dataiku-sdk 3.9.0 → 4.1.0

package/dist/src/resources/jobs.js

@@ -66,6 +66,12 @@ function jobBuildDefinition(targets, defaultProjectKey, opts) {
 function jobLogLines(log) {
     return log.split(/\r?\n/).map((line) => line.trimEnd());
 }
+function countLogLines(log) {
+    if (!log)
+        return 0;
+    const lines = jobLogLines(log);
+    return lines[lines.length - 1] === "" ? lines.length - 1 : lines.length;
+}
 /**
  * DSS tags recipe subprocess output by reader thread: `[null-out-N]` carries
  * the child's stdout and `[null-err-N]` its stderr. The legacy fallback is an
@@ -81,6 +87,13 @@ const LEGACY_STDERR_RECORD = /^\s*stderr:/i;
  * continuation of that record (exception chain, JVM frames, ...).
  */
 const DSS_RECORD_HEADER = /^\[\d{4}\/\d{2}\/\d{2}-\d{2}:\d{2}:\d{2}\.\d{3}\]/;
+/**
+ * Job-level outcome line the job engine writes outside any record, e.g.
+ * `2026-10-12T09:13:22.189: Job is incompatible with build state: [...]` when
+ * another running job already builds the target. It carries no level word but
+ * is the only reason DSS gives for such a failure.
+ */
+const JOB_OUTCOME_LINE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}: \S/;
 const ERROR_KEYWORDS = /\b(error|failed|failure|exception|traceback)\b/i;
 /**
  * Exception class names ending in the `Exception`/`Error` suffix (e.g.
@@ -149,7 +162,7 @@ function lineMatchesLogFilter(line, filter) {
         case "stderr":
             return normalized.includes("[null-err-") || LEGACY_STDERR_RECORD.test(line);
         case "errors":
-            return isErrorContent(line);
+            return isErrorContent(line) || JOB_OUTCOME_LINE.test(line);
         case "user":
             return !/^\d{4}[-/]\d{2}[-/]\d{2}/.test(line)
                 && !normalized.includes("backend-log")
@@ -195,6 +208,11 @@ function filterJobLogToErrors(lines) {
             }
             pyTraceback = false;
         }
+        if (JOB_OUTCOME_LINE.test(line)) {
+            kept.push(line);
+            recordMatches = false;
+            continue;
+        }
         if (isHeader) {
             recordMatches = isErrorContent(stripJsonPayloads(line)) || PY_FILE_FRAME.test(message);
             if (recordMatches && (PY_TRACEBACK_HEAD.test(message) || PY_FILE_FRAME.test(message))) {
@@ -322,22 +340,39 @@ export class JobsResource extends BaseResource {
      * Use `0` or `-1` to return the log without line truncation. Credential-like
      * JSON pairs (`"jobTicketSecret":"..."`) are redacted.
      *
-     * The download is byte-bounded and deadline-covered: at most `maxLogBytes`
-     * (default 10 MiB) of the *most recent* log output is retained, so a
-     * collaborator-influenced oversized log cannot exhaust client memory while
-     * the line limit previously only applied after a full unbounded download.
-     * Logs up to the cap are returned in full.
+     * The download is byte-bounded: at most `maxLogBytes` (default 10 MiB) of
+     * the *most recent* log output is retained, so a collaborator-influenced
+     * oversized log cannot exhaust client memory while the line limit
+     * previously only applied after a full unbounded download. The request
+     * timeout is a stall deadline (per received chunk), so a large log that
+     * keeps arriving is not cut off by a total-transfer budget. Logs up to the
+     * cap are returned in full. Use {@link logDetails} to learn whether bytes
+     * were dropped.
      */
     async log(jobId, opts) {
+        return (await this.logDetails(jobId, opts)).text;
+    }
+    /**
+     * Same retrieval as {@link log}, additionally reporting whether the
+     * byte-bounded download dropped early log bytes (`truncated`) and how many
+     * lines were scanned before filtering (`scannedLines`).
+     */
+    async logDetails(jobId, opts) {
         const jobEnc = encodeURIComponent(jobId);
         const query = opts?.activity ? `?activity=${encodeURIComponent(opts.activity)}` : "";
         // DSS cat-activity-log URLs require a browser session; API-key callers must use the public log endpoint.
         const path = `/public/api/projects/${this.enc(opts?.projectKey)}/jobs/${jobEnc}/log/${query}`;
         const maxLogBytes = Math.max(1, opts?.maxLogBytes ?? DEFAULT_MAX_LOG_BYTES);
-        const { text, } = await this.client.getTextTailLimited(path, maxLogBytes);
+        const { text, truncated, } = await this.client.getTextTailLimited(path, maxLogBytes);
         // Single download choke point (logFromUrl and wait/summary go through here):
         // DSS logs embed the job ticket secret in start_session JSON.
-        return limitJobLog(filterJobLog(redactCredentialPairs(text), opts?.logFilter), opts?.maxLogLines);
+        const redacted = redactCredentialPairs(text);
+        return {
+            text: limitJobLog(filterJobLog(redacted, opts?.logFilter), opts?.maxLogLines),
+            truncated,
+            scannedLines: countLogLines(redacted),
+            maxLogBytes,
+        };
     }
     async logFromUrl(logUrl, opts) {
         const parsed = new URL(logUrl, "http://dss.local");
@@ -438,6 +473,28 @@ export class JobsResource extends BaseResource {
         const startedAt = Date.now();
         let pollCount = 0;
         let lastJ;
+        // The wait only stops polling: the job keeps running in DSS and is never
+        // cancelled, so the result says so explicitly.
+        const timedOutResult = (last, elapsedMs) => {
+            const bs = last?.baseStatus ?? {};
+            const gs = last?.globalState ?? {};
+            return {
+                success: false,
+                jobId,
+                state: bs.state ?? "unknown",
+                type: bs.def?.type ?? "unknown",
+                elapsedMs,
+                pollCount,
+                timedOut: true,
+                cancelled: false,
+                progress: {
+                    done: gs.done ?? 0,
+                    failed: gs.failed ?? 0,
+                    running: gs.running ?? 0,
+                    total: gs.total ?? null,
+                },
+            };
+        };
         while (true) {
             const elapsedBeforeMs = Date.now() - startedAt;
             // The first observation always happens, even when the budget is
@@ -445,24 +502,7 @@ export class JobsResource extends BaseResource {
             // the loop reports the structured timeout from the last observed
             // state instead of issuing a request the budget cannot cover.
             if (lastJ !== undefined && elapsedBeforeMs >= timeout) {
-                const bs = lastJ.baseStatus ?? {};
-                const def = bs.def ?? {};
-                const gs = lastJ.globalState ?? {};
-                return {
-                    success: false,
-                    jobId,
-                    state: bs.state ?? "unknown",
-                    type: def.type ?? "unknown",
-                    elapsedMs: elapsedBeforeMs,
-                    pollCount,
-                    timedOut: true,
-                    progress: {
-                        done: gs.done ?? 0,
-                        failed: gs.failed ?? 0,
-                        running: gs.running ?? 0,
-                        total: gs.total ?? null,
-                    },
-                };
+                return timedOutResult(lastJ, elapsedBeforeMs);
             }
             pollCount += 1;
             // Requests issued while budget remains are bounded by the remaining
@@ -482,21 +522,8 @@ export class JobsResource extends BaseResource {
                 // error escape the loop.
                 if (!isRequestDeadlineError(error, startedAt + timeout))
                     throw error;
-                return {
-                    success: false,
-                    jobId,
-                    state: "unknown",
-                    type: "unknown",
-                    elapsedMs: Date.now() - startedAt,
-                    pollCount,
-                    timedOut: true,
-                    progress: {
-                        done: 0,
-                        failed: 0,
-                        running: 0,
-                        total: null,
-                    },
-                };
+                // A deadline mid-poll keeps the last state a previous poll observed.
+                return timedOutResult(lastJ, Date.now() - startedAt);
             }
             lastJ = j;
             const bs = j.baseStatus ?? {};

