@hyperfixation/cli 0.1.2 → 0.1.3

package/dist/cloud-steps/context.d.ts

@@ -7,7 +7,8 @@ import type { FetchLike } from "../providers/http.js";
  * A step refused to act, or a command it ran failed.
  *
  * Carries no provider body and no environment: the only thing a step is allowed to say about a
- * secret is that it has one. `ProviderError` keeps the same rule for the HTTP half.
+ * secret is that it has one. `ProviderError` keeps the same rule for the HTTP half — it quotes the
+ * provider's own explanation, with every credential and every value it was sent blanked out.
  */
 export declare class StepFailed extends Error {
     constructor(message: string);

package/dist/cloud-steps/context.js

@@ -9,7 +9,8 @@ import { fetchTemplate } from "../template-source.js";
  * A step refused to act, or a command it ran failed.
  *
  * Carries no provider body and no environment: the only thing a step is allowed to say about a
- * secret is that it has one. `ProviderError` keeps the same rule for the HTTP half.
+ * secret is that it has one. `ProviderError` keeps the same rule for the HTTP half — it quotes the
+ * provider's own explanation, with every credential and every value it was sent blanked out.
  */
 export class StepFailed extends Error {
     constructor(message) {

package/dist/cloud-steps/coolify.d.ts

@@ -6,6 +6,16 @@ import { StepFailed, type CloudStepContext } from "./context.js";
 export declare const COOLIFY_ENVIRONMENT = "production";
 /** Where the build pack looks for the compose file, relative to the repository root. */
 export declare const COMPOSE_LOCATION = "/docker-compose.prod.yml";
+/**
+ * The compose service the app's domain is attached to — the one the template publishes 3000 from.
+ *
+ * A `dockercompose` application cannot take `domains` at all (Coolify 4.3.21: 422 `The domains
+ * field cannot be used for dockercompose applications`), and `docker_compose_domains` names a
+ * service, so one of them has to be named here. A template that renamed `web` would deploy an app
+ * Coolify's proxy routes nothing to, which is why this is a constant with a test behind it rather
+ * than a literal in the payload.
+ */
+export declare const COMPOSE_DOMAIN_SERVICE = "web";
 /** The compose file the drift assertion reads, under the app's directory. */
 export declare const PROD_COMPOSE_FILE = "docker-compose.prod.yml";
 /**

package/dist/cloud-steps/coolify.js

@@ -9,6 +9,16 @@ import { appFqdn, StepFailed } from "./context.js";
 export const COOLIFY_ENVIRONMENT = "production";
 /** Where the build pack looks for the compose file, relative to the repository root. */
 export const COMPOSE_LOCATION = "/docker-compose.prod.yml";
+/**
+ * The compose service the app's domain is attached to — the one the template publishes 3000 from.
+ *
+ * A `dockercompose` application cannot take `domains` at all (Coolify 4.3.21: 422 `The domains
+ * field cannot be used for dockercompose applications`), and `docker_compose_domains` names a
+ * service, so one of them has to be named here. A template that renamed `web` would deploy an app
+ * Coolify's proxy routes nothing to, which is why this is a constant with a test behind it rather
+ * than a literal in the payload.
+ */
+export const COMPOSE_DOMAIN_SERVICE = "web";
 /** The compose file the drift assertion reads, under the app's directory. */
 export const PROD_COMPOSE_FILE = "docker-compose.prod.yml";
 /**
@@ -255,7 +265,7 @@ async function findOrCreateApplication(context, coolify, projectUuid, environmen
         docker_compose_location: COMPOSE_LOCATION,
         connect_to_docker_network: true,
         name,
-        domains: `https://${fqdn}`,
+        docker_compose_domains: [{ name: COMPOSE_DOMAIN_SERVICE, domain: `https://${fqdn}` }],
         // The `deploy` step is what deploys, once the environment is set and the database migrated.
         instant_deploy: false,
     });

