vgi-python 0.29.5__tar.gz → 0.30.0__tar.gz

{vgi_python-0.29.5 → vgi_python-0.30.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vgi-python
-Version: 0.29.5
+Version: 0.30.0
 Summary: Vector Gateway Interface - Connect DuckDB to external programs via Apache Arrow
 Project-URL: Homepage, https://query.farm
 Project-URL: Repository, https://github.com/Query-farm/vgi-python
@@ -162,7 +162,7 @@ Requires-Dist: httpx2>=2.9.1
 Requires-Dist: platformdirs
 Requires-Dist: pyarrow
 Requires-Dist: typer>=0.9
-Requires-Dist: vgi-rpc>=0.43.2
+Requires-Dist: vgi-rpc>=0.44.1
 Provides-Extra: azure
 Requires-Dist: azure-identity>=1.16.0; extra == 'azure'
 Requires-Dist: pymssql>=2.3.0; extra == 'azure'

{vgi_python-0.29.5 → vgi_python-0.30.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "vgi-python"
-version = "0.29.5"
+version = "0.30.0"
 description = "Vector Gateway Interface - Connect DuckDB to external programs via Apache Arrow"
 readme = "README.md"
 keywords = [
@@ -40,7 +40,7 @@ dependencies = [
     "pyarrow",
     "typer>=0.9",
     "platformdirs",
-    "vgi-rpc>=0.43.2",
+    "vgi-rpc>=0.44.1",
     "httpx2>=2.9.1",
 ]
 

{vgi_python-0.29.5 → vgi_python-0.30.0}/tests/client/test_batch_metadata_callback.py

@@ -69,7 +69,7 @@ def test_callback_sees_none_for_a_batch_without_custom_metadata(client: Any) ->
         client.table_function(
             function_name="sequence",
             schema_name="main",
-            arguments=Arguments(positional=[pa.scalar(4)]),
+            arguments=Arguments(positional=(pa.scalar(4),)),
             batch_metadata_callback=metas.append,
         )
     )

{vgi_python-0.29.5 → vgi_python-0.30.0}/tests/client/test_scan_branches_client.py

@@ -60,8 +60,11 @@ def test_single_branch_table_falls_back_to_legacy_rpc(client: Any) -> None:
         name="numbers",
     )
     assert len(result.branches) == 1
-    assert result.branches[0].function_name == client.table_scan_function_get(
-        attach_opaque_data=_attach_opaque(client),
-        schema_name=DATA,
-        name="numbers",
-    ).function_name
+    assert (
+        result.branches[0].function_name
+        == client.table_scan_function_get(
+            attach_opaque_data=_attach_opaque(client),
+            schema_name=DATA,
+            name="numbers",
+        ).function_name
+    )

{vgi_python-0.29.5 → vgi_python-0.30.0}/tests/client/test_time_travel_client.py

@@ -79,7 +79,7 @@ def test_table_function_with_no_at_clause_is_unaffected(client: Any) -> None:
     """The new `at_unit`/`at_value` params default to `None` — unchanged behavior without them."""
     batches = list(
         client.table_function(
-            function_name="sequence", schema_name="main", arguments=Arguments(positional=[pa.scalar(5)])
+            function_name="sequence", schema_name="main", arguments=Arguments(positional=(pa.scalar(5),))
         )
     )
     assert sum(b.num_rows for b in batches) == 5

{vgi_python-0.29.5 → vgi_python-0.30.0}/tests/table_in_out/test_blended_exchange.py

