Module transport 

Transport layer for remote UDFs via Arrow Flight.

Two transport modes:

• mTLS: full mutual TLS. The client presents its own certificate/key and verifies the server certificate against a pinned CA. The expected worker identity is bound to the TLS domain_name, so a certificate whose SAN does not match aborts the handshake; that failure is surfaced as TransportError::PeerIdentityMismatch.
• Sidecar: plain TCP to localhost, assuming a sidecar terminates TLS.

Both transports attach Authorization: Bearer <token> to every request when an auth token is configured. The response is collected as a bounded streaming read: the byte ceiling is enforced batch-by-batch, so an oversized response is rejected before it is fully buffered.

Structs

UdfServiceConnection

A pooled connection to a remote UDF service, shared across its functions.

Enums

Transport

Runtime transport configuration (derived from the manifest).

TransportError

Transport-layer errors.