@lightdash/warehouses 2.228.1 → 2.229.1

package/dist/warehouseClients/DuckdbWarehouseClient.test.js

@@ -1,1749 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const common_1 = require("@lightdash/common");
-const crypto_1 = require("crypto");
-const promises_1 = __importDefault(require("fs/promises"));
-const DuckdbWarehouseClient_1 = require("./DuckdbWarehouseClient");
-const MotherduckInstanceCache = __importStar(require("./MotherduckInstanceCache"));
-const createInstanceMock = vi.fn();
-const duckdbS3Credentials = {
-    type: 'duckdb_s3',
-    s3Config: {
-        endpoint: 'localhost:9000',
-        region: 'us-east-1',
-        forcePathStyle: true,
-        useSsl: false,
-    },
-};
-// Must provide DuckDBTypeId since mapFieldTypeFromTypeId references it at runtime
-const DUCKDB_TYPE_IDS = {
-    BOOLEAN: 1,
-    TINYINT: 2,
-    SMALLINT: 3,
-    INTEGER: 4,
-    BIGINT: 5,
-    UTINYINT: 6,
-    USMALLINT: 7,
-    UINTEGER: 8,
-    UBIGINT: 9,
-    FLOAT: 10,
-    DOUBLE: 11,
-    TIMESTAMP: 12,
-    DATE: 13,
-    TIME: 14,
-    DECIMAL: 19,
-    HUGEINT: 25,
-    TIMESTAMP_S: 27,
-    TIMESTAMP_MS: 28,
-    TIMESTAMP_NS: 29,
-    TIMESTAMP_TZ: 31,
-    TIME_TZ: 32,
-    UHUGEINT: 49,
-    // Not referenced in switch — used to test default→STRING
-    VARCHAR: 17,
-    BLOB: 18,
-};
-vi.mock('@duckdb/node-api', () => ({
-    DuckDBTypeId: {
-        BOOLEAN: 1,
-        TINYINT: 2,
-        SMALLINT: 3,
-        INTEGER: 4,
-        BIGINT: 5,
-        UTINYINT: 6,
-        USMALLINT: 7,
-        UINTEGER: 8,
-        UBIGINT: 9,
-        FLOAT: 10,
-        DOUBLE: 11,
-        TIMESTAMP: 12,
-        DATE: 13,
-        TIME: 14,
-        DECIMAL: 19,
-        HUGEINT: 25,
-        TIMESTAMP_S: 27,
-        TIMESTAMP_MS: 28,
-        TIMESTAMP_NS: 29,
-        TIMESTAMP_TZ: 31,
-        TIME_TZ: 32,
-        UHUGEINT: 49,
-    },
-    DuckDBInstance: {
-        create: (...args) => createInstanceMock(...args),
-    },
-    version: () => 'v1.5.2',
-}));
-const getMockStreamResult = (chunks, columnTypeIds) => {
-    const columnNames = Object.keys(chunks[0]?.[0] || {});
-    return {
-        columnCount: columnNames.length,
-        columnNames: () => columnNames,
-        columnType: (i) => ({ typeId: columnTypeIds[i] ?? 0 }),
-        // eslint-disable-next-line object-shorthand, func-names, no-restricted-syntax
-        yieldRowObjectJson: async function* () {
-            // eslint-disable-next-line no-restricted-syntax
-            for (const chunk of chunks) {
-                yield chunk;
-            }
-        },
-    };
-};
-const createMockExtractStatements = (overrides) => vi.fn(async () => ({
-    count: overrides?.count ?? 1,
-    prepare: async () => ({
-        statementType: overrides?.statementType ?? 1, // SELECT
-        destroySync: vi.fn(),
-    }),
-}));
-const createMockConnection = (streamMock, runMock = vi.fn(), opts) => ({
-    connect: async () => ({
-        run: runMock,
-        stream: streamMock,
-        extractStatements: opts?.extractStatements ?? createMockExtractStatements(),
-        interrupt: opts?.interrupt ?? vi.fn(),
-        closeSync: vi.fn(),
-        disconnectSync: vi.fn(),
-    }),
-    closeSync: vi.fn(),
-});
-describe('internal Parquet projects', () => {
-    const scope = 'https://storage.googleapis.com/example/events/compacted/org_id=org-a/';
-    const url = `${scope}stream=query_events/dt=2026-09-07/part.parquet`;
-    const source = () => ({
-        scope,
-        httpAuth: { bearerToken: 'test-token' },
-        tables: [{ name: 'query_events', urls: [url] }],
-    });
-    let run;
-    beforeEach(() => {
-        vi.clearAllMocks();
-        run = vi.fn();
-        createInstanceMock.mockResolvedValue(createMockConnection(vi.fn(async () => getMockStreamResult([[{ count: 2 }]], [5])), run));
-    });
-    it('binds trusted views, restricts external access and refreshes the manifest each session', async () => {
-        const resolveSource = vi.fn(async () => source());
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: 'duckdb_parquet',
-            resolveSource,
-        });
-        await client.runQuery('SELECT count(*) FROM query_events');
-        await client.runQuery('SELECT count(*) FROM query_events');
-        expect(resolveSource).toHaveBeenCalledTimes(2);
-        expect(createInstanceMock).toHaveBeenCalledTimes(2);
-        expect(run).toHaveBeenCalledWith(`SET allowed_paths = ['${url}'];`);
-        expect(run).toHaveBeenCalledWith('SET enable_external_access = false;');
-        expect(run).toHaveBeenCalledWith("SET temp_directory = '';");
-        expect(run).toHaveBeenCalledWith(expect.stringContaining('CREATE VIEW "query_events" AS SELECT * FROM read_parquet'));
-        expect(client.credentials).not.toHaveProperty('httpAuth');
-        expect(run).toHaveBeenCalledWith("SET memory_limit = '256MB';");
-        for (const cache of [
-            'enable_http_metadata_cache',
-            'enable_external_file_cache',
-            'parquet_metadata_cache',
-        ]) {
-            expect(run).toHaveBeenCalledWith(`SET ${cache} = true;`);
-        }
-        const statements = run.mock.calls.map(([sql]) => sql);
-        const bind = statements.findIndex((sql) => sql.startsWith('CREATE VIEW'));
-        expect(run).toHaveBeenCalledWith('SET threads = 32;');
-        expect(statements[bind]).toContain('union_by_name = true');
-        const instance = await createInstanceMock.mock.results[0].value;
-        expect(instance.closeSync).toHaveBeenCalledTimes(2);
-    });
-    it('honors explicit thread limits during metadata binding and execution', async () => {
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({ type: 'duckdb_parquet', resolveSource: async () => source() }, { sharedResourceLimits: { threads: 1, memoryLimit: '128MB' } });
-        await client.runQuery('SELECT count(*) FROM query_events');
-        expect(run).toHaveBeenCalledWith("SET memory_limit = '128MB';");
-        expect(run).toHaveBeenCalledWith('SET threads = 1;');
-        expect(run).not.toHaveBeenCalledWith('SET threads = 32;');
-        expect(run).not.toHaveBeenCalledWith('SET threads = 2;');
-    });
-    it('closes the private cache when view binding fails', async () => {
-        run.mockImplementation(async (sql) => {
-            if (sql.startsWith('CREATE VIEW'))
-                throw new Error('binding failed');
-        });
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: 'duckdb_parquet',
-            resolveSource: async () => source(),
-        });
-        await expect(client.runQuery('SELECT count(*) FROM query_events')).rejects.toThrow(/Internal analytics query failed/);
-        const instance = await createInstanceMock.mock.results[0].value;
-        expect(instance.closeSync).toHaveBeenCalledTimes(1);
-    });
-    it.each([
-        'https://storage.googleapis.com/example/events/compacted/org_id=org-b/file.parquet',
-        `${scope}../org-b/file.parquet`,
-        `${scope}%2e%2e/org-b/file.parquet`,
-        `${scope}*.parquet`,
-        '/tmp/private.parquet',
-    ])('rejects files outside the exact manifest scope: %s', async (file) => {
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: 'duckdb_parquet',
-            resolveSource: async () => ({
-                ...source(),
-                tables: [{ name: 'query_events', urls: [file] }],
-            }),
-        });
-        await expect(client.runQuery('SELECT * FROM query_events')).rejects.toThrow();
-        expect(run).not.toHaveBeenCalledWith(expect.stringContaining('CREATE SECRET'));
-    });
-    it.each([
-        { name: 'x"; SELECT 1; --', urls: [url] },
-        { name: 'query_events', urls: [] },
-    ])('rejects arbitrary table SQL and empty manifests: $name', async (table) => {
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: 'duckdb_parquet',
-            resolveSource: async () => ({ ...source(), tables: [table] }),
-        });
-        await expect(client.runQuery('SELECT 1')).rejects.toThrow(/unique names/);
-    });
-    it('keeps user-supplied read_parquet forbidden', async () => {
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: 'duckdb_parquet',
-            resolveSource: async () => source(),
-        });
-        await expect(client.runQuery(`SELECT * FROM read_parquet('${url}')`)).rejects.toThrow(/query permissions/);
-    });
-    it('allows exact signed GET URLs without configuring bucket credentials', async () => {
-        const signedScope = scope.replace('org_id=', 'org_id%3D');
-        const signedUrl = `${url.replace(/=/g, '%3D')}?X-Amz-Signature=test&X-Amz-Expires=900`;
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: 'duckdb_parquet',
-            resolveSource: async () => ({
-                scope: signedScope,
-                signedUrls: true,
-                tables: [{ name: 'query_events', urls: [signedUrl] }],
-            }),
-        });
-        await client.runQuery('SELECT count(*) FROM query_events');
-        expect(run).toHaveBeenCalledWith(`SET allowed_paths = ['${signedUrl}'];`);
-        expect(run).not.toHaveBeenCalledWith(expect.stringContaining('CREATE SECRET'));
-        expect(run).toHaveBeenCalledWith('SET enable_external_file_cache = true;');
-    });
-    it.each([
-        'SELECT sql FROM duckdb_views()',
-        'SELECT * FROM duckdb_external_file_cache()',
-        'SELECT * FROM "information_schema"."views"',
-        'SELECT * FROM sqlite_master',
-        "SELECT * FROM pragma_storage_info('query_events')",
-    ])('blocks metadata queries that could disclose signed URLs: %s', async (sql) => {
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: 'duckdb_parquet',
-            resolveSource: async () => source(),
-        });
-        await expect(client.runQuery(sql)).rejects.toThrow(/catalog access/);
-    });
-    it('redacts signed URLs from native query failures', async () => {
-        run.mockRejectedValue(new Error(`${url}?X-Amz-Signature=private`));
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: 'duckdb_parquet',
-            resolveSource: async () => source(),
-        });
-        await expect(client.runQuery('SELECT count(*) FROM query_events')).rejects.toThrow(/^Internal analytics query failed\. Check storage access and query permissions\.$/);
