@hyperfixation/cli 0.1.2 → 0.1.4

package/dist/cloud-steps/context.d.ts

@@ -7,7 +7,8 @@ import type { FetchLike } from "../providers/http.js";
  * A step refused to act, or a command it ran failed.
  *
  * Carries no provider body and no environment: the only thing a step is allowed to say about a
- * secret is that it has one. `ProviderError` keeps the same rule for the HTTP half.
+ * secret is that it has one. `ProviderError` keeps the same rule for the HTTP half — it quotes the
+ * provider's own explanation, with every credential and every value it was sent blanked out.
  */
 export declare class StepFailed extends Error {
     constructor(message: string);

package/dist/cloud-steps/context.js

@@ -9,7 +9,8 @@ import { fetchTemplate } from "../template-source.js";
  * A step refused to act, or a command it ran failed.
  *
  * Carries no provider body and no environment: the only thing a step is allowed to say about a
- * secret is that it has one. `ProviderError` keeps the same rule for the HTTP half.
+ * secret is that it has one. `ProviderError` keeps the same rule for the HTTP half — it quotes the
+ * provider's own explanation, with every credential and every value it was sent blanked out.
  */
 export class StepFailed extends Error {
     constructor(message) {

package/dist/cloud-steps/coolify.d.ts

@@ -6,6 +6,16 @@ import { StepFailed, type CloudStepContext } from "./context.js";
 export declare const COOLIFY_ENVIRONMENT = "production";
 /** Where the build pack looks for the compose file, relative to the repository root. */
 export declare const COMPOSE_LOCATION = "/docker-compose.prod.yml";
+/**
+ * The compose service the app's domain is attached to — the one the template publishes 3000 from.
+ *
+ * A `dockercompose` application cannot take `domains` at all (Coolify 4.3.21: 422 `The domains
+ * field cannot be used for dockercompose applications`), and `docker_compose_domains` names a
+ * service, so one of them has to be named here. A template that renamed `web` would deploy an app
+ * Coolify's proxy routes nothing to, which is why this is a constant with a test behind it rather
+ * than a literal in the payload.
+ */
+export declare const COMPOSE_DOMAIN_SERVICE = "web";
 /** The compose file the drift assertion reads, under the app's directory. */
 export declare const PROD_COMPOSE_FILE = "docker-compose.prod.yml";
 /**

package/dist/cloud-steps/coolify.js

@@ -9,6 +9,16 @@ import { appFqdn, StepFailed } from "./context.js";
 export const COOLIFY_ENVIRONMENT = "production";
 /** Where the build pack looks for the compose file, relative to the repository root. */
 export const COMPOSE_LOCATION = "/docker-compose.prod.yml";
+/**
+ * The compose service the app's domain is attached to — the one the template publishes 3000 from.
+ *
+ * A `dockercompose` application cannot take `domains` at all (Coolify 4.3.21: 422 `The domains
+ * field cannot be used for dockercompose applications`), and `docker_compose_domains` names a
+ * service, so one of them has to be named here. A template that renamed `web` would deploy an app
+ * Coolify's proxy routes nothing to, which is why this is a constant with a test behind it rather
+ * than a literal in the payload.
+ */
+export const COMPOSE_DOMAIN_SERVICE = "web";
 /** The compose file the drift assertion reads, under the app's directory. */
 export const PROD_COMPOSE_FILE = "docker-compose.prod.yml";
 /**
@@ -223,12 +233,11 @@ async function findOrCreateProject(context, coolify) {
 async function productionEnvironment(context, coolify, projectUuid) {
     const environments = await coolify.listEnvironments(projectUuid);
     const production = environments.find((environment) => environment.name === COOLIFY_ENVIRONMENT);
-    if (production === undefined) {
-        throw new StepFailed(`the Coolify project ${context.names.given} has no ${COOLIFY_ENVIRONMENT} environment ` +
-            `(it has ${environments.map((environment) => environment.name).join(", ") || "none"}), ` +
-            "and the API has no endpoint that creates one: add it in Coolify and re-run hf new");
-    }
-    return production.uuid;
+    if (production !== undefined)
+        return production.uuid;
+    const created = await coolify.createEnvironment(projectUuid, { name: COOLIFY_ENVIRONMENT });
+    context.io.out(`${context.names.given}: created the ${COOLIFY_ENVIRONMENT} environment in the Coolify project`);
+    return created.uuid;
 }
 async function findOrCreateApplication(context, coolify, projectUuid, environmentUuid) {
     const name = context.names.given;
@@ -255,7 +264,7 @@ async function findOrCreateApplication(context, coolify, projectUuid, environmen
         docker_compose_location: COMPOSE_LOCATION,
         connect_to_docker_network: true,
         name,
-        domains: `https://${fqdn}`,
+        docker_compose_domains: [{ name: COMPOSE_DOMAIN_SERVICE, domain: `https://${fqdn}` }],
         // The `deploy` step is what deploys, once the environment is set and the database migrated.
         instant_deploy: false,
     });

