@heroku/heroku-fetch 0.1.6 → 0.2.0

package/README.md

@@ -27,7 +27,7 @@ npm install @heroku/heroku-fetch
 import { HerokuApiClient } from '@heroku/heroku-fetch';
 
 // Create a client for the Platform API
-// Automatically uses token from HEROKU_API_KEY env var or ~/.netrc
+// Automatically uses token from the HEROKU_API_KEY env var
 const client = new HerokuApiClient({
   service: 'platform',
 });
@@ -78,29 +78,36 @@ const customClient = new HerokuApiClient({
 
 ## Authentication
 
-### Automatic Token from Environment or Netrc (Default)
+### Automatic Token from Environment (Default)
 
-By default, the client automatically fetches tokens from `HEROKU_API_KEY` environment variable or `~/.netrc` file. **No manual token management required!**
+By default, the client reads the token from the `HEROKU_API_KEY` environment variable:
 
 ```typescript
 import { HerokuApiClient } from '@heroku/heroku-fetch';
 
-// Token automatically loaded from HEROKU_API_KEY or ~/.netrc
+// Token automatically loaded from HEROKU_API_KEY
 const client = new HerokuApiClient({
   service: 'platform',
 });
 ```
 
-The token priority is:
-1. `HEROKU_API_KEY` environment variable
-2. `~/.netrc` file (api.heroku.com machine)
-
-If you need to manually retrieve the token for other purposes, you can use `getAuthToken()`:
+heroku-fetch does not read stored CLI credentials. To authenticate with
+credentials saved by the Heroku CLI (native credential store or `~/.netrc`),
+resolve a token with [`@heroku/heroku-credential-manager`](https://github.com/heroku/heroku-credential-manager)
+and pass it to the client:
 
 ```typescript
-import { getAuthToken } from '@heroku/heroku-fetch';
+import { HerokuApiClient } from '@heroku/heroku-fetch';
+import { getAuth } from '@heroku/heroku-credential-manager';
 
-const token = getAuthToken(); // Returns string | undefined
+// Pass the account to read the native credential store (Keychain, libsecret,
+// Windows Credential Manager). Passing `undefined` reads `~/.netrc` by host
+// only — it will not find credentials stored solely in the native store.
+const { token } = await getAuth('your-account@example.com', 'api.heroku.com');
+const client = new HerokuApiClient({
+  service: 'platform',
+  token,
+});
 ```
 
 ### Static Bearer Token
@@ -117,15 +124,6 @@ const client = new HerokuApiClient({
 Use a function to dynamically retrieve or refresh tokens:
 
 ```typescript
-import { getAuthTokenProvider } from '@heroku/heroku-fetch';
-
-// Option 1: Use the built-in provider for dynamic token fetching
-const client = new HerokuApiClient({
-  service: 'platform',
-  token: getAuthTokenProvider(), // Returns a function that fetches token each time
-});
-
-// Option 2: Provide your own custom token function
 const client = new HerokuApiClient({
   service: 'platform',
   token: async () => {
@@ -487,7 +485,7 @@ import { HerokuApiClient } from '@heroku/heroku-fetch';
 
 export default class AppsList extends Command {
   async run() {
-    // Client automatically uses token from env or netrc
+    // Client automatically uses token from the HEROKU_API_KEY env var
     const client = new HerokuApiClient({
       service: 'platform',
     });

package/dist/browser.d.ts

@@ -2,8 +2,7 @@
  * Browser-specific entry point for @heroku/heroku-fetch
  *
  * This entry point excludes Node.js-specific features like:
- * - CLI utilities (login, 2FA prompts)
- * - File system access (netrc)
+ * - CLI utilities (2FA prompts)
  * - Process environment variables
  *
  * Use this entry point when bundling for browser environments.

package/dist/browser.js

@@ -2,8 +2,7 @@
  * Browser-specific entry point for @heroku/heroku-fetch
  *
  * This entry point excludes Node.js-specific features like:
- * - CLI utilities (login, 2FA prompts)
- * - File system access (netrc)
+ * - CLI utilities (2FA prompts)
  * - Process environment variables
  *
  * Use this entry point when bundling for browser environments.