-    });
-    it('cannot create privileged readers from public project credentials or shared instances', () => {
-        expect(() => new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: common_1.WarehouseTypes.DUCKDB,
-            connectionType: common_1.DuckdbConnectionType.ANALYTICS,
-            database: 'memory',
-            schema: 'main',
-        })).toThrow(/internal project service/);
-        expect(() => new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: 'duckdb_parquet',
-            resolveSource: async () => source(),
-        }, { instanceCacheKey: 'shared' })).toThrow(/cannot share/);
-    });
-});
-describe('mapFieldTypeFromTypeId', () => {
-    it('should map date types', () => {
-        expect((0, DuckdbWarehouseClient_1.mapFieldTypeFromTypeId)(DUCKDB_TYPE_IDS.DATE)).toBe(common_1.DimensionType.DATE);
-    });
-    it('should map timestamp types', () => {
-        const timestampIds = [
-            DUCKDB_TYPE_IDS.TIMESTAMP,
-            DUCKDB_TYPE_IDS.TIMESTAMP_S,
-            DUCKDB_TYPE_IDS.TIMESTAMP_MS,
-            DUCKDB_TYPE_IDS.TIMESTAMP_NS,
-            DUCKDB_TYPE_IDS.TIMESTAMP_TZ,
-            DUCKDB_TYPE_IDS.TIME,
-            DUCKDB_TYPE_IDS.TIME_TZ,
-        ];
-        timestampIds.forEach((id) => {
-            expect((0, DuckdbWarehouseClient_1.mapFieldTypeFromTypeId)(id)).toBe(common_1.DimensionType.TIMESTAMP);
-        });
-    });
-    it('should map boolean type', () => {
-        expect((0, DuckdbWarehouseClient_1.mapFieldTypeFromTypeId)(DUCKDB_TYPE_IDS.BOOLEAN)).toBe(common_1.DimensionType.BOOLEAN);
-    });
-    it('should map numeric types', () => {
-        const numericIds = [
-            DUCKDB_TYPE_IDS.TINYINT,
-            DUCKDB_TYPE_IDS.SMALLINT,
-            DUCKDB_TYPE_IDS.INTEGER,
-            DUCKDB_TYPE_IDS.BIGINT,
-            DUCKDB_TYPE_IDS.UTINYINT,
-            DUCKDB_TYPE_IDS.USMALLINT,
-            DUCKDB_TYPE_IDS.UINTEGER,
-            DUCKDB_TYPE_IDS.UBIGINT,
-            DUCKDB_TYPE_IDS.HUGEINT,
-            DUCKDB_TYPE_IDS.UHUGEINT,
-            DUCKDB_TYPE_IDS.FLOAT,
-            DUCKDB_TYPE_IDS.DOUBLE,
-            DUCKDB_TYPE_IDS.DECIMAL,
-        ];
-        numericIds.forEach((id) => {
-            expect((0, DuckdbWarehouseClient_1.mapFieldTypeFromTypeId)(id)).toBe(common_1.DimensionType.NUMBER);
-        });
-    });
-    it('should default to string for unknown types', () => {
-        expect((0, DuckdbWarehouseClient_1.mapFieldTypeFromTypeId)(DUCKDB_TYPE_IDS.VARCHAR)).toBe(common_1.DimensionType.STRING);
-        expect((0, DuckdbWarehouseClient_1.mapFieldTypeFromTypeId)(DUCKDB_TYPE_IDS.BLOB)).toBe(common_1.DimensionType.STRING);
-        expect((0, DuckdbWarehouseClient_1.mapFieldTypeFromTypeId)(9999)).toBe(common_1.DimensionType.STRING);
-    });
-});
-describe('DuckdbWarehouseClient', () => {
-    beforeEach(() => {
-        vi.clearAllMocks();
-        DuckdbWarehouseClient_1.DuckdbWarehouseClient.resetSharedDuckdbStateForTesting();
-        MotherduckInstanceCache.resetForTesting();
-        MotherduckInstanceCache.configure({
-            idleTtlMs: 60000,
-            maxAgeMs: 60000,
-            maxEntries: 8,
-        });
-    });
-    afterEach(() => {
-        vi.useRealTimers();
-    });
-    it('should return query rows and mapped fields', async () => {
-        const rows = [
-            {
-                customer_name: 'Alice',
-                order_count: 2,
-                last_order_at: '2026-02-22 12:00:00',
-            },
-        ];
-        const streamMock = vi.fn(async () => getMockStreamResult([rows], [
-            DUCKDB_TYPE_IDS.VARCHAR,
-            DUCKDB_TYPE_IDS.INTEGER,
-            DUCKDB_TYPE_IDS.TIMESTAMP,
-        ]));
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock));
-        const client = DuckdbWarehouseClient_1.DuckdbWarehouseClient.createForPreAggregate({
-            type: 'duckdb_s3',
-            s3Config: {
-                endpoint: 'localhost:9000',
-                region: 'us-east-1',
-                forcePathStyle: true,
-                useSsl: false,
-            },
-        });
-        const result = await client.runQuery('SELECT * FROM customers');
-        expect(result.rows).toEqual(rows);
-        expect(result.fields).toEqual({
-            customer_name: { type: common_1.DimensionType.STRING },
-            order_count: {
-                type: common_1.DimensionType.NUMBER,
-                numericKind: { kind: 'integer' },
-            },
-            last_order_at: { type: common_1.DimensionType.TIMESTAMP },
-        });
-    });
-    it('should stream results in multiple chunks', async () => {
-        const chunk1 = [{ id: 1 }, { id: 2 }];
-        const chunk2 = [{ id: 3 }];
-        const streamMock = vi.fn(async () => getMockStreamResult([chunk1, chunk2], [DUCKDB_TYPE_IDS.INTEGER]));
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock));
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-        const streamCallback = vi.fn();
-        const result = await client.executeAsyncQuery({
-            sql: 'SELECT id FROM t',
-            tags: { project_uuid: 'proj-1' },
-        }, streamCallback);
-        expect(streamCallback).toHaveBeenCalledTimes(2);
-        const idField = {
-            id: {
-                type: common_1.DimensionType.NUMBER,
-                numericKind: { kind: 'integer' },
-            },
-        };
-        expect(streamCallback).toHaveBeenNthCalledWith(1, chunk1, idField);
-        expect(streamCallback).toHaveBeenNthCalledWith(2, chunk2, idField);
-        expect(result.totalRows).toBe(3);
-    });
-    it('should handle empty result set', async () => {
-        const streamMock = vi.fn(async () => getMockStreamResult([], [DUCKDB_TYPE_IDS.INTEGER]));
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock));
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-        const result = await client.runQuery('SELECT id FROM empty_table');
-        expect(result.rows).toEqual([]);
-        expect(result.fields).toEqual({});
-    });
-    it('skips MotherDuck timezone and profiling configuration, warns once, and runs every query', async () => {
-        const runMock = vi.fn();
-        const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        const logger = { info: vi.fn(), warn: vi.fn() };
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: common_1.WarehouseTypes.DUCKDB,
-            connectionType: common_1.DuckdbConnectionType.MOTHERDUCK,
-            database: 'analytics',
-            schema: 'main',
-            token: 'motherduck_token',
-        }, { logger, enableQueryProfiling: true });
-        await client.runQuery('SELECT 1 AS val', undefined, 'Europe/London');
-        await client.runQuery('SELECT 2 AS val', undefined, 'Europe/London');
-        expect(streamMock).toHaveBeenCalledTimes(2);
-        expect(runMock).not.toHaveBeenCalledWith("SET TimeZone = 'Europe/London';");
-        expect(runMock).not.toHaveBeenCalledWith("PRAGMA enable_profiling='json';");
-        expect(logger.warn).toHaveBeenCalledExactlyOnceWith(expect.stringMatching(/Europe\/London.*MotherDuck.*saas_mode.*server default zone.*configured zone/));
-        expect(logger.info).not.toHaveBeenCalledWith(expect.stringContaining('Requested timezone'));
-    });
-    it('falls back to info for the MotherDuck timezone warning', async () => {
-        const runMock = vi.fn();
-        const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        const logger = { info: vi.fn() };
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: common_1.WarehouseTypes.DUCKDB,
-            connectionType: common_1.DuckdbConnectionType.MOTHERDUCK,
-            database: 'analytics',
-            schema: 'main',
-            token: 'motherduck_token',
-        }, { logger });
-        await client.runQuery('SELECT 1 AS val', undefined, 'Europe/London');
-        expect(logger.info).toHaveBeenCalledWith(expect.stringMatching(/Europe\/London.*MotherDuck.*saas_mode.*server default zone.*configured zone/));
-    });
-    describe('MotherDuck instance caching', () => {
-        const credentials = {
-            type: common_1.WarehouseTypes.DUCKDB,
-            connectionType: common_1.DuckdbConnectionType.MOTHERDUCK,
-            database: 'analytics',
-            schema: 'main',
-            token: 'token-a',
-        };
-        it('reuses an instance without issuing SET or PRAGMA statements and reports connect timing', async () => {
-            const runMock = vi.fn();
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            const onPhaseTiming = vi.fn();
-            const events = [];
-            MotherduckInstanceCache.setObserver((event) => events.push(event));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(credentials, {
-                enableInstanceCache: true,
-                projectUuid: 'project-a',
-            });
-            await client.streamQuery('SELECT 1 AS val', vi.fn(), {
-                onPhaseTiming,
-            });
-            await client.streamQuery('SELECT 1 AS val', vi.fn(), {
-                onPhaseTiming,
-            });
-            expect(createInstanceMock).toHaveBeenCalledOnce();
-            expect(runMock).not.toHaveBeenCalledWith(expect.stringMatching(/^(?:SET|PRAGMA)\b/i));
-            const acquisitions = events.filter((event) => event.type === 'acquire');
-            expect(acquisitions).toHaveLength(2);
-            acquisitions.forEach((event) => {
-                expect(onPhaseTiming).toHaveBeenCalledWith('connect', event.waitMs + event.instanceCreateMs + event.connectMs);
-            });
-        });
-        it('reports instance creation and connection as direct connect timing', async () => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            const onPhaseTiming = vi.fn();
-            const performanceNow = vi
-                .spyOn(performance, 'now')
-                .mockReturnValueOnce(0)
-                .mockReturnValueOnce(10)
-                .mockReturnValueOnce(30)
-                .mockReturnValueOnce(40)
-                .mockReturnValueOnce(45)
-                .mockReturnValue(45);
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(credentials);
-            try {