package/dist/doctor.d.ts

@@ -49,7 +49,7 @@ export interface DoctorOptions {
  * whole point of this command is one screen that says whether anything needs attention.
  *
  * Nothing here prints a secret. The read token authorizes the status request and never appears
- * in a finding; a provider's response body is dropped for the same reason (`ProviderError`).
+ * in a finding, and a provider's refusal reaches a finding redacted (`ProviderError`).
  */
 export declare function doctor(options?: DoctorOptions): Promise<DoctorResult>;
 /** The report as printed: a blank line and a header per app, then its findings. */

package/dist/doctor.js

@@ -20,7 +20,7 @@ export const CORE_BUMP_BRANCH_PREFIX = "core-bump/";
  * whole point of this command is one screen that says whether anything needs attention.
  *
  * Nothing here prints a secret. The read token authorizes the status request and never appears
- * in a finding; a provider's response body is dropped for the same reason (`ProviderError`).
+ * in a finding, and a provider's refusal reaches a finding redacted (`ProviderError`).
  */
 export async function doctor(options = {}) {
     const env = options.env ?? process.env;

package/dist/providers/cloudflare.js

@@ -7,6 +7,7 @@ export class CloudflareClient {
             provider: "cloudflare",
             baseUrl: options.url ?? CLOUDFLARE_API_URL,
             headers: { authorization: `Bearer ${options.token}` },
+            secrets: [options.token],
             fetch: options.fetch,
         });
     }

package/dist/providers/coolify.d.ts

@@ -29,14 +29,28 @@ export interface CoolifyApplicationRequest {
     build_pack: "nixpacks" | "railpack" | "static" | "dockerfile" | "dockercompose";
     name?: string;
     description?: string;
-    /** Comma-separated; the app's `https://<name>.<HF_BASE_DOMAIN>`. */
+    /**
+     * Comma-separated. Rejected outright for a `dockercompose` build pack — Coolify 4.3.21 answers
+     * 422 `The domains field cannot be used for dockercompose applications` — so
+     * `docker_compose_domains` is what `hf new` sends and this is for the other four packs.
+     */
     domains?: string;
+    /** One entry per compose service that gets a domain; `hf new` sends exactly one. */
+    docker_compose_domains?: readonly CoolifyComposeDomain[];
     ports_exposes?: string;
     docker_compose_location?: string;
     connect_to_docker_network?: boolean;
     instant_deploy?: boolean;
     is_auto_deploy_enabled?: boolean;
 }
+/** A domain on one service of a compose application, which is how a `dockercompose` app gets one. */
+export interface CoolifyComposeDomain {
+    /** The service name as `docker-compose.prod.yml` spells it. */
+    name: string;
+    /** Comma-separated, same as `domains`. */
+    domain: string;
+    redirect?: "www" | "non-www" | "both";
+}
 export interface CoolifyApplication {
     uuid: string;
 }

package/dist/providers/coolify.js

@@ -6,6 +6,7 @@ export class CoolifyClient {
             provider: "coolify",
             baseUrl: `${options.url.replace(/\/+$/, "")}/api/v1`,
             headers: { authorization: `Bearer ${options.token}` },
+            secrets: [options.token],
             fetch: options.fetch,
         });
     }
@@ -42,6 +43,9 @@ export class CoolifyClient {
             method: "PATCH",
             path: `/applications/${segment(appUuid)}/envs/bulk`,
             body: { data },
+            // The app's whole environment goes out in this one call, and a 422 names the variables it
+            // rejected by quoting them.
+            secrets: data.map((variable) => variable.value),
         });
     }
     async deploy(uuid, options = {}) {

package/dist/providers/github.js

@@ -11,6 +11,7 @@ export class GithubClient {
                 accept: "application/vnd.github+json",
                 "x-github-api-version": "2022-11-28",
             },
+            secrets: [options.token],
             fetch: options.fetch,
         });
     }

