databricks-sql-kernel 1.0.0__tar.gz → 1.2.0__tar.gz

databricks_sql_kernel-1.2.0/.github/scripts/check-release-debuginfo.ps1

@@ -0,0 +1,154 @@
+# Copyright (c) 2026 Databricks, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+function Invoke-Checked {
+    param(
+        [Parameter(Mandatory = $true)][string]$FilePath,
+        [Parameter(Mandatory = $false)][AllowEmptyCollection()][string[]]$Arguments = @()
+    )
+
+    & $FilePath @Arguments
+    if ($LASTEXITCODE -ne 0) {
+        throw "command failed with exit code ${LASTEXITCODE}: $FilePath $($Arguments -join ' ')"
+    }
+}
+
+function Find-AsciiMatch {
+    param(
+        [Parameter(Mandatory = $true)][string]$Path,
+        [Parameter(Mandatory = $true)][regex]$Pattern
+    )
+
+    $buffer = [byte[]]::new(65536)
+    $tail = ""
+    $stream = [System.IO.File]::OpenRead($Path)
+    try {
+        while (($bytesRead = $stream.Read($buffer, 0, $buffer.Length)) -gt 0) {
+            $chunk = $tail + [System.Text.Encoding]::ASCII.GetString($buffer, 0, $bytesRead)
+            $match = $Pattern.Match($chunk)
+            if ($match.Success) {
+                return $match.Value
+            }
+            $tailLength = [Math]::Min(1024, $chunk.Length)
+            $tail = $chunk.Substring($chunk.Length - $tailLength)
+        }
+    } finally {
+        $stream.Dispose()
+    }
+    return $null
+}
+
+$profileName = "release-with-debuginfo"
+$repoRoot = (Resolve-Path (Join-Path $PSScriptRoot "../..")).Path
+$targetRoot = if ($env:CARGO_TARGET_DIR) {
+    [System.IO.Path]::GetFullPath($env:CARGO_TARGET_DIR, $repoRoot)
+} else {
+    Join-Path $repoRoot "target"
+}
+$profileDir = Join-Path $targetRoot $profileName
+$source = Join-Path $repoRoot "tests/symbols/staticlib_consumer.c"
+$includeDir = Join-Path $repoRoot "include"
+$archive = Join-Path $profileDir "databricks_sql_kernel.lib"
+$object = Join-Path $profileDir "staticlib_consumer.obj"
+$executable = Join-Path $profileDir "kernel-symbol-smoke.exe"
+$pdb = Join-Path $profileDir "kernel-symbol-smoke.pdb"
+
+New-Item -ItemType Directory -Force -Path $profileDir | Out-Null
+Push-Location $repoRoot
+try {
+    # Build the exact static archive under test and capture the MSVC system
+    # libraries that rustc says its final native linker must receive.
+    # The toolchain action enables color globally; disable it here so ANSI reset
+    # bytes cannot become part of the parsed final library argument.
+    $env:CARGO_TERM_COLOR = "never"
+    $buildLines = @(& cargo rustc --locked --profile $profileName --lib -- --print=native-static-libs 2>&1)
+    $buildExit = $LASTEXITCODE
+    $buildLines | ForEach-Object { Write-Host $_ }
+    if ($buildExit -ne 0) {
+        throw "cargo rustc failed with exit code $buildExit"
+    }
+    if (-not (Test-Path -LiteralPath $archive -PathType Leaf)) {
+        throw "Cargo did not produce $archive"
+    }
+
+    $nativeLine = $buildLines |
+        ForEach-Object { "$_" } |
+        Where-Object { $_ -match "native-static-libs:\s*(.+)$" } |
+        Select-Object -Last 1
+    if (-not $nativeLine) {
+        throw "rustc did not report native-static-libs"
+    }
+    $nativeText = ([regex]::Match($nativeLine, "native-static-libs:\s*(.+)$")).Groups[1].Value.Trim()
+    $nativeLinkArgs = @($nativeText -split "\s+" | Where-Object { $_ })
+
+    Invoke-Checked "cl.exe" @(
+        "/nologo", "/c", "/O2", "/MD", "/Z7", "/I$includeDir", $source, "/Fo$object"
+    )
+    $linkArgs = @(
+        "/NOLOGO", "/DEBUG:FULL", "/OPT:REF", "/OPT:ICF", "/INCREMENTAL:NO",
+        "/PDB:$pdb", "/PDBALTPATH:%_PDB%", "/OUT:$executable",
+        $object, $archive
+    ) + $nativeLinkArgs
+    Invoke-Checked "link.exe" $linkArgs
+    if (-not (Test-Path -LiteralPath $pdb -PathType Leaf)) {
+        throw "link.exe did not produce $pdb"
+    }
+    Invoke-Checked $executable @()
+
+    if (-not (Get-Command "dumpbin.exe" -ErrorAction SilentlyContinue)) {
+        throw "dumpbin.exe is required to validate the executable/PDB CodeView identity"
+    }
+
+    $functionPattern = [regex]::new("kernel_get_last_error")
+    $sourcePattern = [regex]::new("(?i)src[\\/]c_abi[\\/]error\.rs")
+    if (-not (Find-AsciiMatch $pdb $functionPattern)) {
+        throw "PDB does not describe kernel_get_last_error"
+    }
+    if (-not (Find-AsciiMatch $pdb $sourcePattern)) {
+        throw "PDB does not name src/c_abi/error.rs"
+    }
+
+    # The PE carries only the CodeView locator/identity; source and function
+    # records stay in the separately published PDB. In an isolated directory,
+    # dumpbin reports the adjacent PDB only when its GUID and age match the PE.
+    $checkDir = Join-Path ([System.IO.Path]::GetTempPath()) ("kernel-pdb-check-" + [guid]::NewGuid().ToString("N"))
+    New-Item -ItemType Directory -Path $checkDir | Out-Null
+    try {
+        $checkExe = Join-Path $checkDir (Split-Path -Leaf $executable)
+        $checkPdb = Join-Path $checkDir (Split-Path -Leaf $pdb)
+        Copy-Item -LiteralPath $executable -Destination $checkExe
+        Copy-Item -LiteralPath $pdb -Destination $checkPdb
+
+        $lookup = @(& dumpbin.exe /NOLOGO /PDBPATH $checkExe 2>&1)
+        $lookupExit = $LASTEXITCODE
+        $lookupText = $lookup | Out-String
+        Write-Host $lookupText
+        if ($lookupExit -ne 0) {
+            throw "dumpbin /PDBPATH failed with exit code $lookupExit"
+        }
+        if ($lookupText -notmatch [regex]::Escape($checkPdb)) {
+            throw "dumpbin did not resolve the supplied PDB; its GUID/age may not match the executable"
+        }
+    } finally {
+        Remove-Item -LiteralPath $checkDir -Recurse -Force -ErrorAction SilentlyContinue
+    }
+
+    Write-Host "ok: Windows PDB contains kernel Rust source/function info"
+    Write-Host "ok: dumpbin validated the executable/PDB CodeView GUID and age"
+} finally {
+    Pop-Location
+}