-                await client.streamQuery('SELECT 1 AS val', vi.fn(), {
-                    onPhaseTiming,
-                });
-            }
-            finally {
-                performanceNow.mockRestore();
-            }
-            expect(onPhaseTiming).toHaveBeenCalledWith('connect', 25);
-        });
-        it('falls back to direct sessions when user credentials are required', async () => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            createInstanceMock.mockImplementation(async () => createMockConnection(streamMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({ ...credentials, requireUserCredentials: true }, { enableInstanceCache: true, projectUuid: 'project-a' });
-            await client.runQuery('SELECT 1 AS val');
-            await client.runQuery('SELECT 1 AS val');
-            expect(createInstanceMock).toHaveBeenCalledTimes(2);
-        });
-        it('retries one stale failure before rows are emitted and replaces only the failed entry', async () => {
-            const events = [];
-            MotherduckInstanceCache.setObserver((event) => events.push(event));
-            const staleError = new Error('Connection Error: Connection has already been closed');
-            const firstStream = vi.fn().mockRejectedValue(staleError);
-            const recoveredStream = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            const firstInstance = createMockConnection(firstStream);
-            const recoveredInstance = createMockConnection(recoveredStream);
-            createInstanceMock
-                .mockResolvedValueOnce(firstInstance)
-                .mockResolvedValueOnce(recoveredInstance);
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(credentials, {
-                enableInstanceCache: true,
-                projectUuid: 'project-a',
-            });
-            await expect(client.runQuery('SELECT 1 AS val')).resolves.toEqual(expect.objectContaining({ rows: [{ val: 1 }] }));
-            expect(createInstanceMock).toHaveBeenCalledTimes(2);
-            expect(firstInstance.closeSync).toHaveBeenCalledOnce();
-            expect(events).toContainEqual(expect.objectContaining({
-                type: 'evict',
-                reason: 'stale',
-            }));
-            expect(events).toContainEqual(expect.objectContaining({
-                type: 'retry',
-                outcome: 'recovered',
-            }));
-        });
-        it('reports a failed retry and does not loop on a second stale failure', async () => {
-            const events = [];
-            MotherduckInstanceCache.setObserver((event) => events.push(event));
-            const staleError = new Error('Connection Error: Connection has already been closed');
-            const firstInstance = createMockConnection(vi.fn().mockRejectedValue(staleError));
-            const secondInstance = createMockConnection(vi.fn().mockRejectedValue(staleError));
-            createInstanceMock
-                .mockResolvedValueOnce(firstInstance)
-                .mockResolvedValueOnce(secondInstance);
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(credentials, {
-                enableInstanceCache: true,
-                projectUuid: 'project-a',
-            });
-            await expect(client.runQuery('SELECT 1 AS val')).rejects.toThrow(staleError);
-            expect(createInstanceMock).toHaveBeenCalledTimes(2);
-            expect(firstInstance.closeSync).toHaveBeenCalledOnce();
-            expect(secondInstance.closeSync).toHaveBeenCalledOnce();
-            expect(events).toContainEqual(expect.objectContaining({
-                type: 'retry',
-                outcome: 'failed',
-            }));
-        });
-        it('does not retry a stale failure after rows reached the consumer', async () => {
-            const events = [];
-            MotherduckInstanceCache.setObserver((event) => events.push(event));
-            const staleError = new Error('Invalid Input Error: Cannot execute statement of closed connection');
-            const streamMock = vi.fn(async () => {
-                let hasYielded = false;
-                const iterator = {
-                    next: async () => {
-                        if (!hasYielded) {
-                            hasYielded = true;
-                            return { done: false, value: [{ val: 1 }] };
-                        }
-                        throw staleError;
-                    },
-                    [Symbol.asyncIterator]() {
-                        return this;
-                    },
-                };
-                return {
-                    columnCount: 1,
-                    columnNames: () => ['val'],
-                    columnType: () => ({ typeId: DUCKDB_TYPE_IDS.INTEGER }),
-                    yieldRowObjectJson: () => iterator,
-                };
-            });
-            const instance = createMockConnection(streamMock);
-            createInstanceMock.mockResolvedValue(instance);
-            const streamCallback = vi.fn();
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(credentials, {
-                enableInstanceCache: true,
-                projectUuid: 'project-a',
-            });
-            await expect(client.streamQuery('SELECT 1 AS val', streamCallback)).rejects.toThrow(staleError);
-            expect(streamCallback).toHaveBeenCalledOnce();
-            expect(createInstanceMock).toHaveBeenCalledOnce();
-            expect(instance.closeSync).toHaveBeenCalledOnce();
-            expect(events).toContainEqual(expect.objectContaining({
-                type: 'evict',
-                reason: 'stale',
-            }));
-            expect(events).not.toContainEqual(expect.objectContaining({ type: 'retry' }));
-        });
-        it('invalidates authentication failures without retrying', async () => {
-            const events = [];
-            MotherduckInstanceCache.setObserver((event) => events.push(event));
-            const authError = new Error('Invalid Input Error: MD Authentication Error: Invalid token');
-            const streamMock = vi.fn().mockRejectedValue(authError);
-            const instance = createMockConnection(streamMock);
-            createInstanceMock.mockResolvedValue(instance);
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(credentials, {
-                enableInstanceCache: true,
-                projectUuid: 'project-a',
-            });
-            await expect(client.runQuery('SELECT 1 AS val')).rejects.toThrow(authError);
-            expect(createInstanceMock).toHaveBeenCalledOnce();
-            expect(instance.closeSync).toHaveBeenCalledOnce();
-            expect(events).toContainEqual(expect.objectContaining({
-                type: 'evict',
-                reason: 'auth',
-            }));
-            expect(events).not.toContainEqual(expect.objectContaining({ type: 'retry' }));
-        });
-        it('never includes the cache digest in cached-instance log lines or metadata', async () => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            const logger = { info: vi.fn() };
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(credentials, {
-                enableInstanceCache: true,
-                projectUuid: 'project-a',
-                logger,
-            });
-            await client.runQuery('SELECT 1 AS val');
-            const connectionString = createInstanceMock.mock.calls[0][0];
-            if (typeof connectionString !== 'string') {
-                throw new Error('Expected a MotherDuck connection string');
-            }
-            const digest = (0, crypto_1.createHash)('sha256')
-                .update(JSON.stringify({ connectionString, v: 1 }))
-                .digest('hex');
-            expect(JSON.stringify(logger.info.mock.calls)).not.toContain(digest);
-        });
-    });
-    describe('session strategy routing', () => {
-        const createSuccessfulInstance = () => createMockConnection(vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER])), vi.fn());
-        it('keeps embedded playground databases on direct read-only sessions', async () => {
-            createInstanceMock.mockResolvedValue(createSuccessfulInstance());
-            const onPhaseTiming = vi.fn();
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-                type: common_1.WarehouseTypes.DUCKDB,
-                connectionType: common_1.DuckdbConnectionType.EMBEDDED,
-                dataset: 'jaffle_shop',
-            });
-            await client.streamQuery('SELECT 1 AS val', vi.fn(), {
-                onPhaseTiming,
-            });
-            expect(createInstanceMock).toHaveBeenCalledWith(expect.stringContaining('jaffle_shop.duckdb'), expect.objectContaining({ access_mode: 'READ_ONLY' }));
-            expect(onPhaseTiming).toHaveBeenCalledWith('connect', expect.any(Number));
-        });
-        it('routes resource-limited in-memory clients to isolated sessions', async () => {
-            createInstanceMock.mockResolvedValue(createSuccessfulInstance());
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(undefined, {
-                resourceLimits: { memoryLimit: '64MB', threads: 1 },
-            });
-            await client.runQuery('SELECT 1 AS val');
-            await client.runQuery('SELECT 1 AS val');
-            expect(createInstanceMock).toHaveBeenCalledTimes(2);
-            expect(createInstanceMock).toHaveBeenNthCalledWith(1, ':memory:');
-            expect(createInstanceMock).toHaveBeenNthCalledWith(2, ':memory:');
-        });
-        it('routes explicit cache keys to shared sessions', async () => {
-            createInstanceMock.mockResolvedValue(createSuccessfulInstance());
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(undefined, {
-                instanceCacheKey: 'routing-shared-instance',
-            });
-            await client.runQuery('SELECT 1 AS val');
-            await client.runQuery('SELECT 1 AS val');
-            expect(createInstanceMock).toHaveBeenCalledExactlyOnceWith(':memory:');
-        });
-        it('keeps DuckLake on its existing shared session strategy', async () => {
-            createInstanceMock.mockResolvedValue(createSuccessfulInstance());
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-                type: common_1.WarehouseTypes.DUCKDB,
