@query-farm/vgi 0.43.0 → 0.44.0

package/dist/codec/asd.d.ts

@@ -15,7 +15,9 @@
 import { type VgiSchema } from "../arrow/index.js";
 /**
  * Encode a typed object as a single-row Arrow IPC stream using `schema`.
- * Matches Python's `ArrowSerializableDataclass.serialize_to_bytes()`.
+ * Matches Python's `ArrowSerializableDataclass.serialize_to_bytes()`, including
+ * its container rules: a non-nullable list/map left out or null is written as
+ * empty, and list items / map values are never null (see `conformRecord`).
  */
 export declare function encodeASD(schema: VgiSchema, obj: Record<string, any>): Uint8Array;
 /** Compare two strings by Unicode code point (= UTF-8 byte order). */

package/dist/codec/conform.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Wire conformance for protocol records.
+ *
+ * vgi-python is the reference for the wire shape, and two of its rules are not
+ * expressed by a record's Arrow schema nullability flags alone:
+ *
+ *  1. A **non-nullable list or map column is never null.** Python's dataclass
+ *     defaults a `list[...]` / `dict[...]` field to an empty container, so an
+ *     "absent" list goes out as `[]`. A JS caller that leaves the field out (or
+ *     passes `null`) would otherwise put a null in a column the schema calls
+ *     non-null — `CatalogInfo.releases`, `CatalogInfo.attach_option_specs`,
+ *     ... — which a strict client rejects as a protocol error.
+ *
+ *  2. **List items and map values are never null** unless the Python annotation
+ *     says so (`list[str | None]`). pyarrow marks every list item field nullable,
+ *     so the generated schemas carry `item: nullable=true` everywhere and cannot
+ *     tell the two apart. In the whole protocol exactly one field has optional
+ *     items — `argument_names` on `BindRequest` / `AggregateBindRequest` (a
+ *     positional argument has no name). Every other null item is a bug on the
+ *     sending side (e.g. `BindResponse.lookup_names` built from an unset secret
+ *     name, where Python sends `""`).
+ *
+ * `conformRecord` applies both rules to a record about to be encoded: a null or
+ * absent non-nullable list/map becomes empty, and a null list item / map value
+ * becomes its type's zero value (`""`, `0`, `false`, empty bytes, empty list),
+ * which is also what the C++ client reads such an item as. It never mutates its
+ * input (catalog items may be frozen and shared) and returns the input itself
+ * when nothing needed changing. Nullable columns, and scalars, pass through
+ * untouched: a null in a non-nullable scalar column has no safe default and is
+ * left for the caller to fix (see `wireViolations`).
+ */
+import { type VgiSchema, type VgiDataType } from "../arrow/index.js";
+/**
+ * Top-level / struct-child field names whose list items may legitimately be
+ * null (the Python annotation is `list[X | None]`). Derived from vgi-python by
+ * walking every protocol dataclass's type hints; keep in sync if the protocol
+ * adds another optional-item list.
+ */
+export declare const OPTIONAL_ITEM_FIELDS: ReadonlySet<string>;
+/** The value a non-null slot of `type` takes when the sender left it null. */
+export declare function zeroValue(type: VgiDataType): unknown;
+/**
+ * `obj` conformed to `schema`'s wire rules (see the module comment). Returns
+ * `obj` itself when nothing changed.
+ */
+export declare function conformRecord<T extends Record<string, any>>(schema: VgiSchema, obj: T): T;
+/**
+ * Column-dict form of `conformRecord` for `batchFromColumns` callers: each
+ * value is a one-element array holding the row's value.
+ */
+export declare function conformColumns(schema: VgiSchema, columns: Record<string, unknown[]>): Record<string, unknown[]>;

package/dist/errors.d.ts

@@ -1,6 +1,10 @@
+import type { ErrorCode } from "@query-farm/vgi-rpc";
 export declare class VgiError extends Error {
-    constructor(message: string);
+    /** Canonical code hoisted as `vgi_rpc.error_code`; unset means `UNKNOWN`. */
+    readonly errorCode?: ErrorCode;
+    constructor(message: string, code?: ErrorCode);
 }
+/** A worker bug (the function returned the wrong number of rows): UNKNOWN. */
 export declare class RowCountMismatchError extends VgiError {
     constructor(expected: number, actual: number);
 }

