…ssion

Ports the session-level query-tags wiring onto the post-#428 lib/kernel path
(originally lib/sea/SeaBackend, before the SEA→kernel rename). openSession
serializes request.queryTags into the reserved QUERY_TAGS session conf, which
the kernel allowlists (SESSION_CONF_ALLOWLIST) and forwards onto the SEA
CreateSession session_confs — mirroring ThriftBackend.openSession. queryTags
takes precedence over an explicit configuration.QUERY_TAGS.

Verified end-to-end against a live warehouse: the tag lands in
system.query.history.query_tags.

Co-authored-by: Isaac
Signed-off-by: Madhavendra Rathore <madhavendra.rathore@databricks.com>

…configurable) (databricks#430)

* feat(kernel): wire session-level query tags into KernelBackend.openSession

Ports the session-level query-tags wiring onto the post-databricks#428 lib/kernel path
(originally lib/sea/SeaBackend, before the SEA→kernel rename). openSession
serializes request.queryTags into the reserved QUERY_TAGS session conf, which
the kernel allowlists (SESSION_CONF_ALLOWLIST) and forwards onto the SEA
CreateSession session_confs — mirroring ThriftBackend.openSession. queryTags
takes precedence over an explicit configuration.QUERY_TAGS.

Verified end-to-end against a live warehouse: the tag lands in
system.query.history.query_tags.

Co-authored-by: Isaac
Signed-off-by: Madhavendra Rathore <madhavendra.rathore@databricks.com>

* fix(kernel): request Thrift-parity OAuth scopes, configurable via oauthScopes

The kernel U2M flow passed no scopes, so it fell through to the kernel's bare
default (all-apis offline_access). The databricks-sql-connector OAuth app is
registered for `sql`, so U2M auth used the wrong scope set. Pass scopes
explicitly from the driver:

  - U2M defaults to ['sql', 'offline_access'] (matches the Thrift driver's
    defaultOAuthScopes), overriding the kernel's all-apis default.
  - M2M defaults to ['all-apis'] (matches Thrift + the kernel's M2M default).
  - Both overridable via a new `oauthScopes` connect option — closing the
    configurability gap with pyo3, which already forwards `scopes` on M2M.

Driver-only change: the napi binding already forwards oauth_scopes and the
kernel's u2m.rs/m2m.rs feed them into the authorize/token request.

Co-authored-by: Isaac
Signed-off-by: Madhavendra Rathore <madhavendra.rathore@databricks.com>

* fix(kernel): no-op unsupported per-statement options instead of throwing

Per-statement options the kernel backend doesn't honour are now NO-OPs (logged
at warn), not HiveDriverErrors, so call sites written for the Thrift backend are
drop-in on the kernel path:

  - useCloudFetch / useLZ4Compression — kernel-governed perf/format hints
  - stagingAllowedLocalPath — staging not yet exposed on the kernel

Ignoring these can't change query results. Parameter binding (compound/BINARY)
is deliberately NOT no-op'd — a dropped param would silently change results, so
it still throws.

Co-authored-by: Isaac
Signed-off-by: Madhavendra Rathore <madhavendra.rathore@databricks.com>

* feat(kernel): route OAuth identically to Thrift (strict parity) + custom U2M client id

Make the kernel auth flow selector + client-id resolution byte-for-byte identical
to the Thrift driver (`DBSQLClient.createAuthProvider`):

  - flow     = `oauthClientSecret === undefined ? U2M : M2M`  (strict undefined)
  - clientId = `oauthClientId ?? defaultClientId`             (`??` guards null/undefined only)

No blank/reserved normalization on the OAuth fields — a present-but-degenerate
value (`""` / `"undefined"` / whitespace) is forwarded verbatim, exactly as Thrift
forwards it. This removes every divergence from the Thrift backend across the full
(clientId × clientSecret) input matrix (verified). Consequences vs the prior
id-presence routing:

  - `oauthClientId` + no secret now runs U2M (browser) and forwards the id as a
    custom U2M client (Thrift does the same).
  - M2M with no/blank id no longer throws "id required" — it uses the default
    client (`?? defaultClientId`), matching Thrift.
  - A present-but-empty/`"undefined"` secret routes to M2M (not U2M), matching
    Thrift's strict `=== undefined` check.

Trade-off (accepted for parity): this re-imports Thrift's env-stringification
behaviour — a secret/id env var that resolved to `""`/`"undefined"` is taken
literally rather than treated as unset.

Updated the auth unit tests (u2m/m2m/edge-cases) to assert the strict-parity
matrix.

Co-authored-by: Isaac
Signed-off-by: Madhavendra Rathore <madhavendra.rathore@databricks.com>

* chore(kernel): bump KERNEL_REV to kernel main (statement-level query tags + proxy + UA)

Bump the pinned kernel from b676275 to 34b4c20 (current kernel main), which
brings:
  - databricks#150 — per-statement query tags on the SEA wire (native query_tags array).
    This is what makes `executeStatement(sql, { queryTags })` actually reach the
    server on the kernel path — bringing statement-level query tags to parity
    with the Thrift backend (the driver already serialized them into
    statement_conf["query_tags"]; the kernel previously dropped that before the
    wire). Verified e2e: the tag now lands in system.query.history.query_tags.
  - databricks#129 — programmatic HTTP/HTTPS proxy + per-connection socket timeout
    (additive optional napi ConnectionOptions fields; refreshed in index.d.ts).
  - databricks#151 — caller User-Agent overwrites the kernel base UA for accurate
    query-source attribution.

Refreshes the committed napi types (native/kernel/index.d.ts) accordingly; the
new fields are optional, so no driver-side change is required.

Co-authored-by: Isaac
Signed-off-by: Madhavendra Rathore <madhavendra.rathore@databricks.com>

---------

Signed-off-by: Madhavendra Rathore <madhavendra.rathore@databricks.com>