dataiku-sdk 2.0.0 → 3.1.0

package/dist/src/cli/runtime.js

@@ -1,5 +1,35 @@
 import { loadCredentials, } from "../config.js";
-import { dataikuEnvironmentEnabled, } from "./env.js";
+import { dataikuEnvironmentEnabled, envFileProvenance, } from "./env.js";
+import { UsageError, } from "./usage.js";
+function envVarSource(name) {
+    return envFileProvenance(name) ?? "env";
+}
+/**
+ * Reject an endpoint (URL/TLS) taken from the project `.env` when the API key
+ * would come from anywhere else: project-supplied endpoints must not harvest a
+ * user key and transmit it. A project `.env` that supplies the URL and the key
+ * together stays supported, as does `DATAIKU_DISABLE_ENV=1`, which stops the
+ * loader from recording any project provenance.
+ */
+export function assertCredentialBinding(sources) {
+    if (sources.apiKey === undefined || sources.apiKey === "project")
+        return;
+    const projectEndpoint = sources.url === "project"
+        || sources.tlsRejectUnauthorized === "project"
+        || sources.caCertPath === "project";
+    if (!projectEndpoint)
+        return;
+    throw new UsageError("Refusing to pair credentials: the DSS URL/TLS configuration comes from the project .env, but the API key comes from another source.", "conflicting_input_sources", "Supply both DATAIKU_URL and DATAIKU_API_KEY in the project .env, pass --url/--api-key explicitly, or set DATAIKU_DISABLE_ENV=1 to ignore the project .env.", {
+        url: sources.url,
+        apiKey: sources.apiKey,
+        ...(sources.tlsRejectUnauthorized === "project"
+            ? { tlsRejectUnauthorized: sources.tlsRejectUnauthorized, }
+            : {}),
+        ...(sources.caCertPath === "project"
+            ? { caCertPath: sources.caCertPath, }
+            : {}),
+    });
+}
 function parseTlsRejectUnauthorizedEnv(value) {
     if (value === undefined)
         return undefined;
@@ -10,15 +40,38 @@ function parseTlsRejectUnauthorizedEnv(value) {
         return true;
     return undefined;
 }
-export function resolveTlsSettings(flags, saved) {
+export function resolveTlsSettings(flags, saved, sources = {}) {
     let tlsRejectUnauthorized = flags["insecure"] === true ? false : undefined;
     let caCertPath = flags["ca-cert"];
-    tlsRejectUnauthorized ??= parseTlsRejectUnauthorizedEnv(process.env.NODE_TLS_REJECT_UNAUTHORIZED);
-    caCertPath ??= process.env.NODE_EXTRA_CA_CERTS;
+    if (flags["insecure"] === true)
+        sources.tlsRejectUnauthorized = "flag";
+    if (caCertPath !== undefined)
+        sources.caCertPath = "flag";
+    if (tlsRejectUnauthorized === undefined) {
+        const envValue = process.env.NODE_TLS_REJECT_UNAUTHORIZED;
+        const parsed = parseTlsRejectUnauthorizedEnv(envValue);
+        if (envValue !== undefined && parsed !== undefined) {
+            tlsRejectUnauthorized = parsed;
+            sources.tlsRejectUnauthorized = envVarSource("NODE_TLS_REJECT_UNAUTHORIZED");
+        }
+    }
+    if (caCertPath === undefined) {
+        const envCaCert = process.env.NODE_EXTRA_CA_CERTS;
+        if (envCaCert !== undefined) {
+            caCertPath = envCaCert;
+            sources.caCertPath = envVarSource("NODE_EXTRA_CA_CERTS");
+        }
+    }
     if (tlsRejectUnauthorized === undefined) {
         tlsRejectUnauthorized = saved?.tlsRejectUnauthorized;
+        if (tlsRejectUnauthorized !== undefined)
+            sources.tlsRejectUnauthorized = "saved";
+    }
+    if (caCertPath === undefined) {
+        caCertPath = saved?.caCertPath;
+        if (caCertPath !== undefined)
+            sources.caCertPath = "saved";
     }
-    caCertPath ??= saved?.caCertPath;
     return { tlsRejectUnauthorized, caCertPath, };
 }
 export const currentCommandContext = {};
@@ -32,28 +85,82 @@ export function resolveCredentials(flags) {
     let url = hasUrlFlag ? flags["url"] : undefined;
     let apiKey = hasApiKeyFlag ? flags["api-key"] : undefined;
     let projectKey = hasProjectKeyFlag ? flags["project-key"] : undefined;
+    const sources = {};
+    if (hasUrlFlag)
+        sources.url = "flag";
+    if (hasApiKeyFlag)
+        sources.apiKey = "flag";
     const saved = loadCredentials();
     const useEnv = dataikuEnvironmentEnabled();