package/dist/index.core.d.ts

@@ -28,7 +28,7 @@ export type { LandingInfo } from "./http/landing.js";
 export { createLandingRoutes } from "./http/landing.js";
 export { BindResultSchema, ScanFunctionResultSchema } from "./generated/vgi-protocol-schemas.js";
 export { type AttachOptionSpec, serializeAttachOptionSpec, serializeAttachOptionSpecs, deserializeAttachOptionSpec, deserializeAttachOptionSpecs, RESERVED_ATTACH_OPTION, ReservedAttachOptionError, } from "./catalog/attach-option.js";
-export { ATTACH_TICKET_OPTION, ATTACH_TICKET_PREFIX, ATTACH_TICKETS_PROTOCOL_NAME, ATTACH_TICKETS_PROTOCOL_VERSION, ATTACH_TICKET_SCHEMA, SEAL_ATTACH_REQUEST_SCHEMA, AttachTicketExpiredError, AttachTicketInvalidError, AttachTicketRequestError, SealAttachDeniedError, type AttachTicketClaims, type RestoredAttach, attachTicketAad, mintAttachTicket, openAttachTicket, redeemAttachTicket, } from "./attach-ticket.js";
+export { ATTACH_TICKET_OPTION, ATTACH_TICKET_PREFIX, ATTACH_TICKETS_PROTOCOL_NAME, ATTACH_TICKETS_PROTOCOL_VERSION, ATTACH_TICKET_SCHEMA, SEAL_ATTACH_REQUEST_SCHEMA, AttachTicketExpiredError, AttachTicketInvalidError, AttachTicketRequestError, SealAttachDeniedError, type AttachTicket, type AttachTicketClaims, type RestoredAttach, encodeAttachTicket, attachTicketAad, mintAttachTicket, openAttachTicket, redeemAttachTicket, } from "./attach-ticket.js";
 export { type ColumnStatistics, serializeColumnStatistics } from "./util/statistics.js";
 export { toUint8Array } from "./util/bytes.js";
 export { iterRows, batchFromRows, batchFromColumns, emptyBatch, filterBatch, projectSchema, projectBatch, batchToScalarDict, batchToSecretDict, safeNumber, } from "./util/arrow/index.js";

package/dist/index.js

@@ -1,4 +1,27 @@
 var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
 var __returnValue = (v) => v;
 function __exportSetter(name, newValue) {
   this[name] = __returnValue.bind(null, newValue);
@@ -2021,6 +2044,11 @@ var init_arrow = __esm(() => {
 });
 
 // src/functions/storage-cf-do.ts
+var exports_storage_cf_do = {};
+__export(exports_storage_cf_do, {
+  FunctionStorageCfDo: () => FunctionStorageCfDo
+});
+
 class FunctionStorageCfDo {
   _baseUrl;
   _token;
@@ -2466,7 +2494,7 @@ function resolveStorageFromEnv() {
     return new FunctionStorageSqlite;
   }
   if (backend === "cloudflare-do") {
-    init_storage_cf_do();
+    const { FunctionStorageCfDo } = (init_storage_cf_do(), __toCommonJS(exports_storage_cf_do));
     return FunctionStorageCfDo.fromEnv();
   }
   throw new Error(`Unknown VGI_WORKER_SHARED_STORAGE backend: '${backend}'. Supported: 'memory', 'sqlite', 'cloudflare-do'.`);
@@ -2637,9 +2665,12 @@ var DEFAULT_MAX_WORKERS = 99999;
 
 // src/errors.ts
 class VgiError extends Error {
-  constructor(message) {
+  errorCode;
+  constructor(message, code) {
     super(message);
     this.name = "VgiError";
+    if (code !== undefined)
+      this.errorCode = code;
   }
 }
 
