@hyperfixation/cli 0.1.1 → 0.1.3

package/dist/doctor.d.ts

@@ -49,19 +49,20 @@ export interface DoctorOptions {
  * whole point of this command is one screen that says whether anything needs attention.
  *
  * Nothing here prints a secret. The read token authorizes the status request and never appears
- * in a finding; a provider's response body is dropped for the same reason (`ProviderError`).
+ * in a finding, and a provider's refusal reaches a finding redacted (`ProviderError`).
  */
 export declare function doctor(options?: DoctorOptions): Promise<DoctorResult>;
 /** The report as printed: a blank line and a header per app, then its findings. */
 export declare function doctorLines(result: DoctorResult): string[];
 /**
- * E006 as `postgres` with `SET ROLE hf_<app>`, over the tunnel a `Runner` opens.
+ * E006 as the cluster admin with `SET ROLE hf_<app>`, over the tunnel a `Runner` opens.
  *
  * As the app role rather than as an admin because that is the only role whose answer matters —
  * a superuser's privileges are both true whatever the migrator granted.
  */
 export declare function tunnelPrivilegeCheck(runner: Runner, options?: {
-    container?: string;
+    containers?: readonly string[];
+    adminUser?: string;
 }): PrivilegeCheck;
 /**
  * `@hyperfixation/db`'s own E006, run against `adminUrl` — which must already name the app's