@@ -238,3 +238,45 @@ class TestBlendedArityAndVarargs:
 
         assert len(results) == 1
         assert results[0].column("row_sum").to_pylist() == [3.0, 5.0]
+
+
+class TestHasFinalizeSkip:
+    """`has_finalize=False` skips the FINALIZE `init()` entirely for a no-finalize function.
+
+    Real interop bug found live against a non-Python worker SDK: the client
+    unconditionally sent a FINALIZE-phase init() for every table-in-out call,
+    which the Python fixture worker happens to no-op gracefully but a
+    TypeScript-SDK worker rejects outright ("a blended row-transform function
+    has no FINALIZE phase"). `has_finalize=False` avoids sending that init()
+    at all rather than depending on every SDK tolerating an unexpected one.
+    Output must be identical either way for a function that has no finalize
+    stage (there is nothing to skip yielding) -- this is the equivalence this
+    suite can prove locally; the cross-SDK rejection itself is TypeScript-only.
+    """
+
+    def test_output_identical_with_and_without_has_finalize(self, client_transport: Any) -> None:
+        """Same output whether the FINALIZE init() is sent or skipped, both transports."""
+        input_schema = make_schema([pa.field("n", pa.int64())])
+        batch = pa.RecordBatch.from_pydict({"n": [0, 1, 3, 2]}, schema=input_schema)
+
+        with client_transport() as client:
+            with_finalize = list(
+                client.table_in_out_function(
+                    function_name="blended_explode",
+                    schema_name="main",
+                    input=iter([batch]),
+                )
+            )
+        with client_transport() as client:
+            without_finalize = list(
+                client.table_in_out_function(
+                    function_name="blended_explode",
+                    schema_name="main",
+                    input=iter([batch]),
+                    has_finalize=False,
+                )
+            )
+
+        assert len(with_finalize) == 1
+        assert len(without_finalize) == 1
+        assert with_finalize[0].column("i").to_pylist() == without_finalize[0].column("i").to_pylist()