package/dist/client/http-error-handler.js

@@ -5,6 +5,7 @@
  */
 import { debugError } from '../debug-loggers.js';
 import { AuthenticationError, HerokuApiError, NotFoundError, RateLimitError, TwoFactorRequiredError, } from '../errors.js';
+import { logScrubbed } from '../redact.js';
 /**
  * Parse and handle an error response from the API
  * Throws appropriate typed error based on status code
@@ -20,7 +21,7 @@ export async function handleErrorResponse(response) {
     catch {
         // Failed to parse error body, continue without it
     }
-    debugError('Error response: %d %O', response.status, errorBody);
+    await logScrubbed(debugError, 'Error response: %d %O', response.status, errorBody);
     // Check for 2FA error (can be 403 or 412)
     if (response.status === 412
         || (response.status === 403 && errorBody?.id === 'two_factor')) {

package/dist/client/http-request-hooks.js

@@ -5,32 +5,9 @@
  * used by the ky HTTP client.
  */
 import { debugAuth, debugRequest, debugResponse } from '../debug-loggers.js';
+import { logScrubbed } from '../redact.js';
 import { handleErrorResponse } from './http-error-handler.js';
 import { handle2FAChallenge, is2FAError } from './two-factor-authentication-handler.js';
-/**
- * Headers whose values must never appear in debug output. Compared
- * case-insensitively. Mirrors the redaction in http-call so tokens
- * aren't leaked when `debug` is enabled.
- */
-const SENSITIVE_HEADERS = new Set([
-    'authorization',
-    'cookie',
-    'heroku-two-factor-code',
-    'proxy-authorization',
-    'x-addon-sso',
-]);
-/**
- * Build a plain object of a request's headers with sensitive values
- * replaced by `[REDACTED]`, safe for debug logging.
- */
-function redactHeaders(headers) {
-    const result = {};
-    // eslint-disable-next-line unicorn/no-array-for-each
-    headers.forEach((value, key) => {
-        result[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? '[REDACTED]' : value;
-    });
-    return result;
-}
 /**
  * Create a beforeRequest hook that adds authentication and custom headers
  */
@@ -65,7 +42,7 @@ export function createBeforeRequestHook(getToken, defaultAccept, customHeaders,
         }
         debugRequest('%s %s', request.method, request.url);
         if (debug) {
-            debugRequest('Headers: %O', redactHeaders(request.headers));
+            await logScrubbed(debugRequest, 'Headers: %O', request.headers);
         }
     };
 }

package/dist/client/node-environment-defaults.d.ts

@@ -1,10 +1,18 @@
 /**
  * Default providers for Node.js environments
- * These use file system (netrc) and CLI utilities
  */
 import type { TokenProvider, TwoFactorOptions } from '../types.js';
 /**
- * Get default token provider for Node.js (uses netrc/env vars)
+ * Get default token provider for Node.js (reads the HEROKU_API_KEY env var)
+ *
+ * heroku-fetch does not read stored credentials. To authenticate with
+ * credentials saved by the Heroku CLI, resolve a token with the
+ * heroku-credential-manager package and pass it to the client explicitly.
+ *
+ * When HEROKU_API_KEY is unset this returns `undefined`, so the request is sent
+ * with no `Authorization` header rather than failing eagerly — endpoints that
+ * need no auth still work, and endpoints that do get a server 401 surfaced as
+ * `AuthenticationError`.
  */
 export declare function getDefaultTokenProvider(): TokenProvider;
 /**

package/dist/client/node-environment-defaults.js

@@ -1,20 +1,22 @@
 /**
  * Default providers for Node.js environments
- * These use file system (netrc) and CLI utilities
  */
 import { debugRequest } from '../debug-loggers.js';
+import { logScrubbed } from '../redact.js';
 /**
- * Get default token provider for Node.js (uses netrc/env vars)
+ * Get default token provider for Node.js (reads the HEROKU_API_KEY env var)
+ *
+ * heroku-fetch does not read stored credentials. To authenticate with
+ * credentials saved by the Heroku CLI, resolve a token with the
+ * heroku-credential-manager package and pass it to the client explicitly.
+ *
+ * When HEROKU_API_KEY is unset this returns `undefined`, so the request is sent
+ * with no `Authorization` header rather than failing eagerly — endpoints that
+ * need no auth still work, and endpoints that do get a server 401 surfaced as
+ * `AuthenticationError`.