     if (useEnv) {
-        if (!hasUrlFlag)
-            url ??= process.env.DATAIKU_URL;
-        if (!hasApiKeyFlag)
-            apiKey ??= process.env.DATAIKU_API_KEY;
-        if (!hasProjectKeyFlag)
-            projectKey ??= process.env.DATAIKU_PROJECT_KEY;
+        if (!hasUrlFlag && process.env.DATAIKU_URL !== undefined) {
+            url = process.env.DATAIKU_URL;
+            sources.url = envVarSource("DATAIKU_URL");
+        }
+        if (!hasApiKeyFlag && process.env.DATAIKU_API_KEY !== undefined) {
+            apiKey = process.env.DATAIKU_API_KEY;
+            sources.apiKey = envVarSource("DATAIKU_API_KEY");
+        }
+        if (!hasProjectKeyFlag && process.env.DATAIKU_PROJECT_KEY !== undefined) {
+            projectKey = process.env.DATAIKU_PROJECT_KEY;
+        }
     }
     if (saved) {
-        if (!hasUrlFlag)
-            url ??= saved.url;
-        if (!hasApiKeyFlag)
-            apiKey ??= saved.apiKey;
-        if (!hasProjectKeyFlag)
-            projectKey ??= saved.projectKey;
+        if (!hasUrlFlag && url === undefined) {
+            url = saved.url;
+            sources.url = "saved";
+        }
+        if (!hasApiKeyFlag && apiKey === undefined) {
+            apiKey = saved.apiKey;
+            sources.apiKey = "saved";
+        }
+        if (!hasProjectKeyFlag && projectKey === undefined) {
+            projectKey = saved.projectKey;
+        }
     }
+    const tlsSettings = resolveTlsSettings(flags, saved ?? undefined, sources);
+    assertCredentialBinding(sources);
     return {
         url: url ?? "",
         apiKey: apiKey ?? "",
         projectKey,
-        ...resolveTlsSettings(flags, saved ?? undefined),
+        ...tlsSettings,
     };
 }
+/**
+ * Resolve credentials for `auth login` from explicit flags and the process
+ * environment only — never from saved credentials — with provenance tracking
+ * and binding enforcement. The call throws before transmitting anything when
+ * the project `.env` supplies the URL/TLS configuration while the API key
+ * comes from another source.
+ */
+export function resolveLoginCredentials(flags) {
+    const hasUrlFlag = typeof flags["url"] === "string";
+    const hasApiKeyFlag = typeof flags["api-key"] === "string";
+    const hasProjectKeyFlag = typeof flags["project-key"] === "string";
+    let url = hasUrlFlag ? flags["url"] : undefined;
+    let apiKey = hasApiKeyFlag ? flags["api-key"] : undefined;
+    let projectKey = hasProjectKeyFlag ? flags["project-key"] : undefined;
+    const sources = {};
+    if (hasUrlFlag)
+        sources.url = "flag";
+    if (hasApiKeyFlag)
+        sources.apiKey = "flag";
+    const useEnv = dataikuEnvironmentEnabled();
+    if (useEnv) {
+        if (!hasUrlFlag && process.env.DATAIKU_URL !== undefined) {
+            url = process.env.DATAIKU_URL;
+            sources.url = envVarSource("DATAIKU_URL");
+        }
+        if (!hasApiKeyFlag && process.env.DATAIKU_API_KEY !== undefined) {
+            apiKey = process.env.DATAIKU_API_KEY;
+            sources.apiKey = envVarSource("DATAIKU_API_KEY");
+        }
+        if (!hasProjectKeyFlag && process.env.DATAIKU_PROJECT_KEY !== undefined) {
+            projectKey = process.env.DATAIKU_PROJECT_KEY;
+        }
+    }
+    const tlsSettings = resolveTlsSettings(flags, undefined, sources);
+    assertCredentialBinding(sources);
+    return { url: url ?? "", apiKey: apiKey ?? "", projectKey, tlsSettings, };
+}

package/dist/src/cli/types.d.ts

@@ -5,6 +5,7 @@ export interface CommandPayloadSchema {
     stdin?: boolean;
     dataFlag?: boolean;
     dataFileFlag?: boolean;
+    contentType?: "application/json" | "text/plain";
     jsonShape?: "object" | "array";
 }
 export interface CommandFlagChoice {
@@ -21,6 +22,12 @@ export interface CommandRegistryOverride {
 export interface CommandMeta extends CommandRegistryOverride {
     handler: CommandHandler;
     localHandler?: LocalCommandHandler;
+    /**
+     * Pure, DSS-free argument validation run before credentials are resolved,
+     * so a bad flag value is reported as its own usage error even when no
+     * credentials are configured, instead of being masked by a missing-URL error.