package/dist/doctor.js

@@ -2,7 +2,7 @@ import { access, readdir } from "node:fs/promises";
 import path from "node:path";
 import { checkE006, quoteIdent } from "@hyperfixation/db";
 import { Client } from "pg";
-import { loadOperatorConfig, requireOperatorConfig, } from "./config.js";
+import { DEFAULT_PG_ADMIN_USER, loadOperatorConfig, pgAdminUser, postgresContainers, requireOperatorConfig, } from "./config.js";
 import { openDatabase } from "./database.js";
 import { deriveNames } from "./names.js";
 import { GithubClient } from "./providers/github.js";
@@ -12,8 +12,6 @@ import { openAppState, stateDir } from "./state.js";
 export const RESTORE_CHECK_MAX_AGE_DAYS = 7;
 /** The branch prefix Phase 4's core bumps open their pull requests on. */
 export const CORE_BUMP_BRANCH_PREFIX = "core-bump/";
-/** The cluster role `hf doctor` reads privileges as, before `SET ROLE`. */
-const CLUSTER_ADMIN_USER = "postgres";
 /**
  * `hf doctor` — what is wrong with the deployed apps, one line per finding.
  *
@@ -22,7 +20,7 @@ const CLUSTER_ADMIN_USER = "postgres";
  * whole point of this command is one screen that says whether anything needs attention.
  *
  * Nothing here prints a secret. The read token authorizes the status request and never appears
- * in a finding; a provider's response body is dropped for the same reason (`ProviderError`).
+ * in a finding, and a provider's refusal reaches a finding redacted (`ProviderError`).
  */
 export async function doctor(options = {}) {
     const env = options.env ?? process.env;
@@ -63,21 +61,22 @@ export function doctorLines(result) {
     return lines;
 }
 /**
- * E006 as `postgres` with `SET ROLE hf_<app>`, over the tunnel a `Runner` opens.
+ * E006 as the cluster admin with `SET ROLE hf_<app>`, over the tunnel a `Runner` opens.
  *
  * As the app role rather than as an admin because that is the only role whose answer matters —
  * a superuser's privileges are both true whatever the migrator granted.
  */
 export function tunnelPrivilegeCheck(runner, options = {}) {
+    const adminUser = options.adminUser ?? DEFAULT_PG_ADMIN_USER;
     return async (target) => {
         const db = await openDatabase(runner, {
-            admin: { user: CLUSTER_ADMIN_USER },
-            container: options.container,
+            admin: { user: adminUser },
+            containers: options.containers,
         });
         try {
             const adminUrl = db.adminUrl(target.databaseName);
             if (adminUrl === undefined) {
-                throw new Error(`E006 cannot be read over the ${db.kind} transport: ${CLUSTER_ADMIN_USER} has to be ` +
+                throw new Error(`E006 cannot be read over the ${db.kind} transport: ${adminUser} has to be ` +
                     "a session a pg client holds open, so that SET ROLE outlives the statement");
             }
             await checkAppRolePrivileges(adminUrl, target.applicationRole);
@@ -105,7 +104,10 @@ export async function checkAppRolePrivileges(adminUrl, role) {
 }
 function defaultPrivilegeCheck(config, env) {
     const { HF_SSH_HOST } = requireOperatorConfig(config, ["HF_SSH_HOST"], { env });
-    return tunnelPrivilegeCheck(createSshRunner({ host: HF_SSH_HOST }));
+    return tunnelPrivilegeCheck(createSshRunner({ host: HF_SSH_HOST }), {
+        containers: postgresContainers(config),
+        adminUser: pgAdminUser(config),
+    });
 }
 async function doctorApp(context, name) {
     const findings = [];
@@ -141,7 +143,7 @@ async function doctorApp(context, name) {
     }
     const report = await statusFindings(context, name, state, add);
     versionFinding(report?.applicationVersion, mainSha, mainShaProblem, add);
-    if (report !== undefined) {
+    if (report?.budget !== undefined) {
         budgetFinding(report.budget.current, "current", add);
         budgetFinding(report.budget.previous, "previous", add);
     }
@@ -161,23 +163,75 @@ async function statusFindings(context, name, state, add) {
     }
     let report;
     try {
-        report = await getStatus(context.fetch, url, token);
+        report = readStatus(await getStatus(context.fetch, url, token));
     }
     catch (error) {
         add("status", "fail", `GET ${url}: ${flatten(error.message)}`);
         return undefined;
     }
-    add("status", report.health === "ok" ? "ok" : "warn", `health ${report.health}, ${String(report.anomalies)} anomaly/anomalies, core ` +
-        report.coreVersion);
-    add("runs", "ok", `${String(report.runs.running)} run(s) running`);
-    // Only `fixtures` gets a line. `live` is the expected deploy, and `unknown` is an app whose
-    // worker has not reported yet — neither is a finding, but a canned draft an operator takes
-    // for a real one is.
-    if (report.llm.mode === "fixtures") {
+    const anomalies = report.anomalies === undefined ? UNKNOWN : String(report.anomalies);
+    add("status", 
+    // Only a health the app actually reported can be a warning: a field it did not answer with
+    // says nothing about the deployment, and a WARN the operator cannot act on is noise.
+    report.health === undefined || report.health === "ok" ? "ok" : "warn", `health ${report.health ?? UNKNOWN}, ${anomalies} anomaly/anomalies, core ` +
+        (report.coreVersion ?? UNKNOWN));
+    if (report.runsRunning !== undefined) {
+        add("runs", "ok", `${String(report.runsRunning)} run(s) running`);
+    }
+    // Only `fixtures` gets a line. `live` is the expected deploy, and `unknown` — as is a core too
+    // old to have the field at all — is an app that has not said; neither is a finding, but a
+    // canned draft an operator takes for a real one is.
+    if (report.llmMode === "fixtures") {
         add("llm", "warn", "app is serving fixture drafts — no provider key set");
     }
     return report;
 }
+const UNKNOWN = "unknown";
+function readStatus(payload) {
+    const report = record(payload);
+    const budget = record(report.budget);
+    return {
+        health: text(report.health),
+        anomalies: numeric(report.anomalies),
+        coreVersion: text(report.coreVersion),
+        applicationVersion: report.applicationVersion === null ? null : text(report.applicationVersion),
+        runsRunning: numeric(record(report.runs).running),
+        llmMode: text(record(report.llm).mode),
+        budget: isRecord(report.budget)
+            ? { current: readPeriod(budget.current), previous: readPeriod(budget.previous) }
+            : undefined,
+    };
+}
+/** `null` for a period the app has no row for, which is also how a malformed one reads. */
+function readPeriod(value) {
+    if (!isRecord(value))
+        return null;
+    return {
+        period: text(value.period),
+        budgetUsd: text(value.budgetUsd),
+        spentUsd: text(value.spentUsd),
+        driftUsd: text(value.driftUsd),
+    };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function record(value) {
+    return isRecord(value) ? value : {};
+}
+function text(value) {
+    return typeof value === "string" ? value : undefined;
+}
+function numeric(value) {
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+/** A money column as a number, or `undefined` when the app did not report a usable one. */
+function amount(value) {
+    if (value === undefined)
+        return undefined;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
 function versionFinding(deployed, mainSha, mainShaProblem, add) {
     if (mainShaProblem !== undefined) {
         add("version", "fail", mainShaProblem);
@@ -198,9 +252,13 @@ function budgetFinding(period, which, add) {
         add("budget", "ok", `no ${which} period row yet`);
         return;
     }
-    const over = Number(period.spentUsd) > Number(period.budgetUsd);
-    const drifting = Number(period.driftUsd) !== 0;
-    const spend = `${period.period} spent $${period.spentUsd} of $${period.budgetUsd}`;
+    const spent = amount(period.spentUsd);
+    const budget = amount(period.budgetUsd);
+    const drift = amount(period.driftUsd);
+    const over = spent !== undefined && budget !== undefined && spent > budget;
+    const drifting = drift !== undefined && drift !== 0;
+    const spend = `${period.period ?? UNKNOWN} spent $${period.spentUsd ?? UNKNOWN} ` +
+        `of $${period.budgetUsd ?? UNKNOWN}`;
     if (over || drifting) {
         add("budget", "warn", `${spend}${over ? " — over budget" : ""}${drifting ? ` — drift $${period.driftUsd}` : ""}`);
         return;
@@ -283,7 +341,7 @@ async function getStatus(fetchImpl, url, token) {
     });
     if (!response.ok)
         throw new Error(`HTTP ${String(response.status)}`);
-    return (await response.json());
+    return await response.json();
 }
 async function stateNames(dir) {
     const entries = await readdir(dir).catch(() => []);