  */
 export function getDefaultTokenProvider() {
-    return async () => {
-        const { getAuthToken } = await import('../auth/auth.js');
-        const token = getAuthToken();
-        if (!token) {
-            throw new Error('No authentication token found. Please set HEROKU_API_KEY or run: heroku login');
-        }
-        return token;
-    };
+    return () => process.env.HEROKU_API_KEY;
 }
 /**
  * Get default 2FA handler for Node.js (uses CLI prompts)
@@ -56,7 +58,7 @@ export async function getDefaultDispatcher() {
         return new EnvHttpProxyAgent();
     }
     catch (error) {
-        debugRequest('undici not available; skipping dispatcher (%o)', error);
+        await logScrubbed(debugRequest, 'undici not available; skipping dispatcher (%o)', error);
         return undefined;
     }
 }

package/dist/client/two-factor-authentication-handler.js

@@ -5,6 +5,7 @@
  */
 import ky from 'ky';
 import { debugAuth, debugError } from '../debug-loggers.js';
+import { logScrubbed } from '../redact.js';
 /**
  * Check if a 403 response is a 2FA error by checking the error id
  */
@@ -47,7 +48,7 @@ export async function handle2FAChallenge(request, twoFactorOptions, twoFactorAtt
     }
     catch (error) {
         twoFactorAttemptedRef.value = false;
-        debugError('2FA retry failed: %O', error);
+        await logScrubbed(debugError, '2FA retry failed: %O', error);
         throw error;
     }
 }

package/dist/debug-loggers.d.ts

@@ -3,4 +3,3 @@ export declare const debugRequest: debug.Debugger;
 export declare const debugResponse: debug.Debugger;
 export declare const debugAuth: debug.Debugger;
 export declare const debugError: debug.Debugger;
-export declare const debugCliLogin: debug.Debugger;

package/dist/debug-loggers.js

@@ -3,4 +3,3 @@ export const debugRequest = debug('heroku:fetch:request');
 export const debugResponse = debug('heroku:fetch:response');
 export const debugAuth = debug('heroku:fetch:auth');
 export const debugError = debug('heroku:fetch:error');
-export const debugCliLogin = debug('heroku:fetch:cli:login');

package/dist/host.d.ts

@@ -0,0 +1,33 @@
+/**
+ * API host/URL utilities for the Heroku API — resolve the API host and base
+ * URL from `HEROKU_HOST`, falling back to the public defaults.
+ *
+ * Note: heroku-fetch does not read stored credentials. Credential storage and
+ * retrieval (netrc, native credential stores) lives in the
+ * `@heroku/heroku-credential-manager` package; supply a token to the client
+ * explicitly.
+ */
+/**
+ * Get the API host from environment or default
+ *
+ * @returns The API host (default: 'api.heroku.com')
+ *
+ * @example
+ * ```typescript
+ * const host = getApiHost();
+ * // Returns 'api.heroku.com' or value of HEROKU_HOST env var
+ * ```
+ */
+export declare function getApiHost(): string;
+/**
+ * Get the full API URL from environment or default
+ *
+ * @returns The API URL (default: 'https://api.heroku.com')
+ *
+ * @example
+ * ```typescript
+ * const url = getApiUrl();
+ * // Returns 'https://api.heroku.com' or https://{HEROKU_HOST}
+ * ```
+ */
+export declare function getApiUrl(): string;

package/dist/host.js

@@ -0,0 +1,38 @@
+/**
+ * API host/URL utilities for the Heroku API — resolve the API host and base
+ * URL from `HEROKU_HOST`, falling back to the public defaults.
+ *
+ * Note: heroku-fetch does not read stored credentials. Credential storage and
+ * retrieval (netrc, native credential stores) lives in the
+ * `@heroku/heroku-credential-manager` package; supply a token to the client
+ * explicitly.