databricks_sql_kernel-1.2.0/.github/scripts/check-release-debuginfo.sh

@@ -0,0 +1,164 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026 Databricks, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+readonly PROFILE="release-with-debuginfo"
+readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+readonly REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
+readonly TARGET_ROOT="${CARGO_TARGET_DIR:-${REPO_ROOT}/target}"
+readonly PROFILE_DIR="${TARGET_ROOT}/${PROFILE}"
+readonly CONSUMER_SOURCE="${REPO_ROOT}/tests/symbols/staticlib_consumer.c"
+readonly ARCHIVE="${PROFILE_DIR}/libdatabricks_sql_kernel.a"
+readonly CONSUMER="${PROFILE_DIR}/kernel-symbol-smoke"
+
+for command in cargo cc; do
+  if ! command -v "${command}" >/dev/null 2>&1; then
+    echo "FAIL: required command not found: ${command}" >&2
+    exit 1
+  fi
+done
+
+mkdir -p "${PROFILE_DIR}"
+build_log="$(mktemp)"
+trap 'rm -f "${build_log}"' EXIT
+
+# Cargo prints the platform libraries a C/C++ final linker must add when it
+# consumes this staticlib. Capture that list while building the exact archive
+# under test.
+CARGO_TERM_COLOR=never cargo rustc --locked --profile "${PROFILE}" --lib -- \
+  --print=native-static-libs 2>&1 | tee "${build_log}"
+
+if [[ ! -f "${ARCHIVE}" ]]; then
+  echo "FAIL: Cargo did not produce ${ARCHIVE}" >&2
+  exit 1
+fi
+
+native_link_line="$(sed -n 's/^note: native-static-libs: //p' "${build_log}" | tail -n 1)"
+if [[ -z "${native_link_line}" ]]; then
+  echo "FAIL: rustc did not report native-static-libs" >&2
+  exit 1
+fi
+read -r -a native_link_args <<<"${native_link_line}"
+
+case "$(uname -s)" in
+  Linux)
+    for command in objcopy readelf; do
+      if ! command -v "${command}" >/dev/null 2>&1; then
+        echo "FAIL: required command not found: ${command}" >&2
+        exit 1
+      fi
+    done
+
+    debug_file="${CONSUMER}.debug"
+    cc -O2 -I "${REPO_ROOT}/include" "${CONSUMER_SOURCE}" "${ARCHIVE}" \
+      "${native_link_args[@]}" -Wl,--build-id=sha1 -o "${CONSUMER}"
+    "${CONSUMER}"
+
+    # This mirrors consumer packaging: retain full DWARF in the private symbol
+    # artifact, strip it from the customer executable, and leave only the GNU
+    # debug-link locator/checksum in the shipped file.
+    objcopy --only-keep-debug "${CONSUMER}" "${debug_file}"
+    objcopy --strip-debug "${CONSUMER}"
+    objcopy --add-gnu-debuglink="${debug_file}" "${CONSUMER}"
+
+    if readelf --sections "${CONSUMER}" | \
+      grep -E '\.debug_(abbrev|info|line|str)' >/dev/null; then
+      echo "FAIL: customer executable still contains DWARF sections" >&2
+      exit 1
+    fi
+    if ! readelf --sections "${CONSUMER}" | grep -F '.gnu_debuglink' >/dev/null; then
+      echo "FAIL: customer executable has no .gnu_debuglink" >&2
+      exit 1
+    fi
+
+    dwarf_dump="${PROFILE_DIR}/kernel-symbol-smoke.dwarf.txt"
+    line_dump="${PROFILE_DIR}/kernel-symbol-smoke.lines.txt"