package/dist/cloud-steps/template.js

@@ -37,19 +37,33 @@ export const templateStep = {
         await substituteTree(fetched, names);
         // The marker is what `assertTemplateSource` looks for: an app is never a template twice.
         await rm(path.join(fetched, TEMPLATE_MARKER));
+        // Recorded before the rename, not after: a crash between the two must leave a directory this
+        // run's state vouches for, or the rerun would refuse the app it just made.
+        await context.state.patch({ templateStartedAt: new Date(context.now()).toISOString() });
         await rename(fetched, dir);
         context.io.out(`${names.given}: template fetched into ${dir}`);
     },
 };
 /**
- * A directory already at the target: this app on a run whose state was lost, or something else.
+ * A directory already at the target: this app on a run that crashed after the rename, or
+ * something else.
  *
- * "This app" means a substituted template — its `package.json` carries the underscored app name
- * and the marker is gone. Anything else is the local flow's rule, refused rather than written
- * into.
+ * Adopted only on a genuine resume — the state cache records that this app's template step began
+ * (`templateStartedAt`) or finished. With no such record the directory is not ours however much it
+ * looks like it: an earlier `hf new --local` leaves a substituted scaffold with the right
+ * `package.json` name, and adopting it once pushed a stale template to a new repo.
+ *
+ * On a resume, "this app" means a substituted template — its `package.json` carries the
+ * underscored app name and the marker is gone. Anything else is the local flow's rule, refused
+ * rather than written into.
  */
 async function adoptOrRefuse(context) {
-    const { dir, names } = context;
+    const { dir, names, state } = context;
+    const resuming = state.state.templateStartedAt !== undefined || state.isDone("template");
+    if (!resuming) {
+        throw new TemplateError(`${dir} already exists and hf has no record of creating it, so it will not adopt it on a ` +
+            `first run. Move it away (or delete it) and rerun; the template is fetched fresh.`);
+    }
     const substituted = !(await exists(path.join(dir, TEMPLATE_MARKER))) && (await packageName(dir)) === names.appName;
     if (!substituted) {
         throw new TemplateError(`${dir} already exists; hf new will not write into it`);

package/dist/doctor.d.ts

@@ -49,7 +49,7 @@ export interface DoctorOptions {
  * whole point of this command is one screen that says whether anything needs attention.
  *
  * Nothing here prints a secret. The read token authorizes the status request and never appears
- * in a finding; a provider's response body is dropped for the same reason (`ProviderError`).
+ * in a finding, and a provider's refusal reaches a finding redacted (`ProviderError`).
  */
 export declare function doctor(options?: DoctorOptions): Promise<DoctorResult>;
 /** The report as printed: a blank line and a header per app, then its findings. */

package/dist/doctor.js

@@ -20,7 +20,7 @@ export const CORE_BUMP_BRANCH_PREFIX = "core-bump/";
  * whole point of this command is one screen that says whether anything needs attention.
  *
  * Nothing here prints a secret. The read token authorizes the status request and never appears
- * in a finding; a provider's response body is dropped for the same reason (`ProviderError`).
+ * in a finding, and a provider's refusal reaches a finding redacted (`ProviderError`).
  */
 export async function doctor(options = {}) {
     const env = options.env ?? process.env;