-                connectionType: common_1.DuckdbConnectionType.DUCKLAKE,
-                schema: 'main',
-                catalogAlias: 'ducklake',
-                catalog: {
-                    type: common_1.DucklakeCatalogType.POSTGRES,
-                    host: 'pg.example.com',
-                    port: 5432,
-                    database: 'catalog',
-                    user: 'ducklake_user',
-                    password: 'password',
-                },
-                dataPath: {
-                    type: common_1.DucklakeDataPathType.S3,
-                    url: 's3://bucket/path/',
-                    region: 'us-east-1',
-                },
-            });
-            await client.runQuery('SELECT 1 AS val');
-            await client.runQuery('SELECT 1 AS val');
-            expect(createInstanceMock).toHaveBeenCalledExactlyOnceWith(':memory:');
-        });
-        it('keeps default in-memory clients on ephemeral sessions', async () => {
-            createInstanceMock.mockResolvedValue(createSuccessfulInstance());
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            await client.runQuery('SELECT 1 AS val');
-            await client.runQuery('SELECT 1 AS val');
-            expect(createInstanceMock).toHaveBeenCalledTimes(2);
-            expect(createInstanceMock).toHaveBeenNthCalledWith(1, ':memory:');
-            expect(createInstanceMock).toHaveBeenNthCalledWith(2, ':memory:');
-        });
-    });
-    it('sets timezone for in-memory and embedded DuckDB queries', async () => {
-        const runMock = vi.fn();
-        const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-        const inMemoryClient = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-        await inMemoryClient.runQuery('SELECT 1 AS val', undefined, 'Europe/London');
-        expect(runMock).toHaveBeenCalledWith("SET TimeZone = 'Europe/London';");
-        runMock.mockClear();
-        const embeddedClient = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: common_1.WarehouseTypes.DUCKDB,
-            connectionType: common_1.DuckdbConnectionType.EMBEDDED,
-            dataset: 'jaffle_shop',
-        });
-        await embeddedClient.runQuery('SELECT 2 AS val', undefined, 'America/New_York');
-        expect(runMock).toHaveBeenCalledWith("SET TimeZone = 'America/New_York';");
-    });
-    it('should set timezone, S3 config, and shared resource limits before streaming', async () => {
-        const runMock = vi.fn();
-        const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-        const config = {
-            type: 'duckdb_s3',
-            s3Config: {
-                endpoint: 'localhost:9000',
-                region: 'us-east-1',
-                accessKey: 'key',
-                secretKey: 'secret',
-                forcePathStyle: true,
-                useSsl: false,
-            },
-        };
-        const clientA = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(config, {
-            sharedResourceLimits: {
-                memoryLimit: '3GB',
-                threads: 4,
-            },
-            instanceCacheKey: 'pre-aggregate-query-instance',
-        });
-        const clientB = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(config, {
-            sharedResourceLimits: {
-                memoryLimit: '3GB',
-                threads: 4,
-            },
-            instanceCacheKey: 'pre-aggregate-query-instance',
-        });
-        await clientA.runQuery('SELECT 1 AS val');
-        await clientB.runQuery('SELECT 1 AS val');
-        expect(createInstanceMock).toHaveBeenCalledTimes(1);
-        expect(runMock.mock.calls.filter(([sql]) => sql.includes('CREATE OR REPLACE SECRET __lightdash_s3'))).toHaveLength(1);
-        expect(streamMock).toHaveBeenCalledTimes(2);
-    });
-    it('should use DuckDB credential chain for S3 config without static credentials', async () => {
-        const runMock = vi.fn();
-        const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-        const client = DuckdbWarehouseClient_1.DuckdbWarehouseClient.createForPreAggregate({
-            type: 'duckdb_s3',
-            s3Config: {
-                endpoint: 's3.eu-west-1.amazonaws.com',
-                region: 'eu-west-1',
-                forcePathStyle: false,
-                useSsl: true,
-            },
-        });
-        await client.runQuery('SELECT 1 AS val');
-        expect(runMock).toHaveBeenCalledWith('INSTALL aws;');
-        expect(runMock).toHaveBeenCalledWith('LOAD aws;');
-        const secretSql = runMock.mock.calls
-            .map(([sql]) => sql)
-            .find((sql) => sql.includes('CREATE OR REPLACE SECRET __lightdash_s3'));
-        expect(secretSql).toContain('PROVIDER credential_chain');
-        expect(secretSql).toContain('REFRESH auto');
-        expect(secretSql).toContain("VALIDATION 'none'");
-        expect(secretSql).toContain("REGION 'eu-west-1'");
-        expect(secretSql).toContain("ENDPOINT 's3.eu-west-1.amazonaws.com'");
-        expect(secretSql).not.toContain('KEY_ID');
-        expect(secretSql).not.toContain("SECRET '");
-    });
-    it('scopes S3 credentials to the trusted external-source object', async () => {
-        const runMock = vi.fn();
-        createInstanceMock.mockResolvedValue(createMockConnection(vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER])), runMock));
-        const scope = [
-            's3://bucket/external-sources/project/source/table/v1.parquet',
-            's3://bucket/external-sources/project/source/table/v2.parquet',
-        ];
-        const client = DuckdbWarehouseClient_1.DuckdbWarehouseClient.createForPreAggregate({
-            type: 'duckdb_s3',
-            s3Config: {
-                endpoint: 's3.amazonaws.com',
-                forcePathStyle: false,
-                useSsl: true,
-                scope,
-            },
-        });
-        await client.runQuery('SELECT 1');
-        const secretSql = runMock.mock.calls
-            .map(([sql]) => sql)
-            .find((sql) => sql.includes('CREATE OR REPLACE SECRET __lightdash_s3'));
-        expect(secretSql).toContain(`SCOPE ('${scope[0]}', '${scope[1]}')`);
-    });
-    it('caps isolated S3 queries per organization', async () => {
-        let resolveStream = () => { };
-        const streamMock = vi.fn(() => new Promise((resolve) => {
-            resolveStream = resolve;
-        }));
-        createInstanceMock.mockImplementation(async () => createMockConnection(streamMock));
-        const createClient = () => DuckdbWarehouseClient_1.DuckdbWarehouseClient.createForPreAggregate({
-            type: 'duckdb_s3',
-            s3Config: {
-                endpoint: 's3.amazonaws.com',
-                forcePathStyle: false,
-                useSsl: true,
-                scope: ['s3://bucket/external-sources/object.parquet'],
-            },
-        }, {
-            resourceLimits: { memoryLimit: '128MB', threads: 1 },
-            organizationConcurrencyLimit: 1,
-        });
-        const tags = { organization_uuid: 'external-source-org' };
-        const first = createClient().runQuery('SELECT 1', tags);
-        await vi.waitFor(() => expect(streamMock).toHaveBeenCalledOnce());
-        await expect(createClient().runQuery('SELECT 2', tags)).rejects.toThrow('External source query capacity is full');
-        resolveStream(getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        await first;
-    });
-    it('should load bundled extensions without runtime installs', async () => {
-        const accessMock = vi.spyOn(promises_1.default, 'access').mockResolvedValue();
-        try {
-            const runMock = vi.fn();
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-            const client = DuckdbWarehouseClient_1.DuckdbWarehouseClient.createForPreAggregate({
-                type: 'duckdb_s3',
-                s3Config: {
-                    endpoint: 's3.eu-west-1.amazonaws.com',
-                    region: 'eu-west-1',
-                    forcePathStyle: false,
-                    useSsl: true,
-                },
-            });
-            await client.runQuery('SELECT 1 AS val');
-            expect(runMock).toHaveBeenCalledWith(expect.stringContaining("duckdbExtensions/v1.5.2/httpfs.duckdb_extension';"));
-            expect(runMock).toHaveBeenCalledWith(expect.stringContaining("duckdbExtensions/v1.5.2/aws.duckdb_extension';"));
-            expect(runMock).not.toHaveBeenCalledWith('INSTALL httpfs;');
-            expect(runMock).not.toHaveBeenCalledWith('INSTALL aws;');
-        }
-        finally {
-            accessMock.mockRestore();
-        }
-    });
-    it('should surface bundled extension load failures', async () => {
-        const accessMock = vi.spyOn(promises_1.default, 'access').mockResolvedValue();
-        try {
-            const loadError = new Error('Invalid bundled extension');
-            const runMock = vi.fn(async (sql) => {
-                if (sql.includes('httpfs.duckdb_extension')) {
-                    throw loadError;
-                }
-            });
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-            const client = DuckdbWarehouseClient_1.DuckdbWarehouseClient.createForPreAggregate({
-                type: 'duckdb_s3',
-                s3Config: {
-                    endpoint: 'localhost:9000',
-                    region: 'us-east-1',
-                    accessKey: 'key',
-                    secretKey: 'secret',
-                    forcePathStyle: true,
-                    useSsl: false,
-                },
-            });
-            await expect(client.runQuery('SELECT 1 AS val')).rejects.toThrow(loadError);
-            expect(runMock).not.toHaveBeenCalledWith('INSTALL httpfs;');
-        }
-        finally {
-            accessMock.mockRestore();
-        }
-    });
-    it('should use static DuckDB S3 credentials when configured', async () => {
-        const runMock = vi.fn();
-        const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-        const client = DuckdbWarehouseClient_1.DuckdbWarehouseClient.createForPreAggregate({
-            type: 'duckdb_s3',
-            s3Config: {
-                endpoint: 'localhost:9000',
