npm - @malloy-publisher/server - Versions diffs - 0.0.216 → 0.0.218 - Mend

@malloy-publisher/server 0.0.216 → 0.0.218

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (39) hide show

package/dist/sshcrypto-8m50vnmb.node ADDED Viewed

Binary file

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
    "name": "@malloy-publisher/server",
    "description": "Malloy Publisher Server",
-   "version": "0.0.216",
+   "version": "0.0.218",
    "main": "dist/server.mjs",
    "bin": {
       "malloy-publisher": "dist/server.mjs"

package/src/dto/connection.dto.ts CHANGED Viewed

@@ -1,10 +1,12 @@
 import { Type } from "class-transformer";
 import {
+   IsDefined,
    IsEnum,
    IsArray,
    IsNumber,
    IsOptional,
    IsString,
+   ValidateIf,
    ValidateNested,
 } from "class-validator";
 import "reflect-metadata";
@@ -199,6 +201,42 @@ export class DuckdbConnectionDto {
    attachedDatabases?: AttachedDatabase[];
 }
+export class SshProxyConfigDto {
+   @IsString()
+   host!: string;
+   @IsOptional()
+   @IsNumber()
+   port?: number;
+   @IsString()
+   username!: string;
+   @IsString()
+   privateKey!: string;
+   @IsOptional()
+   @IsString()
+   privateKeyPass?: string;
+   @IsOptional()
+   @IsString()
+   hostKey?: string;
+}
+export class ConnectionProxyDto {
+   @IsEnum(["ssh"])
+   type!: "ssh";
+   // ssh config is required for the ssh proxy type (the only type today); keep
+   // the conditional so a future proxy type isn't forced to supply `ssh`.
+   @ValidateIf((o) => o.type === "ssh")
+   @IsDefined()
+   @ValidateNested()
+   @Type(() => SshProxyConfigDto)
+   ssh?: SshProxyConfigDto;
+}
 export class ConnectionDto implements ApiConnection {
    @IsOptional()
    @IsString()
@@ -256,4 +294,9 @@ export class ConnectionDto implements ApiConnection {
    @ValidateNested()
    @Type(() => DuckdbConnectionDto)
    duckdbConnection?: DuckdbConnectionDto;
+   @IsOptional()
+   @ValidateNested()
+   @Type(() => ConnectionProxyDto)
+   proxy?: ConnectionProxyDto;
 }

