), so switching EXPLICIT_ENV to INHERIT cannot leave
+     * a stale `envName` behind. `envSelection` outside `recipe.params` is rejected.
      */
     async update(recipeName, data, projectKey) {
         const enc = this.enc(projectKey);
         const rnEnc = encodeURIComponent(recipeName);
         const current = await this.client.get(`/public/api/projects/${enc}/recipes/${rnEnc}`);
-        const currentRecipe = asRecord(current.recipe);
-        if (!currentRecipe) {
+        if (!asRecord(current.recipe)) {
             throw new ClientValidationError(`Recipe "${recipeName}" was not found or returned an empty definition.`, "validation_failed");
         }
-        const misplacedRecipeFields = rootRecipeDefinitionFields(data);
-        if (misplacedRecipeFields.length > 0) {
-            throw new ClientValidationError(`Recipe fields ${misplacedRecipeFields.join(", ")} must be nested under "recipe". Example: {"recipe":{"outputs":{...},"params":{...}}}`, "validation_failed");
-        }
-        const mergedRecipe = deepMerge(currentRecipe, asRecord(data.recipe) ?? {});
-        const merged = { ...current, ...data, recipe: mergedRecipe, };
+        const merged = buildRecipeUpdate(current, data);
         await this.client.put(`/public/api/projects/${enc}/recipes/${rnEnc}`, merged);
     }
     /** Replace a full recipe API document. */
@@ -922,7 +949,7 @@ export class RecipesResource extends BaseResource {
         }
         const safeRecipeName = sanitizeFileName(recipeName, "recipe");
         const filePath = opts?.outputPath ?? resolve(process.cwd(), `${safeRecipeName}${inferRecipeCodeExtension(result.recipe.type)}`);
-        await writeFile(filePath, result.payload, "utf-8");
+        await Bun.write(filePath, result.payload);
         return filePath;
     }
     /** Get only the code payload of a recipe as a raw string. */
@@ -965,7 +992,7 @@ export class RecipesResource extends BaseResource {
         const recipe = await this.client.get(`/public/api/projects/${enc}/recipes/${rnEnc}`);
         const safeRecipeName = sanitizeFileName(recipeName, "recipe");
         const filePath = opts?.outputPath ?? resolve(process.cwd(), `${safeRecipeName}.json`);
-        await writeFile(filePath, JSON.stringify(recipe, null, 2), "utf-8");
+        await Bun.write(filePath, JSON.stringify(recipe, null, 2));
         return filePath;
     }
 }

package/dist/src/resources/scenarios.d.ts

@@ -107,6 +107,10 @@ export interface ScenarioScriptRunResult {
     elapsedMs: number;
     pollCount: number;
     output?: string;
+    /** True when the captured script output was cut (wrapper byte budget or log read cap); `output` then holds the last part only. */
+    outputTruncated?: boolean;
+    /** Bytes of script output the wrapper dropped from the front; absent when the cut happened in the log read instead. */
+    outputOmittedBytes?: number;
     log: string;
     logTruncated: boolean;
     maxLogBytes: number;
@@ -186,12 +190,15 @@ export declare class ScenariosResource extends BaseResource {
      * Get the log of a scenario run (GET /scenarios/{id}/{runId}/log), optionally
      * scoped to a single step via `stepId`. The text is byte-bounded: at most
      * `maxLogBytes` (default 1 MiB) of the beginning of the log is retained and
-     * `truncated` reports whether the cap cut the body.
+     * `truncated` reports whether the cap cut the body. With `tail: true` the
+     * last `maxLogBytes` are retained instead (used by code runs, whose output
+     * markers sit at the end of the log).
      */
     getRunLog(scenarioId: string, runId: string, opts?: {
         stepId?: string;
         maxLogBytes?: number;
         projectKey?: string;
+        tail?: boolean;
     }): Promise<ScenarioRunLog>;
     /** Get the payload of a (custom) scenario (GET /scenarios/{id}/payload). */
     getPayload(scenarioId: string, opts?: {