package/dist/src/resources/projects.js

@@ -188,7 +188,7 @@ export class ProjectsResource extends BaseResource {
                         && settings.targetProjectKey.trim() !== ""
                         ? { targetProjectKey: settings.targetProjectKey, }
                         : {}),
-                });
+                }, { cause: error, });
             }
             throw error;
         }
@@ -246,7 +246,7 @@ export class ProjectsResource extends BaseResource {
         catch (error) {
             if (error instanceof DataikuError
                 && (error.status === 404 || error.status === 0 || error.status >= 500)) {
-                throw new ClientValidationError(`DSS reported import success for project ${usedProjectKey}, but the project could not be re-read for verification.`, "ambiguous_outcome", PROJECT_IMPORT_AMBIGUOUS_REMEDIATION, { importId, usedProjectKey, });
+                throw new ClientValidationError(`DSS reported import success for project ${usedProjectKey}, but the project could not be re-read for verification.`, "ambiguous_outcome", PROJECT_IMPORT_AMBIGUOUS_REMEDIATION, { importId, usedProjectKey, }, { cause: error, });
             }
             throw error;
         }

package/dist/src/resources/recipe-create.d.ts

@@ -30,7 +30,10 @@ export declare function groupingPayloadConfig(opts: RecipeCreateOptions): Groupi
 /**
  * Apply grouping keys and aggregates to the payload DSS created: `keys` lists
  * the group columns; each aggregated column's `values[]` entry gets its
- * aggregate flags (and `orderColumn` for first/last).
+ * aggregate flags (and `orderColumn` for first/last). With aggregates given,
+ * DSS's per-group row count (`globalCount`, a `count` column) is turned off so
+ * the output holds exactly the keys and the requested aggregates; `COL:count`
+ * asks for a count. Keys alone keep the count as the only aggregate.
  */
 export declare function applyGroupingPayload(payload: Record<string, unknown>, config: GroupingPayloadConfig): Record<string, unknown>;
 /** Prepare option groups, in the default step order. */

package/dist/src/resources/recipe-create.js

@@ -164,7 +164,10 @@ export function groupingPayloadConfig(opts) {
 /**
  * Apply grouping keys and aggregates to the payload DSS created: `keys` lists
  * the group columns; each aggregated column's `values[]` entry gets its
- * aggregate flags (and `orderColumn` for first/last).
+ * aggregate flags (and `orderColumn` for first/last). With aggregates given,
+ * DSS's per-group row count (`globalCount`, a `count` column) is turned off so
+ * the output holds exactly the keys and the requested aggregates; `COL:count`
+ * asks for a count. Keys alone keep the count as the only aggregate.
  */
 export function applyGroupingPayload(payload, config) {
     const values = Array.isArray(payload.values)
@@ -182,7 +185,13 @@ export function applyGroupingPayload(payload, config) {
             entry.orderColumn = config.orderBy;
         }
     }
-    return { ...payload, keys: config.keys.map((column) => ({ column, })), values, };
+    const hasAggregates = Object.keys(config.aggregates).length > 0;
+    return {
+        ...payload,
+        keys: config.keys.map((column) => ({ column, })),
+        values,
+        ...(hasAggregates ? { globalCount: false, } : {}),
+    };
 }
 function processorStep(type, params) {
     return {

package/dist/src/resources/recipes.d.ts

@@ -65,6 +65,14 @@ export interface RecipeCloneResult {
     payloadTextRewrites: Record<string, string>;
     copiedOutputDatasets: string[];
 }
+/**
+ * Validate an update patch against the current recipe document and return the
+ * document to PUT. `recipe` is deep-merged, except `recipe.params.envSelection`,
+ * which the patch replaces wholesale so no stale `envName` survives an
+ * EXPLICIT_ENV to INHERIT switch. `envSelection` outside `recipe.params` is
+ * rejected: neither DSS nor the CLI reads it there.
+ */
+export declare function buildRecipeUpdate(current: Record<string, unknown>, data: Record<string, unknown>): Record<string, unknown>;
 export declare class RecipesResource extends BaseResource {
     /** List all recipes in a project. */
     list(projectKey?: string): Promise<RecipeSummary[]>;
@@ -136,7 +144,10 @@ export declare class RecipesResource extends BaseResource {
     }): Promise<RecipeUpdateSchemaResult>;
     /**
      * Update a recipe by merging the patch into the current definition.
-     * The `recipe` sub-object is deep-merged to preserve nested fields.
+     * The `recipe` sub-object is deep-merged to preserve nested fields, except
+     * `recipe.params.envSelection`: when the patch provides it, the whole object
+     * is replaced (not merged), so switching EXPLICIT_ENV to INHERIT cannot leave
+     * a stale `envName` behind. `envSelection` outside `recipe.params` is rejected.
      */
     update(recipeName: string, data: Record<string, unknown>, projectKey?: string): Promise<void>;
     /** Replace a full recipe API document. */