package/dist/providers/cloudflare.js

@@ -7,6 +7,7 @@ export class CloudflareClient {
             provider: "cloudflare",
             baseUrl: options.url ?? CLOUDFLARE_API_URL,
             headers: { authorization: `Bearer ${options.token}` },
+            secrets: [options.token],
             fetch: options.fetch,
         });
     }

package/dist/providers/coolify.d.ts

@@ -29,14 +29,28 @@ export interface CoolifyApplicationRequest {
     build_pack: "nixpacks" | "railpack" | "static" | "dockerfile" | "dockercompose";
     name?: string;
     description?: string;
-    /** Comma-separated; the app's `https://<name>.<HF_BASE_DOMAIN>`. */
+    /**
+     * Comma-separated. Rejected outright for a `dockercompose` build pack — Coolify 4.3.21 answers
+     * 422 `The domains field cannot be used for dockercompose applications` — so
+     * `docker_compose_domains` is what `hf new` sends and this is for the other four packs.
+     */
     domains?: string;
+    /** One entry per compose service that gets a domain; `hf new` sends exactly one. */
+    docker_compose_domains?: readonly CoolifyComposeDomain[];
     ports_exposes?: string;
     docker_compose_location?: string;
     connect_to_docker_network?: boolean;
     instant_deploy?: boolean;
     is_auto_deploy_enabled?: boolean;
 }
+/** A domain on one service of a compose application, which is how a `dockercompose` app gets one. */
+export interface CoolifyComposeDomain {
+    /** The service name as `docker-compose.prod.yml` spells it. */
+    name: string;
+    /** Comma-separated, same as `domains`. */
+    domain: string;
+    redirect?: "www" | "non-www" | "both";
+}
 export interface CoolifyApplication {
     uuid: string;
 }
@@ -118,6 +132,11 @@ export declare class CoolifyClient {
     listProjects(): Promise<CoolifyProject[]>;
     getProject(uuid: string): Promise<CoolifyProject>;
     listEnvironments(projectUuid: string): Promise<CoolifyEnvironment[]>;
+    createEnvironment(projectUuid: string, body: {
+        name: string;
+    }): Promise<{
+        uuid: string;
+    }>;
     createPrivateGithubAppApplication(body: CoolifyApplicationRequest): Promise<CoolifyApplication>;
     /**
      * Every application, so a rerun can find the one it created last time by name.

package/dist/providers/coolify.js

@@ -6,6 +6,7 @@ export class CoolifyClient {
             provider: "coolify",
             baseUrl: `${options.url.replace(/\/+$/, "")}/api/v1`,
             headers: { authorization: `Bearer ${options.token}` },
+            secrets: [options.token],
             fetch: options.fetch,
         });
     }
@@ -25,6 +26,13 @@ export class CoolifyClient {
             path: `/projects/${segment(projectUuid)}/environments`,
         });
     }
+    async createEnvironment(projectUuid, body) {
+        return await this.request({
+            method: "POST",
+            path: `/projects/${segment(projectUuid)}/environments`,
+            body,
+        });
+    }
     async createPrivateGithubAppApplication(body) {
         return await this.request({ method: "POST", path: "/applications/private-github-app", body });
     }
@@ -42,6 +50,9 @@ export class CoolifyClient {
             method: "PATCH",
             path: `/applications/${segment(appUuid)}/envs/bulk`,
             body: { data },
+            // The app's whole environment goes out in this one call, and a 422 names the variables it
+            // rejected by quoting them.
+            secrets: data.map((variable) => variable.value),
         });
     }
     async deploy(uuid, options = {}) {

package/dist/providers/github.js

@@ -11,6 +11,7 @@ export class GithubClient {
                 accept: "application/vnd.github+json",
                 "x-github-api-version": "2022-11-28",
             },
+            secrets: [options.token],
             fetch: options.fetch,
         });
     }