-                region: 'us-east-1',
-                accessKey: 'key',
-                secretKey: 'secret',
-                forcePathStyle: true,
-                useSsl: false,
-            },
-        });
-        await client.runQuery('SELECT 1 AS val');
-        expect(runMock).not.toHaveBeenCalledWith('INSTALL aws;');
-        expect(runMock).not.toHaveBeenCalledWith('LOAD aws;');
-        const secretSql = runMock.mock.calls
-            .map(([sql]) => sql)
-            .find((sql) => sql.includes('CREATE OR REPLACE SECRET __lightdash_s3'));
-        expect(secretSql).not.toContain('PROVIDER credential_chain');
-        expect(secretSql).toContain("KEY_ID 'key'");
-        expect(secretSql).toContain("SECRET 'secret'");
-        expect(secretSql).toContain("URL_STYLE 'path'");
-        expect(secretSql).toContain('USE_SSL false');
-    });
-    it('should treat instanceCacheKey as the shared instance identity', async () => {
-        const runMock = vi.fn();
-        const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-        const clientA = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: 'duckdb_s3',
-            s3Config: {
-                endpoint: 'localhost:9000',
-                region: 'us-east-1',
-                accessKey: 'key-a',
-                secretKey: 'secret-a',
-                forcePathStyle: true,
-                useSsl: false,
-            },
-        }, {
-            sharedResourceLimits: {
-                memoryLimit: '3GB',
-            },
-            instanceCacheKey: 'pre-aggregate-query-instance',
-        });
-        const clientB = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: 'duckdb_s3',
-            s3Config: {
-                endpoint: 'localhost:9000',
-                region: 'us-east-1',
-                accessKey: 'key-b',
-                secretKey: 'secret-b',
-                forcePathStyle: true,
-                useSsl: false,
-            },
-        }, {
-            sharedResourceLimits: {
-                memoryLimit: '6GB',
-                threads: 8,
-            },
-            instanceCacheKey: 'pre-aggregate-query-instance',
-        });
-        await clientA.runQuery('SELECT 1 AS val');
-        await clientB.runQuery('SELECT 1 AS val');
-        expect(createInstanceMock).toHaveBeenCalledTimes(1);
-        expect(runMock.mock.calls.filter(([sql]) => sql.includes('CREATE OR REPLACE SECRET __lightdash_s3'))).toHaveLength(1);
-        expect(runMock).not.toHaveBeenCalledWith("SET memory_limit = '6GB';");
-        expect(runMock).not.toHaveBeenCalledWith('SET threads = 8;');
-    });
-    it('hardens each query connection on a shared instance', async () => {
-        const bootstrapRunMock = vi.fn();
-        const queryRunMock = vi.fn();
-        const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        const connectMock = vi
-            .fn()
-            .mockResolvedValueOnce({
-            run: bootstrapRunMock,
-            closeSync: vi.fn(),
-            disconnectSync: vi.fn(),
-        })
-            .mockResolvedValueOnce({
-            run: queryRunMock,
-            stream: streamMock,
-            extractStatements: createMockExtractStatements(),
-            closeSync: vi.fn(),
-            disconnectSync: vi.fn(),
-        });
-        createInstanceMock.mockResolvedValue({
-            connect: connectMock,
-            closeSync: vi.fn(),
-        });
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(undefined, {
-            instanceCacheKey: 'shared-query-hardening',
-            sharedResourceLimits: { memoryLimit: '256MB', threads: 1 },
-        });
-        await client.runQuery('SELECT 1 AS val');
-        expect(queryRunMock.mock.calls.map(([sql]) => sql)).toEqual([
-            "SET memory_limit = '256MB';",
-            'SET threads = 1;',
-            'SET allow_community_extensions = false;',
-            'SET autoinstall_known_extensions = false;',
-            'SET autoload_known_extensions = false;',
-            'SET allow_unredacted_secrets = false;',
-        ]);
-    });
-    it('points httpfs at the CA bundle the session config names', async () => {
-        const bootstrapRunMock = vi.fn();
-        const queryRunMock = vi.fn();
-        const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        const connectMock = vi
-            .fn()
-            .mockResolvedValueOnce({
-            run: bootstrapRunMock,
-            closeSync: vi.fn(),
-            disconnectSync: vi.fn(),
-        })
-            .mockResolvedValueOnce({
-            run: queryRunMock,
-            stream: streamMock,
-            extractStatements: createMockExtractStatements(),
-            closeSync: vi.fn(),
-            disconnectSync: vi.fn(),
-        });
-        createInstanceMock.mockResolvedValue({
-            connect: connectMock,
-            closeSync: vi.fn(),
-        });
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: 'duckdb_s3',
-            s3Config: {
-                endpoint: 'results.example.com',
-                region: 'eu-west-1',
-                accessKey: 'key',
-                secretKey: 'secret',
-                forcePathStyle: false,
-                useSsl: true,
-                caCertFile: '/etc/ssl/certs/ca-certificates.crt',
-            },
-        }, { instanceCacheKey: 'ca-bundle-session' });
-        await client.runQuery('SELECT 1 AS val');
-        expect(bootstrapRunMock).toHaveBeenCalledWith("SET ca_cert_file = '/etc/ssl/certs/ca-certificates.crt';");
-    });
-    it('confines embedded user queries without writing profiles to local files', async () => {
-        const runMock = vi.fn();
-        const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        const logger = { info: vi.fn() };
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: common_1.WarehouseTypes.DUCKDB,
-            connectionType: common_1.DuckdbConnectionType.EMBEDDED,
-            dataset: 'jaffle_shop',
-        }, { logger });
-        await client.runQuery('SELECT 1 AS val');
-        expect(createInstanceMock).toHaveBeenCalledWith(expect.stringContaining('jaffle_shop.duckdb'), {
-            access_mode: 'READ_ONLY',
-            memory_limit: '256MB',
-            threads: '1',
-        });
-        expect(runMock).toHaveBeenCalledWith("SET disabled_filesystems = 'LocalFileSystem';");
-        expect(runMock).not.toHaveBeenCalledWith("PRAGMA enable_profiling='json';");
-    });
-    it('runs a queued embedded query once a same-organization holder releases', async () => {
-        const pendingStreams = [];
-        const streamMock = vi.fn((_sql) => new Promise((resolve) => {
-            pendingStreams.push(resolve);
-        }));
-        createInstanceMock.mockImplementation(async () => createMockConnection(streamMock));
-        const createClient = () => new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: common_1.WarehouseTypes.DUCKDB,
-            connectionType: common_1.DuckdbConnectionType.EMBEDDED,
-            dataset: 'jaffle_shop',
-        }, { embeddedQueryTimeoutMs: 60000 });
-        const tags = { organization_uuid: 'organization-1' };
-        const queries = Array.from({ length: 6 }, (_, index) => createClient().runQuery(`SELECT ${index + 1} AS val`, tags));
-        await vi.waitFor(() => expect(streamMock).toHaveBeenCalledTimes(4));
-        expect(createInstanceMock).toHaveBeenCalledTimes(4);
-        pendingStreams[0](getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        await queries[0];
-        await vi.waitFor(() => expect(streamMock).toHaveBeenCalledTimes(5));
-        expect(createInstanceMock).toHaveBeenCalledTimes(5);
-        expect(streamMock.mock.calls[4]?.[0]).toContain('SELECT 5 AS val');
-        pendingStreams[1](getMockStreamResult([[{ val: 2 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        await queries[1];
-        await vi.waitFor(() => expect(streamMock).toHaveBeenCalledTimes(6));
-        expect(createInstanceMock).toHaveBeenCalledTimes(6);
-        expect(streamMock.mock.calls[5]?.[0]).toContain('SELECT 6 AS val');
-        pendingStreams.forEach((resolve) => resolve(getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER])));
-        await Promise.all(queries.slice(1));
-    });
-    it('times out a queued embedded query with the existing capacity error', async () => {
-        vi.useFakeTimers();
-        const pendingStreams = [];
-        const streamMock = vi.fn(() => new Promise((resolve) => {
-            pendingStreams.push(resolve);
-        }));
-        createInstanceMock.mockImplementation(async () => createMockConnection(streamMock));
-        const createClient = () => new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: common_1.WarehouseTypes.DUCKDB,
-            connectionType: common_1.DuckdbConnectionType.EMBEDDED,
-            dataset: 'jaffle_shop',
-        }, { embeddedQueryTimeoutMs: 60000 });
-        const tags = { organization_uuid: 'organization-1' };
-        const activeQueries = Array.from({ length: 4 }, (_, index) => createClient().runQuery(`SELECT ${index + 1} AS val`, tags));
-        await vi.waitFor(() => expect(streamMock).toHaveBeenCalledTimes(4));
-        const queuedQuery = createClient().runQuery('SELECT 5 AS val', tags);
-        const capacityError = queuedQuery.catch((error) => error);
-        await vi.advanceTimersByTimeAsync(15000);
-        const error = await capacityError;
-        expect(error).toBeInstanceOf(common_1.WarehouseQueryError);
-        expect(error).toMatchObject({
-            message: 'Playground query capacity is full. Try again shortly.',
-        });
-        expect(createInstanceMock).toHaveBeenCalledTimes(4);
-        pendingStreams.forEach((resolve) => resolve(getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER])));
-        await Promise.all(activeQueries);
-    });
-    it('returns embedded capacity when a query throws', async () => {
-        const pendingStreams = [];
-        const streamMock = vi.fn((sql) => {
-            if (sql.includes('SELECT 4')) {
-                return Promise.reject(new Error('Query failed'));
-            }
-            return new Promise((resolve) => {
-                pendingStreams.push(resolve);
-            });
-        });
