dataiku-sdk 3.8.0 → 4.0.0

package/dist/src/cli.js

@@ -1,14 +1,13 @@
 #!/usr/bin/env node
-import * as fs from "node:fs/promises";
 import { homedir, } from "node:os";
 import { resolve, } from "node:path";
-import { num, seenJsonInputCredentials, unknownJsonInput, } from "./cli/coerce.js";
+import { num, resultRecord, seenJsonInputCredentials, stringField, unknownJsonInput, } from "./cli/coerce.js";
 import { commands, } from "./cli/commands/index.js";
 import { ambientProjectKey, loadEnvFile, } from "./cli/env.js";
 import { executionMode, FLAG_ALIASES, isFlagValueToken, parseArgs, rawPositionals, } from "./cli/flags.js";
-import { cleanupLedgerEntry, } from "./cli/helpers/cleanup.js";
-import { shapeListResult, } from "./cli/list-output.js";
+import { cleanupInputIdentifierField, cleanupLedgerEntry, } from "./cli/helpers/cleanup.js";
 import { commandFailureExitCode, CommandResultFailure, enqueueCliWarning, flushCliWarnings, isFailedWaitResult, planResult, projectResultFields, setOutputFieldProjection, writeCommandResult, } from "./cli/output.js";
+import { shapeCommandResult, } from "./cli/result-shapes.js";
 import { currentCommandContext, resolveCredentials, resolveLoginCredentials, } from "./cli/runtime.js";
 import { commandSyntaxTree, commandUsage, } from "./cli/syntax.js";
 import { COMMANDS_RUN_HINT, inferRequiresProject, missingActionError, noCommandError, requireArgs, RESOURCE_NAMES, unknownActionError, unknownFlagError, unknownResourceError, UsageError, } from "./cli/usage.js";
@@ -786,7 +785,7 @@ async function commandsRunResult(flags) {
         : projectResultFields(registry, selectors, () => Object.keys(contract.commandActionSummary()).sort());
     if (typeof outputPath === "string") {
         const exported = selectedRegistry;
-        await fs.writeFile(outputPath, `${JSON.stringify(exported)}\n`, "utf-8");
+        await Bun.write(outputPath, `${JSON.stringify(exported)}\n`);
         return { path: outputPath, };
     }
     return selectedRegistry;
@@ -802,8 +801,9 @@ function assertCleanupLedgerSupported(resource, action, flags) {
     if (!contract.supportsCleanupLedger(resource, action)) {
         throw new UsageError(`--record-cleanup is not supported for ${resource} ${action}.`);
     }
-    if (resource === "workspace" && action === "create" && flags["stdin"] === true) {
-        throw new UsageError("workspace create cannot combine --record-cleanup with --stdin because the cleanup identifier cannot be replayed from a consumed stream.", "conflicting_input_sources", "Use --data or --data-file so the workspaceKey remains available for the cleanup ledger.");
+    const pinnedField = cleanupInputIdentifierField(resource, action);
+    if (pinnedField !== undefined && flags["stdin"] === true) {
+        throw new UsageError(`${resource} ${action} cannot combine --record-cleanup with --stdin because the cleanup identifier cannot be replayed from a consumed stream.`, "conflicting_input_sources", `Use --data or --data-file so the ${pinnedField} remains available for the cleanup ledger.`);
     }
 }
 /**
@@ -856,11 +856,36 @@ async function preflightCleanupLedgerForFlags(client, flags) {
     }
 }
 /**
- * Append the cleanup entry for a completed handler result. Callers must pass the
- * raw, unprojected result and must call this before any failure exit code is
- * raised: an indeterminate post-POST outcome stays addressable only when the
- * ledger records it first. Eligibility (dry runs, skipped work, an explicit
- * `cleanupEligible:false`) is decided by `cleanupLedgerEntry`, never here.
+ * What the command result already says about the created object, so a failed
+ * ledger write never hides it: the `created`/`saved` receipt, the object `id`
+ * and `name`, and the project key DSS landed it in. Fields stay distinct (a
+ * name is not an id) and absent ones are omitted rather than guessed.