package/dist/new-cloud.d.ts

@@ -75,13 +75,22 @@ export declare function invalidateStaleSecretSteps(state: AppStateStore): Promis
  * Errors propagate untouched: the caller prints them, and the state file is the resume point.
  */
 export declare function runSteps<Context extends CloudContext>(steps: readonly Step<Context>[], context: Context): Promise<RunStepsResult>;
+/**
+ * The keys a cloud `hf new` runs without: three have a default derived from another key, the two
+ * provider keys are what the checklist warns about when they are unset, and the three Langfuse
+ * keys are three ways of configuring one step — an org key, a project key pair, or neither, which
+ * the step degrades to a warning and a checklist line.
+ */
+export declare const OPTIONAL_CLOUD_CONFIG: readonly ConfigKey[];
 /**
  * Every operator config key a cloud `hf new` needs, checked before the first step.
  *
  * All at once, and before anything is created: `requireOperatorConfig` names every missing key,
  * and an operator who learns about them one failed step at a time pays for a half-provisioned app
- * each time. The optional keys are deliberately absent — `HF_DB_HOST_INTERNAL` has a default, and
- * the two provider keys are what the checklist warns about when they are unset.
+ * each time. Derived from `CONFIG_KEYS` rather than listed, because a hand-kept list is exactly
+ * what left `HF_GITHUB_TOKEN`, the Cloudflare pair and five others to fail at their own step: the
+ * ten steps between them read every key there is, so the required set is the complement of the
+ * optional one, and a key added for a step is required the moment it is named.
  */
 export declare const REQUIRED_CLOUD_CONFIG: readonly ConfigKey[];
 export interface NewAppCloudOptions {

