@malloy-publisher/server 0.0.208 → 0.0.210

package/src/service/build_plan.ts

@@ -0,0 +1,238 @@
+import type {
+   AtomicField,
+   BuildGraph as MalloyBuildGraph,
+   MalloyConfig,
+   Connection as MalloyConnection,
+   PersistSource,
+} from "@malloydata/malloy";
+import { components } from "../api";
+import { logger } from "../logger";
+import { recordConnectionDigestSkipped } from "../materialization_metrics";
+import { Model } from "./model";
+
+type WireBuildGraph = components["schemas"]["BuildGraph"];
+type WirePersistSourcePlan = components["schemas"]["PersistSourcePlan"];
+type WireColumn = components["schemas"]["Column"];
+type BuildPlan = components["schemas"]["BuildPlan"];
+
+/**
+ * Minimal surface a package must expose to compile its build plan. Both
+ * {@link Package} (for the read-only `Package.buildPlan`) and the
+ * materialization service (for auto-run and orchestrated builds) satisfy it.
+ */
+export interface BuildPlanPackage {
+   getModelPaths(): string[];
+   getPackagePath(): string;
+   getMalloyConfig(): MalloyConfig;
+   getMalloyConnection(name: string): Promise<MalloyConnection>;
+}
+
+/**
+ * Result of compiling a package's persist sources: the dependency-ordered
+ * build graphs, the persist sources keyed by sourceID, the per-connection
+ * digests, and the resolved live connections. The wire {@link BuildPlan} is a
+ * projection of this (see {@link deriveBuildPlan}); the build engine consumes
+ * the full structure.
+ */
+export interface CompiledBuildPlan {
+   graphs: MalloyBuildGraph[];
+   sources: Record<string, PersistSource>;
+   connectionDigests: Record<string, string>;
+   connections: Map<string, MalloyConnection>;
+}
+
+/** Output columns of a persist source, degrading to [] if unavailable. */
+export function deriveColumns(persistSource: PersistSource): WireColumn[] {
+   try {
+      return persistSource._explore.intrinsicFields
+         .filter((f) => f.isAtomicField())
+         .map((f) => ({
+            name: f.name,
+            type: String((f as AtomicField).type),
+         }));
+   } catch (err) {
+      logger.warn("Failed to derive columns for persist source", {
+         sourceID: persistSource.sourceID,
+         error: err instanceof Error ? err.message : String(err),
+      });
+      return [];
+   }
+}
+
+/** Flatten Malloy's nested BuildNode.dependsOn into a list of sourceIDs. */
+export function flattenDependsOn(node: {
+   dependsOn: { sourceID: string }[];
+}): string[] {
+   return node.dependsOn.map((d) => d.sourceID);
+}
+
+/**
+ * The buildId for a persist source: a stable digest of its connection identity
+ * and canonical SQL. Centralizes the (source, connectionDigests) call shape so
+ * planning, self-instruction, and build all agree on the same id.
+ */
+export function computeBuildId(
+   source: PersistSource,
+   connectionDigests: Record<string, string>,
+): string {
+   return source.makeBuildId(
+      connectionDigests[source.connectionName],
+      source.getSQL(),
+   );
+}
+
+/**
+ * Resolve a Map<name, Connection> for the names a step is about to touch.
+ * The package's MalloyConfig caches each lookup, so repeated calls are cheap.
+ * A failed lookup is logged and omitted; downstream code reports the missing
+ * connection explicitly.
+ */
+export async function resolvePackageConnections(
+   pkg: { getMalloyConnection(name: string): Promise<MalloyConnection> },
+   names: Iterable<string>,
+): Promise<Map<string, MalloyConnection>> {
+   const map = new Map<string, MalloyConnection>();
+   const seen = new Set<string>();
+   for (const name of names) {
+      if (!name || seen.has(name)) continue;
+      seen.add(name);
+      try {
+         map.set(name, await pkg.getMalloyConnection(name));
+      } catch (err) {
+         logger.warn(`Failed to resolve connection ${name}`, {
+            error: err instanceof Error ? err.message : String(err),
+         });
+      }
+   }
+   return map;
+}
+
+/**
+ * Compile every model in the package and collect the dependency-ordered
+ * build graphs, persist sources, connection digests, and resolved
+ * connections. The build plan is a pure function of the compiled model plus
+ * connection config (no warehouse access).