+ */
+function createdObjectFromResult(result, fallbackProjectKey) {
+    const record = resultRecord(result);
+    const created = stringField(record, ["created", "saved", "usedProjectKey",]);
+    const id = stringField(record, ["id",]);
+    const name = stringField(record, ["name",]);
+    const projectKey = stringField(record, ["projectKey", "usedProjectKey", "targetProjectKey",])
+        ?? fallbackProjectKey;
+    return {
+        ...(created ? { created, } : {}),
+        ...(id ? { id, } : {}),
+        ...(name ? { name, } : {}),
+        ...(projectKey ? { projectKey, } : {}),
+    };
+}
+/**
+ * Append the cleanup entry for a completed handler result. Callers must call
+ * this before any failure exit code is raised: an indeterminate post-POST
+ * outcome stays addressable only when the ledger records it first. Eligibility
+ * (dry runs, skipped work, an explicit `cleanupEligible:false`) is decided by
+ * `cleanupLedgerEntry`, never here.
+ *
+ * The mutation has already happened when this runs, so every failure here is
+ * an `ambiguous_outcome` that says so (`mutationSucceeded: true`,
+ * `cleanupRecorded: false`) and carries the created identifier/project key:
+ * callers must never retry the create, only clean up or record it themselves.
  */
 async function recordCleanupLedgerEntry(client, resource, action, args, flags, result, projectKey) {
     const ledgerPath = flags["record-cleanup"];
@@ -868,15 +893,33 @@ async function recordCleanupLedgerEntry(client, resource, action, args, flags, r
         return;
     const entry = cleanupLedgerEntry(resource, action, args, flags, result, projectKey);
     if (entry) {
-        await appendCleanupLedgerEntry(ledgerPath, entry, client.getBaseUrl());
+        try {
+            await appendCleanupLedgerEntry(ledgerPath, entry, client.getBaseUrl());
+        }
+        catch (error) {
+            throw new ClientValidationError(`Mutation completed but the cleanup entry for ${resource} ${action} could not be recorded: ${error instanceof Error ? error.message : String(error)}`, "ambiguous_outcome", "The mutation already succeeded: do not retry it. Remove the created object manually or append this cleanup entry to the ledger yourself.", {
+                resource,
+                action,
+                ledgerPath,
+                mutationSucceeded: true,
+                cleanupRecorded: false,
+                ...createdObjectFromResult(result, projectKey),
+                cleanup: entry.cleanup,
+            });
+        }
         return;
     }
-    const record = result !== null && typeof result === "object" && !Array.isArray(result)
-        ? result
-        : {};
+    const record = resultRecord(result);
     if (record.skipped !== undefined || record.cleanupEligible === false)
         return;
-    throw new ClientValidationError(`Mutation completed but no cleanup entry could be derived for ${resource} ${action}.`, "ambiguous_outcome", "Inspect the created object and remove it manually; do not assume the requested cleanup ledger contains it.", { resource, action, ledgerPath, });
+    throw new ClientValidationError(`Mutation completed but no cleanup entry could be derived for ${resource} ${action}.`, "ambiguous_outcome", "The mutation already succeeded: do not retry it. Inspect the created object and remove it manually; the requested cleanup ledger does not contain it.", {
+        resource,
+        action,
+        ledgerPath,
+        mutationSucceeded: true,
+        cleanupRecorded: false,
+        ...createdObjectFromResult(result, projectKey),
+    });
 }
 async function runBatch(flags) {
     const payload = unknownJsonInput(flags);
@@ -1022,8 +1065,7 @@ async function runBatch(flags) {
                     await preflightCleanupLedgerForFlags(client, stepFlags);
                     const stepArgs = positional.slice(2);
                     result = await meta.handler(client, stepArgs, stepFlags);
-                    if (action === "list")
-                        result = shapeListResult(resource, result, stepFlags);
+                    result = shapeCommandResult(resource, action, result, stepFlags);
                     await recordCleanupLedgerEntry(client, resource, action, stepArgs, stepFlags, result, projectKey);
                 }
                 const failureExitCode = commandFailureExitCode(result);
@@ -1301,27 +1343,33 @@ function errorExitCode(err) {
 }
 function buildErrorReport(err, contextOverride) {
     const context = contextOverride ?? rawCommandContext();
+    // The envelope echoes only the resolved project; resource/action are known to the caller.
+    const scope = context.projectKey ? { projectKey: context.projectKey, } : {};
     const exitCode = errorExitCode(err);
     if (err instanceof ClientValidationError
         && (err.code === "ambiguous_outcome" || err.code === "assertion_failed"
             || err.code === "long_running_failure")) {
+        // The DSS response behind an indeterminate outcome stays visible (status,
+        // sanitized message), e.g. a 500 that names the conflicting project key.