package/dist/src/resources/recipes.js

@@ -1,4 +1,3 @@
-import { writeFile, } from "node:fs/promises";
 import { resolve, } from "node:path";
 import { ClientValidationError, DataikuError, nonJsonResponseBody, unexpectedResponseError, } from "../errors.js";
 import { ProjectMetadataSchema, RecipeSchemaUpdatesSchema, RecipeSummaryArraySchema, } from "../schemas.js";
@@ -40,6 +39,37 @@ const RECIPE_DEFINITION_FIELDS = new Set(["params", "inputs", "outputs", "script
 function rootRecipeDefinitionFields(data) {
     return Object.keys(data).filter((key) => RECIPE_DEFINITION_FIELDS.has(key));
 }
+/**
+ * Validate an update patch against the current recipe document and return the
+ * document to PUT. `recipe` is deep-merged, except `recipe.params.envSelection`,
+ * which the patch replaces wholesale so no stale `envName` survives an
+ * EXPLICIT_ENV to INHERIT switch. `envSelection` outside `recipe.params` is
+ * rejected: neither DSS nor the CLI reads it there.
+ */
+export function buildRecipeUpdate(current, data) {
+    const currentRecipe = asRecord(current.recipe) ?? {};
+    const recipePatch = asRecord(data.recipe) ?? {};
+    const misplacedEnvSelection = [
+        ...("envSelection" in data ? ["envSelection",] : []),
+        ...("envSelection" in recipePatch ? ["recipe.envSelection",] : []),
+    ];
+    if (misplacedEnvSelection.length > 0) {
+        throw new ClientValidationError(`envSelection at ${misplacedEnvSelection.join(" and ")} is ignored; it only applies under recipe.params. Example: {"recipe":{"params":{"envSelection":{"envMode":"EXPLICIT_ENV","envName":"py311_env"}}}}`, "validation_failed");
+    }
+    const misplacedRecipeFields = rootRecipeDefinitionFields(data);
+    if (misplacedRecipeFields.length > 0) {
+        throw new ClientValidationError(`Recipe fields ${misplacedRecipeFields.join(", ")} must be nested under "recipe". Example: {"recipe":{"outputs":{...},"params":{...}}}`, "validation_failed");
+    }
+    const mergedRecipe = deepMerge(currentRecipe, recipePatch);
+    const paramsPatch = asRecord(recipePatch.params);
+    if (paramsPatch && "envSelection" in paramsPatch) {
+        mergedRecipe.params = {
+            ...asRecord(mergedRecipe.params),
+            envSelection: paramsPatch.envSelection,
+        };
+    }
+    return { ...current, ...data, recipe: mergedRecipe, };
+}
 function normalizeRecipeOutputType(value) {
     if (typeof value !== "string")
         return undefined;
@@ -823,22 +853,19 @@ export class RecipesResource extends BaseResource {
     }
     /**
      * Update a recipe by merging the patch into the current definition.
-     * The `recipe` sub-object is deep-merged to preserve nested fields.
+     * The `recipe` sub-object is deep-merged to preserve nested fields, except
+     * `recipe.params.envSelection`: when the patch provides it, the whole object
+     * is replaced (not merged), so switching EXPLICIT_ENV to INHERIT cannot leave
+     * a stale `envName` behind. `envSelection` outside `recipe.params` is rejected.
      */
     async update(recipeName, data, projectKey) {
         const enc = this.enc(projectKey);
         const rnEnc = encodeURIComponent(recipeName);
         const current = await this.client.get(`/public/api/projects/${enc}/recipes/${rnEnc}`);
-        const currentRecipe = asRecord(current.recipe);
-        if (!currentRecipe) {
+        if (!asRecord(current.recipe)) {
             throw new ClientValidationError(`Recipe "${recipeName}" was not found or returned an empty definition.`, "validation_failed");
         }
-        const misplacedRecipeFields = rootRecipeDefinitionFields(data);
-        if (misplacedRecipeFields.length > 0) {
-            throw new ClientValidationError(`Recipe fields ${misplacedRecipeFields.join(", ")} must be nested under "recipe". Example: {"recipe":{"outputs":{...},"params":{...}}}`, "validation_failed");
-        }
-        const mergedRecipe = deepMerge(currentRecipe, asRecord(data.recipe) ?? {});
-        const merged = { ...current, ...data, recipe: mergedRecipe, };
+        const merged = buildRecipeUpdate(current, data);
         await this.client.put(`/public/api/projects/${enc}/recipes/${rnEnc}`, merged);
     }
     /** Replace a full recipe API document. */
@@ -922,7 +949,7 @@ export class RecipesResource extends BaseResource {
         }
         const safeRecipeName = sanitizeFileName(recipeName, "recipe");
         const filePath = opts?.outputPath ?? resolve(process.cwd(), `${safeRecipeName}${inferRecipeCodeExtension(result.recipe.type)}`);
-        await writeFile(filePath, result.payload, "utf-8");
+        await Bun.write(filePath, result.payload);
         return filePath;
     }
     /** Get only the code payload of a recipe as a raw string. */
@@ -965,7 +992,7 @@ export class RecipesResource extends BaseResource {
         const recipe = await this.client.get(`/public/api/projects/${enc}/recipes/${rnEnc}`);
         const safeRecipeName = sanitizeFileName(recipeName, "recipe");
         const filePath = opts?.outputPath ?? resolve(process.cwd(), `${safeRecipeName}.json`);
-        await writeFile(filePath, JSON.stringify(recipe, null, 2), "utf-8");
+        await Bun.write(filePath, JSON.stringify(recipe, null, 2));
         return filePath;
     }
 }