+ */
+export async function compilePackageBuildPlan(
+   pkg: BuildPlanPackage,
+   signal?: AbortSignal,
+): Promise<CompiledBuildPlan> {
+   const allGraphs: MalloyBuildGraph[] = [];
+   const allSources: Record<string, PersistSource> = {};
+
+   for (const modelPath of pkg.getModelPaths()) {
+      if (signal?.aborted) throw new Error("Build cancelled");
+
+      const { runtime, modelURL, importBaseURL } = await Model.getModelRuntime(
+         pkg.getPackagePath(),
+         modelPath,
+         pkg.getMalloyConfig(),
+      );
+      const malloyModel = await runtime
+         .loadModel(modelURL, { importBaseURL })
+         .getModel();
+
+      // getBuildPlan() returns empty graphs for models with no #@ persist
+      // sources, so non-persist models are simply skipped below.
+      const buildPlan = malloyModel.getBuildPlan();
+      for (const msg of buildPlan.tagParseLog) {
+         logger.warn("Persist annotation issue", {
+            modelPath,
+            message: msg.message,
+            severity: msg.severity,
+         });
+      }
+      if (buildPlan.graphs.length === 0) continue;
+
+      allGraphs.push(...buildPlan.graphs);
+      for (const [sourceID, source] of Object.entries(buildPlan.sources)) {
+         allSources[sourceID] = source;
+      }
+   }
+
+   const connections = await resolvePackageConnections(
+      pkg,
+      allGraphs.map((g) => g.connectionName),
+   );
+   const connectionDigests: Record<string, string> = {};
+   for (const graph of allGraphs) {
+      const conn = connections.get(graph.connectionName);
+      if (!conn) {
+         // The connection failed to resolve (already warned in
+         // resolvePackageConnections). Its buildIds will be computed without a
+         // digest, so surface it as a discrete correctness signal rather than
+         // skipping silently.
+         recordConnectionDigestSkipped();
+         logger.warn("Skipping connection digest; connection did not resolve", {
+            connectionName: graph.connectionName,
+         });
+         continue;
+      }
+      if (!connectionDigests[graph.connectionName]) {
+         connectionDigests[graph.connectionName] = await conn.getDigest();
+      }
+   }
+
+   return {
+      graphs: allGraphs,
+      sources: allSources,
+      connectionDigests,
+      connections,
+   };
+}
+
+/** Project the Malloy build plan into the trimmed wire BuildPlan. */
+export function deriveBuildPlan(
+   graphs: MalloyBuildGraph[],
+   sources: Record<string, PersistSource>,
+   connectionDigests: Record<string, string>,
+   sourceNames?: string[],
+): BuildPlan {
+   const include = sourceNames ? new Set(sourceNames) : null;
+
+   const wireGraphs: WireBuildGraph[] = graphs.map((graph) => ({
+      connectionName: graph.connectionName,
+      nodes: graph.nodes.map((level) =>
+         level.map((node) => ({
+            sourceID: node.sourceID,
+            dependsOn: flattenDependsOn(node),
+         })),
+      ),
+   }));
+
+   const wireSources: Record<string, WirePersistSourcePlan> = {};
+   for (const [sourceID, source] of Object.entries(sources)) {
+      if (include && !include.has(source.name)) continue;
+      wireSources[sourceID] = {
+         name: source.name,
+         sourceID: source.sourceID,
+         connectionName: source.connectionName,
+         dialect: source.dialectName,
+         buildId: computeBuildId(source, connectionDigests),
+         sql: source.getSQL(),
+         columns: deriveColumns(source),
+      };
+   }
+
+   return { graphs: wireGraphs, sources: wireSources };
+}
+
+/**
+ * Compile and project a package's build plan, or null when the package
+ * declares no persist source. Convenience for the read-only `Package.buildPlan`
+ * field, which is a deterministic property of the compiled package.
+ */
+export async function computePackageBuildPlan(
+   pkg: BuildPlanPackage,
+   signal?: AbortSignal,
+): Promise<BuildPlan | null> {
+   const compiled = await compilePackageBuildPlan(pkg, signal);
+   if (compiled.graphs.length === 0) {
+      return null;
+   }
+   return deriveBuildPlan(
+      compiled.graphs,
+      compiled.sources,
+      compiled.connectionDigests,
+   );
+}