+        const cause = err.cause instanceof DataikuError ? err.cause : undefined;
+        const diagnostics = cause ? dssDiagnosticDetails(cause) : {};
+        const details = { ...diagnostics, ...err.details, };
         return {
             type: "error",
-            ok: false,
             error: err.message,
             code: err.code,
             category: "dss",
             exitCode,
+            ...(cause ? { status: cause.status, } : {}),
             retryable: false,
             ...(err.hint ? { hint: err.hint, } : {}),
-            ...(err.details ? { details: err.details, } : {}),
-            ...context,
+            ...(Object.keys(details).length > 0 ? { details, } : {}),
+            ...scope,
         };
     }
     if (err instanceof UsageError || err instanceof ClientValidationError) {
         return {
             type: "error",
-            ok: false,
             error: err.message,
             code: err.code,
             category: err.code === "target_absence_unverifiable"
@@ -1333,26 +1381,24 @@ function buildErrorReport(err, contextOverride) {
             ...(err.code === "target_absence_unverifiable" ? { retryable: false, } : {}),
             ...(err.hint ? { hint: err.hint, } : {}),
             ...(err.details ? { details: err.details, } : {}),
-            ...context,
+            ...scope,
         };
     }
     if (err instanceof CommandResultFailure) {
         return {
             type: "error",
-            ok: false,
             error: err.message,
             code: err.code,
             category: "dss",
             exitCode: err.exitCode,
             details: boundedFailureResult(err.result),
-            ...context,
+            ...scope,
         };
     }
     if (isAmbiguousMutationFailure(err, context)) {
         const method = err.retry?.method.toUpperCase() ?? "mutation";
         return {
             type: "error",
-            ok: false,
             error: `The ${method} request failed after dispatch; the mutation outcome is unknown.`,
             code: "ambiguous_outcome",
             category: "dss",
@@ -1369,7 +1415,7 @@ function buildErrorReport(err, contextOverride) {
                 ...err.details,
                 ...(err.retry ? { retry: err.retry, } : {}),
             },
-            ...context,
+            ...scope,
         };
     }
     if (err instanceof DataikuError) {
@@ -1391,7 +1437,6 @@ function buildErrorReport(err, contextOverride) {
                 : err.retryHint;
         return {
             type: "error",
-            ok: false,
             error: dssMessage ? `${err.safeMessage}: ${dssMessage}` : err.safeMessage,
             code: dataikuErrorCode(err.category),
             category: "dss",
@@ -1401,18 +1446,17 @@ function buildErrorReport(err, contextOverride) {
             retryable: err.retryable,
             requestId: err.requestId ?? requestIdFromBody(err.body),
             ...(Object.keys(details).length > 0 ? { details, } : {}),
-            ...context,
+            ...scope,
         };
     }
     const message = err instanceof Error ? err.message : String(err);
     return {
         type: "error",
-        ok: false,
         error: message,
         code: "internal_error",
         category: "internal",
         exitCode,
-        ...context,
+        ...scope,
     };
 }
 function writeErrorReport(err) {
@@ -1524,7 +1568,7 @@ async function main() {
     assertCleanupLedgerSupported(resource, action, flags);
     await preflightCleanupLedgerForFlags(client, flags);
     const handled = await actionMeta.handler(client, args, flags);
-    const result = action === "list" ? shapeListResult(resource, handled, flags) : handled;
+    const result = shapeCommandResult(resource, action, handled, flags);
     await recordCleanupLedgerEntry(client, resource, action, args, flags, result, projectKey);
     const failureExitCode = commandFailureExitCode(result);
     if (failureExitCode !== undefined)

package/dist/src/client.d.ts

@@ -153,7 +153,13 @@ export declare class DataikuClient {
     private readonly maxResponseBodyBytes;
     private readonly retryMaxAttempts;
     private readonly verbose;
-    private readonly tlsOptions;
+    /**
+     * Connection pool carrying this client's TLS settings (custom CA, disabled
+     * verification). A session never shares connections with plain `fetch` or
+     * another client, so a connection opened with relaxed TLS cannot serve a
+     * client that expects strict verification. Default-TLS clients use plain fetch.
+     */
+    private readonly session;
     private readonly onTrace;
     private readonly onValidationWarning;
     private projectsResource?;
@@ -294,7 +300,8 @@ export declare class DataikuClient {
      * When the response exceeds the cap, earlier bytes are discarded, only
      * the tail is kept and `truncated` is true — so callers that need the end
      * of a large document (e.g. job logs) stay bounded without losing the most
-     * recent content. The read runs under the request deadline.