vgi_python-0.30.0/tests/test_client_oauth.py

@@ -0,0 +1,204 @@
+# Copyright 2025, 2026 Query Farm LLC - https://query.farm
+
+"""Tests for vgi.client.Client's OAuth wiring (oauth=/oauth_refresh_token=/oauth_flow=).
+
+The device-code/PKCE flow logic itself is tested exhaustively in
+vgi-rpc-python's tests/test_oauth_client.py (mock IdP, no network). These
+tests cover the integration seam: does `Client` build a `VgiOAuthAuth` with
+the right configuration, does construction-time validation reject bad
+combinations, and does a full round trip actually work when driven through
+`Client`'s real request path (via the `httpx_client=` escape hatch, wired to
+a mock IdP the same way vgi-rpc-python's own tests are).
+"""
+
+from __future__ import annotations
+
+import httpx2
+import pytest
+from vgi_rpc.http import VgiOAuthAuth
+
+from vgi.client.client import Client
+
+RESOURCE_METADATA_URL = "https://api.example.com/.well-known/oauth-protected-resource"
+DEVICE_AUTH_URL = "https://auth.example.com/device/code"
+TOKEN_URL = "https://auth.example.com/token"
+
+
+class _MockIdp:
+    """Minimal mock IdP + protected resource for one full device-code round trip."""
+
+    def __init__(self) -> None:
+        self.device_auth_calls = 0
+        self.granted_token = "mock-access-token"
+
+    def handler(self, request: httpx2.Request) -> httpx2.Response:
+        """Route a request to the matching mock endpoint by exact URL."""
+        url = str(request.url)
+        if url == RESOURCE_METADATA_URL:
+            return httpx2.Response(
+                200,
+                json={
+                    "resource": "https://api.example.com",
+                    "authorization_servers": ["https://auth.example.com"],
+                    "device_code_client_id": "device-client",
+                    "device_code_client_secret": "device-secret",
+                },
+            )
+        if url == "https://auth.example.com/.well-known/openid-configuration":
+            return httpx2.Response(
+                200,
+                json={
+                    "token_endpoint": TOKEN_URL,
+                    "device_authorization_endpoint": DEVICE_AUTH_URL,
+                    "grant_types_supported": ["urn:ietf:params:oauth:grant-type:device_code"],
+                },
+            )
+        if url == DEVICE_AUTH_URL:
+            self.device_auth_calls += 1
+            return httpx2.Response(
+                200,
+                json={
+                    "device_code": "devcode-123",
+                    "user_code": "ABCD-EFGH",
+                    "verification_uri": "https://auth.example.com/activate",
+                    "expires_in": 600,
+                    "interval": 0,
+                },
+            )
+        if url == TOKEN_URL:
+            return httpx2.Response(200, json={"access_token": self.granted_token, "token_type": "Bearer"})
+        if url.endswith("/vgi/catalogs"):
+            token = request.headers.get("authorization", "")
+            if token:
+                return httpx2.Response(200, json={"authorization": token})
+            return httpx2.Response(
+                401,
+                headers={"www-authenticate": f'Bearer resource_metadata="{RESOURCE_METADATA_URL}"'},
+            )
+        return httpx2.Response(404, json={"error": "not_found", "url": url})  # pragma: no cover
+
+
+class TestConstructorValidation:
+    """Tests for the mutually-exclusive oauth/bearer_token/httpx_client combinations."""
+
+    def test_oauth_and_bearer_token_raises(self) -> None:
+        """Passing both oauth=True and bearer_token= raises ValueError."""
+        with pytest.raises(ValueError, match="mutually exclusive"):
+            Client(transport="http", base_url="https://example.com", oauth=True, bearer_token="tok")
+
+    def test_oauth_refresh_token_and_bearer_token_raises(self) -> None:
+        """oauth_refresh_token= (which implies oauth=True) also conflicts with bearer_token=."""
+        with pytest.raises(ValueError, match="mutually exclusive"):
+            Client(
+                transport="http",
+                base_url="https://example.com",
+                oauth_refresh_token="seed",
+                bearer_token="tok",
+            )
+
+    def test_oauth_and_httpx_client_raises(self) -> None:
+        """Passing both oauth=True and httpx_client= raises ValueError."""
+        with pytest.raises(ValueError, match="httpx_client"):
+            Client(
+                transport="http",
+                base_url="https://example.com",
+                oauth=True,
+                httpx_client=httpx2.Client(),
+            )
+
+    def test_invalid_oauth_flow_raises(self) -> None:
+        """An unrecognized oauth_flow value raises ValueError, not a silent no-op."""
+        with pytest.raises(ValueError, match="oauth_flow"):
+            Client(transport="http", base_url="https://example.com", oauth=True, oauth_flow="carrier-pigeon")  # type: ignore[arg-type]
+
+    def test_invalid_oauth_prompt_raises(self) -> None:
+        """An unrecognized oauth_prompt value raises ValueError, not a silent no-op."""
+        with pytest.raises(ValueError, match="oauth_prompt"):
+            Client(transport="http", base_url="https://example.com", oauth=True, oauth_prompt="shout")  # type: ignore[arg-type]
+
+    def test_bearer_token_alone_still_works(self) -> None:
+        """The existing bearer_token= path is unaffected by the new oauth params."""
+        client = Client(transport="http", base_url="https://example.com", bearer_token="tok")
+        assert client._bearer_token == "tok"
+        assert not client._use_oauth
+
+
+class TestOAuthWiring:
+    """Tests that Client(oauth=...) builds a correctly-configured VgiOAuthAuth."""
+
+    def test_oauth_true_builds_vgi_oauth_auth(self) -> None:
+        """oauth=True lazily builds a VgiOAuthAuth with the client's own oauth_* settings."""
+        client = Client(
+            transport="http",
+            base_url="https://example.com",
+            oauth=True,
+            oauth_flow="device_code",
+            oauth_timeout_seconds=42.0,
+            oauth_prompt="consent",
+        )
+        assert client.oauth_identity() is None  # nothing has authenticated yet
+        client._get_or_create_httpx_client()
+        assert isinstance(client._oauth_auth, VgiOAuthAuth)
+        assert client._oauth_auth._flow == "device_code"  # noqa: SLF001 -- white-box wiring check
+        assert client._oauth_auth._timeout_seconds == 42.0  # noqa: SLF001
+        assert client._oauth_auth._prompt == "consent"  # noqa: SLF001
+        client._oauth_auth.close()
+
+    def test_oauth_refresh_token_seeds_the_auth_object(self) -> None:
+        """oauth_refresh_token= implies oauth=True and seeds the refresh token."""
+        client = Client(
+            transport="http",
+            base_url="https://example.com",
+            oauth_refresh_token="pre-seeded-token",
+        )
+        assert client._use_oauth
+        client._get_or_create_httpx_client()
+        assert client._oauth_auth is not None
+        assert client._oauth_auth._token.refresh_token == "pre-seeded-token"  # noqa: SLF001
+        client._oauth_auth.close()
+
+
+class TestOAuthEndToEnd:
+    """A full device-code login round trip through the exact client Client would use.
+
+    Uses the httpx_client= escape hatch to wire a VgiOAuthAuth against a mock
+    IdP (httpx2.MockTransport) -- the same technique vgi-rpc-python's own
+    tests use. The device-code/PKCE flow mechanics are covered exhaustively
+    there (mock IdP, no network); this test's job is narrower: prove
+    ``Client`` actually issues its RPCs through the httpx2.Client it was
+    handed (so a real attach would carry the OAuth-obtained token), and that
+    a 401-triggered login on that client completes end to end.
+    """
+
+    def test_client_issues_requests_through_the_oauth_authed_httpx_client(self) -> None:
+        """A 401 on the client Client._get_or_create_httpx_client() returns triggers a real login."""
+        idp = _MockIdp()
+        auth = VgiOAuthAuth(
+            base_url="https://example.com",
+            flow="device_code",
+            timeout_seconds=5.0,
+            transport=httpx2.MockTransport(idp.handler),
+        )
+        httpx_client = httpx2.Client(
+            transport=httpx2.MockTransport(idp.handler), auth=auth, base_url="https://example.com"
+        )
+        # Not started (no worker spawned) -- this test only exercises the HTTP/OAuth
+        # plumbing, not a full RPC call, so client.stop() (which requires start())
+        # doesn't apply; the httpx_client/auth are closed directly instead.
+        client = Client(transport="http", base_url="https://example.com", httpx_client=httpx_client)
+        try:
+            # This is the exact client object Client's own RPC machinery sends
+            # every request through -- not a parallel one built just for the test.
+            assert client._get_or_create_httpx_client() is httpx_client
+
+            resp = httpx_client.get("/vgi/catalogs")
+            assert resp.status_code == 200
+            assert resp.json()["authorization"] == f"Bearer {idp.granted_token}"
+            assert idp.device_auth_calls == 1
+
+            # A second request reuses the cached token -- no second login.
+            httpx_client.get("/vgi/catalogs")
+            assert idp.device_auth_calls == 1
+        finally:
+            httpx_client.close()
+            auth.close()

