@query-farm/vgi 0.26.1 → 0.28.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@query-farm/vgi",
-  "version": "0.26.1",
+  "version": "0.28.0",
   "description": "TypeScript framework for extending DuckDB with user-defined functions via the Vector Gateway Interface (VGI) over Arrow IPC.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Query Farm LLC (https://query.farm)",
@@ -90,12 +90,12 @@
   },
   "peerDependencies": {
     "@query-farm/apache-arrow": "^21.1.1",
-    "@query-farm/vgi-rpc": ">=0.20.0 <0.21.0"
+    "@query-farm/vgi-rpc": ">=0.21.0 <0.22.0"
   },
   "devDependencies": {
     "@duckdb/node-api": "^1.5.5-r.4",
     "@query-farm/apache-arrow": "^21.1.1",
-    "@query-farm/vgi-rpc": "^0.20.0",
+    "@query-farm/vgi-rpc": "^0.21.0",
     "@types/bun": "latest",
     "typescript": "^7.0.2"
   },

package/src/http/fetch.ts

@@ -29,10 +29,18 @@ export interface VgiFetchOptions {
   prefix?: string;
   /** Server ID for state-token attribution (default "vgi-cf"). */
   serverId?: string;
-  /** CORS allowed origins. When set, CORS headers are added to all responses,
-   *  and the preflight `OPTIONS` that browser clients (e.g. the hosted Cupola
-   *  UI) send before `__describe__` will succeed. Omit to disable CORS. */
-  corsOrigins?: string;
+  /** CORS allowed origins, added to all responses so the preflight `OPTIONS`
+   *  that browser clients send before `__describe__` succeeds.
+   *
+   *  **Defaults to `"*"`.** A VGI worker exists to be attached and explored, and
+   *  the hosted Cupola UI reaches it from another origin, so cross-origin is the
+   *  normal case rather than the exception — and a worker that omits this gets
+   *  no CORS headers at all, which fails only in a browser and only for someone
+   *  else's page, i.e. nowhere its author is looking. `serveVgiWorker` has
+   *  always defaulted this way; this matches it so both entries agree.
+   *
+   *  Pass `null` to disable CORS. */
+  corsOrigins?: string | null;
   /** Public source-repository URL, surfaced on the landing page. */
   repositoryUrl?: string;
   /** Worker identity for the standardized VGI landing surface: `GET /` serves
@@ -92,7 +100,8 @@ export function createVgiFetch(opts: VgiFetchOptions): (req: Request) => Promise
     tokenKey: opts.signingKey,
     tokenTtl,
     stateSerializer: arrowStateSerializer,
-    corsOrigins: opts.corsOrigins,
+    // `null` is the explicit opt-out; `undefined` (omitted) means "*".
+    corsOrigins: opts.corsOrigins === null ? undefined : (opts.corsOrigins ?? "*"),
     repositoryUrl: opts.repositoryUrl,
     // The landing surface is ours, contributed into vgi-rpc's routing rather
     // than built there. `enableLandingPage: false` drops vgi-rpc's generic

package/src/serve-entry.ts

@@ -179,9 +179,11 @@ export function createVgiWorkerFetch(
   const env = opts.env ?? (process.env as ServeEnv);
   const signingKey = resolveSigningKey(opts.signingKey, env);
   const tokenTtl = resolveTokenTtl(opts.tokenTtl, env);
-  // `null` disables CORS; `undefined` falls through to the env var, then "*".
-  const corsOrigins =
-    opts.corsOrigins === null ? undefined : (opts.corsOrigins ?? env.CORS_ORIGINS ?? "*");
+  // `null` disables CORS and must stay `null` through to createVgiFetch, which
+  // now reads a bare `undefined` as "default to *" — passing `undefined` here to
+  // mean "off" would silently re-enable it. `undefined` falls through to the env
+  // var and then to that same default.
+  const corsOrigins = opts.corsOrigins === null ? null : (opts.corsOrigins ?? env.CORS_ORIGINS);
 
   return createVgiFetch({
     protocol: { registry: opts.registry, catalogInterface: opts.catalogInterface },