package/dist/new-cloud.js

@@ -2,7 +2,7 @@ import path from "node:path";
 import { checklistLines } from "./checklist.js";
 import { providerKeys } from "./cloud-steps/coolify.js";
 import { cloudCommands, CLOUD_STEPS, defaultTemplateFetch, spawnStepExec, } from "./cloud-steps/index.js";
-import { loadOperatorConfig, requireOperatorConfig, } from "./config.js";
+import { CONFIG_KEYS, loadOperatorConfig, pgAdminUser, postgresContainers, requireOperatorConfig, } from "./config.js";
 import { openDatabase } from "./database.js";
 import { deriveNames } from "./names.js";
 import { createSshRunner } from "./runner.js";
@@ -106,28 +106,33 @@ export async function runSteps(steps, context) {
     assertRotationApplied(context);
     return { ran, skipped, invalidated };
 }
+/**
+ * The keys a cloud `hf new` runs without: three have a default derived from another key, the two
+ * provider keys are what the checklist warns about when they are unset, and the three Langfuse
+ * keys are three ways of configuring one step — an org key, a project key pair, or neither, which
+ * the step degrades to a warning and a checklist line.
+ */
+export const OPTIONAL_CLOUD_CONFIG = [
+    "HF_DB_HOST_INTERNAL",
+    "HF_DB_CONTAINER",
+    "HF_PG_ADMIN_USER",
+    "HF_ANTHROPIC_API_KEY",
+    "HF_OPENAI_API_KEY",
+    "HF_LANGFUSE_ORG_KEY",
+    "HF_LANGFUSE_PUBLIC_KEY",
+    "HF_LANGFUSE_SECRET_KEY",
+];
 /**
  * Every operator config key a cloud `hf new` needs, checked before the first step.
  *
  * All at once, and before anything is created: `requireOperatorConfig` names every missing key,
  * and an operator who learns about them one failed step at a time pays for a half-provisioned app
- * each time. The optional keys are deliberately absent — `HF_DB_HOST_INTERNAL` has a default, and
- * the two provider keys are what the checklist warns about when they are unset.
+ * each time. Derived from `CONFIG_KEYS` rather than listed, because a hand-kept list is exactly
+ * what left `HF_GITHUB_TOKEN`, the Cloudflare pair and five others to fail at their own step: the
+ * ten steps between them read every key there is, so the required set is the complement of the
+ * optional one, and a key added for a step is required the moment it is named.
  */
-export const REQUIRED_CLOUD_CONFIG = [
-    "HF_COOLIFY_URL",
-    "HF_COOLIFY_TOKEN",
-    "HF_COOLIFY_SERVER_UUID",
-    "HF_COOLIFY_GITHUB_APP_UUID",
-    "HF_COOLIFY_POSTGRES_UUID",
-    "HF_SSH_HOST",
-    "HF_BASE_DOMAIN",
-    "HF_SMTP_URL",
-    "HF_EMAIL_FROM",
-    "HF_LANGFUSE_URL",
-];
-/** The cluster role `hf new` provisions the app's database and roles as. */
-const CLUSTER_ADMIN_USER = "postgres";
+export const REQUIRED_CLOUD_CONFIG = CONFIG_KEYS.filter((key) => !OPTIONAL_CLOUD_CONFIG.includes(key));
 /**
  * `hf new <name>` without `--local`: the ten steps, resumable, then the checklist.
  *
@@ -144,7 +149,7 @@ export async function newAppCloud(options) {
     const runner = options.runner ?? createSshRunner({ host: required.HF_SSH_HOST });
     // `PGPASSWORD` is libpq's own name for it, and the same place `hf restore-check` reads it:
     // Coolify's cluster password is not an hf config key, because nothing of ours should hold it.
-    const clusterAdmin = options.clusterAdmin ?? { user: CLUSTER_ADMIN_USER, password: env.PGPASSWORD };
+    const clusterAdmin = options.clusterAdmin ?? { user: pgAdminUser(config), password: env.PGPASSWORD };
     let database;
     const hadWriteToken = state.state.statusTokens?.write !== undefined;
     const fqdn = `${names.given}.${required.HF_BASE_DOMAIN}`;
@@ -164,9 +169,13 @@ export async function newAppCloud(options) {
         email: options.email,
         budgetUsd: options.budgetUsd,
         database: async () => {
-            // No `container`: the `docker exec psql` transport has no address, and every use of the
-            // cluster here — `provisionRoles`, the migrator, the tokens — is a pg client.
-            database ??= await openDatabase(runner, { admin: clusterAdmin });
+            // The container is named so the tunnel can discover its address, but no `dockerExec`: that
+            // transport has no address, and every use of the cluster here — `provisionRoles`, the
+            // migrator, the tokens — is a pg client.
+            database ??= await openDatabase(runner, {
+                admin: clusterAdmin,
+                containers: postgresContainers(config),
+            });
             return database;
         },
         commands: options.commands ?? cloudCommands,