@@ -2652,42 +2683,42 @@ class RowCountMismatchError extends VgiError {
 
 class FunctionNotFoundError extends VgiError {
   constructor(name, available) {
-    super(`Unknown function '${name}'`);
+    super(`Unknown function '${name}'`, "NOT_FOUND");
     this.name = "FunctionNotFoundError";
   }
 }
 
 class CatalogReadOnlyError extends VgiError {
   constructor(operation) {
-    super(`catalog is read-only: ${operation} is not supported`);
+    super(`catalog is read-only: ${operation} is not supported`, "FAILED_PRECONDITION");
     this.name = "CatalogReadOnlyError";
   }
 }
 
 class CatalogNotFoundError extends VgiError {
   constructor(entity, name) {
-    super(`${entity} '${name}' not found`);
+    super(`${entity} '${name}' not found`, "NOT_FOUND");
     this.name = "CatalogNotFoundError";
   }
 }
 
 class CatalogAlreadyExistsError extends VgiError {
   constructor(entity, name) {
-    super(`${entity} '${name}' already exists`);
+    super(`${entity} '${name}' already exists`, "ALREADY_EXISTS");
     this.name = "CatalogAlreadyExistsError";
   }
 }
 
 class ArgumentValidationError extends VgiError {
   constructor(message) {
-    super(message);
+    super(message, "INVALID_ARGUMENT");
     this.name = "ArgumentValidationError";
   }
 }
 
 class NoCatalogError extends VgiError {
   constructor() {
-    super("No catalog is configured for this worker");
+    super("No catalog is configured for this worker", "UNIMPLEMENTED");
     this.name = "NoCatalogError";
   }
 }
@@ -5381,6 +5412,137 @@ init_arrow();
 