+    readelf --debug-dump=info "${debug_file}" >"${dwarf_dump}"
+    readelf --debug-dump=decodedline "${debug_file}" >"${line_dump}"
+    if ! grep -Fq 'kernel_get_last_error' "${dwarf_dump}"; then
+      echo "FAIL: split DWARF does not describe kernel_get_last_error" >&2
+      exit 1
+    fi
+    if ! grep -Fq 'src/c_abi/error.rs' "${line_dump}"; then
+      echo "FAIL: split DWARF does not name src/c_abi/error.rs" >&2
+      exit 1
+    fi
+
+    binary_notes="$(readelf --notes "${CONSUMER}")"
+    debug_notes="$(readelf --notes "${debug_file}")"
+    binary_id="$(sed -n 's/.*Build ID: //p' <<<"${binary_notes}")"
+    debug_id="$(sed -n 's/.*Build ID: //p' <<<"${debug_notes}")"
+    if [[ -z "${binary_id}" || "${binary_id}" != "${debug_id}" ]]; then
+      echo "FAIL: executable and split DWARF build IDs do not match" >&2
+      exit 1
+    fi
+
+    echo "ok: Linux split DWARF contains kernel Rust source/function info"
+    echo "ok: executable and .debug share build ID ${binary_id}"
+    ;;
+  Darwin)
+    for command in dsymutil otool strip xcrun; do
+      if ! command -v "${command}" >/dev/null 2>&1; then
+        echo "FAIL: required command not found: ${command}" >&2
+        exit 1
+      fi
+    done
+
+    dsym="${CONSUMER}.dSYM"
+    cc -O2 -I "${REPO_ROOT}/include" "${CONSUMER_SOURCE}" "${ARCHIVE}" \
+      "${native_link_args[@]}" -o "${CONSUMER}"
+    "${CONSUMER}"
+    dsymutil "${CONSUMER}" -o "${dsym}"
+    strip -S "${CONSUMER}"
+
+    if otool -l "${CONSUMER}" | grep -F '__DWARF' >/dev/null; then
+      echo "FAIL: customer executable still contains a __DWARF segment" >&2
+      exit 1
+    fi
+
+    dwarf_dump="${PROFILE_DIR}/kernel-symbol-smoke.dwarf.txt"
+    dwarf_file="${dsym}/Contents/Resources/DWARF/$(basename "${CONSUMER}")"
+    if [[ ! -f "${dwarf_file}" ]]; then
+      echo "FAIL: dsymutil did not produce ${dwarf_file}" >&2
+      exit 1
+    fi
+    xcrun dwarfdump --name kernel_get_last_error "${dsym}" >"${dwarf_dump}"
+    if ! grep -Fq 'kernel_get_last_error' "${dwarf_dump}"; then
+      echo "FAIL: dSYM does not describe kernel_get_last_error" >&2
+      exit 1
+    fi
+    if ! grep -Eq 'DW_AT_decl_file.*error\.rs' "${dwarf_dump}"; then
+      echo "FAIL: kernel_get_last_error has no error.rs source record in the dSYM" >&2
+      exit 1
+    fi
+
+    binary_uuid_dump="$(xcrun dwarfdump --uuid "${CONSUMER}")"
+    dsym_uuid_dump="$(xcrun dwarfdump --uuid "${dsym}")"
+    binary_uuid="$(awk 'NR == 1 { print $2 }' <<<"${binary_uuid_dump}")"
+    dsym_uuid="$(awk 'NR == 1 { print $2 }' <<<"${dsym_uuid_dump}")"
+    if [[ -z "${binary_uuid}" || "${binary_uuid}" != "${dsym_uuid}" ]]; then
+      echo "FAIL: executable and dSYM UUIDs do not match" >&2
+      exit 1
+    fi
+
+    echo "ok: macOS dSYM contains kernel Rust source/function info"
+    echo "ok: executable and dSYM share UUID ${binary_uuid}"
+    ;;
+  *)
+    echo "FAIL: unsupported platform for this check: $(uname -s)" >&2
+    exit 1
+    ;;
+esac