+ */
+/**
+ * Get the API host from environment or default
+ *
+ * @returns The API host (default: 'api.heroku.com')
+ *
+ * @example
+ * ```typescript
+ * const host = getApiHost();
+ * // Returns 'api.heroku.com' or value of HEROKU_HOST env var
+ * ```
+ */
+export function getApiHost() {
+    return process.env.HEROKU_HOST || 'api.heroku.com';
+}
+/**
+ * Get the full API URL from environment or default
+ *
+ * @returns The API URL (default: 'https://api.heroku.com')
+ *
+ * @example
+ * ```typescript
+ * const url = getApiUrl();
+ * // Returns 'https://api.heroku.com' or https://{HEROKU_HOST}
+ * ```
+ */
+export function getApiUrl() {
+    const host = getApiHost();
+    return `https://${host}`;
+}

package/dist/index.d.ts

@@ -1,6 +1,5 @@
-export { getApiHost, getApiUrl, getAuthToken, getAuthTokenProvider, } from './auth/auth.js';
-export { Login } from './cli/cli-login.js';
 export { cliTwoFactorPrompt, createCliTwoFactorPrompt, } from './cli/cli-two-factor-prompt.js';
 export { HerokuApiClient } from './client/index.js';
 export { AuthenticationError, HerokuApiError, NotFoundError, RateLimitError, TwoFactorRequiredError, } from './errors.js';
+export { getApiHost, getApiUrl, } from './host.js';
 export type { HerokuApiClientOptions, HerokuError, HerokuErrorResponse, HerokuService, RequestOptions, ServiceConfig, TokenProvider, TwoFactorOptions, } from './types.js';

package/dist/index.js

@@ -1,5 +1,4 @@
-export { getApiHost, getApiUrl, getAuthToken, getAuthTokenProvider, } from './auth/auth.js';
-export { Login } from './cli/cli-login.js';
 export { cliTwoFactorPrompt, createCliTwoFactorPrompt, } from './cli/cli-two-factor-prompt.js';
 export { HerokuApiClient } from './client/index.js';
 export { AuthenticationError, HerokuApiError, NotFoundError, RateLimitError, TwoFactorRequiredError, } from './errors.js';
+export { getApiHost, getApiUrl, } from './host.js';

package/dist/redact.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Lazy, fail-closed secret scrubbing for DEBUG-gated log output.
+ *
+ * Wraps `@heroku/js-blanket`, loaded via dynamic `import()` the first time a
+ * debug namespace is enabled so it stays off the default code path.
+ */
+/**
+ * Scrub a value for debug logging. Handles `Error`, `Headers`, plain objects,
+ * and primitives (passed through unchanged — a top-level string is not
+ * pattern-scrubbed; `VALUE_PATTERNS` only apply to strings nested inside a
+ * scrubbed object/Error). Fail-closed: any failure returns `'[unscrubbable]'`
+ * rather than risking the raw value. `depth` is internal, for `cause`
+ * recursion.
+ */
+export declare function scrubForLog(value: unknown, depth?: number): Promise<unknown>;
+/** A `debug` logger: a format call plus an `enabled` flag for its namespace. */
+export interface DebugLike {
+    (formatter: string, ...args: unknown[]): void;
+    readonly enabled: boolean;
+}
+/**
+ * Scrub each `value` and emit it through `logger` under `formatter`. No-ops
+ * when the namespace is disabled. Use this instead of passing raw objects to a
+ * `debug` logger with `%O`/`%o` (enforced by lint).
+ */
+export declare function logScrubbed(logger: DebugLike, formatter: string, ...values: unknown[]): Promise<void>;

package/dist/redact.js

@@ -0,0 +1,158 @@
+/**
+ * Lazy, fail-closed secret scrubbing for DEBUG-gated log output.
+ *
+ * Wraps `@heroku/js-blanket`, loaded via dynamic `import()` the first time a
+ * debug namespace is enabled so it stays off the default code path.
+ */
+/** Replacement token for redacted values. */
+const REPLACEMENT = '[REDACTED]';
+/**
+ * Extra sensitive keys the preset doesn't cover, matched case-insensitively as
+ * substrings. `code` is deliberately excluded so it doesn't also redact
+ * `statusCode`/`errorCode` in logged error objects.
+ */
+const EXTRA_FIELDS = [
+    'secondfactor',
+    'second_factor',
+    'otp',
+    'sso',
+];
+/**
+ * Redact inline `Bearer`/`Basic` credentials in string leaf values reached
+ * while scrubbing an object or Error (e.g. an error message). Bare UUIDs/JWTs
+ * are intentionally not matched — they're indistinguishable from benign
+ * resource IDs. Note these patterns don't apply to a top-level string passed
+ * straight to `scrubForLog`.