package/src/service/connection.ts

@@ -7,6 +7,10 @@ import "@malloydata/db-mysql";
 import type { MySQLConnection } from "@malloydata/db-mysql";
 import "@malloydata/db-postgres";
 import type { PostgresConnection } from "@malloydata/db-postgres";
+// Registers the "publisher" connection type (proxies SQL to a remote Publisher
+// dataplane). No live-class branch is needed in lookupConnection — the default
+// path resolves it through the registry like any other registered type.
+import "@malloydata/db-publisher";
 import {
    buildPoolOptions,
    SnowflakeConnection,

package/src/service/connection_config.spec.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from "bun:test";
+import { afterEach, beforeEach, describe, expect, it } from "bun:test";
 import { generateKeyPairSync } from "crypto";
 import { components } from "../api";
 import {
@@ -168,3 +168,184 @@ describe("normalizeSnowflakePrivateKey", () => {
       expect(result.endsWith("-----END PRIVATE KEY-----\n")).toBe(true);
    });
 });
+
+describe("assembleEnvironmentConnections — publisher", () => {
+   const validBase: ApiConnection = {
+      name: "analytics",
+      type: "publisher",
+      publisherConnection: {
+         connectionUri:
+            "https://org.data.example.com/api/v0/environments/proj/connections/analytics",
+         accessToken: "jwt-token",
+      },
+   };
+
+   // publisher connections are default-deny (SSRF gate); these assembly tests
+   // exercise the enabled path, so opt in for the block and restore after.
+   const priorFlag = process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS;
+   beforeEach(() => {
+      process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS = "true";
+   });
+   afterEach(() => {
+      if (priorFlag === undefined) {
+         delete process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS;
+      } else {
+         process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS = priorFlag;
+      }
+   });
+
+   it("emits a publisher core entry proxying to the remote dataplane", () => {
+      const { pojo } = assembleEnvironmentConnections([validBase]);
+
+      const entry = pojo.connections["analytics"];
+      expect(entry.is).toBe("publisher");
+      expect(entry.connectionUri).toBe(
+         "https://org.data.example.com/api/v0/environments/proj/connections/analytics",
+      );
+      expect(entry.accessToken).toBe("jwt-token");
+   });
+
+   it("does not populate static connection attributes (dialect is resolved at runtime)", () => {
+      const { apiConnections } = assembleEnvironmentConnections([validBase]);
+      expect(apiConnections).toHaveLength(1);
+      expect(apiConnections[0].attributes).toBeUndefined();
+   });
+
+   it("assembles without an accessToken (optional)", () => {
+      const conn: ApiConnection = {
+         name: "analytics",
+         type: "publisher",
+         publisherConnection: {
+            connectionUri:
+               "https://org.data.example.com/api/v0/environments/proj/connections/analytics",
+         },
+      };
+      const { pojo } = assembleEnvironmentConnections([conn]);
+      const entry = pojo.connections["analytics"];
+      expect(entry.is).toBe("publisher");
+      expect(entry.accessToken).toBeUndefined();
+   });
+
+   it("rejects a publisher connection missing connectionUri with an actionable error", () => {
+      const conn: ApiConnection = {
+         name: "analytics",
+         type: "publisher",
+         publisherConnection:
+            {} as components["schemas"]["PublisherConnection"],
+      };
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "Invalid publisher connection 'analytics': missing connectionUri.",
+      );
+   });
+
+   it("rejects a publisher connection missing the publisherConnection block", () => {
+      const conn: ApiConnection = {
+         name: "analytics",
+         type: "publisher",
+      };
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "Invalid publisher connection 'analytics': missing connectionUri.",
+      );
+   });
+
+   it("rejects a publisher connection whose connectionUri is not a valid URL", () => {