package/dist/providers/cloudflare.js

@@ -7,6 +7,7 @@ export class CloudflareClient {
             provider: "cloudflare",
             baseUrl: options.url ?? CLOUDFLARE_API_URL,
             headers: { authorization: `Bearer ${options.token}` },
+            secrets: [options.token],
             fetch: options.fetch,
         });
     }

package/dist/providers/coolify.d.ts

@@ -29,14 +29,28 @@ export interface CoolifyApplicationRequest {
     build_pack: "nixpacks" | "railpack" | "static" | "dockerfile" | "dockercompose";
     name?: string;
     description?: string;
-    /** Comma-separated; the app's `https://<name>.<HF_BASE_DOMAIN>`. */
+    /**
+     * Comma-separated. Rejected outright for a `dockercompose` build pack — Coolify 4.3.21 answers
+     * 422 `The domains field cannot be used for dockercompose applications` — so
+     * `docker_compose_domains` is what `hf new` sends and this is for the other four packs.
+     */
     domains?: string;
+    /** One entry per compose service that gets a domain; `hf new` sends exactly one. */
+    docker_compose_domains?: readonly CoolifyComposeDomain[];
     ports_exposes?: string;
     docker_compose_location?: string;
     connect_to_docker_network?: boolean;
     instant_deploy?: boolean;
     is_auto_deploy_enabled?: boolean;
 }
+/** A domain on one service of a compose application, which is how a `dockercompose` app gets one. */
+export interface CoolifyComposeDomain {
+    /** The service name as `docker-compose.prod.yml` spells it. */
+    name: string;
+    /** Comma-separated, same as `domains`. */
+    domain: string;
+    redirect?: "www" | "non-www" | "both";
+}
 export interface CoolifyApplication {
     uuid: string;
 }

package/dist/providers/coolify.js

@@ -6,6 +6,7 @@ export class CoolifyClient {
             provider: "coolify",
             baseUrl: `${options.url.replace(/\/+$/, "")}/api/v1`,
             headers: { authorization: `Bearer ${options.token}` },
+            secrets: [options.token],
             fetch: options.fetch,
         });
     }
@@ -42,6 +43,9 @@ export class CoolifyClient {
             method: "PATCH",
             path: `/applications/${segment(appUuid)}/envs/bulk`,
             body: { data },
+            // The app's whole environment goes out in this one call, and a 422 names the variables it
+            // rejected by quoting them.
+            secrets: data.map((variable) => variable.value),
         });
     }
     async deploy(uuid, options = {}) {