 // src/protocol/serializers/shared.ts
 init_arrow();
+
+// src/codec/conform.ts
+init_arrow();
+var OPTIONAL_ITEM_FIELDS = new Set(["argument_names"]);
+function children(type) {
+  return type.children ?? [];
+}
+function mapValueType(type) {
+  const entries = children(type)[0].type;
+  return children(entries)[1].type;
+}
+function mapPairs(raw) {
+  if (Array.isArray(raw))
+    return raw.map((e) => Array.isArray(e) ? [e[0], e[1]] : [e?.key, e?.value]);
+  if (raw instanceof Map)
+    return Array.from(raw.entries());
+  if (typeof raw[Symbol.iterator] === "function")
+    return Array.from(raw);
+  return Object.entries(raw);
+}
+function zeroValue(type) {
+  if (isUtf8(type) || isDictionary(type))
+    return "";
+  if (isBinary(type))
+    return new Uint8Array(0);
+  if (isBool(type))
+    return false;
+  if (isInt(type))
+    return type.bitWidth === 64 ? 0n : 0;
+  if (isFloat(type))
+    return 0;
+  if (isList(type) || isMap(type))
+    return [];
+  if (isStruct(type)) {
+    const out = {};
+    for (const c of children(type))
+      out[c.name] = c.nullable ? null : conformValue(c.type, undefined, false, c.name);
+    return out;
+  }
+  return null;
+}
+var HAS_CONTAINER = new WeakMap;
+function hasContainer(type) {
+  const cached = HAS_CONTAINER.get(type);
+  if (cached !== undefined)
+    return cached;
+  let has = isList(type) || isMap(type);
+  if (!has && isStruct(type))
+    has = children(type).some((c) => hasContainer(c.type));
+  HAS_CONTAINER.set(type, has);
+  return has;
+}
+function conformValue(type, value, nullable, name) {
+  if (value == null) {
+    if (nullable)
+      return value ?? null;
+    if (isList(type) || isMap(type))
+      return [];
+    return value;
+  }
+  if (!hasContainer(type))
+    return value;
+  if (isList(type)) {
+    const itemType = children(type)[0].type;
+    const itemsNullable = OPTIONAL_ITEM_FIELDS.has(name);
+    const items = Array.isArray(value) ? value : Array.from(value);
+    let changed = !Array.isArray(value);
+    const out = items.map((item) => {
+      const next = item == null && !itemsNullable ? zeroValue(itemType) : conformValue(itemType, item, true, name);
+      if (next !== item)
+        changed = true;
+      return next;
+    });
+    return changed ? out : value;
+  }
+  if (isMap(type)) {
+    const valueType = mapValueType(type);
+    const pairs = mapPairs(value);
+    let changed = false;
+    const out = pairs.map(([k, v]) => {
+      const next = v == null ? zeroValue(valueType) : conformValue(valueType, v, true, name);
+      if (next !== v)
+        changed = true;
+      return [k, next];
+    });
+    return changed ? out : value;
+  }
+  if (isStruct(type)) {
+    let out = null;
+    for (const c of children(type)) {
+      const v = value[c.name];
+      const next = conformValue(c.type, v, c.nullable, c.name);
+      if (next !== v) {
+        (out ??= { ...value })[c.name] = next;
+      }
+    }
+    return out ?? value;
+  }
+  return value;
+}
+function conformRecord(schema, obj) {
+  let out = null;
+  for (const f of schema.fields) {
+    const v = obj[f.name];
+    const next = conformValue(f.type, v, f.nullable, f.name);
+    if (next !== v) {
+      (out ??= { ...obj })[f.name] = next;
+    }
+  }
+  return out ?? obj;
+}
+function conformColumns(schema, columns) {
+  let out = null;
+  for (const f of schema.fields) {
+    const col = columns[f.name];
+    const rows = col ?? [undefined];
+    let changed = col === undefined;
+    const next = rows.map((v) => {
+      const c = conformValue(f.type, v, f.nullable, f.name);
+      if (c !== v)
+        changed = true;
+      return c;
+    });
+    if (changed) {
+      (out ??= { ...columns })[f.name] = next;
+    }
+  }
+  return out ?? columns;
+}
+
+// src/protocol/serializers/shared.ts
 function toUint8Array2(val) {
   if (typeof val === "string")
     return new TextEncoder().encode(val);
@@ -5392,8 +5554,9 @@ function toUint8Array2(val) {
 }
 function buildSingleRowBatch(schema, values) {
   const cols = {};
+  const row = conformRecord(schema, values);
   for (const f of schema.fields) {
-    let val = values[f.name];
+    let val = row[f.name];
     if (isInt(f.type) && f.type.bitWidth === 64 && typeof val === "number") {
       val = BigInt(val);
     }
@@ -5433,7 +5596,7 @@ function serializeBindRequest(req) {
   return buildSingleRowBatch(BIND_REQUEST_SCHEMA, {
     function_name: req.function_name,
     arguments: serializeArguments(req.arguments),
-    function_type: req.function_type,