+      const conn: ApiConnection = {
+         name: "analytics",
+         type: "publisher",
+         publisherConnection: { connectionUri: "not a url" },
+      };
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "Invalid publisher connection 'analytics': connectionUri is not a valid URL.",
+      );
+   });
+
+   it("rejects a publisher connection whose connectionUri uses a non-http(s) scheme", () => {
+      const conn: ApiConnection = {
+         name: "analytics",
+         type: "publisher",
+         publisherConnection: { connectionUri: "file:///etc/passwd" },
+      };
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "connectionUri must use http or https (got 'file:')",
+      );
+   });
+
+   it("does not echo a credential-bearing connectionUri in the validation error", () => {
+      const conn: ApiConnection = {
+         name: "analytics",
+         type: "publisher",
+         // Userinfo present but the URI is otherwise malformed (space in host)
+         // so it fails to parse and must not be reflected back verbatim.
+         publisherConnection: {
+            connectionUri: "https://user:s3cret@bad host/connections/x",
+         },
+      };
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "connectionUri is not a valid URL",
+      );
+      expect(() => assembleEnvironmentConnections([conn])).not.toThrow(
+         /s3cret/,
+      );
+   });
+
+   it("still rejects the reserved 'duckdb' name for a publisher connection", () => {
+      const conn: ApiConnection = {
+         name: "duckdb",
+         type: "publisher",
+         publisherConnection: { connectionUri: "https://x/connections/duckdb" },
+      };
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "Connection name 'duckdb' is reserved",
+      );
+   });
+
+   it("still rejects a publisher connection with no name", () => {
+      const conn = {
+         type: "publisher",
+         publisherConnection: { connectionUri: "https://x/connections/y" },
+      } as ApiConnection;
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "Invalid connection configuration. No name.",
+      );
+   });
+
+   describe("SSRF gate (PUBLISHER_ALLOW_PROXY_CONNECTIONS)", () => {
+      it("denies a valid publisher connection when the flag is unset (default-deny)", () => {
+         delete process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS;
+         expect(() => assembleEnvironmentConnections([validBase])).toThrow(
+            "Publisher proxy connection 'analytics' is disabled in this deployment",
+         );
+      });
+
+      it("error names the env var to flip", () => {
+         delete process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS;
+         expect(() => assembleEnvironmentConnections([validBase])).toThrow(
+            "Fix: set the environment variable PUBLISHER_ALLOW_PROXY_CONNECTIONS=true",
+         );
+      });
+
+      it("denies for any non-'true' value (fail-closed)", () => {
+         process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS = "1";
+         expect(() => assembleEnvironmentConnections([validBase])).toThrow(
+            "is disabled in this deployment",
+         );
+      });
+
+      it("gate fires before the connectionUri shape check", () => {
+         // A publisher connection missing connectionUri still surfaces the
+         // disabled error first when the gate is closed — the type is refused
+         // outright, not validated.
+         delete process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS;
+         const conn: ApiConnection = { name: "analytics", type: "publisher" };
+         expect(() => assembleEnvironmentConnections([conn])).toThrow(
+            "is disabled in this deployment",
+         );
+      });
+
+      it("allows a valid publisher connection when the flag is 'true'", () => {
+         process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS = "true";
+         const { pojo } = assembleEnvironmentConnections([validBase]);
+         expect(pojo.connections["analytics"].is).toBe("publisher");
+      });
+   });
+});