+     * recent content. The request timeout applies per received chunk (a stall
+     * deadline), not to the whole transfer.
      */
     getTextTailLimited(path: string, maxBytes: number): Promise<{
         text: string;
@@ -385,6 +392,11 @@ export declare class DataikuClient {
      * Returns `truncated: true` when bytes had to be dropped. Bytes that fall
      * in the middle of a UTF-8 character are dropped from both ends so the
      * decoded text never contains a replacement character.
+     *
+     * The request timeout applies per chunk (a stall deadline), like the
+     * streaming path: a large body that keeps arriving is read to EOF however
+     * long the whole transfer takes, while a body that stops sending for longer
+     * than the timeout fails with the body-read timeout error.
      */
     private readBodyTextTail;
     private buildResponseTooLargeError;

package/dist/src/client.js

@@ -211,7 +211,13 @@ export class DataikuClient {
     maxResponseBodyBytes;
     retryMaxAttempts;
     verbose;
-    tlsOptions;
+    /**
+     * Connection pool carrying this client's TLS settings (custom CA, disabled
+     * verification). A session never shares connections with plain `fetch` or
+     * another client, so a connection opened with relaxed TLS cannot serve a
+     * client that expects strict verification. Default-TLS clients use plain fetch.
+     */
+    session;
     onTrace;
     onValidationWarning;
     /* Resource namespaces — lazily initialized to break circular imports */
@@ -606,7 +612,8 @@ export class DataikuClient {
         const rawMax = config?.retryMaxAttempts ?? DEFAULT_RETRY_MAX_ATTEMPTS;
         this.retryMaxAttempts = Math.min(Math.max(1, rawMax), MAX_RETRY_ATTEMPTS_CAP);
         this.verbose = config?.verbose === true;
-        this.tlsOptions = config ? buildFetchTlsOptions(config) : undefined;
+        const tls = config ? buildFetchTlsOptions(config) : undefined;
+        this.session = tls ? new Bun.FetchSession({ tls, }) : undefined;
         this.onTrace = config?.onTrace ?? defaultTrace;
         this.onValidationWarning = config?.onValidationWarning ?? defaultValidationWarning;
     }
@@ -691,7 +698,8 @@ export class DataikuClient {
      * When the response exceeds the cap, earlier bytes are discarded, only
      * the tail is kept and `truncated` is true — so callers that need the end
      * of a large document (e.g. job logs) stay bounded without losing the most
-     * recent content. The read runs under the request deadline.
+     * recent content. The request timeout applies per received chunk (a stall
+     * deadline), not to the whole transfer.
      */
     async getTextTailLimited(path, maxBytes) {
         const limit = Math.max(0, Math.floor(maxBytes));
@@ -1080,6 +1088,11 @@ export class DataikuClient {
      * Returns `truncated: true` when bytes had to be dropped. Bytes that fall
      * in the middle of a UTF-8 character are dropped from both ends so the
      * decoded text never contains a replacement character.
+     *
+     * The request timeout applies per chunk (a stall deadline), like the
+     * streaming path: a large body that keeps arriving is read to EOF however
+     * long the whole transfer takes, while a body that stops sending for longer
+     * than the timeout fails with the body-read timeout error.
      */
     async readBodyTextTail(res, maxBytes) {
         const limit = Math.max(0, Math.floor(maxBytes));
@@ -1090,13 +1103,9 @@ export class DataikuClient {
         let writeOffset = 0;
         let retainedBytes = 0;
         let truncated = false;
-        const startedAt = Date.now();
         try {
             while (true) {
-                const remainingMs = this.requestTimeoutMs - (Date.now() - startedAt);
-                if (remainingMs <= 0)
-                    throw buildBodyReadTimeoutError(this.requestTimeoutMs);
-                const { done, value, } = await readChunkWithDeadline(reader, remainingMs, this.requestTimeoutMs);
+                const { done, value, } = await readChunkWithDeadline(reader, this.requestTimeoutMs, this.requestTimeoutMs);
                 if (done)
                     break;
                 if (limit === 0) {
@@ -1187,9 +1196,8 @@ export class DataikuClient {
                     ...init,
                     method,
                     signal: controller.signal,
+                    ...(this.session ? { session: this.session, } : {}),
                 };
-                if (this.tlsOptions)
-                    requestInit.tls = this.tlsOptions;
                 const res = await fetch(url, requestInit);
                 this.logTrace({
                     phase: "response",