package/dist/providers/github.js

@@ -11,6 +11,7 @@ export class GithubClient {
                 accept: "application/vnd.github+json",
                 "x-github-api-version": "2022-11-28",
             },
+            secrets: [options.token],
             fetch: options.fetch,
         });
     }

package/dist/providers/http.d.ts

@@ -7,15 +7,23 @@ export interface ProviderRequest {
     path: string;
     query?: Record<string, string | number | boolean | undefined>;
     body?: unknown;
+    /**
+     * Values this request carries that a provider may echo back at it — the app's environment, in
+     * the one call that sends it. Blanked out of the error message; see `explain`.
+     */
+    secrets?: readonly string[];
 }
+/** How much of a rejected request's explanation reaches the message before it is cut. */
+export declare const EXPLANATION_LIMIT = 500;
 /**
  * A provider answered with a status outside 2xx.
  *
- * The response body is on `body` and deliberately **not** in `message`: a Coolify 422 echoes
- * the fields it rejected, and those fields are the app's whole environment — its database URL,
- * its status tokens, its Langfuse secret key. `hf` prints `error.message`, so a body that
- * quotes a secret would land in a terminal and a scrollback. Nor is the query string included,
- * for the same reason.
+ * `message` carries the response's own `message` and `errors` and nothing else of it: those two are
+ * where every provider here puts the reason, and the rest of a body is free to quote what was sent.
+ * What reaches the message is redacted first — every credential the client was built with, every
+ * value the request declared, and anything shaped like a password — because `hf` prints
+ * `error.message` and a terminal keeps a scrollback. The raw body is on `body` for a caller that
+ * wants it; the request's own headers and query string are in neither.
  */
 export declare class ProviderError extends Error {
     readonly provider: string;
@@ -23,7 +31,7 @@ export declare class ProviderError extends Error {
     readonly method: HttpMethod;
     readonly path: string;
     readonly body: string;
-    constructor(provider: string, request: ProviderRequest, status: number, body: string);
+    constructor(provider: string, request: ProviderRequest, status: number, body: string, explanation?: string);
 }
 export interface TransportOptions {
     /** Names the provider in errors. */
@@ -32,8 +40,17 @@ export interface TransportOptions {
     baseUrl: string;
     /** Sent on every request — the authorization header, and whatever else the API insists on. */
     headers: Record<string, string>;
+    /** The credentials this client was built with; blanked out of every error message. */
+    secrets?: readonly string[];
     fetch?: FetchLike;
 }
+/**
+ * Why the provider refused, out of its `message` and `errors` and redacted.
+ *
+ * `undefined` when the body is not JSON or carries neither key: a provider that explained nothing
+ * leaves the status to speak, rather than a page of HTML in a terminal.
+ */
+export declare function explain(body: string, secrets: readonly string[]): string | undefined;
 export type Transport = <Result>(request: ProviderRequest) => Promise<Result>;
 /** Builds the `request` function the clients in this directory are written against. */
 export declare function createTransport(options: TransportOptions): Transport;