package/dist/src/resources/scenarios.d.ts

@@ -107,6 +107,10 @@ export interface ScenarioScriptRunResult {
     elapsedMs: number;
     pollCount: number;
     output?: string;
+    /** True when the captured script output was cut (wrapper byte budget or log read cap); `output` then holds the last part only. */
+    outputTruncated?: boolean;
+    /** Bytes of script output the wrapper dropped from the front; absent when the cut happened in the log read instead. */
+    outputOmittedBytes?: number;
     log: string;
     logTruncated: boolean;
     maxLogBytes: number;
@@ -186,12 +190,15 @@ export declare class ScenariosResource extends BaseResource {
      * Get the log of a scenario run (GET /scenarios/{id}/{runId}/log), optionally
      * scoped to a single step via `stepId`. The text is byte-bounded: at most
      * `maxLogBytes` (default 1 MiB) of the beginning of the log is retained and
-     * `truncated` reports whether the cap cut the body.
+     * `truncated` reports whether the cap cut the body. With `tail: true` the
+     * last `maxLogBytes` are retained instead (used by code runs, whose output
+     * markers sit at the end of the log).
      */
     getRunLog(scenarioId: string, runId: string, opts?: {
         stepId?: string;
         maxLogBytes?: number;
         projectKey?: string;
+        tail?: boolean;
     }): Promise<ScenarioRunLog>;
     /** Get the payload of a (custom) scenario (GET /scenarios/{id}/payload). */
     getPayload(scenarioId: string, opts?: {