+     */
+    validate?: (args: string[], flags: Record<string, string | boolean>) => void;
     usage: string;
     description?: string;
     examples?: string[];

package/dist/src/cli.js

@@ -7,8 +7,8 @@ import { runDoctor, runFixtures, } from "./cli/doctor.js";
 import { dataikuEnvironmentEnabled, loadEnvFile, } from "./cli/env.js";
 import { FLAG_ALIASES, isNegativeNumberToken, parseArgs, SHORT_FLAGS, VALUE_FLAGS, } from "./cli/flags.js";
 import { cleanupLedgerEntry, } from "./cli/helpers/cleanup.js";
-import { commandFailureExitCode, commandFailureMessage, CommandResultFailure, flushCliWarnings, isFailedWaitResult, planResult, projectResultFields, setOutputFieldProjection, writeCommandResult, } from "./cli/output.js";
-import { currentCommandContext, resolveCredentials, resolveTlsSettings, } from "./cli/runtime.js";
+import { commandFailureExitCode, CommandResultFailure, flushCliWarnings, isFailedWaitResult, planResult, projectResultFields, setOutputFieldProjection, writeCommandResult, } from "./cli/output.js";
+import { currentCommandContext, resolveCredentials, resolveLoginCredentials, } from "./cli/runtime.js";
 import { COMMANDS_RUN_HINT, missingActionError, noCommandError, requireArgs, unknownActionError, unknownResourceError, UsageError, } from "./cli/usage.js";
 import { cliVersionResult, } from "./cli/version.js";
 import { DataikuClient, } from "./client.js";
@@ -153,6 +153,11 @@ async function runCleanup(flags) {
         try {
             const parsed = parseArgs(entry.cleanup.argv);
             const [resource, action, ...args] = parsed.positional;
+            Object.assign(currentCommandContext, {
+                resource,
+                action,
+                projectKey: parsed.flags["project-key"],
+            });
             if (!resource || !action || !isAllowedCleanupAction(resource, action)
                 || !commands[resource]?.[action]) {
                 throw new UsageError(`Invalid cleanup argv: ${entry.cleanup.argv.join(" ")}`);
@@ -173,13 +178,18 @@ async function runCleanup(flags) {
                 const failure = {
                     index,
                     cleanup: entry.cleanup,
-                    error: commandFailureMessage(result),
-                    result,
+                    error: buildErrorReport(new CommandResultFailure(result, 4)),
                 };
                 failures.push(failure);
                 if (flags["continue-on-error"] !== true) {
                     return {
-                        result: { applied: true, steps, results: applied, failures, },
+                        result: {
+                            applied: true,
+                            steps,
+                            results: applied,
+                            failures,
+                            ...summarizeCleanupFailures(failures),
+                        },
                         exitCode: 2,
                     };
                 }
@@ -191,19 +201,31 @@ async function runCleanup(flags) {
             const failure = {
                 index,
                 cleanup: entry.cleanup,
-                error: error instanceof Error ? error.message : String(error),
+                error: buildErrorReport(error),
             };
             failures.push(failure);
             if (flags["continue-on-error"] !== true) {
                 return {
-                    result: { applied: true, steps, results: applied, failures, },
+                    result: {
+                        applied: true,
+                        steps,
+                        results: applied,
+                        failures,
+                        ...summarizeCleanupFailures(failures),
+                    },
                     exitCode: 2,
                 };
             }
         }
     }
     return {
-        result: { applied: true, steps, results: applied, failures, },
+        result: {
+            applied: true,
+            steps,
+            results: applied,
+            failures,
+            ...summarizeCleanupFailures(failures),
+        },
         exitCode: failures.length > 0 ? 2 : 0,
     };
 }
@@ -656,23 +678,7 @@ function runInstallSkill(flags) {
 }
 const META_PLAN_EXIT_CODES = { usage: 1, error: 2, transient: 3, };
 function authLoginPlan(flags) {
-    const tlsSettings = resolveTlsSettings(flags);
-    const useEnv = dataikuEnvironmentEnabled();
-    const url = typeof flags["url"] === "string"
-        ? flags["url"]
-        : useEnv