package/dist/providers/http.d.ts

@@ -7,15 +7,23 @@ export interface ProviderRequest {
     path: string;
     query?: Record<string, string | number | boolean | undefined>;
     body?: unknown;
+    /**
+     * Values this request carries that a provider may echo back at it — the app's environment, in
+     * the one call that sends it. Blanked out of the error message; see `explain`.
+     */
+    secrets?: readonly string[];
 }
+/** How much of a rejected request's explanation reaches the message before it is cut. */
+export declare const EXPLANATION_LIMIT = 500;
 /**
  * A provider answered with a status outside 2xx.
  *
- * The response body is on `body` and deliberately **not** in `message`: a Coolify 422 echoes
- * the fields it rejected, and those fields are the app's whole environment — its database URL,
- * its status tokens, its Langfuse secret key. `hf` prints `error.message`, so a body that
- * quotes a secret would land in a terminal and a scrollback. Nor is the query string included,
- * for the same reason.
+ * `message` carries the response's own `message` and `errors` and nothing else of it: those two are
+ * where every provider here puts the reason, and the rest of a body is free to quote what was sent.
+ * What reaches the message is redacted first — every credential the client was built with, every
+ * value the request declared, and anything shaped like a password — because `hf` prints
+ * `error.message` and a terminal keeps a scrollback. The raw body is on `body` for a caller that
+ * wants it; the request's own headers and query string are in neither.
  */
 export declare class ProviderError extends Error {
     readonly provider: string;
@@ -23,7 +31,7 @@ export declare class ProviderError extends Error {
     readonly method: HttpMethod;
     readonly path: string;
     readonly body: string;
-    constructor(provider: string, request: ProviderRequest, status: number, body: string);
+    constructor(provider: string, request: ProviderRequest, status: number, body: string, explanation?: string);
 }
 export interface TransportOptions {
     /** Names the provider in errors. */
@@ -32,8 +40,17 @@ export interface TransportOptions {
     baseUrl: string;
     /** Sent on every request — the authorization header, and whatever else the API insists on. */
     headers: Record<string, string>;
+    /** The credentials this client was built with; blanked out of every error message. */
+    secrets?: readonly string[];
     fetch?: FetchLike;
 }
+/**
+ * Why the provider refused, out of its `message` and `errors` and redacted.
+ *
+ * `undefined` when the body is not JSON or carries neither key: a provider that explained nothing
+ * leaves the status to speak, rather than a page of HTML in a terminal.
+ */
+export declare function explain(body: string, secrets: readonly string[]): string | undefined;
 export type Transport = <Result>(request: ProviderRequest) => Promise<Result>;
 /** Builds the `request` function the clients in this directory are written against. */
 export declare function createTransport(options: TransportOptions): Transport;

package/dist/providers/http.js

@@ -1,11 +1,15 @@
+import { redactPasswords } from "../database.js";
+/** How much of a rejected request's explanation reaches the message before it is cut. */
+export const EXPLANATION_LIMIT = 500;
 /**
  * A provider answered with a status outside 2xx.
  *
- * The response body is on `body` and deliberately **not** in `message`: a Coolify 422 echoes
- * the fields it rejected, and those fields are the app's whole environment — its database URL,
- * its status tokens, its Langfuse secret key. `hf` prints `error.message`, so a body that
- * quotes a secret would land in a terminal and a scrollback. Nor is the query string included,
- * for the same reason.
+ * `message` carries the response's own `message` and `errors` and nothing else of it: those two are
+ * where every provider here puts the reason, and the rest of a body is free to quote what was sent.
+ * What reaches the message is redacted first — every credential the client was built with, every
+ * value the request declared, and anything shaped like a password — because `hf` prints
+ * `error.message` and a terminal keeps a scrollback. The raw body is on `body` for a caller that
+ * wants it; the request's own headers and query string are in neither.
  */
 export class ProviderError extends Error {
     provider;
@@ -13,8 +17,9 @@ export class ProviderError extends Error {
     method;
     path;
     body;
-    constructor(provider, request, status, body) {
-        super(`${provider} ${request.method} ${request.path} failed: HTTP ${status}`);
+    constructor(provider, request, status, body, explanation) {
+        super(`${provider} ${request.method} ${request.path} failed: HTTP ${status}` +
+            (explanation === undefined ? "" : `: ${explanation}`));
         this.name = "ProviderError";
         this.provider = provider;
         this.status = status;
@@ -23,6 +28,38 @@ export class ProviderError extends Error {
         this.body = body;
     }
 }
+/**
+ * Why the provider refused, out of its `message` and `errors` and redacted.
+ *
+ * `undefined` when the body is not JSON or carries neither key: a provider that explained nothing
+ * leaves the status to speak, rather than a page of HTML in a terminal.
+ */
+export function explain(body, secrets) {
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return undefined;
+    const { message, errors } = parsed;
+    if (message === undefined && errors === undefined)
+        return undefined;
+    let text = JSON.stringify({
+        ...(message === undefined ? {} : { message }),
+        ...(errors === undefined ? {} : { errors }),
+    });
+    for (const secret of secrets) {
+        // Short values are skipped: a two-character secret would blank half the explanation with it.
+        if (secret.length < 4)
+            continue;
+        text = text.split(JSON.stringify(secret).slice(1, -1)).join("***");
+    }
+    text = redactPasswords(text);
+    return text.length > EXPLANATION_LIMIT ? `${text.slice(0, EXPLANATION_LIMIT)}…` : text;
+}
 /** Builds the `request` function the clients in this directory are written against. */
 export function createTransport(options) {
     // Looked up per request, not captured: a test's mock server replaces `globalThis.fetch` after
@@ -45,7 +82,8 @@ export function createTransport(options) {
         });
         const text = await response.text();
         if (!response.ok) {
-            throw new ProviderError(options.provider, request, response.status, text);
+            const secrets = [...(options.secrets ?? []), ...(request.secrets ?? [])];
+            throw new ProviderError(options.provider, request, response.status, text, explain(text, secrets));
         }
         return (text === "" ? undefined : JSON.parse(text));
     };