package/dist/src/resources/scenarios.js

@@ -32,6 +32,14 @@ export class ScenarioScriptRunWithCleanupFailureError extends Error {
 const DEFAULT_CODE_RUN_MAX_LOG_BYTES = 1_048_576;
 const CODE_RUN_OUTPUT_START = "<<<DSS_CODE_RUN_OUTPUT_b7e3a1>>>";
 const CODE_RUN_OUTPUT_END = "<<<DSS_CODE_RUN_OUTPUT_END_b7e3a1>>>";
+/** Written right after the END marker when the wrapper cut the captured output; carries the omitted byte count. */
+const CODE_RUN_OUTPUT_TRUNCATED_RE = /^<<<DSS_CODE_RUN_OUTPUT_TRUNCATED_b7e3a1:(\d+)>>>$/;
+/**
+ * The wrapper keeps at most `maxLogBytes / CODE_RUN_OUTPUT_BUDGET_DIVISOR` bytes
+ * of script output. The remainder of the read cap is headroom for the per-line
+ * DSS log prefix, so the markers still fit in what `runScript` reads back.
+ */
+const CODE_RUN_OUTPUT_BUDGET_DIVISOR = 4;
 /** Prefer the current runId field, with the legacy id field as fallback. */
 function triggerRunIdOf(trigger, scenarioId) {
     const runId = trigger?.runId ?? trigger?.id;
@@ -80,8 +88,10 @@ function scenarioLightStatusFromRaw(raw) {
  * wrapper noise. The script is base64-encoded to avoid quoting/escaping issues and
  * exec'd as `__main__`. A failing script re-raises SystemExit(1) so the scenario
  * outcome is FAILED while the captured traceback still lands between the markers.
+ * Only the last `maxOutputBytes` UTF-8 bytes of output are re-emitted; when output
+ * was cut, a truncation marker with the omitted byte count follows the END marker.
  */
-function buildCodeRunScript(script) {
+function buildCodeRunScript(script, maxOutputBytes) {
     const encoded = Buffer.from(script, "utf-8").toString("base64");
     return [
         "import base64 as _dku_b64, sys as _dku_sys, io as _dku_io, traceback as _dku_tb",
@@ -99,9 +109,14 @@ function buildCodeRunScript(script) {
         "\t_dku_tb.print_exc()",
         "finally:",
         "\t_dku_sys.stdout, _dku_sys.stderr = _dku_out, _dku_err",
+        '\t_dku_bytes = _dku_buf.getvalue().encode("utf-8", "replace")',
+        `\t_dku_omitted = max(0, len(_dku_bytes) - ${maxOutputBytes})`,
+        '\t_dku_text = _dku_bytes[_dku_omitted:].decode("utf-8", "ignore")',
         `\t_dku_out.write("${CODE_RUN_OUTPUT_START}\\n")`,
-        "\t_dku_out.write(_dku_buf.getvalue())",
+        "\t_dku_out.write(_dku_text)",
         `\t_dku_out.write("\\n${CODE_RUN_OUTPUT_END}\\n")`,
+        "\tif _dku_omitted:",
+        '\t\t_dku_out.write("<<<DSS_CODE_RUN_OUTPUT_TRUNCATED_b7e3a1:%d>>>\\n" % _dku_omitted)',
         "\t_dku_out.flush()",
         "if _dku_code:",
         "\traise SystemExit(_dku_code)",
@@ -112,10 +127,13 @@ function buildCodeRunScript(script) {
  * Pull the script's own stdout/stderr back out of the full DSS run log by slicing
  * the `[process]` lines between the markers emitted by {@link buildCodeRunScript}.
  * Returns undefined if the markers are absent (e.g. the harness never ran), in which
- * case callers should fall back to the full log.
+ * case callers should fall back to the full log. When the log read itself was cut
+ * (`logTruncated`) the START marker may be gone while END survives; the output is
+ * then whatever precedes END, reported as truncated.
  */
-function extractCodeRunOutput(log) {
-    const messageRe = /^\[[^\]]*\] \[[^\]]*\] \[[^\]]*\] \[process\]  - (.*)$/;
+function extractCodeRunOutput(log, logTruncated) {
+    // `[\s\S]` (not `.`): CR, U+2028 and U+2029 inside a printed line must not drop it.
+    const messageRe = /^\[[^\]]*\] \[[^\]]*\] \[[^\]]*\] \[process\]  - ([\s\S]*)$/;
     const contents = [];
     for (const rawLine of log.split("\n")) {
         const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
@@ -125,7 +143,7 @@ function extractCodeRunOutput(log) {
     }
     // First start + last end, so a script that prints a marker string stays body content.
     const start = contents.indexOf(CODE_RUN_OUTPUT_START);
-    if (start < 0)
+    if (start < 0 && !logTruncated)
         return undefined;
     let end = -1;
     for (let i = contents.length - 1; i > start; i--) {
@@ -140,7 +158,13 @@ function extractCodeRunOutput(log) {
     // Drop only the single trailing separator the harness writes before the end marker.
     if (body.length > 0 && body[body.length - 1] === "")
         body.pop();
