appendValue is a test-only reimplementation of the subset of duckdbservice.AppendValue logic needed for MAP round-trip tests. It lives here because se

cursorUsers returns the users fixture rows (fixtures/data.sql) with firstID <= id <= lastID, ordered by id.

executeCleanup runs cleanup statements, ignoring errors (best effort). This is used to clean up temp tables after a multi-statement query.

isDuckLakeTransactionConflict returns true if the error is a DuckLake transaction conflict. These occur when concurrent DuckLake transactions try to c

isWSChar reports whether c is an ASCII whitespace character.

listConns returns a snapshot of all registered client connections.

metricCounterFamilyTotal sums the value across all series of a counter family. Returns 0 if the family has no series yet. Useful for "did anything inc

newTestCache creates a DiskCache backed by t.TempDir() for isolation.

observeLifecycleTransitionDuration records elapsed time for a WorkerLifecycle.* invocation against the duration histogram. Negative durations (clock s

observeSpawnFailure increments the spawn-failure counter for the given (reason, image) tuple. Empty reason drops the sample (the counter would be usel

queryPgStatActivity returns all rows from pg_stat_activity as maps.

quoteIdentifier quotes an identifier for safe use in SQL

reapIdle rolls back idle transactions and releases drain tokens stranded by a GetFlightInfo whose matching DoGet never arrived. Both are bounded so a

retryOnConflict retries fn on DuckLake transaction conflicts with exponential backoff and jitter (50-100% of backoff interval). Only used for autocomm

sessionFromContext extracts the session from gRPC metadata. The session token is expected in the "x-duckgres-session" header.

setAuditDetail records a human-readable detail string for the current request so AuditMiddleware includes it in the audit row. No-op for the empty str

DestroyAllSessions destroys every active session without holding the manager lock while running per-session cleanup.

IdentityFromContext returns the resolved Identity, or nil if unauthenticated.

MemoryLimit returns the memory limit string applied to every session.

OnWorkerCrash handles a worker crash by marking all affected executors as dead and notifying sessions. Executors are marked dead BEFORE the shared gRP

PreBindSockets eagerly binds count Unix sockets at startup while the socket directory is verified writable. Under systemd's ProtectSystem=strict, the

PutStream stores data from r under key without buffering the whole body in memory. It writes to a temp file and atomically renames it into place, so a

RetireOneMismatchedVersionWorker scans all shared worker pods in the namespace for one whose duckgres/control-plane label identifies a different Deplo

SetMaxConnections sets the maximum connections for this SessionManager.

String renders the decimal in plain numeric form, e.g. {314159, 5} → "3.14159" and {-5, 2} → "-0.05". Required so the PG text-protocol formatter (serv

WalkFunc walks all nodes in a ParseResult and calls fn for each. If fn returns false, walking stops.

writeErrorResponse sends an error to the client

cleanDeadWorkersLocked removes all dead worker entries from the map and schedules resource cleanup (client, parent listener, socket file) in the backg

cleanupOrphanedWorkerPods deletes worker pods whose DB row is in a terminal state (retired/lost) or has no DB row at all, reconciling K8s against the

closeCursor closes a specific cursor and cleans up its resources.

emulateGenerateName makes the fake clientset assign unique names from metav1.GenerateName on pod create, as the real API server does (the fake otherwi

fetchCursorRows runs a FETCH/MOVE statement on the transaction's connection (lib/pq sends it via the simple query protocol) and collects any rows it r

--- Helpers ---

openBaseDB creates and configures a DuckDB connection with threads, memory limit, temp directory, extensions, and cache_httpfs settings. This shared s

orgStr renders an org config string value for audit detail, showing "" as a readable "(unset)" so a cleared field is unambiguous.

persistWorkerRecord upserts the record and returns the underlying error (including ErrWorkerRecordUpsertFenceMiss when the CP no longer owns the lease

podNameForWorker returns the pod name for a given worker ID, including the org ID if set (multi-tenant mode).

readStartupFromRaw reads the startup message from a raw (unbuffered) connection. It handles GSSENCRequest negotiation (up to maxNegotiationRounds) bef

restoreLongIdentifiers reverses protectLongIdentifiers, substituting each placeholder in sql back to its original token text. It is a no-op when repls

retireWorkerWithReason retires a worker and deletes its pod. Returns true if the worker was found and retired. origin labels the originating subsystem

shortTempDir creates a short temp directory suitable for Unix socket paths (which are limited to 104 bytes on macOS). t.TempDir() paths are too long.

AcquireWorker returns a worker for a new session. Strategy: 1. Reuse an idle worker (0 active sessions) if available. 2. If the pool has fewer live w

ActivateReservedWorker transitions a reserved worker through activating to hot. Failed activations retire the worker immediately.

AllStacks returns a snapshot of all org stacks for admin API usage.

AuthMiddleware authenticates a request and resolves its Role. A valid TokenSet bearer token (header/cookie) is the service-to-service / break-glass pa

DestroySession destroys a session, retires its dedicated worker, and rebalances memory/thread limits across remaining sessions.

DuckDBTypeToArrow maps a DuckDB type name to an Arrow DataType.

NewWorkerSnapshot wraps a WorkerRecord into a WorkerSnapshot. The preferred way to obtain a snapshot is still through ObserveWorker or the snapshot-re