package/dist/providers/http.d.ts

@@ -7,15 +7,23 @@ export interface ProviderRequest {
     path: string;
     query?: Record<string, string | number | boolean | undefined>;
     body?: unknown;
+    /**
+     * Values this request carries that a provider may echo back at it — the app's environment, in
+     * the one call that sends it. Blanked out of the error message; see `explain`.
+     */
+    secrets?: readonly string[];
 }
+/** How much of a rejected request's explanation reaches the message before it is cut. */
+export declare const EXPLANATION_LIMIT = 500;
 /**
  * A provider answered with a status outside 2xx.
  *
- * The response body is on `body` and deliberately **not** in `message`: a Coolify 422 echoes
- * the fields it rejected, and those fields are the app's whole environment — its database URL,
- * its status tokens, its Langfuse secret key. `hf` prints `error.message`, so a body that
- * quotes a secret would land in a terminal and a scrollback. Nor is the query string included,
- * for the same reason.
+ * `message` carries the response's own `message` and `errors` and nothing else of it: those two are
+ * where every provider here puts the reason, and the rest of a body is free to quote what was sent.
+ * What reaches the message is redacted first — every credential the client was built with, every
+ * value the request declared, and anything shaped like a password — because `hf` prints
+ * `error.message` and a terminal keeps a scrollback. The raw body is on `body` for a caller that
+ * wants it; the request's own headers and query string are in neither.
  */
 export declare class ProviderError extends Error {
     readonly provider: string;
@@ -23,7 +31,7 @@ export declare class ProviderError extends Error {
     readonly method: HttpMethod;
     readonly path: string;
     readonly body: string;
-    constructor(provider: string, request: ProviderRequest, status: number, body: string);
+    constructor(provider: string, request: ProviderRequest, status: number, body: string, explanation?: string);
 }
 export interface TransportOptions {
     /** Names the provider in errors. */
@@ -32,8 +40,17 @@ export interface TransportOptions {
     baseUrl: string;
     /** Sent on every request — the authorization header, and whatever else the API insists on. */
     headers: Record<string, string>;
+    /** The credentials this client was built with; blanked out of every error message. */
+    secrets?: readonly string[];
     fetch?: FetchLike;
 }
+/**
+ * Why the provider refused, out of its `message` and `errors` and redacted.
+ *
+ * `undefined` when the body is not JSON or carries neither key: a provider that explained nothing
+ * leaves the status to speak, rather than a page of HTML in a terminal.
+ */
+export declare function explain(body: string, secrets: readonly string[]): string | undefined;
 export type Transport = <Result>(request: ProviderRequest) => Promise<Result>;
 /** Builds the `request` function the clients in this directory are written against. */
 export declare function createTransport(options: TransportOptions): Transport;