{vgi_python-0.29.5 → vgi_python-0.30.0}/uv.lock

@@ -2569,7 +2569,7 @@ requires-dist = [
 
 [[package]]
 name = "vgi-python"
-version = "0.29.5"
+version = "0.30.0"
 source = { editable = "." }
 dependencies = [
     { name = "click" },
@@ -2686,7 +2686,7 @@ requires-dist = [
     { name = "vgi-python", extras = ["test-fixtures"], marker = "extra == 'test-fixtures-writable'" },
     { name = "vgi-python", extras = ["test-fixtures", "test-fixtures-writable", "http", "launch", "oauth", "otel", "sentry", "azure"], marker = "extra == 'dev'" },
     { name = "vgi-python", extras = ["transactor"], marker = "extra == 'test-fixtures-writable'" },
-    { name = "vgi-rpc", specifier = ">=0.43.2" },
+    { name = "vgi-rpc", specifier = ">=0.44.1" },
     { name = "vgi-rpc", extras = ["cli"], marker = "extra == 'launch'" },
     { name = "vgi-rpc", extras = ["cli", "conformance", "external", "http", "oauth", "otel", "sentry"], marker = "extra == 'dev'" },
     { name = "vgi-rpc", extras = ["http"], marker = "extra == 'granian'" },
@@ -2716,7 +2716,7 @@ docs = [
 