package/src/server.ts CHANGED Viewed

@@ -491,7 +491,32 @@ type PageItem = {
    packageName: string;
    path: string;
    title: string;
+   fit?: "viewport";
 };
+// The spots in an HTML head where a "<meta ...>" literal would NOT be a live
+// tag: HTML comments (terminated or unterminated) and raw-text/RCDATA elements
+// (script/style/title/textarea). One alternation so a single .replace covers
+// them all (and so the fixpoint loop below applies one self-referential
+// replace, which is the complete-sanitization shape CodeQL recognizes).
+const NON_TAG_TEXT_PATTERN =
+   /<!--[\s\S]*?-->|<!--[\s\S]*$|<(script|style|title|textarea)\b[\s\S]*?<\/\1\s*>/gi;
+// Remove those matches until the string stops changing. A single pass is
+// incomplete because removing one match can splice the surrounding text into a
+// new one (CWE-116), so re-apply the same pattern to its own output until a
+// fixpoint. Each pass only deletes, so the string strictly shrinks and the loop
+// terminates, bounded by the input length (callers pass at most the first 4KB).
+function stripNonTagText(input: string): string {
+   let current = input;
+   let previous: string;
+   do {
+      previous = current;
+      current = current.replace(NON_TAG_TEXT_PATTERN, "");
+   } while (current !== previous);
+   return current;
+}
 async function listPackagePages(
    environmentName: string,
    packageName: string,
@@ -539,8 +564,9 @@ async function listPackagePages(
             (entry.name.endsWith(".html") || entry.name.endsWith(".htm"))
          ) {
             const rel = path.relative(publicRoot, full).replace(/\\/g, "/");
-            // Cheap title extraction: read first 4KB and grep for <title>.
+            // Cheap metadata extraction: read first 4KB and grep the <head>.
             let title = rel;
+            let fit: "viewport" | undefined;
             try {
                const fh = await fs.open(full, "r");
                try {
@@ -549,6 +575,33 @@ async function listPackagePages(
                   const head = buf.slice(0, bytesRead).toString("utf8");
                   const m = head.match(/<title[^>]*>([^<]+)<\/title>/i);
                   if (m) title = m[1].trim();
+                  // Full-screen apps (e.g. slide decks) opt into a viewport-fill
+                  // embed with <meta name="publisher:fit" content="viewport">.
+                  // FIRST strip the spots where the literal string is NOT a live
+                  // tag (comments, script/style/title/textarea), THEN look at the
+                  // <head> region only (up to </head> or <body>). Order matters:
+                  // stripping before locating the boundary keeps a literal
+                  // "<body>"/"</head>" inside a comment or <script> from
+                  // truncating the scan and hiding a real tag. What's left and
+                  // matches is a genuine <meta> the browser would honor too, so a
+                  // documented/commented example or a string in a code block
+                  // can't opt the page in. Match by name (attribute order/quoting
+                  // vary), then confirm content="viewport"; the [\s"'] before
+                  // `name` keeps `data-name="publisher:fit"` out. Like the title,
+                  // the tag must sit within the first 4KB.
+                  const cleaned = stripNonTagText(head);
+                  const headEnd = cleaned.search(/<\/head\s*>|<body[\s>]/i);
+                  const headTags =
+                     headEnd === -1 ? cleaned : cleaned.slice(0, headEnd);
+                  const fitMeta = headTags.match(
+                     /<meta\b[^>]*[\s"']name\s*=\s*["']publisher:fit["'][^>]*>/i,
+                  );
+                  if (
+                     fitMeta &&
+                     /\bcontent\s*=\s*["']\s*viewport\s*["']/i.test(fitMeta[0])
+                  ) {
+                     fit = "viewport";
+                  }
                } finally {
                   await fh.close();
                }
@@ -560,6 +613,7 @@ async function listPackagePages(
                packageName,
                path: rel,
                title,
+               fit,
             });
          }
       }

package/src/service/build_plan.spec.ts CHANGED Viewed

@@ -229,6 +229,27 @@ describe("deriveBuildPlan", () => {
       expect(Object.keys(plan.sources)).toEqual(["a@m"]);
    });
+   it("carries the per-source package-relative modelPath", () => {
+      const a = fakeSource({ name: "a", buildId: "bid-a" });
+      const b = fakeSource({ name: "b", buildId: "bid-b" });
+      const plan = deriveBuildPlan(
+         [
+            {
+               connectionName: "duckdb",
+               nodes: [[{ sourceID: "a@m", dependsOn: [] }]],
+            },
+         ] as unknown as Parameters<typeof deriveBuildPlan>[0],
+         { "a@m": a, "b@m": b },
+         { duckdb: "dig" },
+         undefined,
+         { "a@m": "rollup.malloy" },
+      );
+      // Mapped source gets its model path; an unmapped source stays undefined.
+      expect(plan.sources["a@m"].modelPath).toBe("rollup.malloy");
+      expect(plan.sources["b@m"].modelPath).toBeUndefined();
+   });
 });
 describe("compilePackageBuildPlan", () => {