databricks_sql_kernel-1.2.0/.github/workflows/release-debuginfo.yml

@@ -0,0 +1,138 @@
+# Copyright (c) 2026 Databricks, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Release Debuginfo
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches: [main]
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.sha || github.head_ref || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  # Hosted macOS runners cannot check out this private repository through the
+  # org IP allow list. Hand the same checked-out source to macOS through the
+  # Actions artifact service, which is not allow-list gated.
+  macos-source:
+    name: Source handoff (macOS)
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: [linux-ubuntu-latest]
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          path: repo-src
+
+      - name: Archive source
+        shell: bash
+        run: |
+          set -euo pipefail
+          tar czf repo-source.tar.gz -C repo-src --exclude='.git' .
+
+      - name: Upload source
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: release-debuginfo-source
+          path: repo-source.tar.gz
+          retention-days: 1
+          if-no-files-found: error
+
+  linux:
+    name: Linux split DWARF
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: [linux-ubuntu-latest]
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: ./.github/actions/setup-jfrog
+        with:
+          cargo: "true"
+
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          toolchain: stable
+
+      - name: Verify split DWARF
+        shell: bash
+        run: bash .github/scripts/check-release-debuginfo.sh
+
+  macos:
+    name: macOS dSYM
+    needs: macos-source
+    runs-on: macos-15
+    timeout-minutes: 45
+    steps:
+      - name: Download source
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: release-debuginfo-source
+
+      - name: Unpack source
+        shell: bash
+        run: |
+          set -euo pipefail
+          tar xzf repo-source.tar.gz -C "$GITHUB_WORKSPACE"
+          rm -f repo-source.tar.gz
+          test -f Cargo.toml
+
+      - uses: ./.github/actions/setup-jfrog
+        with:
+          cargo: "true"
+
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          toolchain: stable
+
+      - name: Verify dSYM
+        shell: bash
+        run: bash .github/scripts/check-release-debuginfo.sh
+
+  windows:
+    name: Windows linker PDB
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: [windows-server-latest]
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: ./.github/actions/setup-jfrog
+        with:
+          cargo: "true"
+
+      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+        with:
+          toolchain: stable
+
+      - name: Set up MSVC environment
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
+        with:
+          arch: x64
+
+      - name: Verify linker PDB
+        shell: pwsh
+        run: ./.github/scripts/check-release-debuginfo.ps1

{databricks_sql_kernel-1.0.0 → databricks_sql_kernel-1.2.0}/CHANGELOG.md

@@ -14,6 +14,90 @@ cadences and may not move in lockstep with the crate.
 