package/src/service/connection_config.ts

@@ -336,6 +336,60 @@ function validateConnectionShape(connection: ApiConnection): void {
          }
          break;
       }
+      case "publisher": {
+         // SSRF gate (default-deny / fail-closed). A `publisher` connection
+         // makes THIS server issue outbound HTTP to a tenant-controlled
+         // `connectionUri` (both the query path in db-publisher's
+         // PublisherConnection and the introspection path in db_utils). That is
+         // the intended behavior for local `--watch-env` authoring, but in a
+         // hosted multi-tenant deployment (e.g. Credible running this server) it
+         // is an SSRF surface. Require an explicit opt-in so the type is refused
+         // unless the operator deliberately enabled it. This is the single
+         // choke point — every connection passes validateConnectionShape before
+         // it can be assembled, queried, or introspected — so denying here shuts
+         // off all three at once.
+         if (process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS !== "true") {
+            throw new Error(
+               `Publisher proxy connection '${connection.name}' is disabled in this deployment. ` +
+                  `'publisher' connections make the server issue outbound requests to a configured connectionUri, ` +
+                  `which is only appropriate for local --watch-env authoring. ` +
+                  `Fix: set the environment variable PUBLISHER_ALLOW_PROXY_CONNECTIONS=true to enable them.`,
+            );
+         }
+         const publisher = connection.publisherConnection;
+         if (!publisher?.connectionUri) {
+            throw new Error(
+               `Invalid publisher connection '${connection.name}': missing connectionUri. ` +
+                  `Fix: { "name": "${connection.name}", "type": "publisher", ` +
+                  `"publisherConnection": { "connectionUri": "https://…/connections/${connection.name}", "accessToken": "<jwt>" } }`,
+            );
+         }
+         // Reject a malformed connectionUri here, at config-load, rather than
+         // letting it fail deep in the request path — where the thrown error can
+         // echo the raw value back, leaking any credentials embedded in it
+         // (`redactUrlCredentials` returns the URI unchanged when it can't parse
+         // it). Never include the raw connectionUri in these messages; the
+         // scheme is safe to name.
+         let parsedUri: URL;
+         try {
+            parsedUri = new URL(publisher.connectionUri);
+         } catch {
+            throw new Error(
+               `Invalid publisher connection '${connection.name}': connectionUri is not a valid URL. ` +
+                  `Fix: set connectionUri to an absolute https URL like "https://…/connections/${connection.name}".`,
+            );
+         }
+         if (
+            parsedUri.protocol !== "http:" &&
+            parsedUri.protocol !== "https:"
+         ) {
+            throw new Error(
+               `Invalid publisher connection '${connection.name}': connectionUri must use http or https (got '${parsedUri.protocol}'). ` +
+                  `Fix: set connectionUri to an absolute https URL like "https://…/connections/${connection.name}".`,
+            );
+         }
+         break;
+      }
    }
 }
 
@@ -546,6 +600,22 @@ export function assembleEnvironmentConnections(
             break;
          }
 
+         case "publisher": {
+            // connectionUri presence is validated by validateConnectionShape
+            // above. The proxied dataplane owns auth and read-only enforcement;
+            // PublisherConnection itself does not reject writes. The real
+            // dialect is the remote connection's and is resolved at runtime by
+            // the live connection, so getStaticConnectionAttributes returns
+            // undefined for publisher (falls through to its default).
+            const publisher = connection.publisherConnection!;
+            pojo.connections[connection.name] = {
+               is: "publisher",
+               connectionUri: publisher.connectionUri,
+               accessToken: publisher.accessToken,
+            };
+            break;
+         }
+
          default: {
             throw new Error(`Unsupported connection type: ${connection.type}`);
          }

package/src/service/db_utils.spec.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it, mock } from "bun:test";
+import { afterEach, describe, expect, it, mock } from "bun:test";
 