+    function_type: req.function_type == null ? req.function_type : String(req.function_type).toUpperCase(),
     input_schema: req.input_schema ? serializeSchema(req.input_schema) : null,
     settings: req.settings ? serializeBatch(req.settings) : null,
     secrets: req.secrets ? serializeBatch(req.secrets) : null,
@@ -7035,7 +7198,7 @@ function schemaPathDisplay(path) {
 // src/codec/asd.ts
 init_arrow();
 function encodeASD(schema, obj) {
-  return serializeBatch(batchFromRows([sortMapsForSchema(schema, obj)], schema));
+  return serializeBatch(batchFromRows([sortMapsForSchema(schema, conformRecord(schema, obj))], schema));
 }
 function compareCodePoints(a, b) {
   const n = Math.min(a.length, b.length);
@@ -7052,7 +7215,7 @@ function compareCodePoints(a, b) {
   }
   return a.length - b.length;
 }
-function mapPairs(raw) {
+function mapPairs2(raw) {
   if (Array.isArray(raw))
     return raw.map((e) => Array.isArray(e) ? [e[0], e[1]] : [e?.key, e?.value]);
   if (raw instanceof Map)
@@ -7087,7 +7250,7 @@ function sortMapsForType(type, value) {
   if (isMap(type)) {
     const entries = type.children[0].type;
     const valueType = entries.children[1].type;
-    return mapPairs(value).map(([k, v]) => [k, sortMapsForType(valueType, v)]).sort((x, y) => compareKeys(x[0], y[0]));
+    return mapPairs2(value).map(([k, v]) => [k, sortMapsForType(valueType, v)]).sort((x, y) => compareKeys(x[0], y[0]));
   }
   if (isList(type)) {
     const child = type.children[0].type;
@@ -8252,12 +8415,12 @@ var encodeAttachCatalogInfo = (v) => encodeASD(AttachCatalogInfoSchema, {
   secret_ref: v.secret_ref ?? ""
 });
 function encodeScanFunctionResult(functionName, argumentsBytes, requiredExtensions = [], schemaPath = null) {
-  return serializeBatch(batchFromColumns({
+  return serializeBatch(batchFromColumns(conformColumns(ScanFunctionResultSchema, {
     function_name: [functionName],
     arguments: [argumentsBytes],
     required_extensions: [requiredExtensions],
     schema_path: [schemaPath]
-  }, ScanFunctionResultSchema));
+  }), ScanFunctionResultSchema));
 }
 function decodeScanFunctionResult(inner) {
   const argsBytes = inner.arguments;
@@ -8301,7 +8464,7 @@ function singleBranchResult(legacy) {
   };
 }
 function encodeScanBranch(cols) {
-  return serializeBatch(batchFromColumns({
+  return serializeBatch(batchFromColumns(conformColumns(ScanBranchSchema, {
     function_name: [cols.function_name],
     arguments: [cols.arguments],
     branch_filter: [cols.branch_filter ?? null],
@@ -8313,7 +8476,7 @@ function encodeScanBranch(cols) {
     format_locations: [cols.format_locations ?? null],
     format_options: [cols.format_options ?? null],
     schema_path: [cols.schema_path ?? null]
-  }, ScanBranchSchema));
+  }), ScanBranchSchema));
 }
 function encodeFormatOptions(options) {
   const fields = [];
@@ -8884,7 +9047,7 @@ class ReadOnlyCatalogInterface extends CatalogInterface {
   }
   attach(name, options, dataVersionSpec, implementationVersion) {
     if (!this.catalogs().includes(name)) {
-      throw new Error(`No worker handles catalog '${name}'`);
+      throw new VgiError(`No worker handles catalog '${name}'`, "NOT_FOUND");
     }
     validateRequiredAttachOptions(name, this.attachOptionSpecs(name), options ?? {});
     const attachOpaqueData = new Uint8Array(16);
@@ -9284,11 +9447,11 @@ class ReadOnlyCatalogInterface extends CatalogInterface {
     validateAtParams(atUnit, atValue);
     const schema = this._descriptor.schemas.find((s) => schemaPathsEqual(schemaDescriptorPath(s), schemaPath));
     if (!schema || !schema.tables) {
-      throw new Error(`Table '${name}' not found in schema ${schemaPathDisplay(schemaPath)}`);
+      throw new VgiError(`Table '${name}' not found in schema ${schemaPathDisplay(schemaPath)}`, "NOT_FOUND");
     }
     const table = schema.tables.find((t) => t.name === name);
     if (!table) {
-      throw new Error(`Table '${name}' not found in schema ${schemaPathDisplay(schemaPath)}`);
+      throw new VgiError(`Table '${name}' not found in schema ${schemaPathDisplay(schemaPath)}`, "NOT_FOUND");
     }
     if (atUnit && !table.supportsTimeTravel) {
       throw new Error(`Table ${schemaPathDisplay(schemaPath)}.${name} does not support time travel queries`);
@@ -9373,12 +9536,12 @@ function resolveIndexGroups(schema, groups) {
 function serializeForeignKeys(fks, schemaPath) {
   if (!fks || fks.length === 0)
     return [];
-  return fks.map((fk) => serializeBatch(batchFromColumns({
+  return fks.map((fk) => serializeBatch(batchFromColumns(conformColumns(ForeignKeyInfoSchema, {