package/dist/providers/http.js

@@ -1,11 +1,15 @@
+import { redactPasswords } from "../database.js";
+/** How much of a rejected request's explanation reaches the message before it is cut. */
+export const EXPLANATION_LIMIT = 500;
 /**
  * A provider answered with a status outside 2xx.
  *
- * The response body is on `body` and deliberately **not** in `message`: a Coolify 422 echoes
- * the fields it rejected, and those fields are the app's whole environment — its database URL,
- * its status tokens, its Langfuse secret key. `hf` prints `error.message`, so a body that
- * quotes a secret would land in a terminal and a scrollback. Nor is the query string included,
- * for the same reason.
+ * `message` carries the response's own `message` and `errors` and nothing else of it: those two are
+ * where every provider here puts the reason, and the rest of a body is free to quote what was sent.
+ * What reaches the message is redacted first — every credential the client was built with, every
+ * value the request declared, and anything shaped like a password — because `hf` prints
+ * `error.message` and a terminal keeps a scrollback. The raw body is on `body` for a caller that
+ * wants it; the request's own headers and query string are in neither.
  */
 export class ProviderError extends Error {
     provider;
@@ -13,8 +17,9 @@ export class ProviderError extends Error {
     method;
     path;
     body;
-    constructor(provider, request, status, body) {
-        super(`${provider} ${request.method} ${request.path} failed: HTTP ${status}`);
+    constructor(provider, request, status, body, explanation) {
+        super(`${provider} ${request.method} ${request.path} failed: HTTP ${status}` +
+            (explanation === undefined ? "" : `: ${explanation}`));
         this.name = "ProviderError";
         this.provider = provider;
         this.status = status;
@@ -23,6 +28,38 @@ export class ProviderError extends Error {
         this.body = body;
     }
 }
+/**
+ * Why the provider refused, out of its `message` and `errors` and redacted.
+ *
+ * `undefined` when the body is not JSON or carries neither key: a provider that explained nothing
+ * leaves the status to speak, rather than a page of HTML in a terminal.
+ */
+export function explain(body, secrets) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return undefined;
+    const { message, errors } = parsed;
+    if (message === undefined && errors === undefined)
+        return undefined;
+    let text = JSON.stringify({
+        ...(message === undefined ? {} : { message }),
+        ...(errors === undefined ? {} : { errors }),
+    });
+    for (const secret of secrets) {
+        // Short values are skipped: a two-character secret would blank half the explanation with it.
+        if (secret.length < 4)
+            continue;
+        text = text.split(JSON.stringify(secret).slice(1, -1)).join("***");
+    }
+    text = redactPasswords(text);
+    return text.length > EXPLANATION_LIMIT ? `${text.slice(0, EXPLANATION_LIMIT)}…` : text;
+}
 /** Builds the `request` function the clients in this directory are written against. */
 export function createTransport(options) {
     // Looked up per request, not captured: a test's mock server replaces `globalThis.fetch` after
@@ -45,7 +82,8 @@ export function createTransport(options) {
         });
         const text = await response.text();
         if (!response.ok) {
-            throw new ProviderError(options.provider, request, response.status, text);
+            const secrets = [...(options.secrets ?? []), ...(request.secrets ?? [])];
+            throw new ProviderError(options.provider, request, response.status, text, explain(text, secrets));
         }
         return (text === "" ? undefined : JSON.parse(text));
     };

package/dist/providers/langfuse.js

@@ -8,6 +8,8 @@ export class LangfuseClient {
             headers: {
                 authorization: `Basic ${Buffer.from(options.orgKey, "utf8").toString("base64")}`,
             },
+            // Both halves of the pair: an error message must not quote either one back.
+            secrets: options.orgKey.split(":"),
             fetch: options.fetch,
         });
     }

package/dist/providers/sentry.js

@@ -7,6 +7,7 @@ export class SentryClient {
             provider: "sentry",
             baseUrl: options.url ?? SENTRY_URL,
             headers: { authorization: `Bearer ${options.token}` },
+            secrets: [options.token],
             fetch: options.fetch,
         });
     }

package/dist/provision-database.js

@@ -44,8 +44,8 @@ export async function provisionDatabase(target, options) {
     const adminUrl = db.adminUrl();
     if (adminUrl === undefined) {
         throw new ProvisionDatabaseError(`roles cannot be provisioned over the ${db.kind} transport: provisionRoles() is a pg ` +
-            "client and needs an address. Publish the Coolify Postgres port on the box's loopback " +
-            "so the tunnel works.");
+            "client and needs an address. Name the Postgres container — HF_DB_CONTAINER, or " +
+            "HF_COOLIFY_POSTGRES_UUID — so the tunnel can discover one.");
     }
     try {
         const createdDatabase = await createDatabaseIfAbsent(db, names.databaseName);