-    return body.join("\n");
+    const omitted = CODE_RUN_OUTPUT_TRUNCATED_RE.exec(contents[end + 1] ?? "");
+    const omittedBytes = omitted ? Number(omitted[1]) : undefined;
+    return {
+        output: body.join("\n"),
+        truncated: omitted !== null || start < 0,
+        ...(omittedBytes !== undefined ? { omittedBytes, } : {}),
+    };
 }
 function scenarioStepWarningSummary(stepResult) {
     const container = stepResult?.warnings;
@@ -441,7 +465,10 @@ export class ScenariosResource extends BaseResource {
                 type: "custom_python",
                 params: { envSelection, },
             });
-            await this.client.putVoid(`${base}/payload`, { script: buildCodeRunScript(script), extension: "py", });
+            await this.client.putVoid(`${base}/payload`, {
+                script: buildCodeRunScript(script, Math.floor(maxLogBytes / CODE_RUN_OUTPUT_BUDGET_DIVISOR)),
+                extension: "py",
+            });
             const trigger = await this.client.post(`${base}/run/`, {});
             const tracked = await this.trackTriggerRun(scenarioId, base, trigger, {
                 startedAt,
@@ -454,9 +481,12 @@ export class ScenariosResource extends BaseResource {
             pollCount = tracked.pollCount;
             timedOut = tracked.timedOut;
             if (runId && outcome !== "TIMEOUT") {
+                // Tail read: the markers are printed last, so a log over the cap loses
+                // DSS start-up noise instead of the END marker.
                 const limitedLog = await this.getRunLog(scenarioId, runId, {
                     projectKey: opts?.projectKey,
                     maxLogBytes,
+                    tail: true,
                 });
                 log = limitedLog.text;
                 logTruncated = limitedLog.truncated;
@@ -475,7 +505,7 @@ export class ScenariosResource extends BaseResource {
             }
             throw primaryError;
         }
-        const output = extractCodeRunOutput(log);
+        const extracted = extractCodeRunOutput(log, logTruncated);
         return {
             scenarioId,
             runId,
@@ -483,7 +513,11 @@ export class ScenariosResource extends BaseResource {
             success: outcome === "SUCCESS",
             elapsedMs: Date.now() - startedAt,
             pollCount,
-            output,
+            output: extracted?.output,
+            ...(extracted?.truncated ? { outputTruncated: true, } : {}),
+            ...(extracted?.omittedBytes !== undefined
+                ? { outputOmittedBytes: extracted.omittedBytes, }
+                : {}),
             log,
             logTruncated,
             maxLogBytes,
@@ -519,7 +553,9 @@ export class ScenariosResource extends BaseResource {
      * Get the log of a scenario run (GET /scenarios/{id}/{runId}/log), optionally
      * scoped to a single step via `stepId`. The text is byte-bounded: at most
      * `maxLogBytes` (default 1 MiB) of the beginning of the log is retained and
-     * `truncated` reports whether the cap cut the body.
+     * `truncated` reports whether the cap cut the body. With `tail: true` the
+     * last `maxLogBytes` are retained instead (used by code runs, whose output
+     * markers sit at the end of the log).
      */
     async getRunLog(scenarioId, runId, opts) {
         if (opts?.stepId !== undefined)
@@ -529,7 +565,10 @@ export class ScenariosResource extends BaseResource {
         const query = opts?.stepId !== undefined
             ? `?stepId=${encodeURIComponent(opts.stepId)}`
             : "";
-        const { text, truncated, } = await this.client.getTextLimited(`/public/api/projects/${this.enc(opts?.projectKey)}/scenarios/${scEnc}/${encodeURIComponent(runId)}/log${query}`, maxLogBytes);
+        const readText = opts?.tail === true
+            ? this.client.getTextTailLimited.bind(this.client)
+            : this.client.getTextLimited.bind(this.client);
+        const { text, truncated, } = await readText(`/public/api/projects/${this.enc(opts?.projectKey)}/scenarios/${scEnc}/${encodeURIComponent(runId)}/log${query}`, maxLogBytes);
         return { text, truncated, maxLogBytes, };
     }
     /** Get the payload of a (custom) scenario (GET /scenarios/{id}/payload). */