     fk_columns: [fk.columns],
     pk_columns: [fk.referencedColumns],
     referenced_table: [fk.referencedTable],
     referenced_schema_path: [fk.referencedSchemaPath ?? schemaPath ?? ["main"]]
-  }, ForeignKeyInfoSchema)));
+  }), ForeignKeyInfoSchema)));
 }
 function defaultToSql(value) {
   if (value === null || value === undefined)
@@ -9518,7 +9681,7 @@ function serializeArgsBatch(args, argSpecSchema) {
 }
 function validateAtParams(atUnit, atValue) {
   if (Boolean(atUnit) !== Boolean(atValue)) {
-    throw new Error("at_unit and at_value must both be provided or both be absent");
+    throw new VgiError("at_unit and at_value must both be provided or both be absent", "INVALID_ARGUMENT");
   }
 }
 function inferScalarType2(val) {
@@ -10403,7 +10566,7 @@ class CompositeCatalogInterface extends CatalogInterface {
         return result;
       }
     }
-    throw new Error(`No worker handles catalog '${name}'`);
+    throw new VgiError(`No worker handles catalog '${name}'`, "NOT_FOUND");
   }
   async detach(attachOpaqueData) {
     await this._route(attachOpaqueData).detach(attachOpaqueData);
@@ -10727,7 +10890,7 @@ class FunctionRegistry {
       } else if (candidates && candidates.length > 0) {
         const schemas = this.schemasFor(name);
         if (schemas.length > 0) {
-          throw new Error(`Function '${name}' is not registered in schema ${schemaPathDisplay(schemaPath)}. ` + `It is available in: [${schemas.map(schemaPathDisplay).join(", ")}]`);
+          throw new VgiError(`Function '${name}' is not registered in schema ${schemaPathDisplay(schemaPath)}. ` + `It is available in: [${schemas.map(schemaPathDisplay).join(", ")}]`, "NOT_FOUND");
         }
       }
     }
@@ -12315,7 +12478,8 @@ function normalizeRequestSchemaPaths(params) {
 }
 function wrapResult(values, innerSchema) {
   const a = innerSchema;
-  const batch = batchFromColumns(Object.fromEntries(a.fields.map((f) => [f.name, [values[f.name] ?? null]])), a);
+  const row = conformRecord(a, values);
+  const batch = batchFromColumns(Object.fromEntries(a.fields.map((f) => [f.name, [row[f.name] ?? null]])), a);
   return { result: serializeBatch(batch) };
 }
 function overloadContext(req, catalogInterface) {
@@ -13331,7 +13495,7 @@ import {
 var ATTACH_TICKET_PREFIX = "vgia1.";
 var ATTACH_TICKET_OPTION = RESERVED_ATTACH_OPTION;
 var ATTACH_TICKETS_PROTOCOL_NAME = "vgi.attach_tickets.v1";
-var ATTACH_TICKETS_PROTOCOL_VERSION = "1.0.0";
+var ATTACH_TICKETS_PROTOCOL_VERSION = "2.0.0";
 var TICKET_ENVELOPE_VERSION = 1;
 var MAX_OPTIONS_BYTES = 16 * 1024;
 var MAX_TICKET_CHARS = 32 * 1024;
@@ -13606,8 +13770,19 @@ var SEAL_ATTACH_REQUEST_SCHEMA = schema2([
 ]);
 var ATTACH_TICKET_SCHEMA = schema2([
   field2("ticket", utf82(), false),
-  field2("expires_at", float642(), false)
+  field2("expires_at", timestamp2(TimeUnit2.MICROSECOND, "UTC"), true)
 ]);
+function expiresAtMicros(value) {
+  if (value === null)
+    return null;
+  const ms = value.getTime();
+  if (!Number.isFinite(ms))
+    throw new TypeError("AttachTicket.expires_at must be a valid Date or null");
+  return BigInt(ms) * 1000n;
+}
+function encodeAttachTicket(ticket) {
+  return serializeBatch(batchFromColumns({ ticket: [ticket.ticket], expires_at: [expiresAtMicros(ticket.expires_at)] }, ATTACH_TICKET_SCHEMA));
+}
 function resolveTicketMaxTtl(grantKeys, env) {
   if (grantKeys)
     return Math.trunc(grantKeys.maxTtlSeconds);
@@ -13694,7 +13869,7 @@ async function sealAttach2(config, request, auth) {
   } catch (e) {
     throw new AttachTicketRequestError("seal_attach request is invalid", [["request", e.message]]);
   }
-  return { ticket: token, expires_at: expiresAt === 0 ? Number.POSITIVE_INFINITY : expiresAt };
+  return { ticket: token, expires_at: expiresAt === 0 ? null : new Date(expiresAt * 1000) };
 }
 function buildAttachTicketsProtocol(config) {
   const p = new Protocol2(ATTACH_TICKETS_PROTOCOL_NAME, { protocolVersion: ATTACH_TICKETS_PROTOCOL_VERSION });
@@ -13705,8 +13880,7 @@ function buildAttachTicketsProtocol(config) {
     handler: async (params, ctx) => {
       const request = unwrapRequest(params.request);
       const sealed = await sealAttach2(config, request, ctx?.auth);
-      const batch = batchFromColumns({ ticket: [sealed.ticket], expires_at: [sealed.expires_at] }, ATTACH_TICKET_SCHEMA);
-      return { result: serializeBatch(batch) };
+      return { result: encodeAttachTicket(sealed) };
     }
   });
   return p;
@@ -14386,6 +14560,10 @@ function toAsyncIterator(input) {
 }
 
