[eablack]

Summary

Thins @heroku-cli/command for the v14 major by handing shared auth to the published @heroku/heroku-credential-manager package and taking the login transport off @heroku/http-call. Four commits:

1. refactor! — Route credential handling through @heroku/heroku-credential-manager.

   • Delete the in-repo credential-manager-core and deprecated snapshots; the adapter/handlers/netrc-parser/login-state/storage-selector logic now lives in the published package (behavior parity verified byte-for-byte).
   • Repoint the credential-manager DI seam, api-client, login, and login-state-coordinator imports at the published package.
   • Add src/env-auth.ts (resolveEnvToken) as the Node adapter around the package's environment-agnostic resolveEnvAuth.
   • Relocate the Sentry credential-error reporter to src/credential-error-reporter.ts, wired once via setCredentialErrorReporter.
   • Drop the @deprecated credential re-exports from the package barrel.
   • Remove the credential-manager compatibility/handler/acceptance test trees, the package-contract test, and the rollback/packed-consumer verify scripts + their npm scripts and CI jobs.

2. chore — Drop dependencies and a test helper orphaned by the removal: runtime deps execa (git uses node:child_process), @heroku/types, tsheredoc; dev deps proxyquire/@types/proxyquire, fs-extra/@types/fs-extra, @types/supports-color; and test/helpers/unwrap.ts.

3. refactor — Run the login fetch transport on fetch instead of http-call. The credential-manager login module takes a FetchLike, owns its own poll retry, and sets redirect: 'error' + its AbortSignal on every request, so the http-call-backed adapter is replaced with a fetch-based adapter routed through heroku-fetch's getDefaultDispatcher() for HTTP(S)_PROXY/NO_PROXY. When a proxy dispatcher is present the request runs on the installed undici's own fetch; with no proxy configured it uses Node's built-in fetch directly. Custom CAs are honored via the standard NODE_EXTRA_CA_CERTS. Adds @heroku/heroku-fetch as a direct dependency.

4. fix — Address review findings, all specific to this repo:

   • Proxy dispatcher cross-undici mismatch. getDefaultDispatcher() builds an EnvHttpProxyAgent from the installed undici, which Node's built-in fetch (a different bundled undici copy) cannot drive — it throws invalid onRequestStart method. Proxied requests now run on the installed undici's own fetch, decomposing any global-constructor Request into (url, init) since the brand check is per-copy. Adds a direct undici dependency pinned to the range heroku-fetch uses so npm dedupes to a single copy. (Temporary bridge: once heroku-fetch exports a matched fetch+dispatcher pair, the direct undici dep and the decomposition helper can be dropped.)
   • Platform adapter hang. The operation-token adapter passed timeout: undefined, which Object.assign overwrote http-call's default 60s timeout with, letting a request hang indefinitely. Signal/timeout are now set only when the caller supplies them.
   • Sentry under-reporting. The credential-error reporter closed the client after flushing, leaving it registered-but-disabled so the getClient() guard mistook it for live and dropped every later credential error. It now flushes but keeps the client open. Also narrows the reporter import to the published CredentialErrorContext type.

Net: ~7,400 lines removed. api-client.ts and particleboard-client.ts (and the http-call types they still expose through HerokuAPIError and the login Platform adapter) are intentionally left for a later PR.

Type of Change

Breaking Changes (major semver update)

• Add a ! after your change type to denote a change that breaks current behavior

Feature Additions (minor semver update)

• feat: Introduces a new feature to the codebase

Patch Updates (patch semver update)

• fix: Bug fix
• deps: Dependency upgrade
• revert: Revert a previous commit
• chore: Change that does not affect production code
• refactor: Refactoring existing code without changing behavior
• test: Add/update/remove tests

Headline change is breaking (refactor!): the @deprecated credential-manager-core re-exports are removed from the package barrel. Consumers import credential APIs from @heroku/heroku-credential-manager.

Testing

Notes: Behavior parity for the credential APIs was verified byte-for-byte against the published package before deletion. The login transport swap preserves the login module's own poll retry; the two one-shot login POSTs no longer transport-retry on transient 5xx, and custom CAs move from http-call's SSL_CERT_FILE/SSL_CERT_DIR to the standard NODE_EXTRA_CA_CERTS. The proxy fix is covered by real-proxy regression tests (a proxied GET and a body-bearing Request driven through the installed undici).

Steps:

1. Passing CI suffices.
2. npm run build — clean; npm run lint — 0 errors; npm test — 279 passing.

Related Issues

GitHub issue: N/A
GUS work item: N/A (v14 cross-repo thinning; the heroku-fetch counterpart is tracked under W-24583381)

[michaelmalave]

Nice work moving credential storage into the shared package and thinning this one out. Most of the files looked clean against the team patterns. Two things stood out worth a look before merge: the Sentry client now stays open after the first credential error, so later unrelated crashes in the host process would be reported to the credential project too, and two of the login adapter tests would still pass if the behavior they guard broke. There is also one heads-up on custom CA handling, which splits login from the API client for anyone who sets SSL_CERT_FILE.

[michaelmalave]

LGTM! Claude found a few things + those are commented but nothing blocking.