package/dist/restore-check.js

@@ -1,6 +1,6 @@
 import { quoteIdent } from "@hyperfixation/db";
 import { createLocalDirectoryBackupSource, createS3BackupSource, } from "./backup-source.js";
-import { loadOperatorConfig, requireOperatorConfig } from "./config.js";
+import { loadOperatorConfig, pgAdminUser, postgresContainers, requireOperatorConfig, } from "./config.js";
 import { openDatabase, openDatabaseUrl, redactPasswords, DEFAULT_POSTGRES_PORT, } from "./database.js";
 import { deriveNames } from "./names.js";
 import { REQUIRED_EXTENSIONS } from "./provision-database.js";
@@ -12,8 +12,6 @@ export const SCRATCH_SUFFIX = "_restore_check";
 const MAX_IDENTIFIER_BYTES = 63;
 /** Older than this and the dump gets a warning line; it never changes the exit code. */
 export const STALE_DUMP_HOURS = 36;
-/** The box's Coolify Postgres superuser — the role the whole check runs as. */
-const CLUSTER_ADMIN_USER = "postgres";
 const CLUSTER_ADMIN_DATABASE = "postgres";
 export class RestoreCheckError extends Error {
     constructor(message) {
@@ -48,7 +46,8 @@ export async function restoreCheck(options) {
     const clusterUrl = db.adminUrl();
     if (clusterUrl === undefined) {
         throw new RestoreCheckError(`a restore cannot be run over the ${db.kind} transport: pg_restore needs an address. ` +
-            "Publish the Coolify Postgres port on the box's loopback so the tunnel works.");
+            "Name the Postgres container — HF_DB_CONTAINER, or HF_COOLIFY_POSTGRES_UUID — so the " +
+            "tunnel can discover one.");
     }
     const restoreTarget = urlOnto(options.restoreAdminUrl ?? clusterUrl, scratchDatabase);
     const now = options.now ?? new Date();
@@ -219,8 +218,8 @@ export async function restoreCheckApp(options) {
     const config = await loadOperatorConfig({ env });
     const { HF_SSH_HOST } = requireOperatorConfig(config, ["HF_SSH_HOST"], { env });
     const runner = createSshRunner({ host: HF_SSH_HOST });
-    const admin = { user: CLUSTER_ADMIN_USER, password: env.PGPASSWORD };
-    const db = await openDatabase(runner, { admin });
+    const admin = { user: pgAdminUser(config), password: env.PGPASSWORD };
+    const db = await openDatabase(runner, { admin, containers: postgresContainers(config) });
     try {
         return await restoreCheck({
             app: options.app,
@@ -230,17 +229,23 @@ export async function restoreCheckApp(options) {
                 : createLocalDirectoryBackupSource({ runner, directory: options.backupDir }),
             runner,
             database: db,
-            restoreAdminUrl: boxAdminUrl(admin),
+            restoreAdminUrl: boxAdminUrl(admin, db.boxAddress),
         });
     }
     finally {
         await db.close();
     }
 }
-/** The cluster as the box itself sees it, where `pg_restore` runs. */
-function boxAdminUrl(admin) {
-    const url = new URL("postgresql://127.0.0.1");
-    url.port = String(DEFAULT_POSTGRES_PORT);
+/**
+ * The cluster as the box itself sees it, where `pg_restore` runs.
+ *
+ * `address` is whatever the tunnel settled on: with 5432 unpublished the box's loopback is no more
+ * a listener for `pg_restore` than for the forward, and the container's address on the docker
+ * network is what both have to dial.
+ */
+function boxAdminUrl(admin, address) {
+    const url = new URL(`postgresql://${address?.host ?? "127.0.0.1"}`);
+    url.port = String(address?.port ?? DEFAULT_POSTGRES_PORT);
     url.username = encodeURIComponent(admin.user);
     if (admin.password !== undefined)
         url.password = encodeURIComponent(admin.password);