-            ? process.env.DATAIKU_URL ?? ""
-            : "";
-    const apiKey = typeof flags["api-key"] === "string"
-        ? flags["api-key"]
-        : useEnv
-            ? process.env.DATAIKU_API_KEY ?? ""
-            : "";
-    const projectKey = typeof flags["project-key"] === "string"
-        ? flags["project-key"]
-        : useEnv
-            ? process.env.DATAIKU_PROJECT_KEY
-            : undefined;
+    const { url, apiKey, projectKey, tlsSettings, } = resolveLoginCredentials(flags);
     if (!url || !apiKey) {
         throw new UsageError("Missing --url and/or --api-key for auth login.", "missing_required_flag", "Pass --url and --api-key, or set DATAIKU_URL and DATAIKU_API_KEY.", { requiredFlags: ["url", "api-key",], env: ["DATAIKU_URL", "DATAIKU_API_KEY",], });
     }
@@ -861,6 +867,9 @@ function assertCleanupLedgerSupported(resource, action, flags) {
     if (!supportsCleanupLedger(resource, action)) {
         throw new UsageError(`--record-cleanup is not supported for ${resource} ${action}.`);
     }
+    if (resource === "workspace" && action === "create" && flags["stdin"] === true) {
+        throw new UsageError("workspace create cannot combine --record-cleanup with --stdin because the cleanup identifier cannot be replayed from a consumed stream.", "conflicting_input_sources", "Use --data or --data-file so the workspaceKey remains available for the cleanup ledger.");
+    }
 }
 /**
  * Preflight a requested cleanup ledger path before any remote mutation so an
@@ -923,8 +932,16 @@ async function recordCleanupLedgerEntry(client, resource, action, args, flags, r
     if (typeof ledgerPath !== "string" || flags["dry-run"] === true)
         return;
     const entry = cleanupLedgerEntry(resource, action, args, flags, result, projectKey);
-    if (entry)
+    if (entry) {
         await appendCleanupLedgerEntry(ledgerPath, entry, client.getBaseUrl());
+        return;
+    }
+    const record = result !== null && typeof result === "object" && !Array.isArray(result)
+        ? result
+        : {};
+    if (record.skipped !== undefined || record.cleanupEligible === false)
+        return;
+    throw new ClientValidationError(`Mutation completed but no cleanup entry could be derived for ${resource} ${action}.`, "ambiguous_outcome", "Inspect the created object and remove it manually; do not assume the requested cleanup ledger contains it.", { resource, action, ledgerPath, });
 }
 async function runBatch(flags) {
     const payload = unknownJsonInput(flags);
@@ -1102,16 +1119,46 @@ async function runBatch(flags) {
         }
     }
     const ok = firstFailureExit === undefined;
+    const failureSummary = summarizeFailureEnvelopes(results.flatMap((step) => step.error ? [{ index: step.index, error: step.error, },] : []));
     return {
         result: {
             ok,
             total: steps.length,
             completed: results.filter((step) => step.ok !== null).length,
+            ...failureSummary,
             steps: results,
         },
         exitCode: ok ? 0 : firstFailureExit ?? 2,
     };
 }
+function summarizeFailureEnvelopes(failures) {
+    const failureCodes = failures.map(({ index, error, }) => ({
+        index,
+        code: error.code,
+        category: error.category,
+        exitCode: error.exitCode,
+        retryable: error.retryable === true,
+    }));
+    return {
+        failed: failures.length,
+        retryable: failures.length > 0 && failureCodes.every((failure) => failure.retryable),
+        hasRetryableFailures: failureCodes.some((failure) => failure.retryable),
+        failureCodes,
+    };
+}
+function summarizeCleanupFailures(failures) {
+    return summarizeFailureEnvelopes(failures.flatMap((failure) => {
+        const index = failure.index;
+        const error = failure.error;
+        return typeof index === "number"
+            && error !== null
+            && typeof error === "object"
+            && !Array.isArray(error)
+            && error.type === "error"
+            ? [{ index, error: error, },]
+            : [];
+    }));
+}
 function rawFlagValue(argv, flagName) {
     const longFlag = `--${flagName}`;
     for (let index = 0; index < argv.length; index++) {
@@ -1206,13 +1253,48 @@ function requestIdFromBody(body) {
     return undefined;
 }
 const MISSING_PROJECT_KEY_ERROR_PREFIX = "projectKey is required";
+function isAmbiguousMutationFailure(err, context) {
+    if (!(err instanceof DataikuError))
+        return false;