package/dist/src/resources/sql.js

@@ -1,4 +1,4 @@
-import { ClientValidationError, DataikuError, nonJsonResponseBody, SQL_QUERY_FAILED_MARKER, } from "../errors.js";
+import { ClientValidationError, DataikuError, nonJsonResponseBody, RESPONSE_TOO_LARGE_STATUS_TEXT, SQL_QUERY_FAILED_MARKER, } from "../errors.js";
 import { asRecord, } from "../utils/records.js";
 import { BaseResource, } from "./base.js";
 const UNSUPPORTED_SQL_DATASET_CONNECTION_DETAIL = "neither of sql nor hdfs type";
@@ -192,7 +192,7 @@ export class SqlResource extends BaseResource {
         const maxBytes = this.client.getMaxResponseBodyBytes();
         const { text, truncated, } = await this.client.getTextLimited(`/public/api/sql/queries/${id}/stream?format=json`, maxBytes);
         if (truncated) {
-            throw new DataikuError(0, "Response Too Large", `SQL stream results exceeded the ${maxBytes}-byte response limit and were not parsed.`);
+            throw new DataikuError(0, RESPONSE_TOO_LARGE_STATUS_TEXT, `SQL stream results exceeded the ${maxBytes}-byte response limit and were not parsed.`);
         }
         try {
             return JSON.parse(text);
@@ -210,7 +210,7 @@ export class SqlResource extends BaseResource {
         const maxBytes = Math.min(this.client.getMaxResponseBodyBytes(), MAX_SQL_FINISH_TEXT_BYTES);
         const { text, truncated, } = await this.client.getTextLimited(`/public/api/sql/queries/${id}/finish-streaming`, maxBytes);
         if (truncated) {
-            throw new DataikuError(0, "Response Too Large", `SQL finish-streaming response exceeded the ${maxBytes}-byte response limit.`);
+            throw new DataikuError(0, RESPONSE_TOO_LARGE_STATUS_TEXT, `SQL finish-streaming response exceeded the ${maxBytes}-byte response limit.`);
         }
         if (text.length > 0) {
             throw new DataikuError(200, "SQL Query Failed", `${SQL_QUERY_FAILED_MARKER} (${queryId}): ${text}`);