 // Stub the missing optional dependency so db_utils.ts can be imported
 mock.module("@azure/identity", () => ({
@@ -873,3 +873,161 @@ describe("extractErrorDataFromError", () => {
       expect(result.task).toEqual({ id: 1 });
    });
 });
+
+// ---------------------------------------------------------------------------
+// publisher proxy introspection
+//
+// The remote dataplane is the oracle for introspection correctness and is not
+// simulated here. These tests cover only this server's own logic: the request
+// URL it builds, the auth header, the bare-name table filter, and how it
+// surfaces a non-ok / unreachable dataplane (credentials redacted from errors).
+// ---------------------------------------------------------------------------
+describe("publisher proxy introspection", () => {
+   const realFetch = globalThis.fetch;
+   let lastRequest:
+      | { url: string; headers: Record<string, string> }
+      | undefined;
+
+   function stubFetch(
+      payload: unknown,
+      init: { ok?: boolean; status?: number; body?: string } = {},
+   ) {
+      lastRequest = undefined;
+      const ok = init.ok ?? true;
+      globalThis.fetch = (async (url: unknown, opts?: RequestInit) => {
+         lastRequest = {
+            url: String(url),
+            headers: (opts?.headers as Record<string, string>) ?? {},
+         };
+         return {
+            ok,
+            status: init.status ?? (ok ? 200 : 500),
+            json: async () => payload,
+            text: async () => init.body ?? "",
+         } as Response;
+      }) as typeof fetch;
+   }
+
+   afterEach(() => {
+      globalThis.fetch = realFetch;
+   });
+
+   const conn: ApiConnection = {
+      name: "analytics",
+      type: "publisher",
+      publisherConnection: {
+         connectionUri:
+            "https://org.data.example.com/api/v0/environments/proj/connections/analytics",
+         accessToken: "jwt-token",
+      },
+   };
+   // No malloyConnection is used for the publisher path.
+   const noConn = undefined as unknown as Connection;
+
+   it("forwards GET /schemas to the connectionUri with a bearer token", async () => {
+      const schemas = [{ name: "main", isHidden: false, isDefault: true }];
+      stubFetch(schemas);
+      const result = await getSchemasForConnection(conn, noConn);
+
+      expect(lastRequest?.url).toBe(
+         "https://org.data.example.com/api/v0/environments/proj/connections/analytics/schemas",
+      );
+      expect(lastRequest?.headers["Authorization"]).toBe("Bearer jwt-token");
+      expect(result).toEqual(schemas);
+   });
+
+   it("omits the Authorization header when no accessToken is configured", async () => {
+      const tokenless: ApiConnection = {
+         name: "analytics",
+         type: "publisher",
+         publisherConnection: {
+            connectionUri:
+               "https://org.data.example.com/api/v0/environments/proj/connections/analytics",
+         },
+      };
+      stubFetch([]);
+      await getSchemasForConnection(tokenless, noConn);
+      expect(lastRequest?.headers["Authorization"]).toBeUndefined();
+   });
+
+   it("forwards GET /schemas/<schema>/tables and returns all tables when unfiltered", async () => {
+      const tables = [
+         { resource: "main.orders" },
+         { resource: "main.customers" },
+      ];
+      stubFetch(tables);
+      const result = await listTablesForSchema(conn, "main", noConn);
+
+      expect(lastRequest?.url).toBe(
+         "https://org.data.example.com/api/v0/environments/proj/connections/analytics/schemas/main/tables",
+      );
+      expect(result).toEqual(tables);
+   });
+
+   it("URL-encodes the schema name in the tables path", async () => {
+      stubFetch([]);
+      await listTablesForSchema(conn, "weird schema/name", noConn);
+      expect(lastRequest?.url).toContain(
+         "/schemas/weird%20schema%2Fname/tables",
+      );
+   });
+
+   it("filters by bare table name across schema- and catalog-qualified resources", async () => {
+      const tables = [
+         { resource: "main.orders" }, // "<schema>.<table>"
+         { resource: "cat.main.customers" }, // "<catalog>.<schema>.<table>"
+         { resource: "main.events" },
+      ];
+      stubFetch(tables);
+      const result = await listTablesForSchema(conn, "main", noConn, [
+         "orders",
+         "customers",
+      ]);
+      expect(result.map((t) => t.resource)).toEqual([
+         "main.orders",
+         "cat.main.customers",
+      ]);
+   });
+
+   it("returns an empty list when the filter matches nothing (not all rows)", async () => {
+      stubFetch([{ resource: "main.orders" }]);
+      const result = await listTablesForSchema(conn, "main", noConn, [
+         "nonexistent",
+      ]);
+      expect(result).toEqual([]);
+   });
+
+   it("throws an actionable error on a non-ok dataplane response", async () => {
+      stubFetch(null, { ok: false, status: 403, body: "forbidden" });
+      await expect(getSchemasForConnection(conn, noConn)).rejects.toThrow(
+         "failed (403): forbidden",
+      );
+   });
+
+   it("redacts URL-embedded credentials from error messages", async () => {
+      const withCreds: ApiConnection = {
+         name: "analytics",
+         type: "publisher",
+         publisherConnection: {
+            connectionUri:
+               "https://user:secret@org.data.example.com/api/v0/environments/proj/connections/analytics",
+         },
+      };
+      stubFetch(null, { ok: false, status: 500, body: "boom" });
+      await expect(getSchemasForConnection(withCreds, noConn)).rejects.toThrow(
+         /Publisher dataplane request to https:\/\/org\.data\.example\.com.*failed \(500\)/,
+      );
+      await expect(
+         getSchemasForConnection(withCreds, noConn),
+      ).rejects.not.toThrow(/secret/);
+   });
+
+   it("surfaces a network-level failure with the connection name and no token", async () => {
+      globalThis.fetch = (async () => {
+         throw new Error("ECONNREFUSED");
+      }) as unknown as typeof fetch;
+      await expect(getSchemasForConnection(conn, noConn)).rejects.toThrow(
+         'failed for connection "analytics": ECONNREFUSED',
+      );
+   });
+});