package/dist/providers/langfuse.js

@@ -8,6 +8,8 @@ export class LangfuseClient {
             headers: {
                 authorization: `Basic ${Buffer.from(options.orgKey, "utf8").toString("base64")}`,
             },
+            // Both halves of the pair: an error message must not quote either one back.
+            secrets: options.orgKey.split(":"),
             fetch: options.fetch,
         });
     }

package/dist/providers/sentry.js

@@ -7,6 +7,7 @@ export class SentryClient {
             provider: "sentry",
             baseUrl: options.url ?? SENTRY_URL,
             headers: { authorization: `Bearer ${options.token}` },
+            secrets: [options.token],
             fetch: options.fetch,
         });
     }

package/dist/state.d.ts

@@ -50,6 +50,15 @@ export interface StatusTokenState {
  */
 export interface AppState {
     steps: Partial<Record<StepName, StepRecord>>;
+    /**
+     * ISO 8601, written just before the `template` step renames the substituted fetch into place.
+     *
+     * The proof that a directory at the app's path is this run's own: `steps.template` is only
+     * recorded after the rename, so a crash in between would otherwise leave a directory no state
+     * vouches for. Without it the step refuses to adopt a directory — a stale scaffold from an
+     * earlier `hf new --local` looks exactly like a lost run.
+     */
+    templateStartedAt?: string;
     /** `owner/name` of the app's GitHub repository. */
     repo?: string;
     coolify?: CoolifyState;

package/dist/state.js

@@ -149,6 +149,7 @@ function parseAppState(contents, file) {
                 state.steps = parseSteps(value, file);
                 break;
             case "repo":
+            case "templateStartedAt":
             case "sentryDsn":
             case "betterAuthSecret":
             case "lastRestoreCheckAt":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hyperfixation/cli",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "license": "MIT",
   "description": "The hf binary and its Turborepo generator templates",
   "repository": {
@@ -29,15 +29,15 @@
     "!dist/test-support/**"
   ],
   "dependencies": {
-    "@hyperfixation/auth": "0.1.2",
-    "@hyperfixation/core": "0.1.2",
-    "@hyperfixation/db": "0.1.2",
+    "@hyperfixation/auth": "0.1.4",
+    "@hyperfixation/core": "0.1.4",
+    "@hyperfixation/db": "0.1.4",
     "giget": "3.3.1",
     "pg": "^8.23.0"
   },
   "devDependencies": {
-    "@hyperfixation/eslint-config": "0.1.2",
-    "@hyperfixation/testing": "0.1.2",
+    "@hyperfixation/eslint-config": "0.1.4",
+    "@hyperfixation/testing": "0.1.4",
     "@microsoft/api-extractor": "^7.59.1",
     "@types/pg": "^8.23.1",
     "eslint": "^10.10.0",