+    const method = err.retry?.method.toUpperCase();
+    if (!method || method === "GET" || method === "HEAD")
+        return false;
+    if (err.status !== 0 && err.status < 500)
+        return false;
+    const entry = context.resource && context.action
+        ? cachedCommandRegistry()[context.resource]?.[context.action]
+        : undefined;
+    return entry?.sideEffect === "write" && entry.idempotency === "none";
+}
+const MAX_FAILURE_RESULT_BYTES = 64 * 1024;
+function boundedFailureResult(result) {
+    let serialized;
+    try {
+        serialized = JSON.stringify(result);
+    }
+    catch {
+        return { result: "[unserializable command result]", resultTruncated: true, };
+    }
+    if (serialized === undefined || Buffer.byteLength(serialized, "utf8") <= MAX_FAILURE_RESULT_BYTES) {
+        return { result, };
+    }
+    return {
+        resultPreview: Buffer.from(serialized, "utf8").subarray(0, MAX_FAILURE_RESULT_BYTES).toString("utf8"),
+        resultBytes: Buffer.byteLength(serialized, "utf8"),
+        resultTruncated: true,
+    };
+}
 function errorExitCode(err) {
     if (err instanceof CommandResultFailure)
         return err.exitCode;
+    if (err instanceof ClientValidationError && err.code === "assertion_failed")
+        return 4;
     if (err instanceof ClientValidationError && err.code === "ambiguous_outcome")
         return 2;
     if (err instanceof UsageError || err instanceof ClientValidationError)
         return 1;
+    if (isAmbiguousMutationFailure(err, rawCommandContext()))
+        return 2;
     if (err instanceof DataikuError)
         return err.category === "transient" ? 3 : 2;
     if (err instanceof Error && err.message.startsWith(MISSING_PROJECT_KEY_ERROR_PREFIX))
@@ -1222,7 +1304,8 @@ function errorExitCode(err) {
 function buildErrorReport(err) {
     const context = rawCommandContext();
     const exitCode = errorExitCode(err);
-    if (err instanceof ClientValidationError && err.code === "ambiguous_outcome") {
+    if (err instanceof ClientValidationError
+        && (err.code === "ambiguous_outcome" || err.code === "assertion_failed")) {
         return {
             type: "error",
             ok: false,
@@ -1230,6 +1313,7 @@ function buildErrorReport(err) {
             code: err.code,
             category: "dss",
             exitCode,
+            retryable: false,
             ...(err.hint ? { hint: err.hint, } : {}),
             ...(err.details ? { details: err.details, } : {}),
             ...context,
@@ -1259,7 +1343,29 @@ function buildErrorReport(err) {
             code: err.code,
             category: "dss",
             exitCode: err.exitCode,
-            details: { result: err.result, },
+            details: boundedFailureResult(err.result),
+            ...context,
+        };
+    }
+    if (isAmbiguousMutationFailure(err, context)) {
+        const method = err.retry?.method.toUpperCase() ?? "mutation";
+        return {
+            type: "error",
+            ok: false,
+            error: `The ${method} request failed after dispatch; the mutation outcome is unknown.`,
+            code: "ambiguous_outcome",
+            category: "dss",
+            exitCode: 2,
+            hint: "Read the target state and verify whether the mutation took effect before retrying.",
+            status: err.status,
+            retryable: false,
+            requestId: err.requestId ?? requestIdFromBody(err.body),
+            details: {
+                dssCategory: err.category,
+                statusText: canonicalStatusText(err.status),
+                idempotency: "none",
+                ...(err.retry ? { retry: err.retry, } : {}),
+            },
             ...context,
         };
     }
@@ -1387,6 +1493,7 @@ async function main() {
         writeCommandResult(result);
         return;
     }
+    actionMeta.validate?.(args, flags);
     const { url, apiKey, projectKey, tlsRejectUnauthorized, caCertPath, } = resolveCredentials(flags);
     currentCommandContext.projectKey = projectKey;
     if (!url) {

package/dist/src/client.d.ts

@@ -71,6 +71,12 @@ export interface DataikuClientConfig {
     requestTimeoutMs?: number;
     /** Max retry attempts for idempotent requests (default 4, capped at 10) */
     retryMaxAttempts?: number;
+    /**
+     * Maximum bytes buffered from a single response body by the text/JSON
+     * consumer methods (default 50 MiB). Responses larger than this are
+     * rejected with a DataikuError after the stream is cancelled.