package/dist/src/resources/scenarios.js

@@ -32,6 +32,14 @@ export class ScenarioScriptRunWithCleanupFailureError extends Error {
 const DEFAULT_CODE_RUN_MAX_LOG_BYTES = 1_048_576;
 const CODE_RUN_OUTPUT_START = "<<<DSS_CODE_RUN_OUTPUT_b7e3a1>>>";
 const CODE_RUN_OUTPUT_END = "<<<DSS_CODE_RUN_OUTPUT_END_b7e3a1>>>";
+/** Written right after the END marker when the wrapper cut the captured output; carries the omitted byte count. */
+const CODE_RUN_OUTPUT_TRUNCATED_RE = /^<<<DSS_CODE_RUN_OUTPUT_TRUNCATED_b7e3a1:(\d+)>>>$/;
+/**
+ * The wrapper keeps at most `maxLogBytes / CODE_RUN_OUTPUT_BUDGET_DIVISOR` bytes
+ * of script output. The remainder of the read cap is headroom for the per-line
+ * DSS log prefix, so the markers still fit in what `runScript` reads back.
+ */
+const CODE_RUN_OUTPUT_BUDGET_DIVISOR = 4;
 /** Prefer the current runId field, with the legacy id field as fallback. */
 function triggerRunIdOf(trigger, scenarioId) {
     const runId = trigger?.runId ?? trigger?.id;
@@ -80,8 +88,10 @@ function scenarioLightStatusFromRaw(raw) {
  * wrapper noise. The script is base64-encoded to avoid quoting/escaping issues and
  * exec'd as `__main__`. A failing script re-raises SystemExit(1) so the scenario
  * outcome is FAILED while the captured traceback still lands between the markers.
+ * Only the last `maxOutputBytes` UTF-8 bytes of output are re-emitted; when output
+ * was cut, a truncation marker with the omitted byte count follows the END marker.
  */
-function buildCodeRunScript(script) {
+function buildCodeRunScript(script, maxOutputBytes) {
     const encoded = Buffer.from(script, "utf-8").toString("base64");
     return [
         "import base64 as _dku_b64, sys as _dku_sys, io as _dku_io, traceback as _dku_tb",
@@ -99,9 +109,14 @@ function buildCodeRunScript(script) {
         "\t_dku_tb.print_exc()",
         "finally:",
         "\t_dku_sys.stdout, _dku_sys.stderr = _dku_out, _dku_err",
+        '\t_dku_bytes = _dku_buf.getvalue().encode("utf-8", "replace")',
+        `\t_dku_omitted = max(0, len(_dku_bytes) - ${maxOutputBytes})`,
+        '\t_dku_text = _dku_bytes[_dku_omitted:].decode("utf-8", "ignore")',
         `\t_dku_out.write("${CODE_RUN_OUTPUT_START}\\n")`,
-        "\t_dku_out.write(_dku_buf.getvalue())",
+        "\t_dku_out.write(_dku_text)",
         `\t_dku_out.write("\\n${CODE_RUN_OUTPUT_END}\\n")`,
+        "\tif _dku_omitted:",
+        '\t\t_dku_out.write("<<<DSS_CODE_RUN_OUTPUT_TRUNCATED_b7e3a1:%d>>>\\n" % _dku_omitted)',
         "\t_dku_out.flush()",
         "if _dku_code:",
         "\traise SystemExit(_dku_code)",
@@ -112,10 +127,13 @@ function buildCodeRunScript(script) {
  * Pull the script's own stdout/stderr back out of the full DSS run log by slicing
  * the `[process]` lines between the markers emitted by {@link buildCodeRunScript}.
  * Returns undefined if the markers are absent (e.g. the harness never ran), in which
- * case callers should fall back to the full log.
+ * case callers should fall back to the full log. When the log read itself was cut
+ * (`logTruncated`) the START marker may be gone while END survives; the output is
+ * then whatever precedes END, reported as truncated.
  */
-function extractCodeRunOutput(log) {
-    const messageRe = /^\[[^\]]*\] \[[^\]]*\] \[[^\]]*\] \[process\]  - (.*)$/;
+function extractCodeRunOutput(log, logTruncated) {
+    // `[\s\S]` (not `.`): CR, U+2028 and U+2029 inside a printed line must not drop it.
+    const messageRe = /^\[[^\]]*\] \[[^\]]*\] \[[^\]]*\] \[process\]  - ([\s\S]*)$/;
     const contents = [];
     for (const rawLine of log.split("\n")) {
         const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
@@ -125,7 +143,7 @@ function extractCodeRunOutput(log) {
     }
     // First start + last end, so a script that prints a marker string stays body content.
     const start = contents.indexOf(CODE_RUN_OUTPUT_START);
-    if (start < 0)
+    if (start < 0 && !logTruncated)
         return undefined;
     let end = -1;
     for (let i = contents.length - 1; i > start; i--) {
@@ -140,7 +158,13 @@ function extractCodeRunOutput(log) {
     // Drop only the single trailing separator the harness writes before the end marker.
     if (body.length > 0 && body[body.length - 1] === "")
         body.pop();