package/src/service/build_plan.ts CHANGED Viewed

@@ -42,6 +42,13 @@ export interface CompiledBuildPlan {
    sources: Record<string, PersistSource>;
    connectionDigests: Record<string, string>;
    connections: Map<string, MalloyConnection>;
+   /**
+    * sourceID -> the package-relative path of the `.malloy` model that declares
+    * the source (the only place that mapping is known, since a sourceID's
+    * embedded modelURL is an absolute `file://` path with no package boundary).
+    * Optional so existing fixtures/callers that don't track it still typecheck.
+    */
+   sourceModelPaths?: Record<string, string>;
 }
 /** Output columns of a persist source, degrading to [] if unavailable. */
@@ -192,6 +199,7 @@ export async function compilePackageBuildPlan(
 ): Promise<CompiledBuildPlan> {
    const allGraphs: MalloyBuildGraph[] = [];
    const allSources: Record<string, PersistSource> = {};
+   const sourceModelPaths: Record<string, string> = {};
    for (const modelPath of pkg.getModelPaths()) {
       // Only `.malloy` models declare persist sources. Skip `.malloynb`
@@ -225,6 +233,7 @@ export async function compilePackageBuildPlan(
       allGraphs.push(...buildPlan.graphs);
       for (const [sourceID, source] of Object.entries(buildPlan.sources)) {
          allSources[sourceID] = source;
+         sourceModelPaths[sourceID] = modelPath;
       }
    }
@@ -256,6 +265,7 @@ export async function compilePackageBuildPlan(
       sources: allSources,
       connectionDigests,
       connections,
+      sourceModelPaths,
    };
 }
@@ -265,6 +275,7 @@ export function deriveBuildPlan(
    sources: Record<string, PersistSource>,
    connectionDigests: Record<string, string>,
    sourceNames?: string[],
+   sourceModelPaths?: Record<string, string>,
 ): BuildPlan {
    const include = sourceNames ? new Set(sourceNames) : null;
@@ -290,6 +301,7 @@ export function deriveBuildPlan(
          sql: source.getSQL(),
          columns: deriveColumns(source),
          annotationFields: deriveAnnotationFields(source),
+         modelPath: sourceModelPaths?.[sourceID],
       };
    }
@@ -313,5 +325,7 @@ export async function computePackageBuildPlan(
       compiled.graphs,
       compiled.sources,
       compiled.connectionDigests,
+      undefined,
+      compiled.sourceModelPaths,
    );
 }