-        createInstanceMock.mockImplementation(async () => createMockConnection(streamMock));
-        const createClient = () => new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: common_1.WarehouseTypes.DUCKDB,
-            connectionType: common_1.DuckdbConnectionType.EMBEDDED,
-            dataset: 'jaffle_shop',
-        });
-        const tags = { organization_uuid: 'organization-1' };
-        const activeQueries = Array.from({ length: 3 }, (_, index) => createClient().runQuery(`SELECT ${index + 1} AS val`, tags));
-        const failedQuery = createClient().runQuery('SELECT 4 AS val', tags);
-        await expect(failedQuery).rejects.toThrow('Query failed');
-        const nextQuery = createClient().runQuery('SELECT 5 AS val', tags);
-        await vi.waitFor(() => expect(streamMock).toHaveBeenCalledTimes(5));
-        pendingStreams.forEach((resolve) => resolve(getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER])));
-        await Promise.all([...activeQueries, nextQuery]);
-    });
-    it('returns the global slot when organization capacity times out', async () => {
-        vi.useFakeTimers();
-        const pendingStreams = [];
-        const streamMock = vi.fn(() => new Promise((resolve) => {
-            pendingStreams.push(resolve);
-        }));
-        createInstanceMock.mockImplementation(async () => createMockConnection(streamMock));
-        const createClient = () => new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: common_1.WarehouseTypes.DUCKDB,
-            connectionType: common_1.DuckdbConnectionType.EMBEDDED,
-            dataset: 'jaffle_shop',
-        }, { embeddedQueryTimeoutMs: 60000 });
-        const organizationOneTags = {
-            organization_uuid: 'organization-1',
-        };
-        const organizationTwoTags = {
-            organization_uuid: 'organization-2',
-        };
-        const organizationOneQueries = Array.from({ length: 4 }, (_, index) => createClient().runQuery(`SELECT ${index + 1} AS val`, organizationOneTags));
-        await vi.waitFor(() => expect(streamMock).toHaveBeenCalledTimes(4));
-        const timedOutQuery = createClient().runQuery('SELECT 5 AS val', organizationOneTags);
-        const capacityError = timedOutQuery.catch((error) => error);
-        await vi.advanceTimersByTimeAsync(15000);
-        await expect(capacityError).resolves.toMatchObject({
-            name: 'WarehouseQueryError',
-            message: 'Playground query capacity is full. Try again shortly.',
-        });
-        const organizationTwoQueries = Array.from({ length: 4 }, (_, index) => createClient().runQuery(`SELECT ${index + 6} AS val`, organizationTwoTags));
-        await vi.waitFor(() => expect(streamMock).toHaveBeenCalledTimes(8));
-        pendingStreams.forEach((resolve) => resolve(getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER])));
-        await Promise.all([
-            ...organizationOneQueries,
-            ...organizationTwoQueries,
-        ]);
-    });
-    it('logs structured profiles for non-embedded queries and reports metrics', async () => {
-        const runMock = vi.fn(async (sql) => {
-            const match = sql.match(/^PRAGMA profiling_output='(.+)';$/);
-            if (match) {
-                await promises_1.default.writeFile(match[1], JSON.stringify({
-                    latency: 4.747,
-                    cpu_time: 4.731,
-                    rows_returned: 68,
-                    total_bytes_read: 20225287,
-                    children: [
-                        {
-                            operator_name: 'READ_PARQUET ',
-                            operator_timing: 4.632,
-                            operator_cardinality: 9905024,
-                            children: [],
-                        },
-                    ],
-                }));
-            }
-        });
-        const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        const logger = { info: vi.fn() };
-        const onQueryProfile = vi.fn();
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(undefined, {
-            logger,
-            enableQueryProfiling: true,
-            onQueryProfile,
-        });
-        await client.runQuery('SELECT 1 AS val', {
-            query_uuid: 'query-123',
-            chart_uuid: 'chart-123',
-            dashboard_uuid: 'dashboard-123',
-            query_context: common_1.QueryExecutionContext.DASHBOARD,
-        });
-        expect(logger.info).toHaveBeenCalledWith(expect.stringContaining('DuckDB query profile: latency=4747ms cpu=4731ms'), expect.objectContaining({
-            query_uuid: 'query-123',
-            chart_uuid: 'chart-123',
-            dashboard_uuid: 'dashboard-123',
-            query_context: common_1.QueryExecutionContext.DASHBOARD,
-            latencyMs: 4747,
-            cpuMs: 4731,
-            waitMs: 16,
-            readParquetMs: 4632,
-            rowsScanned: 9905024,
-            rowsReturned: 68,
-            bytesRead: 20225287,
-            scanAmplification: 9905024 / 68,
-        }));
-        expect(onQueryProfile).toHaveBeenCalledWith(expect.objectContaining({
-            latencyMs: 4747,
-            readParquetMs: 4632,
-            bytesRead: 20225287,
-        }));
-        expect(runMock).not.toHaveBeenCalledWith("SET disabled_filesystems = 'LocalFileSystem';");
-        expect(runMock).toHaveBeenCalledWith("PRAGMA enable_profiling='json';");
-    });
-    it('does not enable query profiling for a logger without the opt-in flag', async () => {
-        const runMock = vi.fn();
-        const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        const logger = { info: vi.fn() };
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(undefined, { logger });
-        await client.runQuery('SELECT 1 AS val');
-        expect(runMock).not.toHaveBeenCalledWith("PRAGMA enable_profiling='json';");
-        expect(logger.info).not.toHaveBeenCalledWith(expect.stringContaining('DuckDB query profile:'), expect.anything());
-    });
-    it('logs raw profile timings when DuckDB reports cpu above latency', async () => {
-        const runMock = vi.fn(async (sql) => {
-            const match = sql.match(/^PRAGMA profiling_output='(.+)';$/);
-            if (match) {
-                await promises_1.default.writeFile(match[1], JSON.stringify({
-                    latency: 0.002,
-                    cpu_time: 0.004,
-                    rows_returned: 123,
-                    total_bytes_read: 0,
-                    children: [],
-                }));
-            }
-        });
-        const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        const logger = { info: vi.fn() };
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(undefined, {
-            logger,
-            enableQueryProfiling: true,
-        });
-        await client.runQuery('SELECT 1 AS val');
-        expect(logger.info).toHaveBeenCalledWith(expect.stringContaining('DuckDB query profile: latency=2ms cpu=4ms wait=-2ms'), expect.objectContaining({
-            latencyMs: 2,
-            cpuMs: 4,
-            waitMs: -2,
-        }));
-    });
-    describe('SQL security validation', () => {
-        it.each([
-            {
-                name: 'SET statements',
-                sql: "SET s3_endpoint = 'attacker.com'",
-                statementType: 20,
-            },
-            {
-                name: 'COPY statements',
-                sql: "COPY t TO '/tmp/data.csv'",
-                statementType: 11,
-            },
-            {
-                name: 'ATTACH statements',
-                sql: "ATTACH DATABASE 'file.db'",
-                statementType: 25,
-            },
-            {
-                name: 'EXPLAIN statements',
-                sql: 'EXPLAIN SELECT * FROM users',
-                statementType: 4,
-            },
-        ])('should reject $name', async ({ sql, statementType }) => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, vi.fn(), {
-                extractStatements: createMockExtractStatements({
-                    statementType,
-                }),
-            }));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            await expect(client.runQuery(sql)).rejects.toThrow('SQL validation error: only SELECT statements are allowed');
-            expect(streamMock).not.toHaveBeenCalled();
-        });
-        it('should reject multiple statements', async () => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, vi.fn(), {
-                extractStatements: createMockExtractStatements({
-                    count: 2,
-                }),
-            }));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            await expect(client.runQuery('SELECT 1; DROP TABLE users')).rejects.toThrow('SQL validation error: multiple SQL statements are not allowed');
-        });
-        it.each([
-            'current_setting',
-            'duckdb_settings',
-            'duckdb_secrets',
-            'query',
-            'query_table',
-        ])('should reject queries with %s()', async (blockedFunction) => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            await expect(client.runQuery(`SELECT * FROM ${blockedFunction}()`)).rejects.toThrow(`SQL validation error: function '${blockedFunction}' is not allowed`);
-        });
-        it.each([
-            'read_csv',
-            'read_csv_auto',
-            'read_json',
-            'read_json_auto',
-            'read_json_objects',
-            'read_json_objects_auto',
-            'read_ndjson',
-            'read_ndjson_auto',
-            'read_ndjson_objects',
-            'read_ndjson_objects_auto',
-            'read_parquet',
-            'read_text',
-            'read_blob',
-            'read_xlsx',
-            'parquet_scan',
-            'parquet_metadata',
-            'parquet_schema',
-            'parquet_file_metadata',
-            'parquet_kv_metadata',
-            'parquet_bloom_probe',
-            'sniff_csv',
-            'glob',
-            'sqlite_scan',
-            'postgres_scan',
-            'mysql_scan',
-        ])('should reject user queries with %s()', async (blockedFunction) => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            const extractStatementsMock = createMockExtractStatements();