-    return body.join("\n");
+    const omitted = CODE_RUN_OUTPUT_TRUNCATED_RE.exec(contents[end + 1] ?? "");
+    const omittedBytes = omitted ? Number(omitted[1]) : undefined;
+    return {
+        output: body.join("\n"),
+        truncated: omitted !== null || start < 0,
+        ...(omittedBytes !== undefined ? { omittedBytes, } : {}),
+    };
 }
 function scenarioStepWarningSummary(stepResult) {
     const container = stepResult?.warnings;
@@ -441,7 +465,10 @@ export class ScenariosResource extends BaseResource {
                 type: "custom_python",
                 params: { envSelection, },
             });
-            await this.client.putVoid(`${base}/payload`, { script: buildCodeRunScript(script), extension: "py", });
+            await this.client.putVoid(`${base}/payload`, {
+                script: buildCodeRunScript(script, Math.floor(maxLogBytes / CODE_RUN_OUTPUT_BUDGET_DIVISOR)),
+                extension: "py",
+            });
             const trigger = await this.client.post(`${base}/run/`, {});
             const tracked = await this.trackTriggerRun(scenarioId, base, trigger, {
                 startedAt,
@@ -454,9 +481,12 @@ export class ScenariosResource extends BaseResource {
             pollCount = tracked.pollCount;
             timedOut = tracked.timedOut;
             if (runId && outcome !== "TIMEOUT") {
+                // Tail read: the markers are printed last, so a log over the cap loses
+                // DSS start-up noise instead of the END marker.
                 const limitedLog = await this.getRunLog(scenarioId, runId, {
                     projectKey: opts?.projectKey,
                     maxLogBytes,
+                    tail: true,
                 });
                 log = limitedLog.text;
                 logTruncated = limitedLog.truncated;
@@ -475,7 +505,7 @@ export class ScenariosResource extends BaseResource {
             }
             throw primaryError;
         }
-        const output = extractCodeRunOutput(log);
+        const extracted = extractCodeRunOutput(log, logTruncated);
         return {
             scenarioId,
             runId,
@@ -483,7 +513,11 @@ export class ScenariosResource extends BaseResource {
             success: outcome === "SUCCESS",
             elapsedMs: Date.now() - startedAt,
             pollCount,
-            output,
+            output: extracted?.output,
+            ...(extracted?.truncated ? { outputTruncated: true, } : {}),
+            ...(extracted?.omittedBytes !== undefined
+                ? { outputOmittedBytes: extracted.omittedBytes, }
+                : {}),
             log,
             logTruncated,
             maxLogBytes,
@@ -519,7 +553,9 @@ export class ScenariosResource extends BaseResource {
      * Get the log of a scenario run (GET /scenarios/{id}/{runId}/log), optionally
      * scoped to a single step via `stepId`. The text is byte-bounded: at most
      * `maxLogBytes` (default 1 MiB) of the beginning of the log is retained and
-     * `truncated` reports whether the cap cut the body.
+     * `truncated` reports whether the cap cut the body. With `tail: true` the
+     * last `maxLogBytes` are retained instead (used by code runs, whose output
+     * markers sit at the end of the log).
      */
     async getRunLog(scenarioId, runId, opts) {
         if (opts?.stepId !== undefined)
@@ -529,7 +565,10 @@ export class ScenariosResource extends BaseResource {
         const query = opts?.stepId !== undefined
             ? `?stepId=${encodeURIComponent(opts.stepId)}`
             : "";
-        const { text, truncated, } = await this.client.getTextLimited(`/public/api/projects/${this.enc(opts?.projectKey)}/scenarios/${scEnc}/${encodeURIComponent(runId)}/log${query}`, maxLogBytes);
+        const readText = opts?.tail === true
+            ? this.client.getTextTailLimited.bind(this.client)
+            : this.client.getTextLimited.bind(this.client);
+        const { text, truncated, } = await readText(`/public/api/projects/${this.enc(opts?.projectKey)}/scenarios/${scEnc}/${encodeURIComponent(runId)}/log${query}`, maxLogBytes);
         return { text, truncated, maxLogBytes, };
     }
     /** Get the payload of a (custom) scenario (GET /scenarios/{id}/payload). */