 // src/client/client.ts
+function onConflictName(onConflict) {
+  return String(onConflict).toUpperCase();
+}
+
 class VgiClient {
   rpc;
   defaultAttachOpaqueData;
@@ -14841,7 +15019,7 @@ class VgiClient {
     }
     await this.rpc.call("catalog_create", {
       name,
-      on_conflict: onConflict,
+      on_conflict: onConflictName(onConflict),
       options: wireOptions
     });
   }
@@ -14909,7 +15087,7 @@ class VgiClient {
     await this.rpc.call("catalog_schema_create", {
       attach_opaque_data: attachOpaqueData,
       path: normalizeSchemaPath(path),
-      on_conflict: opts?.onConflict ?? "error",
+      on_conflict: onConflictName(opts?.onConflict ?? "error"),
       comment: opts?.comment ?? null,
       tags: tagsMap,
       transaction_opaque_data: opts?.transactionOpaqueData ?? null
@@ -14988,7 +15166,7 @@ class VgiClient {
       schema_path: normalizeSchemaPath(schemaPath),
       name,
       columns,
-      on_conflict: onConflict,
+      on_conflict: onConflictName(onConflict),
       not_null_constraints: notNullConstraints ?? null,
       unique_constraints: uniqueConstraints ?? null,
       check_constraints: checkConstraints ?? null,
@@ -15142,7 +15320,7 @@ class VgiClient {
       schema_path: normalizeSchemaPath(schemaPath),
       name,
       definition,
-      on_conflict: onConflict,
+      on_conflict: onConflictName(onConflict),
       transaction_opaque_data: transactionOpaqueData ?? null
     });
   }
@@ -15209,7 +15387,7 @@ class VgiClient {
       macro_type: [macroType],
       parameters: [parameters],
       definition: [definition],
-      on_conflict: [onConflict],
+      on_conflict: [onConflictName(onConflict)],
       parameter_default_values: [parameterDefaultValues ?? null],
       arguments_schema: [argumentsSchema ?? null],
       transaction_opaque_data: [transactionOpaqueData ?? null]
@@ -15286,7 +15464,7 @@ function validatedHostedProtocols(hosting, primary) {
     }
     const name = p.name;
     if (name.startsWith(RESERVED_PREFIX)) {
-      throw new Error(`${owner} entry ${index} is named '${name}', which claims the reserved '${RESERVED_PREFIX}' prefix. ` + "Framework protocols are not supplied through this hook: reflection is hosted automatically, and " + "vgi_rpc.Identity.v1 is enabled by supplying resolveToken and/or mintGrant.");
+      throw new Error(`${owner} entry ${index} is named '${name}', which claims the reserved '${RESERVED_PREFIX}' prefix. ` + "Framework protocols are not supplied through this hook: reflection is hosted automatically, and " + "vgi_rpc.Identity.v2 is enabled by supplying resolveToken and/or mintGrant.");
     }
     if (!/^[A-Za-z_][A-Za-z0-9_.]*$/.test(name)) {
       throw new Error(`${owner} entry ${index}: protocol name '${name}' is not an identifier, optionally dot-qualified ` + "(e.g. 'acme.Reports.v1').");
@@ -15336,7 +15514,7 @@ function resolveIntrospectPrincipals(explicit, env) {
     principals = raw.split(",").map((p) => p.trim()).filter((p) => p !== "");
   }
   if (principals.length === 0) {
-    throw new Error("This worker supplies resolveToken, which hosts the vgi_rpc.Identity.v1 protocol, but no " + `introspector allowlist was configured. Set ${INTROSPECT_PRINCIPALS_ENV} (comma-separated) or pass ` + `introspectPrincipals.
+    throw new Error("This worker supplies resolveToken, which hosts the vgi_rpc.Identity.v2 protocol, but no " + `introspector allowlist was configured. Set ${INTROSPECT_PRINCIPALS_ENV} (comma-separated) or pass ` + `introspectPrincipals.
 
 ` + "There is no permissive default on purpose: introspection is a separate capability from " + "authentication, and allowing every authenticated caller lets any user resolve any other user's " + "credential to its owner. Remove resolveToken to leave the protocol unhosted entirely.");
   }
@@ -15719,6 +15897,7 @@ export {
   durationNanos,
   durationSeconds,
   emptyBatch,
+  encodeAttachTicket,
   encodeCatalogInfo,
   encodeCopyFromFormatInfo,
   encodeFormatOptions,
@@ -15832,4 +16011,4 @@ export {
   utf82 as utf8
 };
 
-//# debugId=4A48D657E6B1E41464756E2164756E21
+//# debugId=2C6F34EB0944BDD764756E2164756E21