 ### Fixed
 
+## [v1.2.0] - 2026-10-19
+
+### Added
+- Thrift-native metadata routing with compatible public-schema casts and
+  one-based `getColumns` ordinals.
+- Native Arrow `GEOMETRY` / `GEOGRAPHY` results as tagged `struct<srid,wkb>`
+  values, including nested values and empty-result schemas. The kernel uses
+  the structured logical manifest to reconcile attachments without copying
+  child buffers.
+- Typed client-side `GEOMETRY` / `GEOGRAPHY` result representation selection.
+  The kernel normalizes both standard-warehouse WKT / EWKT and Reyden's native
+  SRID+WKB struct to the requested representation. No representation setting
+  is sent to SEA.
+- The default-enabled `kernel_session_config_set_enable_geospatial_support()`
+  C ABI setting selects native SRID+WKB Arrow results when enabled and
+  WKT / EWKT strings when disabled.
+- Authenticated connector-service feature flags with a bounded, process-wide
+  workspace cache and kernel-internal typed readers for all six SAFE types.
+- Result schemas carry the Thrift-compatible `Spark:DataType:SqlName` and
+  optional `Spark:DataType:JsonType` field metadata from the SEA manifest.
+- Caller-driven asynchronous statement submission, status polling, result
+  materialization, query IDs, row counts, cancellation, and close over the C ABI.
+- Nonblocking result-batch fetching through Rust `try_next_batch()` and the C ABI.
+- `Statement::submit_with_timeout()` enforces one client deadline across
+  submission and asynchronous status polling, with cancellation on expiry.
+
+### Changed
+- Native SRID+WKB is now the default geospatial result representation.
+- Route function metadata through the Thrift-native metadata path when
+  supported by the server.
+- Authenticated SEA requests use `Accept-Encoding: identity` by default to
+  avoid gzipping inline LZ4-compressed Arrow results. Response compression can
+  be re-enabled through `HttpConfig` or the C ABI.
+- Feature flags are fetched after kernel authentication and before session
+  creation; sessions read process-cache values instead of retaining snapshots.
+- Kernel telemetry enablement follows the connector-service feature flag when
+  the client leaves it unspecified; explicit client settings take precedence.
+- **Breaking (Rust API):** `TelemetryConfig::enabled` changes from `bool` to
+  `Option<bool>`. `None` defers to the workspace feature flag; use
+  `with_enabled` / `set_enabled` or wrap explicit values in `Some(...)`.
+- A backward-compatible C telemetry-config v2 setter uses nullable config and
+  `has_enabled` to preserve unspecified client enablement.
+- Synchronous `execute()` waits for a terminal server state without the implicit
+  600-second client timeout; explicit execution deadlines remain supported.
+- Inline Arrow result decoding avoids redundant response and attachment copies.
+
+### Updated
+- Updated `quinn-proto` to 0.11.18 to address security scan findings.
+
+### Fixed
+- `list_tables` matches `table_types` case-sensitively, matching Thrift
+  `GetTables`: `["table"]` no longer matches `TABLE` rows.
+- Primary-key metadata resolves missing catalog and schema independently from
+  the current session and preserves explicit empty names.
+- Foreign-key metadata preserves server-provided update and delete rules as
+  nullable `Int16` values.
+- Empty ARRAY result schemas use the Thrift-compatible `element` child name,
+  including nested arrays.
+- M2M and Azure service-principal token exchanges retry transient failures;
+  exhausted transient failures retain their status-based error codes.
+
+## [v1.1.0] - 2026-09-23
+
+### Added
+- Execution-scoped client query deadlines for Rust and C APIs.
+- FAST-mode session version exchange.
+- C ABI query tags, HTTP connection limits, connection-test deadlines, and
+  result-stream cancellation.
+- Release-with-debuginfo build profile and native symbol checks.
+
+### Changed
+- Client deadlines permit an in-flight status request five seconds to finish.
+- Direct traffic identifies itself as Databricks SQL Kernel.
+- rustls now includes OS trust roots.
+- Updated rustls to remediate OSV findings.
+
+### Fixed
+- CloudFetch downloads have end-to-end deadlines and terminal link-fetch
+  errors.
+- C ABI workers preserve a two-MiB stack floor without shrinking larger
+  configured stacks.
+- mTLS rejects non-HTTPS endpoints.
+- PAT telemetry omits OAuth auth-flow metadata.
+
 ## [v1.0.0] - 2026-08-31
 
 ### Fixed

{databricks_sql_kernel-1.0.0 → databricks_sql_kernel-1.2.0}/CONNECTION_PARAMETERS.md