 [[package]]
 name = "vgi-rpc"
-version = "0.43.2"
+version = "0.44.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "docstring-parser" },
@@ -2724,9 +2724,9 @@ dependencies = [
     { name = "pywin32", marker = "sys_platform == 'win32'" },
     { name = "tzdata", marker = "sys_platform == 'win32'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ce/04/efb99f0fb56535bcba110e6c12448c31b429e0861aae4bc2f7136299cfc2/vgi_rpc-0.43.2.tar.gz", hash = "sha256:6a06437af17442451bfe07186bc472a2efb57e030b0e5b38a28922034a814123", size = 1147340, upload-time = "2026-08-27T18:33:54.608Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/1a/16/5a78053080117cac00a8945b70298d636a63d57801a33528bb63b14cdd95/vgi_rpc-0.44.1.tar.gz", hash = "sha256:37a54ae2cb7e5a7a2603aad69ece92c3c99a96906c96d2196806202ee4b70825", size = 1170809, upload-time = "2026-08-28T15:03:07.221Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ac/b9/33cdb4fe27ef3893e1cded63f396af8bc517e390615f34db6f4bd227ef4c/vgi_rpc-0.43.2-py3-none-any.whl", hash = "sha256:b112ab76828367176a41f1b9a4ceeaba8979629e4e5972f64bf769c94b3e36a4", size = 528134, upload-time = "2026-08-27T18:33:52.829Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/d6/3bfff42bd723ffcd0c2550d932e766aa65d39a886017cb9c002174e68196/vgi_rpc-0.44.1-py3-none-any.whl", hash = "sha256:e9785753bdb30e3f07f2bdbeafcddd09533cc014baa310e093a94fdeda6ad517", size = 545257, upload-time = "2026-08-28T15:03:05.268Z" },
 ]
 
 [package.optional-dependencies]

