v0.38.0

Secret attach options

AttachOption and AttachOptionSpec gain secret: bool (default False). Declare every credential option (API keys, tokens, passwords) with secret=True:

class AttachOptions:
    api_key: Annotated[str, AttachOption(desc="API key", required=True, secret=True)]

Clients and the DuckDB extension mask secret options, keep them out of result-cache keys and logs, and can supply them from a vgi_attach DuckDB secret instead of the ATTACH text:

CREATE SECRET (TYPE vgi_attach, SCOPE 'https://worker.example.com', api_key '...');
ATTACH 'mydb' AS mydb (TYPE vgi, LOCATION 'https://worker.example.com');

secret combines with required. It is allowed together with a default, but a secret option should normally have none.

Wire format: a nullable bool column named secret, appended after required. Readers look columns up by name, so a spec without the column reads as secret=False, and older peers ignore it. Backward compatible in both directions.

Also in this release:

• The attach-options fixture's required api_key is now secret.
• The worker page and landing page flag required and secret options, and never show a secret option's default.
• New "Declaring Attach Options" section in docs/catalog-interface.md.