@@ -15,6 +15,7 @@ by the struct it lives on. `ConnectionConfig` and `AuthConfig` are
 | [`ProxyConfig`](#proxyconfig--httphttps-proxy-optional) | HTTP/HTTPS proxy |
 | [`TlsConfig`](#tlsconfig--tls--ssl-optional) | cert validation, custom CA, mTLS |
 | [`ResultConfig`](#resultconfig--result-handling-optional) | CloudFetch tuning, type rendering |
+| [`geospatial_result_representation`](#geospatial_result_representation--geospatial-result-encoding-optional) | GEOMETRY / GEOGRAPHY result encoding |
 | [`LoggingConfig`](#loggingconfig--logging-optional) | log filter / file |
 | [`transport`](#transport--wire-protocol-optional) | wire protocol |
 | [`session_conf`](#session_conf--server-side-session-configuration-optional) | server-side SQL / Spark config |
@@ -173,9 +174,45 @@ Setting only one of `client_cert_pem` / `client_key_pem` is rejected at
 | `cloudfetch_link_prefetch_window` | Number of presigned URLs to prefetch ahead of the consumer. | `10` |
 | `cloudfetch_max_chunks_in_memory` | Max decompressed CloudFetch chunks held in memory at once (bounds download parallelism and peak RSS). | `16` |
 | `inline_max_chunks_in_memory` | Prefetch window for the inline-Arrow path (used when CloudFetch is disabled). `1` disables prefetching. | `4` |
-| `complex_types_as_json` | Render complex columns (`ARRAY` / `MAP` / `STRUCT` / `VARIANT` / `GEOMETRY` / `GEOGRAPHY`) as compact JSON strings instead of native Arrow nested types. | `false` |
+| `complex_types_as_json` | Render complex columns (`ARRAY` / `MAP` / `STRUCT` / `VARIANT`) as compact JSON strings instead of native Arrow nested types. Top-level geo columns use `geospatial_result_representation`; nested geo leaves are normalized before the enclosing value is rendered as JSON. | `false` |
 | `intervals_as_string` | Render `INTERVAL` / `DURATION` columns as canonical Databricks text (e.g. `"Y-M"`, `"D HH:MM:SS.nnnnnnnnn"`) instead of native Arrow interval types. | `false` |
 
+## `geospatial_result_representation` — geospatial result encoding (optional)
+
+Set with `SessionBuilder::geospatial_result_representation(...)`. Both modes
+keep the outer result format as Arrow; this setting only selects the physical
+Arrow representation of `GEOMETRY` and `GEOGRAPHY` values.
+
+| Value | Arrow representation |
+|-------|----------------------|
+| `GeospatialResultRepresentation::String` | Arrow `Utf8` containing WKT / EWKT. |
+| `GeospatialResultRepresentation::Binary` | Arrow `struct<srid: int32 not null, wkb: binary not null>` containing the SRID and little-endian OGC WKB. The WKB itself is not EWKB. This is the default. |
+
+Reyden returns every geo value as that native struct; standard DBSQL warehouses
+return WKT / EWKT as Arrow `Utf8` or `LargeUtf8`. The structured manifest
+reports the logical `GEOMETRY(...)` or `GEOGRAPHY(...)` type and is the source
+of truth for either attachment. The kernel normalizes both paths: binary mode
+attaches the canonical tags to a Reyden struct or parses standard-warehouse
+text into the same tagged SRID+WKB struct, while string mode preserves existing
+text or renders a native struct as EWKT. Nested values in arrays, maps, and
+structs, per-row SRIDs, and null outer values are preserved.
+
+This is entirely client-side and is never forwarded to SEA. Set it through
+the typed kernel or binding API. An `EnableGeoSpatialSupport` entry placed
+directly in `session_conf` is not interpreted by the kernel and is forwarded
+unchanged; SEA/Reyden does not define that server configuration.
+
+Bindings expose the same default-enabled boolean as Python
+`enable_geospatial_support`, Node.js `enableGeoSpatialSupport`, and C
+`kernel_session_config_set_enable_geospatial_support`. Enabled returns the
+native SRID+WKB Arrow representation; disabled returns WKT / EWKT strings.
+
+The structured manifest type text is authoritative for identifying geo leaves;
+the attachment supplies the physical values. The same post-processing step
+produces the requested client-facing schema for non-empty and empty results.
+Manifest field metadata preserves the logical type and SRID text under
+`databricks.type_name` and `databricks.type_text`.
+
 ## `LoggingConfig` — logging (optional)
 
 | Field | Description | Default |