getFirstFoundEnvTestBinaryDir locates the first binary in the specified path. ENVTEST-based tests depend on specific binaries, usually located in path

ingressRouteTCPSpec builds a Traefik IngressRouteTCP .spec routing the SNI hostname to the CNPG read-write Service, TLS-passthrough (Postgres speaks i

keep reports whether an entry satisfies the search/time filters. Assumes normalized() has run (searchLower populated).

normalizeIdent turns an App/DB name into a valid unquoted PostgreSQL identifier: lowercase, hyphens -> underscores. So a client never has to double-qu

normalized clamps Limit to Render's paging range and precomputes searchLower so keep() doesn't re-lower the constant search term for every line.

parseLogLine splits kubelet's "Timestamps: true" prefix (an RFC3339Nano stamp, a space, then the message) off a log line, tagging it with Render-shape

parseLogParams maps Render's logs query string onto resources + a LogQuery. resource is required (repeatable, the App id); type is repeatable (app/app

parsePodMetrics decodes a metrics-server PodMetricsList and sums each pod's container usage into cores + bytes. Unparseable quantities are treated as

parsePromMatrix maps a Prometheus matrix response onto Core MetricSeries: one series per result (labels = its metric labels), points RFC3339-stamped a

pgIdent mirrors the operator's normalizeIdent: a valid unquoted PostgreSQL identifier (lowercase, hyphens -> underscores). Kept in sync with internal/

--- managed Postgres (Render-shaped /v1/postgres) --- seedDatabase adds a Ready public Database + its CNPG-style "<name>-app" Secret.

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppList.

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Database.

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DatabaseList.

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

FollowLogs streams an App's new log lines to emit until ctx is cancelled or emit errors. The same type/text filters as QueryLogs apply. Requires a Pod

GetNonEmptyLines converts given command output string into individual objects according to line breakers, and ignores the empty elements in it.

GetProjectDir will return the directory where the project is

IdentityFrom returns the authenticated Identity the auth middleware attached to the request context.

NewHydraAPIKeys returns the production APIKeyStore talking to Hydra's cluster-internal admin API.

--- Request metrics: Traefik scraped by Prometheus --- NewPrometheusRequestSource returns the production RequestMetricsSource, backed by a Prometheus

Resume brings a suspended App back (spec.suspended = false); the operator restores spec.replicas.

RunStdio serves the MCP adapter over stdio (newline-delimited JSON on stdin/stdout) — the transport a local agent launches bex as a subprocess with. H

bearerToken extracts the RFC 6750 credential from the Authorization header; ok is false when the header is absent or not "Bearer "-prefixed.

brokenServer always returns 500 — the "Ory is up but failing" case.

codeMatcher turns a Render statusCode filter into a Prometheus `code` regex: "2xx"/"5xx" => "2.."/"5..", a bare code ("500") stays literal, "" => no f

Disable kubectl kuberc by default for test isolation. This prevents local kubectl configurations from affecting test behavior. To enable kuberc, set:

Create an Apollo client for client-side rendering.

dbStatus maps bex's Database phase onto Render's databaseStatus enum.

deadServer returns a URL nothing listens on — the "Ory is unreachable" case.

fakeHydraAdmin fakes the client-management slice of Hydra's admin API for the production store implementation.

fakeKratos serves GET /sessions/whoami: session token "live-session" or a cookie containing ory_kratos_session=live is a valid session for identity "i

getMetricsOutput retrieves and returns the logs from the curl pod used to access the metrics endpoint.

graphqlHandler serves POST /graphql, injecting the Core per request so the compiled schema is reused.

hasFilters reports whether any line-level filter (search/time) is set; type scoping is handled at the source level in QueryLogs.

hasSessionCredential reports whether the request carries something worth a Kratos round trip: the session header, or Kratos' session cookie. An unrela

imageEntrypoint derives the entrypoint OpenSandbox requires from the built image (CNB → ["/cnb/process/web"]; Dockerfile → its ENTRYPOINT+CMD).

instanceCountMetric returns a single-series current replica count (running pods). It needs no metrics source — it counts the App's pods directly — so

introspect validates an OAuth2 token at Hydra's admin API. Returns the zero Identity for an inactive/unknown token, an error when Hydra is unreachable

logID synthesizes a stable, unique id (Render ids are opaque; bex derives one from instance + timestamp + a message hash so the same line is always th

logQueryFromArgs maps the GraphQL logs() args onto a Core LogQuery, accepting the same `app` alias for the application type as the REST adapter.

mcpHTTPHandler serves the MCP streamable-HTTP transport. Mounted at /mcp behind the same auth gate as REST/GraphQL (see Handler), so an HTTP MCP clien

mcpStdio reports whether the binary should run as a stdio MCP server rather than the HTTP service: subcommand `mcp-stdio` or BEX_MCP_STDIO=1.

metricQuery serves one Render metrics endpoint. Render's `resource` is an array (repeatable) of service ids; bex merges each App's series into one res

metricQueryFromArgs maps the GraphQL metrics() args onto a Core MetricQuery, accepting the same vocabulary as the REST adapter.

newPromStub is an httptest Prometheus that records the `query` param and returns a one-series matrix (a single sample of value 7).

newSchema builds the schema once; the Core is injected per-request via context.

parseMetricParams maps Render's metrics query string onto resources + a MetricQuery. resource is required (repeatable, the App id); startTime/endTime

podResourceLimits reads each pod's CPU (cores) or memory (bytes) limit, summed across containers, keyed by pod name. A pod with no limit on the metric

promEscape escapes regex metacharacters in an App name used inside a =~ matcher.

reconcileKubernetes runs the revision as a Deployment (+ ClusterIP k8s Service) owned by the App — pods are scheduled onto the cluster's nodes (machin

reconcileOpenSandbox runs the revision as an OpenSandbox sandbox (host runtime).

registerAPIKeyRoutes adds the machine-credential endpoints (bex extension — Render manages API keys only via its dashboard; naming follows Render's ke

rest_logs.go is the REST logs adapter — Render logs-API compatible. It maps the query string (resource/type/text/startTime/endTime/limit) and the {has

registerPostgresRoutes adds the managed-Postgres endpoints, Render-shaped (/v1/postgres) plus a bex-native /v1/databases alias.

requestMetric delegates to the injected request-metrics source, resolving the query into the backend-neutral RequestMetricsRequest. The unit is set he

resourceMetric returns one current series per replica (labels instance + resource) of CPU or memory usage. With Percentage set, each value is divided

restHandler is the REST adapter — Render-public-API compatible. Paths, the {service, cursor} list envelope, the string suspended enum, and the verb st

serviceAccountToken returns a token for the specified service account in the given namespace. It uses the Kubernetes TokenRequest API to generate a to

setupCertManager installs CertManager if needed for webhook tests. Skips installation if CERT_MANAGER_INSTALL_SKIP=true or if already present.

staticLogStream is the PodLogStream sibling of staticLogs (mcp_test.go): it serves each pod's canned lines then EOF, so FollowLogs ends and the SSE re

streamPodLogs follows one pod's log into ch until ctx ends or the stream closes. A replica going away ends its stream without failing the subscription