+ */
+const VALUE_PATTERNS = [
+    /\b(?:Bearer|Basic)\s+[\w.~+/=-]+/gi,
+];
+/** Cap on `error.cause` recursion depth; guards against cyclic chains. */
+const MAX_CAUSE_DEPTH = 8;
+let scrubberPromise;
+/** Build the shared Scrubber once, importing js-blanket lazily. */
+async function getScrubber() {
+    if (!scrubberPromise) {
+        scrubberPromise = (async () => {
+            const [{ Scrubber }, { HEROKU_FIELDS }] = await Promise.all([
+                import('@heroku/js-blanket/core/scrubber'),
+                import('@heroku/js-blanket/core/presets'),
+            ]);
+            return new Scrubber({
+                fields: [...HEROKU_FIELDS, ...EXTRA_FIELDS],
+                patterns: [...VALUE_PATTERNS],
+                replacement: REPLACEMENT,
+            });
+        })();
+        // Don't cache a rejected import: clear it so a later call retries rather
+        // than degrading all object logging to '[unscrubbable]' for the process.
+        scrubberPromise.catch(() => {
+            scrubberPromise = undefined;
+        });
+    }
+    return scrubberPromise;
+}
+/**
+ * Convert a `Headers` instance to a plain object. Scrubbing one directly yields
+ * `{}` (no enumerable own-properties); converting first preserves the entries.
+ */
+function headersToObject(headers) {
+    const out = {};
+    // eslint-disable-next-line unicorn/no-array-for-each
+    headers.forEach((value, key) => {
+        out[key] = value;
+    });
+    return out;
+}
+/**
+ * Clear credentials embedded in a URL (userinfo and sensitive query values),
+ * keeping host/path. Returns the input unchanged if it isn't a parseable URL.
+ */
+function redactUrl(url) {
+    if (typeof url !== 'string')
+        return url;
+    try {
+        const u = new URL(url);
+        if (u.username)
+            u.username = REPLACEMENT;
+        if (u.password)
+            u.password = REPLACEMENT;
+        for (const key of u.searchParams.keys()) {
+            if (/token|secret|code|sso|key|password|auth|assertion|saml|signature|nonce|otp|credential/i.test(key)) {
+                u.searchParams.set(key, REPLACEMENT);
+            }
+        }
+        return u.toString();
+    }
+    catch {
+        return url;
+    }
+}
+/**
+ * Normalize an `Error` into a plain, scrubbable object. An Error's own
+ * `name`/`message`/`stack`/`cause` are non-enumerable and would otherwise be
+ * dropped. Nested `Request`/`Response` are summarized rather than passed
+ * through: they serialize to `{}` and a `Request` can carry live auth headers.
+ */
+async function scrubError(error, depth) {
+    const scrubber = await getScrubber();
+    // Index signature makes the extra own-properties `unknown` without flattening
+    // the known `message`/`name`/`stack` off `Error` (string wins over unknown).
+    const err = error;
+    const { cause, message, name, request, response, stack, ...rest } = err;
+    const normalized = {
+        message, name, stack, ...rest,
+    };
+    if (response && typeof response === 'object') {
+        const r = response;
+        normalized.response = { status: r.status, statusText: r.statusText, url: redactUrl(r.url) };
+    }
+    if (request && typeof request === 'object') {
+        const r = request;
+        normalized.request = { method: r.method, url: redactUrl(r.url) };
+    }
+    const scrubbed = scrubber.scrub(normalized).data;
+    if (cause !== undefined) {
+        scrubbed.cause = depth >= MAX_CAUSE_DEPTH
+            ? '[max cause depth exceeded]'
+            : await scrubForLog(cause, depth + 1);
+    }
+    return scrubbed;
+}
+/**
+ * Scrub a value for debug logging. Handles `Error`, `Headers`, plain objects,
+ * and primitives (passed through unchanged — a top-level string is not
+ * pattern-scrubbed; `VALUE_PATTERNS` only apply to strings nested inside a
+ * scrubbed object/Error). Fail-closed: any failure returns `'[unscrubbable]'`
+ * rather than risking the raw value. `depth` is internal, for `cause`
+ * recursion.