{vgi_python-0.29.5 → vgi_python-0.30.0}/vgi/client/client.py

@@ -424,6 +424,11 @@ class Client(CatalogClientMixin, AggregateClientMixin):
         tcp_host: str | None = None,
         tcp_port: int | None = None,
         bearer_token: str | None = None,
+        oauth: bool = False,
+        oauth_refresh_token: str | None = None,
+        oauth_flow: Literal["auto", "device_code", "pkce"] = "auto",
+        oauth_timeout_seconds: float = 120.0,
+        oauth_prompt: Literal["none", "login", "select_account", "consent"] = "none",
         httpx_client: Any | None = None,
         external_location: Any | None = None,
         launch_argv: Sequence[str] | None = None,
@@ -472,12 +477,38 @@ class Client(CatalogClientMixin, AggregateClientMixin):
                 ``"http://127.0.0.1:8765"``.
             tcp_host: TCP-only. Hostname or IP of the running worker.
             tcp_port: TCP-only. Port of the running worker.
-            bearer_token: HTTP-only. When set, every request carries an
-                ``Authorization: Bearer <token>`` header. Static token
-                support only — no JWT / OAuth flows.
+            bearer_token: HTTP-only. When set, every request carries a
+                static ``Authorization: Bearer <token>`` header. Mutually
+                exclusive with ``oauth``/``oauth_refresh_token`` — for a
+                token that expires or needs a login flow, use those instead.
+            oauth: HTTP-only. When True, obtain and refresh bearer tokens
+                automatically via OAuth (device-code today; PKCE is not yet
+                implemented — see ``oauth_flow``) whenever the worker
+                answers 401 with an RFC 9728 challenge. Implied by passing
+                ``oauth_refresh_token``. The first call blocks and prints a
+                "Visit: ... Enter code: ..." prompt until login completes;
+                later calls reuse the cached token and refresh it silently.
+                See ``vgi_rpc.http.VgiOAuthAuth`` for the full mechanism
+                (RFC 8628 device-code polling, RFC 8414/9728 discovery,
+                silent refresh, the secret-less-proxy ``token_endpoint``
+                override).
+            oauth_refresh_token: HTTP-only. Pre-obtained refresh token,
+                seeded so the first request can silently refresh instead of
+                running an interactive login. Implies ``oauth=True``.
+                Mutually exclusive with ``bearer_token``.
+            oauth_flow: HTTP-only, OAuth-only. ``"auto"`` (default) picks
+                device-code when the server offers it; ``"device_code"``
+                forces it; ``"pkce"`` is not yet implemented and raises
+                ``NotImplementedError`` when actually needed.
+            oauth_timeout_seconds: HTTP-only, OAuth-only. How long an
+                interactive login may take before giving up (further capped
+                by the authorization server's own device-code expiry).
+            oauth_prompt: HTTP-only, OAuth-only. Reserved for the PKCE flow
+                (not yet implemented); has no effect on device-code logins.
             httpx_client: HTTP-only escape hatch. When provided, overrides
-                ``bearer_token`` and is used verbatim; supply this when you
-                need mTLS or a custom auth scheme. Not the canonical path.
+                ``bearer_token``/``oauth``/``oauth_refresh_token`` and is
+                used verbatim; supply this when you need mTLS or a custom
+                auth scheme. Not the canonical path.
             external_location: HTTP-only. ``ExternalLocationConfig`` that
                 controls how the client fetches pointer batches (workers
                 that externalize large outputs via demo storage / S3 return
@@ -535,12 +566,36 @@ class Client(CatalogClientMixin, AggregateClientMixin):
         else:
             raise ValueError(f"unknown transport {transport!r}")
 
+        use_oauth = oauth or oauth_refresh_token is not None
+        if use_oauth and bearer_token is not None:
+            raise ValueError("bearer_token is mutually exclusive with oauth/oauth_refresh_token")
+        if use_oauth and httpx_client is not None:
+            raise ValueError(
+                "oauth/oauth_refresh_token is mutually exclusive with httpx_client "
+                "(the escape hatch is verbatim-or-nothing — build your own VgiOAuthAuth "
+                "and pass it as httpx_client=httpx2.Client(auth=...) instead)"
+            )
+        if oauth_flow not in ("auto", "device_code", "pkce"):
+            raise ValueError(f"oauth_flow must be 'auto', 'device_code', or 'pkce', got {oauth_flow!r}")
+        if oauth_prompt not in ("none", "login", "select_account", "consent"):
+            raise ValueError(
+                f"oauth_prompt must be 'none', 'login', 'select_account', or 'consent', got {oauth_prompt!r}"
+            )
+
         self.server_path: str | Sequence[str] = server_path if server_path is not None else ""
         self._transport = transport
         self._base_url = base_url
         self._tcp_host = tcp_host
         self._tcp_port = tcp_port
         self._bearer_token = bearer_token
+        self._use_oauth = use_oauth
+        self._oauth_refresh_token = oauth_refresh_token
+        self._oauth_flow = oauth_flow
+        self._oauth_timeout_seconds = oauth_timeout_seconds
+        self._oauth_prompt = oauth_prompt
+        # Built lazily by _get_or_create_httpx_client when self._use_oauth; None otherwise
+        # (including when the caller supplied httpx_client= directly, which owns its own auth).
+        self._oauth_auth: Any | None = None
         self._httpx_client = httpx_client
         self._launch_argv = tuple(launch_argv) if launch_argv is not None else None
         self._launch_idle_timeout = launch_idle_timeout
@@ -581,6 +636,11 @@ class Client(CatalogClientMixin, AggregateClientMixin):
         base_url: str,
         *,
         bearer_token: str | None = None,
+        oauth: bool = False,
+        oauth_refresh_token: str | None = None,
+        oauth_flow: Literal["auto", "device_code", "pkce"] = "auto",
+        oauth_timeout_seconds: float = 120.0,
+        oauth_prompt: Literal["none", "login", "select_account", "consent"] = "none",
         httpx_client: Any | None = None,
         external_location: Any | None = None,
         worker_limit: int | None = None,
@@ -590,12 +650,18 @@ class Client(CatalogClientMixin, AggregateClientMixin):
 