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, vi.fn(), {
-                extractStatements: extractStatementsMock,
-            }));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            await expect(client.runQuery(`SELECT * FROM ${blockedFunction}('/tmp/a')`)).rejects.toThrow(`SQL validation error: function '${blockedFunction}' is not allowed`);
-            expect(extractStatementsMock).not.toHaveBeenCalled();
-            expect(streamMock).not.toHaveBeenCalled();
-        });
-        it('should keep file readers blocked when only S3 is configured', async () => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            const extractStatementsMock = createMockExtractStatements();
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, vi.fn(), {
-                extractStatements: extractStatementsMock,
-            }));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(duckdbS3Credentials);
-            await expect(client.runQuery("SELECT * FROM read_parquet('s3://bucket/data.parquet')")).rejects.toThrow("SQL validation error: function 'read_parquet' is not allowed");
-            expect(extractStatementsMock).not.toHaveBeenCalled();
-            expect(streamMock).not.toHaveBeenCalled();
-        });
-        it.each([
-            {
-                format: 'Parquet',
-                sql: "SELECT * FROM read_parquet('s3://bucket/data.parquet')",
-            },
-            {
-                format: 'inferred JSONL',
-                sql: "SELECT * FROM read_json_auto('s3://bucket/data.jsonl')",
-            },
-            {
-                format: 'typed JSONL',
-                sql: "SELECT * FROM read_json('s3://bucket/data.jsonl', format='newline_delimited')",
-            },
-        ])('should allow pre-aggregate clients to read S3 $format files', async ({ sql }) => {
-            const rows = [{ val: 1 }];
-            const streamMock = vi.fn(async () => getMockStreamResult([rows], [DUCKDB_TYPE_IDS.INTEGER]));
-            const extractStatementsMock = createMockExtractStatements();
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, vi.fn(), {
-                extractStatements: extractStatementsMock,
-            }));
-            const client = DuckdbWarehouseClient_1.DuckdbWarehouseClient.createForPreAggregate(duckdbS3Credentials);
-            const result = await client.runQuery(sql);
-            expect(result.rows).toEqual(rows);
-            expect(extractStatementsMock).toHaveBeenCalledTimes(1);
-            expect(streamMock).toHaveBeenCalledTimes(1);
-        });
-        it('should keep pre-aggregate queries read-only', async () => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, vi.fn(), {
-                extractStatements: createMockExtractStatements({
-                    statementType: 11, // COPY
-                }),
-            }));
-            const client = DuckdbWarehouseClient_1.DuckdbWarehouseClient.createForPreAggregate(duckdbS3Credentials);
-            await expect(client.runQuery("COPY t TO 's3://bucket/data.parquet'")).rejects.toThrow('SQL validation error: only SELECT statements are allowed');
-            expect(streamMock).not.toHaveBeenCalled();
-        });
-        it('should keep secret introspection blocked for pre-aggregate queries', async () => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock));
-            const client = DuckdbWarehouseClient_1.DuckdbWarehouseClient.createForPreAggregate(duckdbS3Credentials);
-            await expect(client.runQuery("SELECT current_setting('s3_secret_access_key')")).rejects.toThrow("SQL validation error: function 'current_setting' is not allowed");
-            expect(streamMock).not.toHaveBeenCalled();
-        });
-        it.each(['read_parquet', 'read_json_auto'])('should reject quoted-identifier calls to "%s"()', async (blockedFunction) => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            await expect(client.runQuery(`SELECT * FROM "${blockedFunction}"('/tmp/a')`)).rejects.toThrow(`SQL validation error: function '${blockedFunction}' is not allowed`);
-            expect(streamMock).not.toHaveBeenCalled();
-        });
-        it('should reject schema-qualified calls to file functions', async () => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            await expect(client.runQuery("SELECT * FROM main.read_json_auto('/tmp/a.json')")).rejects.toThrow("SQL validation error: function 'read_json_auto' is not allowed");
-            expect(streamMock).not.toHaveBeenCalled();
-        });
-        it('should reject user queries that use file table paths', async () => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            await expect(client.runQuery("SELECT * FROM '/tmp/data.parquet'")).rejects.toThrow('SQL validation error: file table paths are not allowed');
-            expect(streamMock).not.toHaveBeenCalled();
-        });
-        it('should ignore blocked functions inside SQL comments', async () => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            // Should NOT throw because current_setting is in a comment
-            const result = await client.runQuery("SELECT 1 -- current_setting('s3_secret_access_key')");
-            expect(result.rows).toEqual([{ val: 1 }]);
-        });
-        it('should ignore blocked file readers inside SQL comments', async () => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ val: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            const result = await client.runQuery("SELECT 1 -- SELECT * FROM read_parquet('/tmp/data.parquet')");
-            expect(result.rows).toEqual([{ val: 1 }]);
-        });
-        it('should allow COPY statements in runSql', async () => {
-            const streamMock = vi.fn();
-            const runMock = vi.fn();
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock, {
-                extractStatements: createMockExtractStatements({
-                    statementType: 10, // COPY
-                }),
-            }));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            await client.runSql("COPY table TO 's3://bucket/data.parquet' (FORMAT PARQUET)");
-            expect(runMock).toHaveBeenCalledWith("COPY table TO 's3://bucket/data.parquet' (FORMAT PARQUET)");
-        });
-        it('should allow internal SQL to read staged files', async () => {
-            const streamMock = vi.fn();
-            const runMock = vi.fn();
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            await client.runSql("CREATE TABLE staged AS SELECT * FROM read_parquet('s3://bucket/data.parquet')");
-            expect(runMock).toHaveBeenCalledWith("CREATE TABLE staged AS SELECT * FROM read_parquet('s3://bucket/data.parquet')");
-        });
-        it.each([
-            {
-                name: 'SET statements',
-                sql: "SET s3_endpoint = 'attacker.com'",
-                statementType: 20,
-            },
-            {
-                name: 'ATTACH statements',
-                sql: "ATTACH DATABASE 'file.db'",
-                statementType: 25,
-            },
-            {
-                name: 'LOAD statements',
-                sql: "LOAD 'malicious_extension'",
-                statementType: 21,
-            },
-        ])('should reject $name in runSql', async ({ sql, statementType }) => {
-            const streamMock = vi.fn();
-            const runMock = vi.fn();
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock, {
-                extractStatements: createMockExtractStatements({
-                    statementType,
-                }),
-            }));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            await expect(client.runSql(sql)).rejects.toThrow(`SQL validation error: statement type ${statementType} is not allowed in internal SQL`);
-            expect(runMock).not.toHaveBeenCalledWith(sql);
-        });
-        it('should reject introspection functions in runSql', async () => {
-            const streamMock = vi.fn();
-            const runMock = vi.fn();
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            await expect(client.runSql("COPY (SELECT current_setting('s3_secret_access_key')) TO '/tmp/out.csv'")).rejects.toThrow("SQL validation error: function 'current_setting' is not allowed");
-            expect(runMock).not.toHaveBeenCalledWith("COPY (SELECT current_setting('s3_secret_access_key')) TO '/tmp/out.csv'");
-        });
-        it('should allow valid SELECT queries', async () => {
-            const streamMock = vi.fn(async () => getMockStreamResult([[{ id: 1, name: 'test' }]], [DUCKDB_TYPE_IDS.INTEGER, DUCKDB_TYPE_IDS.VARCHAR]));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient();
-            const result = await client.runQuery('SELECT id, name FROM users WHERE id = 1');
-            expect(result.rows).toEqual([{ id: 1, name: 'test' }]);
-        });
-    });
-    it.each([
-        {
-            name: 'pass encoded token in SaaS-mode connection string for MotherDuck',
-            credentials: {
-                type: common_1.WarehouseTypes.DUCKDB,
-                connectionType: common_1.DuckdbConnectionType.MOTHERDUCK,
-                database: 'my_database',
-                schema: 'main',
-                token: 'my_motherduck_token+with=symbols',
-            },
-            expectedPath: 'md:my_database?motherduck_token=my_motherduck_token%2Bwith%3Dsymbols&saas_mode=true',
-        },
-        {
-            name: 'encode MotherDuck database names before adding connection parameters',
-            credentials: {
-                type: common_1.WarehouseTypes.DUCKDB,
-                connectionType: common_1.DuckdbConnectionType.MOTHERDUCK,
-                database: 'analytics?motherduck_token=other&saas_mode=false',
-                schema: 'main',
-                token: 'my_motherduck_token',
-            },
-            expectedPath: 'md:analytics%3Fmotherduck_token%3Dother%26saas_mode%3Dfalse?motherduck_token=my_motherduck_token&saas_mode=true',
-        },
-    ])('should $name', async ({ credentials, expectedPath }) => {
-        const runMock = vi.fn();
-        const streamMock = vi.fn(async () => getMockStreamResult([[{ id: 1 }]], [DUCKDB_TYPE_IDS.INTEGER]));
-        createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient(credentials);