package/dist/providers/http.js

@@ -1,11 +1,15 @@
+import { redactPasswords } from "../database.js";
+/** How much of a rejected request's explanation reaches the message before it is cut. */
+export const EXPLANATION_LIMIT = 500;
 /**
  * A provider answered with a status outside 2xx.
  *
- * The response body is on `body` and deliberately **not** in `message`: a Coolify 422 echoes
- * the fields it rejected, and those fields are the app's whole environment — its database URL,
- * its status tokens, its Langfuse secret key. `hf` prints `error.message`, so a body that
- * quotes a secret would land in a terminal and a scrollback. Nor is the query string included,
- * for the same reason.
+ * `message` carries the response's own `message` and `errors` and nothing else of it: those two are
+ * where every provider here puts the reason, and the rest of a body is free to quote what was sent.
+ * What reaches the message is redacted first — every credential the client was built with, every
+ * value the request declared, and anything shaped like a password — because `hf` prints
+ * `error.message` and a terminal keeps a scrollback. The raw body is on `body` for a caller that
+ * wants it; the request's own headers and query string are in neither.
  */
 export class ProviderError extends Error {
     provider;
@@ -13,8 +17,9 @@ export class ProviderError extends Error {
     method;
     path;
     body;
-    constructor(provider, request, status, body) {
-        super(`${provider} ${request.method} ${request.path} failed: HTTP ${status}`);
+    constructor(provider, request, status, body, explanation) {
+        super(`${provider} ${request.method} ${request.path} failed: HTTP ${status}` +
+            (explanation === undefined ? "" : `: ${explanation}`));
         this.name = "ProviderError";
         this.provider = provider;
         this.status = status;
@@ -23,6 +28,38 @@ export class ProviderError extends Error {
         this.body = body;
     }
 }
+/**
+ * Why the provider refused, out of its `message` and `errors` and redacted.
+ *
+ * `undefined` when the body is not JSON or carries neither key: a provider that explained nothing
+ * leaves the status to speak, rather than a page of HTML in a terminal.
+ */
+export function explain(body, secrets) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return undefined;
+    const { message, errors } = parsed;
+    if (message === undefined && errors === undefined)
+        return undefined;
+    let text = JSON.stringify({
+        ...(message === undefined ? {} : { message }),
+        ...(errors === undefined ? {} : { errors }),
+    });
+    for (const secret of secrets) {
+        // Short values are skipped: a two-character secret would blank half the explanation with it.
+        if (secret.length < 4)
+            continue;
+        text = text.split(JSON.stringify(secret).slice(1, -1)).join("***");
+    }
+    text = redactPasswords(text);
+    return text.length > EXPLANATION_LIMIT ? `${text.slice(0, EXPLANATION_LIMIT)}…` : text;
+}
 /** Builds the `request` function the clients in this directory are written against. */
 export function createTransport(options) {
     // Looked up per request, not captured: a test's mock server replaces `globalThis.fetch` after
@@ -45,7 +82,8 @@ export function createTransport(options) {
         });
         const text = await response.text();
         if (!response.ok) {
-            throw new ProviderError(options.provider, request, response.status, text);
+            const secrets = [...(options.secrets ?? []), ...(request.secrets ?? [])];
+            throw new ProviderError(options.provider, request, response.status, text, explain(text, secrets));
         }
         return (text === "" ? undefined : JSON.parse(text));
     };

package/dist/providers/langfuse.js

@@ -8,6 +8,8 @@ export class LangfuseClient {
             headers: {
                 authorization: `Basic ${Buffer.from(options.orgKey, "utf8").toString("base64")}`,
             },
+            // Both halves of the pair: an error message must not quote either one back.
+            secrets: options.orgKey.split(":"),
             fetch: options.fetch,
         });
     }

package/dist/providers/sentry.js

@@ -7,6 +7,7 @@ export class SentryClient {
             provider: "sentry",
             baseUrl: options.url ?? SENTRY_URL,
             headers: { authorization: `Bearer ${options.token}` },
+            secrets: [options.token],
             fetch: options.fetch,
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperfixation/cli",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "license": "MIT",
   "description": "The hf binary and its Turborepo generator templates",
   "repository": {
@@ -29,15 +29,15 @@
     "!dist/test-support/**"
   ],
   "dependencies": {
-    "@hyperfixation/auth": "0.1.2",
-    "@hyperfixation/core": "0.1.2",
-    "@hyperfixation/db": "0.1.2",
+    "@hyperfixation/auth": "0.1.3",
+    "@hyperfixation/core": "0.1.3",
+    "@hyperfixation/db": "0.1.3",
     "giget": "3.3.1",
     "pg": "^8.23.0"
   },
   "devDependencies": {
-    "@hyperfixation/eslint-config": "0.1.2",
-    "@hyperfixation/testing": "0.1.2",
+    "@hyperfixation/eslint-config": "0.1.3",
+    "@hyperfixation/testing": "0.1.3",
     "@microsoft/api-extractor": "^7.59.1",
     "@types/pg": "^8.23.1",
     "eslint": "^10.10.0",