         Canonical entry point for non-DuckDB callers (e.g. a TypeScript port
         browsing catalog contents). Subprocess-specific kwargs are not
-        accepted; pool/stderr semantics do not apply.
+        accepted; pool/stderr semantics do not apply. See `[`Client.__init__`][]`
+        for what ``oauth``/``oauth_refresh_token``/``oauth_flow`` do.
         """
         return cls(
             transport="http",
             base_url=base_url,
             bearer_token=bearer_token,
+            oauth=oauth,
+            oauth_refresh_token=oauth_refresh_token,
+            oauth_flow=oauth_flow,
+            oauth_timeout_seconds=oauth_timeout_seconds,
+            oauth_prompt=oauth_prompt,
             httpx_client=httpx_client,
             external_location=external_location,
             worker_limit=worker_limit,
@@ -882,23 +948,39 @@ class Client(CatalogClientMixin, AggregateClientMixin):
         """Return the shared httpx2.Client for this Client's HTTP transport.
 
         Lazily constructs one bound to ``self._base_url`` (so RPC requests
-        resolve against the remote worker) with an ``Authorization: Bearer
-        <token>`` header when ``bearer_token`` was supplied. When the
-        caller passes ``httpx_client=`` directly, they're responsible for
-        configuring ``base_url`` and auth on it — we use it verbatim.
+        resolve against the remote worker) with either a static
+        ``Authorization: Bearer <token>`` header (``bearer_token``) or a
+        ``VgiOAuthAuth`` (``oauth``/``oauth_refresh_token``) that obtains and
+        refreshes tokens on demand — never both, enforced at construction.
+        When the caller passes ``httpx_client=`` directly, they're
+        responsible for configuring ``base_url`` and auth on it — we use it
+        verbatim.
         """
         if self._httpx_client is not None:
             return self._httpx_client
 
         import httpx2
 
+        auth = None
         headers: dict[str, str] = {}
-        if self._bearer_token is not None:
+        if self._use_oauth:
+            from vgi_rpc.http import VgiOAuthAuth
+
+            self._oauth_auth = VgiOAuthAuth(
+                base_url=self._base_url or "",
+                flow=self._oauth_flow,
+                refresh_token=self._oauth_refresh_token,
+                timeout_seconds=self._oauth_timeout_seconds,
+                prompt=self._oauth_prompt,
+            )
+            auth = self._oauth_auth
+        elif self._bearer_token is not None:
             headers["Authorization"] = f"Bearer {self._bearer_token}"
         self._httpx_client = httpx2.Client(
             base_url=self._base_url or "",
             follow_redirects=True,
             headers=headers,
+            auth=auth,
             # httpx2's 5s default read timeout is too aggressive for RPC
             # calls that do real server-side work (scans, cold workers).
             timeout=httpx2.Timeout(60.0, connect=10.0),
@@ -906,6 +988,19 @@ class Client(CatalogClientMixin, AggregateClientMixin):
         self._httpx_client_owned = True
         return self._httpx_client
 