package/src/service/connection.ts CHANGED Viewed

@@ -6,7 +6,10 @@ import "@malloydata/db-duckdb/native";
 import "@malloydata/db-mysql";
 import type { MySQLConnection } from "@malloydata/db-mysql";
 import "@malloydata/db-postgres";
-import type { PostgresConnection } from "@malloydata/db-postgres";
+import {
+   PooledPostgresConnection,
+   type PostgresConnection,
+} from "@malloydata/db-postgres";
 // Registers the "publisher" connection type (proxies SQL to a remote Publisher
 // dataplane). No live-class branch is needed in lookupConnection — the default
 // path resolves it through the registry like any other registered type.
@@ -41,6 +44,7 @@ import {
    normalizeSnowflakePrivateKey,
 } from "./connection_config";
 import { CloudStorageCredentials } from "./gcs_s3_utils";
+import { openProxy, type ProxyEndpoint } from "./proxy";
 type AttachedDatabase = components["schemas"]["AttachedDatabase"];
 type ApiConnection = components["schemas"]["Connection"];
@@ -921,6 +925,30 @@ function buildSnowflakePrivateKeyConnection(
    });
 }
+function buildProxiedPostgresConnection(
+   metadata: EnvironmentConnectionMetadata,
+   endpoint: ProxyEndpoint,
+): PooledPostgresConnection {
+   const name = metadata.apiConnection.name!;
+   const pg = metadata.apiConnection.postgresConnection;
+   if (!pg) {
+      throw new Error(
+         `Proxied connection '${name}' has type 'postgres' but no postgresConnection config.`,
+      );
+   }
+   return new PooledPostgresConnection({
+      name,
+      host: endpoint.host,
+      port: endpoint.port,
+      username: pg.userName,
+      password: pg.password,
+      databaseName: pg.databaseName,
+      // Pool sizing mirrors buildSnowflakePrivateKeyConnection.
+      poolMin: 1,
+      poolMax: 20,
+   });
+}
 function buildDuckLakeConnection(
    metadata: EnvironmentConnectionMetadata,
    entry: CoreConnectionEntry,
@@ -987,6 +1015,11 @@ export function buildEnvironmentMalloyConfig(
    const duckLakeCache = new Map<string, Promise<DuckLakeConnection>>();
    const snowflakeJwtCache = new Map<string, Promise<SnowflakeConnection>>();
    const azureDuckDBCache = new Map<string, Promise<AzureDuckDBConnection>>();
+   const proxyConnectionCache = new Map<
+      string,
+      Promise<PooledPostgresConnection>
+   >();
+   const proxyEndpoints = new Map<string, ProxyEndpoint>();
    const attachPromises = new WeakMap<Connection, Promise<void>>();
    const malloyConfig = new MalloyConfig(assembled.pojo, {
@@ -1044,6 +1077,64 @@ export function buildEnvironmentMalloyConfig(
                return connection;
             }
+            if (metadata?.proxy) {
+               let connectionPromise = proxyConnectionCache.get(name!);
+               if (!connectionPromise) {
+                  const connType = metadata.apiConnection.type;
+                  if (connType !== "postgres") {
+                     throw new Error(
+                        `SSH proxy is not yet supported for connection type '${connType}'. ` +
+                           `Only 'postgres' is implemented.`,
+                     );
+                  }
+                  // validateConnectionShape already enforces explicit host/port
+                  // at config load (the connectionString form can't be tunneled);
+                  // this is a defense-in-depth guard for any path that reaches
+                  // lookup without that validation.
+                  const pgConfig = metadata.apiConnection.postgresConnection;
+                  if (!pgConfig?.host || !pgConfig?.port) {
+                     throw new Error(
+                        `SSH proxy for connection '${name}' requires explicit host and ` +
+                           `port on the postgres connection; the connectionString form ` +
+                           `is not supported with a proxy.`,
+                     );
+                  }
+                  connectionPromise = (async () => {
+                     const endpoint = await openProxy(metadata.proxy!, {
+                        host: pgConfig.host!,
+                        port: pgConfig.port!,
+                     });
+                     try {
+                        const connection = buildProxiedPostgresConnection(
+                           metadata,
+                           endpoint,
+                        );
+                        // Register only after the build succeeds: a throw between
+                        // openProxy and here would otherwise leave an orphaned
+                        // tunnel in proxyEndpoints that a retry can't reach (the
+                        // outer .catch evicts the cache but not the endpoint).
+                        proxyEndpoints.set(name!, endpoint);
+                        return connection;
+                     } catch (err) {
+                        await endpoint.close().catch(() => {});
+                        throw err;
+                     }
+                  })();
+                  // Drop a rejected build from the cache so a later lookup can
+                  // retry, rather than replaying a transient SSH failure (bastion
+                  // restart, network blip) until the environment is rebuilt.
+                  connectionPromise.catch(() => {
+                     if (
+                        proxyConnectionCache.get(name!) === connectionPromise
+                     ) {
+                        proxyConnectionCache.delete(name!);
+                     }
+                  });
+                  proxyConnectionCache.set(name!, connectionPromise);
+               }
+               return connectionPromise;
+            }
             if (metadata?.hasSnowflakePrivateKey) {
                let connectionPromise = snowflakeJwtCache.get(name!);
                if (!connectionPromise) {
@@ -1086,6 +1177,7 @@ export function buildEnvironmentMalloyConfig(
             ...duckLakeCache.values(),
             ...snowflakeJwtCache.values(),
             ...azureDuckDBCache.values(),
+            ...proxyConnectionCache.values(),
          ];
          const closeResults = await Promise.allSettled([
             malloyConfig.shutdown("close"),
@@ -1094,11 +1186,21 @@ export function buildEnvironmentMalloyConfig(
                await connection.close();
             }),
          ]);
+         // Close proxy tunnels only AFTER the build promises above have settled:
+         // openProxy may still be in flight during a teardown race, and the
+         // endpoint is registered inside that promise — capturing the map
+         // earlier would miss it and leak the tunnel. Closing after the DB
+         // connections also keeps the tunnel alive while they drain.
+         const endpointResults = await Promise.allSettled(
+            [...proxyEndpoints.values()].map((ep) => ep.close()),
+         );
          duckLakeCache.clear();
          snowflakeJwtCache.clear();
          azureDuckDBCache.clear();
+         proxyConnectionCache.clear();
+         proxyEndpoints.clear();
-         const failures = closeResults.filter(
+         const failures = [...closeResults, ...endpointResults].filter(
             (result): result is PromiseRejectedResult =>
                result.status === "rejected",
          );