-        await client.runQuery('SELECT 1 AS id');
-        expect(createInstanceMock).toHaveBeenCalledWith(expectedPath);
-        expect(runMock).not.toHaveBeenCalledWith(expect.stringContaining('allow_community_extensions'));
-        expect(runMock).not.toHaveBeenCalledWith(expect.stringContaining('autoinstall_known_extensions'));
-        expect(runMock).not.toHaveBeenCalledWith(expect.stringContaining('autoload_known_extensions'));
-        expect(runMock).not.toHaveBeenCalledWith(expect.stringContaining('allow_unredacted_secrets'));
-    });
-    it('should require a MotherDuck token for direct DuckDB connections', () => {
-        expect(() => new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: common_1.WarehouseTypes.DUCKDB,
-            connectionType: common_1.DuckdbConnectionType.MOTHERDUCK,
-            database: 'my_database',
-            schema: 'main',
-            token: '',
-        })).toThrow('MotherDuck token is required for DuckDB warehouse connections');
-    });
-    it('should expose the configured start of week', () => {
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: common_1.WarehouseTypes.DUCKDB,
-            connectionType: common_1.DuckdbConnectionType.MOTHERDUCK,
-            database: 'analytics',
-            schema: 'main',
-            token: 'motherduck_token',
-            startOfWeek: common_1.WeekDay.SUNDAY,
-        });
-        expect(client.getStartOfWeek()).toBe(common_1.WeekDay.SUNDAY);
-    });
-    it('should default getFields database to the configured DuckDB database', async () => {
-        const runMock = vi.fn(async () => ({
-            getRowObjects: async () => [
-                {
-                    column_name: 'order_id',
-                    data_type: 'INTEGER',
-                },
-                {
-                    column_name: 'created_at',
-                    data_type: 'TIMESTAMP',
-                },
-            ],
-        }));
-        createInstanceMock.mockResolvedValue(createMockConnection(vi.fn(), runMock));
-        const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-            type: common_1.WarehouseTypes.DUCKDB,
-            connectionType: common_1.DuckdbConnectionType.MOTHERDUCK,
-            database: 'analytics',
-            schema: 'main',
-            token: 'motherduck_token',
-        });
-        const result = await client.getFields('orders');
-        expect(runMock).toHaveBeenCalledWith(expect.stringContaining("WHERE table_catalog = 'analytics'"));
-        expect(result).toEqual({
-            analytics: {
-                main: {
-                    orders: {
-                        order_id: common_1.DimensionType.NUMBER,
-                        created_at: common_1.DimensionType.TIMESTAMP,
-                    },
-                },
-            },
-            __lightdashTimestampDomains: {
-                analytics: {
-                    main: { orders: { created_at: 'naive' } },
-                },
-            },
-        });
-    });
-    describe('DuckLake bootstrap', () => {
-        const captureRunMock = () => vi.fn().mockResolvedValue({
-            getRowObjects: async () => [],
-        });
-        const collectStatements = (runMock) => runMock.mock.calls.map((c) => c[0]);
-        it('attaches a postgres-catalog + S3 DuckLake in the correct order', async () => {
-            const runMock = captureRunMock();
-            const streamMock = vi.fn(async () => getMockStreamResult([[]], []));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-                type: common_1.WarehouseTypes.DUCKDB,
-                connectionType: common_1.DuckdbConnectionType.DUCKLAKE,
-                schema: 'main',
-                catalogAlias: 'ducklake',
-                catalog: {
-                    type: common_1.DucklakeCatalogType.POSTGRES,
-                    host: 'pg.example.com',
-                    port: 5432,
-                    database: 'catalog',
-                    user: 'ducklake_user',
-                    password: 'p@ss',
-                },
-                dataPath: {
-                    type: common_1.DucklakeDataPathType.S3,
-                    url: 's3://my-bucket/path/',
-                    accessKeyId: 'AKIAEXAMPLE',
-                    secretAccessKey: 'SECRETEXAMPLE',
-                    region: 'us-east-1',
-                },
-            });
-            await client.runQuery('SELECT 1');
-            const stmts = collectStatements(runMock);
-            const joined = stmts.join('\n');
-            // No explicit INSTALL/LOAD in DuckLake mode — rely on autoload.
-            expect(joined).not.toMatch(/INSTALL httpfs/);
-            expect(joined).not.toMatch(/LOAD httpfs/);
-            expect(stmts).toEqual(expect.arrayContaining([
-                'SET autoinstall_known_extensions = true;',
-                'SET autoload_known_extensions = true;',
-                'SET autoinstall_known_extensions = false;',
-                'SET autoload_known_extensions = false;',
-                'SET allow_community_extensions = false;',
-                'SET allow_unredacted_secrets = false;',
-            ]));
-            const catalogIdx = stmts.findIndex((s) => /__lightdash_ducklake_catalog/.test(s));
-            const dataIdx = stmts.findIndex((s) => /__lightdash_ducklake_data/.test(s));
-            const duckLakeSecretIdx = stmts.findIndex((s) => /SECRET __lightdash_ducklake\s/.test(s));
-            const attachIdx = stmts.findIndex((s) => s.startsWith("ATTACH 'ducklake:__lightdash_ducklake'"));
-            expect(catalogIdx).toBeGreaterThanOrEqual(0);
-            expect(dataIdx).toBeGreaterThan(catalogIdx);
-            expect(duckLakeSecretIdx).toBeGreaterThan(dataIdx);
-            expect(attachIdx).toBeGreaterThan(duckLakeSecretIdx);
-            expect(stmts.lastIndexOf('SET autoinstall_known_extensions = false;')).toBeGreaterThan(attachIdx);
-            expect(stmts.lastIndexOf('SET autoload_known_extensions = false;')).toBeGreaterThan(attachIdx);
-            expect(stmts[catalogIdx]).toMatch(/TYPE postgres/);
-            expect(stmts[catalogIdx]).toMatch(/HOST 'pg.example.com'/);
-            expect(stmts[catalogIdx]).toMatch(/PASSWORD 'p@ss'/);
-            expect(stmts[dataIdx]).toMatch(/TYPE s3/);
-            expect(stmts[dataIdx]).toMatch(/KEY_ID 'AKIAEXAMPLE'/);
-            expect(stmts[dataIdx]).toMatch(/SCOPE 's3:\/\/my-bucket\/path\/'/);
-        });
-        it('uses inline ATTACH (no ducklake secret) for SQLite catalog + local data path', async () => {
-            const runMock = captureRunMock();
-            const streamMock = vi.fn(async () => getMockStreamResult([[]], []));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-                type: common_1.WarehouseTypes.DUCKDB,
-                connectionType: common_1.DuckdbConnectionType.DUCKLAKE,
-                schema: 'main',
-                catalog: {
-                    type: common_1.DucklakeCatalogType.SQLITE,
-                    path: '/tmp/ducklake.sqlite',
-                },
-                dataPath: {
-                    type: common_1.DucklakeDataPathType.LOCAL,
-                    path: '/tmp/ducklake-data',
-                },
-            });
-            await client.runQuery('SELECT 1');
-            const stmts = collectStatements(runMock);
-            const joined = stmts.join('\n');
-            expect(joined).not.toMatch(/__lightdash_ducklake_catalog/);
-            expect(joined).not.toMatch(/__lightdash_ducklake_data/);
-            expect(joined).not.toMatch(/SECRET __lightdash_ducklake\s/);
-            expect(stmts.some((s) => s.startsWith("ATTACH 'ducklake:sqlite:/tmp/ducklake.sqlite' AS \"ducklake\" (DATA_PATH '/tmp/ducklake-data', READ_ONLY);"))).toBe(true);
-        });
-        it('rejects user SQL that contains ATTACH even in DuckLake mode', async () => {
-            const runMock = captureRunMock();
-            const streamMock = vi.fn(async () => getMockStreamResult([[]], []));
-            const extractStatements = vi.fn(async () => ({
-                count: 1,
-                prepare: async () => ({
-                    statementType: 25, // ATTACH
-                    destroySync: vi.fn(),
-                }),
-            }));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock, {
-                extractStatements,
-            }));
-            const client = new DuckdbWarehouseClient_1.DuckdbWarehouseClient({
-                type: common_1.WarehouseTypes.DUCKDB,
-                connectionType: common_1.DuckdbConnectionType.DUCKLAKE,
-                schema: 'main',
-                catalog: {
-                    type: common_1.DucklakeCatalogType.SQLITE,
-                    path: '/tmp/c.sqlite',
-                },
-                dataPath: {
-                    type: common_1.DucklakeDataPathType.LOCAL,
-                    path: '/tmp/d',
-                },
-            });
-            await expect(client.runQuery("ATTACH 'ducklake:evil' AS bad;")).rejects.toThrow(/only SELECT statements are allowed/);
-        });
-        it('keeps autoload disabled for non-DuckLake modes', async () => {
-            const runMock = captureRunMock();
-            const streamMock = vi.fn(async () => getMockStreamResult([[]], []));
-            createInstanceMock.mockResolvedValue(createMockConnection(streamMock, runMock));
-            const client = DuckdbWarehouseClient_1.DuckdbWarehouseClient.createForPreAggregate({
-                type: 'duckdb_s3',
-                s3Config: {
-                    endpoint: 'localhost:9000',
-                    region: 'us-east-1',
-                    forcePathStyle: true,
-                    useSsl: false,
-                },
-            });
-            await client.runQuery('SELECT 1');
-            const stmts = collectStatements(runMock);
-            expect(stmts).toEqual(expect.arrayContaining([
-                'SET autoinstall_known_extensions = false;',
-                'SET autoload_known_extensions = false;',
-            ]));
-            // Regression: existing modes still explicitly INSTALL/LOAD httpfs.
-            expect(stmts).toEqual(expect.arrayContaining(['INSTALL httpfs;', 'LOAD httpfs;']));
-        });
-    });
-});