+ */
+export async function scrubForLog(value, depth = 0) {
+    try {
+        if (value instanceof Error)
+            return await scrubError(value, depth);
+        if (typeof Headers !== 'undefined' && value instanceof Headers) {
+            const scrubber = await getScrubber();
+            return scrubber.scrub(headersToObject(value)).data;
+        }
+        if (value !== null && typeof value === 'object') {
+            const scrubber = await getScrubber();
+            return scrubber.scrub(value).data;
+        }
+        return value;
+    }
+    catch {
+        return '[unscrubbable]';
+    }
+}
+/**
+ * Scrub each `value` and emit it through `logger` under `formatter`. No-ops
+ * when the namespace is disabled. Use this instead of passing raw objects to a
+ * `debug` logger with `%O`/`%o` (enforced by lint).
+ */
+export async function logScrubbed(logger, formatter, ...values) {
+    if (!logger.enabled)
+        return;
+    const scrubbed = await Promise.all(values.map(value => scrubForLog(value)));
+    logger(formatter, ...scrubbed);
+}

package/dist/types.d.ts

@@ -1,5 +1,12 @@
 export type HerokuService = 'custom' | 'data' | 'particleboard' | 'platform';
-export type TokenProvider = (() => Promise<string> | string) | string;
+/**
+ * A bearer token, or a function resolving one at request time. A provider may
+ * return `undefined` (sync or async) to send the request with no `Authorization`
+ * header — appropriate for endpoints or hosts that need no Heroku auth. Requests
+ * to endpoints that do require auth then receive a server 401, surfaced as
+ * `AuthenticationError`.
+ */
+export type TokenProvider = (() => Promise<string | undefined> | string | undefined) | string;
 export interface TwoFactorOptions {
     /** Callback function to prompt for 2FA code */
     onChallenge: () => Promise<string> | string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heroku/heroku-fetch",
-  "version": "0.1.6",
+  "version": "0.2.0",
   "description": "A JavaScript/TypeScript API client for Heroku APIs",
   "type": "module",
   "main": "dist/index.js",
@@ -50,14 +50,13 @@
   },
   "homepage": "https://github.com/heroku/heroku-fetch#readme",
   "dependencies": {
+    "@heroku/js-blanket": "^1.2.0",
     "debug": "^4.3.4",
     "ky": "^2.0.2",
     "undici": "^8.11.2"
   },
   "optionalDependencies": {
-    "@heroku/heroku-cli-util": "^10.8.0",
-    "netrc-parser": "^3.1.6",
-    "open": "^11.0.0"
+    "@heroku/heroku-cli-util": "^10.8.0"
   },
   "devDependencies": {
     "@heroku-cli/test-utils": "^1.0.1",

package/dist/auth/auth.d.ts

@@ -1,66 +0,0 @@
-/**
- * Authentication utilities for Heroku API
- * Handles token retrieval from environment variables and netrc file
- */
-/**
- * Get the Heroku API token from environment variable or netrc file
- *
- * Priority:
- * 1. HEROKU_API_KEY environment variable
- * 2. ~/.netrc file (uses api.heroku.com or HEROKU_HOST if set)
- *
- * @returns The API token or undefined if not found
- *
- * @example
- * ```typescript
- * import { getAuthToken, HerokuApiClient } from '@heroku/heroku-fetch';
- *
- * const token = getAuthToken();
- * const client = new HerokuApiClient({
- *   service: 'platform',
- *   token,
- * });
- * ```
- */
-export declare function getAuthToken(): string | undefined;
-/**
- * Get the API host from environment or default
- *
- * @returns The API host (default: 'api.heroku.com')
- *
- * @example
- * ```typescript
- * const host = getApiHost();
- * // Returns 'api.heroku.com' or value of HEROKU_HOST env var
- * ```
- */
-export declare function getApiHost(): string;
-/**
- * Get the full API URL from environment or default
- *
- * @returns The API URL (default: 'https://api.heroku.com')
- *
- * @example
- * ```typescript
- * const url = getApiUrl();
- * // Returns 'https://api.heroku.com' or https://{HEROKU_HOST}
- * ```
- */
-export declare function getApiUrl(): string;
-/**
- * Create a token provider function for use with HerokuApiClient
- * This is useful when you want the token to be fetched dynamically
- *
- * @returns A function that returns the current auth token
- *
- * @example
- * ```typescript
- * import { getAuthTokenProvider, HerokuApiClient } from '@heroku/heroku-fetch';
- *
- * const client = new HerokuApiClient({
- *   service: 'platform',
- *   token: getAuthTokenProvider(),
- * });
- * ```
- */
-export declare function getAuthTokenProvider(): () => string | undefined;