+     */
+    maxResponseBodyBytes?: number;
     /** Emit HTTP request/response trace events. Defaults to JSONL on stderr when verbose is true. */
     verbose?: boolean;
     onTrace?: (event: DataikuClientTraceEvent) => void;
@@ -91,6 +97,7 @@ export declare class DataikuClient {
     private readonly apiKey;
     private readonly defaultProjectKey;
     private readonly requestTimeoutMs;
+    private readonly maxResponseBodyBytes;
     private readonly retryMaxAttempts;
     private readonly verbose;
     private readonly tlsOptions;
@@ -176,6 +183,11 @@ export declare class DataikuClient {
      */
     getBaseUrl(): string;
     getRequestTimeoutMs(): number;
+    /**
+     * The configured maximum number of bytes buffered from a single response
+     * body by the text/JSON consumer methods (default 50 MiB).
+     */
+    getMaxResponseBodyBytes(): number;
     resolveProjectKey(paramValue?: string): string;
     get<T = unknown>(path: string): Promise<T>;
     /**
@@ -187,11 +199,34 @@ export declare class DataikuClient {
         data: T;
         meta: DataikuClientResponseMeta;
     }>;
+    /**
+     * GET returning the entire text body. The body is buffered with a hard
+     * byte cap (`maxResponseBodyBytes`, default 50 MiB) and read under the
+     * request deadline: a response exceeding the cap throws a DataikuError
+     * instead of being silently truncated, and a stalled body times out.
+     */
     getText(path: string): Promise<string>;
+    /**
+     * GET returning at most the first `maxBytes` bytes of a text body.
+     * When the response exceeds the cap the stream is cancelled, only the
+     * collected prefix is returned and `truncated` is true. The read runs
+     * under the request deadline: a stalled body throws a DataikuError.
+     */
     getTextLimited(path: string, maxBytes: number): Promise<{
         text: string;
         truncated: boolean;
     }>;
+    /**
+     * GET returning at most the last `maxBytes` bytes of a text body.
+     * When the response exceeds the cap, earlier bytes are discarded, only
+     * the tail is kept and `truncated` is true — so callers that need the end
+     * of a large document (e.g. job logs) stay bounded without losing the most
+     * recent content. The read runs under the request deadline.
+     */
+    getTextTailLimited(path: string, maxBytes: number): Promise<{
+        text: string;
+        truncated: boolean;
+    }>;
     /**
      * POST with optional transient retry. Only opt in when repeating the request
      * is safe: the server may have accepted an attempt whose response was lost.
@@ -199,6 +234,10 @@ export declare class DataikuClient {
     post<T = unknown>(path: string, body?: unknown, options?: {
         retryMaxAttempts?: number;
     }): Promise<T>;
+    /**
+     * POST returning the text body, under the same bounded buffering rules as
+     * {@link getText} (byte cap `maxResponseBodyBytes`, request deadline).
+     */
     postText(path: string, body?: unknown): Promise<string>;
     postStream(path: string, body?: unknown): Promise<Response>;
     put<T = unknown>(path: string, body: unknown): Promise<T>;
@@ -229,5 +268,26 @@ export declare class DataikuClient {
     warn(method: string, errors: string[]): void;
     private requestIdFromHeaders;
     private parseJsonResponse;
+    /**
+     * Read at most `maxBytes` of a 2xx response body as UTF-8 text.
+     *
+     * The body is consumed with the request deadline still active (measured
+     * from the first read): a stalled body throws a DataikuError instead of
+     * hanging. When the stream yields more than the cap, the reader cancels the
+     * body and returns the collected prefix with `truncated: true`; truncated
+     * text is trimmed to a UTF-8 character boundary so it never decodes beyond
+     * the byte cap.
+     */
+    private readBoundedBodyText;
+    /**
+     * Read a 2xx response body keeping only the last `maxBytes` bytes.
+     * Earlier bytes are discarded as the stream advances, so memory stays
+     * bounded by the cap plus one chunk even for arbitrarily large bodies.
+     * Returns `truncated: true` when bytes had to be dropped. Bytes that fall
+     * in the middle of a UTF-8 character are dropped from both ends so the
+     * decoded text never contains a replacement character.
+     */
+    private readBodyTextTail;
+    private buildResponseTooLargeError;
     private fetchWithRetry;
 }