package/src/service/connection_config.spec.ts CHANGED Viewed

@@ -349,3 +349,119 @@ describe("assembleEnvironmentConnections — publisher", () => {
       });
    });
 });
+describe("SSH proxy validation", () => {
+   const validSshProxy: ApiConnection = {
+      name: "pg-via-bastion",
+      type: "postgres",
+      postgresConnection: {
+         host: "127.0.0.1",
+         port: 5432,
+         databaseName: "mydb",
+         userName: "user",
+         password: "pass",
+      },
+      proxy: {
+         type: "ssh",
+         ssh: {
+            host: "bastion.example.com",
+            username: "ec2-user",
+            privateKey:
+               "-----BEGIN OPENSSH PRIVATE KEY-----\nfake\n-----END OPENSSH PRIVATE KEY-----",
+         },
+      },
+   };
+   it("allows a postgres+ssh-proxy connection with no env flag required", () => {
+      // The SSH proxy is a normal connection capability — deliberately NOT gated
+      // by PUBLISHER_ALLOW_PROXY_CONNECTIONS (that flag is for the `publisher`
+      // HTTP multi-hop type). Prove it assembles with the flag unset.
+      const priorFlag = process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS;
+      delete process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS;
+      try {
+         const { pojo } = assembleEnvironmentConnections([validSshProxy]);
+         expect(pojo.connections["pg-via-bastion"].is).toBe("postgres");
+      } finally {
+         if (priorFlag === undefined) {
+            delete process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS;
+         } else {
+            process.env.PUBLISHER_ALLOW_PROXY_CONNECTIONS = priorFlag;
+         }
+      }
+   });
+   it("rejects a non-postgres (bigquery) connection with a proxy", () => {
+      const conn: ApiConnection = {
+         name: "bq-via-bastion",
+         type: "bigquery",
+         bigqueryConnection: {
+            serviceAccountKeyJson: JSON.stringify({
+               type: "service_account",
+               project_id: "proj",
+               private_key: "key",
+               client_email: "sa@proj.iam.gserviceaccount.com",
+            }),
+         },
+         proxy: {
+            type: "ssh",
+            ssh: {
+               host: "bastion.example.com",
+               username: "ec2-user",
+               privateKey: "key",
+            },
+         },
+      };
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "Connection proxy is not supported for type 'bigquery' (only 'postgres' today)",
+      );
+   });
+   it("rejects an ssh proxy with no ssh config object", () => {
+      const conn: ApiConnection = {
+         name: "pg-no-ssh-config",
+         type: "postgres",
+         postgresConnection: {
+            host: "127.0.0.1",
+            databaseName: "mydb",
+         },
+         proxy: {
+            type: "ssh",
+         },
+      };
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "Connection proxy on 'pg-no-ssh-config' has type 'ssh' but no 'ssh' config object",
+      );
+   });
+   it("rejects a proxied postgres connection that also carries a connectionString", () => {
+      const conn: ApiConnection = {
+         ...validSshProxy,
+         name: "pg-with-connstring",
+         postgresConnection: {
+            connectionString: "postgresql://real-db.example.com:5432/mydb",
+            host: "127.0.0.1",
+            port: 5432,
+            databaseName: "mydb",
+         },
+      };
+      // The tunnel forwards to host/port; a connectionString would be silently
+      // ignored and could point at a different database, so it's rejected.
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "does not support the connectionString form",
+      );
+   });
+   it("rejects a proxied postgres connection missing explicit host/port", () => {
+      const conn: ApiConnection = {
+         ...validSshProxy,
+         name: "pg-no-host-port",
+         postgresConnection: {
+            databaseName: "mydb",
+            userName: "user",
+         },
+      };
+      expect(() => assembleEnvironmentConnections([conn])).toThrow(
+         "requires explicit host and port",
+      );
+   });
+});