package/dist/src/resources/wiki.js

@@ -1,4 +1,4 @@
-import fs from "node:fs";
+import { stat as statFile, } from "node:fs/promises";
 import path from "node:path";
 import { ClientValidationError, } from "../errors.js";
 import { WikiArticleDataArraySchema, WikiArticleDataSchema, WikiSettingsSchema, } from "../schemas.js";
@@ -19,13 +19,9 @@ export function wikiAttachmentNotFound(data, smartId) {
 }
 /** Check that a local path is a readable regular file before any DSS call. */
 export async function statWikiAttachmentFile(localPath) {
-    let stat;
-    try {
-        stat = await fs.promises.stat(localPath);
-    }
-    catch (error) {
+    const stat = await statFile(localPath).catch((error) => {
         throw new ClientValidationError(`Could not read attachment file ${localPath}: ${error instanceof Error ? error.message : String(error)}.`, "not_found", "Verify the file path and that it is readable.");
-    }
+    });
     if (!stat.isFile()) {
         throw new ClientValidationError(`${localPath} is not a regular file.`);
     }

package/dist/src/skill.js

@@ -1,7 +1,6 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { fileURLToPath, } from "node:url";
 import { ClientValidationError, } from "./errors.js";
 import { sha256Hex, } from "./utils/stable-hash.js";
 const SKILL_URLS = [
@@ -114,7 +113,7 @@ function skillState(target, expectedSha256) {
 }
 /** Load the packaged tree, keeping portable relative paths in the report. */
 function skillFiles() {
-    const root = fileURLToPath(skillDirectory());
+    const root = Bun.fileURLToPath(skillDirectory());
     const files = new Map();
     function visit(relativeDir) {
         const dir = path.join(root, relativeDir);

package/dist/src/utils/project-archive.d.ts

@@ -35,6 +35,25 @@ export interface ProjectArchiveIssue {
     message: string;
     member?: string;
 }
+/**
+ * One credential-bearing structure found in an archive member. Carries the
+ * member path and the JSON key path / field name only, never the value.
+ * - `member_name`: the member itself is a credential store (for example
+ *   `project_config/apikeys.json`) and is not empty.
+ * - `json_key`: a credential-named JSON key holds a non-empty string value
+ *   (or a container of them), e.g. `$.standard.DHL_API_KEY` or a nested
+ *   web-app `apiKey`.
+ * - `list_variable`: a list-form `{name, value}` entry whose `name` is
+ *   credential-named, e.g. `{name: "X_API_KEY", value: "..."}`.
+ */
+export interface ProjectArchiveCredentialFinding {
+    member: string;
+    rule: "member_name" | "json_key" | "list_variable";
+    /** JSON path of the credential value inside the member (absent for `member_name`). */
+    keyPath?: string;
+    /** Credential-named key or list-form variable name (absent for `member_name`). */
+    field?: string;
+}
 export interface ProjectArchiveInspection {
     filePath: string;
     sizeBytes: number;
@@ -42,6 +61,12 @@ export interface ProjectArchiveInspection {
     sourceProjectKey?: string;
     valid: boolean;
     issues: ProjectArchiveIssue[];
+    /**
+     * Credential inventory: member paths and key paths/field names of
+     * credential-bearing structures. Values are never included. Each finding
+     * is also summarized by a `credential_structure` warning issue.
+     */
+    credentialFindings: ProjectArchiveCredentialFinding[];
 }
 /**
  * Inspect a DSS project export ZIP archive without extracting anything to