+    def oauth_identity(self) -> Any | None:
+        """Return the signed-in OAuth identity's parsed id_token claims.
+
+        Returns ``None`` when this client isn't using OAuth, or hasn't
+        completed a login yet (the identity is only known once a real
+        exchange has happened — calling this before the first request
+        never triggers one). See ``vgi_rpc.http.OAuthIdentity`` for the
+        fields (``sub``/``email``/``name``/``issuer``/``claims``).
+        """
+        if self._oauth_auth is None:
+            return None
+        return self._oauth_auth.identity()
+
     def _spawn_subprocess_connection(self, worker_index: int) -> WorkerConnection:
         """Spawn or borrow a subprocess worker and wrap it in an RPC proxy.
 
@@ -1214,6 +1309,12 @@ class Client(CatalogClientMixin, AggregateClientMixin):
             finally:
                 self._httpx_client = None
                 self._httpx_client_owned = False
+        # Close VgiOAuthAuth's own internal (unauthenticated) flow client, if one was built.
+        if self._oauth_auth is not None:
+            try:
+                self._oauth_auth.close()
+            finally:
+                self._oauth_auth = None
 
         return returncode
 
@@ -1915,6 +2016,7 @@ class Client(CatalogClientMixin, AggregateClientMixin):
         settings: dict[str, Any] | None = None,
         transaction_opaque_data: bytes | None = None,
         parent_row_callback: Callable[[list[int]], None] | None = None,
+        has_finalize: bool = True,
     ) -> Generator[pa.RecordBatch]:
         """Invoke a table-in-out function on the worker and stream results.
 
@@ -1956,6 +2058,20 @@ class Client(CatalogClientMixin, AggregateClientMixin):
                 `FunctionInfo.input_from_args`); leave unset for ordinary
                 table-in-out functions, which have no provenance concept and
                 may legitimately change row count.
+            has_finalize: Whether this function declares a FINALIZE stage
+                (`FunctionInfo.has_finalize`). Defaults to `True` — every
+                caller before this parameter existed got a FINALIZE-phase
+                `init()` unconditionally, so this preserves that exactly.
+                Pass `False` for a function known to have no finalize (every
+                blended `RowTransformFunction` — `has_finalize` is always
+                false for those, enforced at `resolve_metadata()`) to skip
+                the FINALIZE `init()` entirely, not just send one expecting
+                an empty reply. Confirmed load-bearing, not cosmetic: some
+                worker SDKs (e.g. the TypeScript one) actively reject an
+                unexpected FINALIZE `init()` for a function that never
+                advertised `has_finalize`, rather than silently no-op'ing
+                it — the C++ DuckDB extension avoids this the same way, by
+                conditionally registering `in_out_function_final` at all.
 
         Yields:
             Output `RecordBatch`es from the function. In single-worker mode, output
@@ -2019,7 +2135,14 @@ class Client(CatalogClientMixin, AggregateClientMixin):
                 # Close secondary workers
                 self._close_secondary_workers()
 
-                # Finalize on primary worker
+                # Finalize on primary worker — skipped entirely (not just
+                # sent expecting an empty reply) when the function has no
+                # finalize stage. See has_finalize's docstring: some worker
+                # SDKs reject an unadvertised FINALIZE init() outright.
+                if not has_finalize:
+                    _logger.debug("skipping_finalize_no_finalize_stage")
+                    return
+
                 _logger.debug("finalizing_primary_worker")
                 yield from self._finalize_primary_worker(
                     bind_request,

{vgi_python-0.29.5 → vgi_python-0.30.0}/vgi/codegen/cpp_request_builders.py

@@ -513,7 +513,7 @@ def main() -> None:
         "--exception-include",
         default='"duckdb/common/exception.hpp"',
         help=(
-            "#include directive (with its own <> or \"\") for the exception "
+            '#include directive (with its own <> or "") for the exception '
             "type named by --exception-type (default: "
             '"duckdb/common/exception.hpp"). E.g. <stdexcept> for '
             "std::runtime_error."