package/src/service/connection_config.ts CHANGED Viewed

@@ -22,6 +22,7 @@ export type EnvironmentConnectionMetadata = {
    isDuckLake: boolean;
    databasePath?: string;
    workingDirectory: string;
+   proxy?: ApiConnection["proxy"];
 };
 export type AssembledEnvironmentConnections = {
@@ -258,6 +259,52 @@ function buildDuckdbEntry(
 }
 function validateConnectionShape(connection: ApiConnection): void {
+   if (connection.proxy) {
+      // A connection proxy makes THIS server open an outbound SSH tunnel to a
+      // tenant-configured bastion. It's a normal connection capability,
+      // authorized by whoever configures the connection — deliberately NOT gated
+      // by an env flag, and kept separate from the `publisher` HTTP multi-hop
+      // type's PUBLISHER_ALLOW_PROXY_CONNECTIONS gate below (that flag is about
+      // publisher-to-publisher proxying, a distinct operator decision). Host-key
+      // pinning is fail-closed at connect time (see openProxy).
+      if (connection.proxy.type !== "ssh") {
+         throw new Error(
+            `Connection '${connection.name}' has an unsupported proxy type '${connection.proxy.type}'. Only 'ssh' is supported.`,
+         );
+      }
+      if (connection.type !== "postgres") {
+         throw new Error(
+            `Connection proxy is not supported for type '${connection.type}' (only 'postgres' today).`,
+         );
+      }
+      if (!connection.proxy.ssh) {
+         throw new Error(
+            `Connection proxy on '${connection.name}' has type 'ssh' but no 'ssh' config object.`,
+         );
+      }
+      // The tunnel forwards to an explicit host:port; the connectionString form
+      // can't be rewritten to the local endpoint. Reject it outright when a
+      // proxy is set — normal postgres gives connectionString precedence over
+      // host/port, so a config carrying BOTH would silently tunnel to
+      // host/port and ignore the connectionString, connecting to a different
+      // database than the operator configured. Require discrete host/port.
+      if (connection.postgresConnection?.connectionString) {
+         throw new Error(
+            `Connection proxy on '${connection.name}' does not support the connectionString form; ` +
+               `provide discrete host and port instead (the tunnel forwards to an explicit endpoint).`,
+         );
+      }
+      if (
+         !connection.postgresConnection?.host ||
+         !connection.postgresConnection?.port
+      ) {
+         throw new Error(
+            `Connection proxy on '${connection.name}' requires explicit host and port on the ` +
+               `postgres connection; the connectionString form is not supported with a proxy.`,
+         );
+      }
+   }
    switch (connection.type) {
       case "postgres":
       case "mysql":
@@ -445,6 +492,7 @@ export function assembleEnvironmentConnections(
          isDuckLake,
          databasePath,
          workingDirectory: environmentPath,
+         proxy: connection.proxy,
       });
       switch (connection.type) {

package/src/service/model.ts CHANGED Viewed

@@ -115,6 +115,18 @@ function quoteMalloyIdentifier(name: string | undefined): string {
    return "`" + (name ?? "").replace(/\\/g, "\\\\").replace(/`/g, "\\`") + "`";
 }
+/**
+ * A non-fatal render-tag finding from {@link Model.validateRenderTags}: an
+ * error-severity issue that affects only how a field renders, never whether the
+ * model compiles or a query runs. `target` is the query or view it sits on
+ * (e.g. `by_carrier` or `flights -> by_carrier`).
+ */
+export interface RenderTagWarning {
+   target: string;
+   message: string;
+   severity: "error" | "warn";
+}
 export class Model {
    private packageName: string;
    private modelPath: string;
@@ -952,12 +964,13 @@ export class Model {
     * it does not fail the package load. Such a tag still renders as
     * "[object Object]" at query time, so the warning is the operator-facing
     * signal. Lower-severity findings are left for the query-time `renderLogs`
-    * surface.
+    * surface. The findings are returned so the owning Package can surface them
+    * as non-fatal `warnings` on its response.
     */
-   public async validateRenderTags(): Promise<void> {
+   public async validateRenderTags(): Promise<RenderTagWarning[]> {
       const mm = this.modelMaterializer;
       if (!mm) {
-         return;
+         return [];
       }
       // Dynamic import (like execute_query_tool.ts): the renderer is heavy and
       // mutates DOM globals on load, so only pull it in when there's a model to
@@ -1003,6 +1016,7 @@ export class Model {
          }
       }
+      const findings: RenderTagWarning[] = [];
       for (const target of targets) {
          let result: Malloy.Result;
          try {
@@ -1024,8 +1038,16 @@ export class Model {
                   .map((e) => e.message)
                   .join("; ")}`,
             );
+            for (const e of errors) {
+               findings.push({
+                  target: target.label,
+                  message: e.message,
+                  severity: "error",
+               });
+            }
          }
       }
+      return findings;
    }
    public async getModel(): Promise<ApiCompiledModel> {