package/dist/src/resources/wiki.js

@@ -1,4 +1,4 @@
-import fs from "node:fs";
+import { stat as statFile, } from "node:fs/promises";
 import path from "node:path";
 import { ClientValidationError, } from "../errors.js";
 import { WikiArticleDataArraySchema, WikiArticleDataSchema, WikiSettingsSchema, } from "../schemas.js";
@@ -19,13 +19,9 @@ export function wikiAttachmentNotFound(data, smartId) {
 }
 /** Check that a local path is a readable regular file before any DSS call. */
 export async function statWikiAttachmentFile(localPath) {
-    let stat;
-    try {
-        stat = await fs.promises.stat(localPath);
-    }
-    catch (error) {
+    const stat = await statFile(localPath).catch((error) => {
         throw new ClientValidationError(`Could not read attachment file ${localPath}: ${error instanceof Error ? error.message : String(error)}.`, "not_found", "Verify the file path and that it is readable.");
-    }
+    });
     if (!stat.isFile()) {
         throw new ClientValidationError(`${localPath} is not a regular file.`);
     }

package/dist/src/skill.js

@@ -1,7 +1,6 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { fileURLToPath, } from "node:url";
 import { ClientValidationError, } from "./errors.js";
 import { sha256Hex, } from "./utils/stable-hash.js";
 const SKILL_URLS = [
@@ -114,7 +113,7 @@ function skillState(target, expectedSha256) {
 }
 /** Load the packaged tree, keeping portable relative paths in the report. */
 function skillFiles() {
-    const root = fileURLToPath(skillDirectory());
+    const root = Bun.fileURLToPath(skillDirectory());
     const files = new Map();
     function visit(relativeDir) {
         const dir = path.join(root, relativeDir);

package/dist/src/utils/project-archive.d.ts

@@ -35,6 +35,25 @@ export interface ProjectArchiveIssue {
     message: string;
     member?: string;
 }
+/**
+ * One credential-bearing structure found in an archive member. Carries the
+ * member path and the JSON key path / field name only, never the value.
+ * - `member_name`: the member itself is a credential store (for example
+ *   `project_config/apikeys.json`) and is not empty.
+ * - `json_key`: a credential-named JSON key holds a non-empty string value
+ *   (or a container of them), e.g. `$.standard.DHL_API_KEY` or a nested
+ *   web-app `apiKey`.
+ * - `list_variable`: a list-form `{name, value}` entry whose `name` is
+ *   credential-named, e.g. `{name: "X_API_KEY", value: "..."}`.
+ */
+export interface ProjectArchiveCredentialFinding {
+    member: string;
+    rule: "member_name" | "json_key" | "list_variable";
+    /** JSON path of the credential value inside the member (absent for `member_name`). */
+    keyPath?: string;
+    /** Credential-named key or list-form variable name (absent for `member_name`). */
+    field?: string;
+}
 export interface ProjectArchiveInspection {
     filePath: string;
     sizeBytes: number;
@@ -42,6 +61,12 @@ export interface ProjectArchiveInspection {
     sourceProjectKey?: string;
     valid: boolean;
     issues: ProjectArchiveIssue[];
+    /**
+     * Credential inventory: member paths and key paths/field names of
+     * credential-bearing structures. Values are never included. Each finding
+     * is also summarized by a `credential_structure` warning issue.
+     */
+    credentialFindings: ProjectArchiveCredentialFinding[];
 }
 /**
  * Inspect a DSS project export ZIP archive without extracting anything to