@query-farm/vgi 0.36.3 → 0.37.1

package/dist/catalog/attach-option.d.ts

@@ -31,6 +31,34 @@ export interface AttachOptionSpec {
      * is by definition satisfiable without the caller.
      */
     required?: boolean;
+    /**
+     * The option carries a credential: an API key, a token, a password, or
+     * anything else that must not be shown, stored or logged in plain text.
+     *
+     * Credential options **MUST** be declared `secret: true`. The value is still
+     * passed inline as an ordinary ATTACH option; the flag tells the DuckDB
+     * extension to redact it from `duckdb_databases()`, keep only a salted hash
+     * of it in its result-cache key, and never log it. Clients use the flag to
+     * mask the field and keep the value out of shared links and exported
+     * configuration.
+     *
+     * To keep the credential out of the SQL text itself, pass it as an
+     * expression:
+     *
+     * ```sql
+     * ATTACH 'sales' (TYPE vgi, LOCATION 'https://worker.example.com',
+     *                 api_key getenv('SALES_API_KEY'));
+     * ```
+     *
+     * Combines with `required` (a credential the catalog cannot attach without,
+     * which a client can then ask for before attaching). It is allowed together
+     * with `default`, but a secret option normally has none: a default would be
+     * a credential shipped in the catalog's own discovery metadata.
+     *
+     * Defaults to `false`. On the wire it is a nullable `secret` Bool column
+     * appended after `required`; a peer that predates it reads it as `false`.
+     */
+    secret?: boolean;
 }
 /**
  * Serialize an AttachOptionSpec to the wire format the extension expects
@@ -45,8 +73,8 @@ export declare function serializeAttachOptionSpecs(specs: Iterable<AttachOptionS
  * Deserialize one AttachOptionSpec from the wire format above.
  *
  * Reads by column name, so a spec written by a peer that predates the
- * `required` column deserializes with `required: false` rather than failing —
- * the same tolerance the Python and C++ readers have.
+ * `required` or `secret` column deserializes with that flag `false` rather
+ * than failing — the same tolerance the Python and C++ readers have.
  */
 export declare function deserializeAttachOptionSpec(bytes: Uint8Array): AttachOptionSpec;
 /** Deserialize many specs — the shape `CatalogInfo.attach_option_specs` holds. */

package/dist/client-entry.js

@@ -4329,7 +4329,8 @@ var SPEC_SCHEMA = schema2([
   field2("description", utf82(), false),
   field2("type", binary2(), false),
   field2("default_value", binary2(), true),
-  field2("required", bool2(), true)
+  field2("required", bool2(), true),
+  field2("secret", bool2(), true)
 ]);
 function deserializeAttachOptionSpec(bytes) {
   const row = [...iterRows(deserializeBatch(bytes))][0];
@@ -4352,7 +4353,8 @@ function deserializeAttachOptionSpec(bytes) {
     description: String(row.description ?? ""),
     type,
     ...value === undefined || value === null ? {} : { default: value },
-    required: row.required === true
+    required: row.required === true,
+    secret: row.secret === true
   };
 }
 function deserializeAttachOptionSpecs(specs) {
@@ -4410,4 +4412,4 @@ export {
   typeSignature
 };
 
-//# debugId=D010E9DAE6E6C42D64756E2164756E21
+//# debugId=8BECE39CB65F6AD764756E2164756E21