heroku 11.0.0-alpha.11 → 11.0.0-alpha.13

package/lib/lib/data-scrubber/types.d.ts

@@ -0,0 +1,169 @@
+/**
+ * Configuration for the Scrubber
+ *
+ * Defines how the scrubber should identify and replace sensitive data.
+ * Supports three complementary scrubbing strategies:
+ *
+ * 1. **Field-based scrubbing** (`fields`): Matches field names at any depth in the object tree
+ * 2. **Path-based scrubbing** (`paths`): Matches specific dot-notation paths
+ * 3. **Pattern-based scrubbing** (`patterns`): Matches regex patterns in string content
+ *
+ * All three strategies can be used together for comprehensive data scrubbing.
+ *
+ * @example Field-based configuration
+ * ```typescript
+ * const config: ScrubConfig = {
+ *   fields: ['password', 'apiToken', /api[-_]?key/i], // Strings and regex patterns
+ *   replacement: '[REDACTED]'
+ * };
+ * ```
+ *
+ * @example Path-based configuration
+ * ```typescript
+ * const config: ScrubConfig = {
+ *   paths: [
+ *     'user.email',
+ *     'request.headers.authorization',
+ *     'items[0].password'  // Array index notation
+ *   ]
+ * };
+ * ```
+ *
+ * @example Pattern-based configuration
+ * ```typescript
+ * const config: ScrubConfig = {
+ *   patterns: [
+ *     /\b\d{3}-\d{2}-\d{4}\b/g,           // SSN
+ *     /\d{4}-\d{4}-\d{4}-\d{4}/g,        // Credit card
+ *     /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}/g  // Email
+ *   ]
+ * };
+ * ```
+ */
+export interface ScrubConfig {
+    /**
+     * Field-based scrubbing: matches field names at any depth
+     *
+     * Supports both exact string matches and regular expressions for flexible matching.
+     * String matches are case-insensitive and use substring matching.
+     *
+     * @example
+     * ```typescript
+     * fields: [
+     *   'password',           // Matches 'password', 'Password', 'old_password', etc.
+     *   'apiToken',           // Matches 'apiToken', 'api_token', etc.
+     *   /api[-_]?key/i,       // Regex: matches 'api_key', 'api-key', 'apikey' (case insensitive)
+     *   /^secret$/            // Exact match: only 'secret', not 'my_secret'
+     * ]
+     * ```
+     */
+    fields?: (string | RegExp)[];
+    /**
+     * Path-based scrubbing: matches specific dot-notation paths
+     *
+     * Use dot notation to target specific fields in nested objects.
+     * Supports array index notation (e.g., `items[0].password`).
+     *
+     * @example
+     * ```typescript
+     * paths: [
+     *   'user.email',                        // Scrubs obj.user.email
+     *   'request.headers.authorization',     // Nested path
+     *   'items[0].secret',                   // Array index notation
+     *   'users[0]'                           // Scrubs entire array element
+     * ]
+     * ```
+     */
+    paths?: string[];
+    /**
+     * Pattern-based scrubbing: regex patterns for content scrubbing
+     *
+     * Scans string values and replaces content matching the patterns.
+     * Use the global flag (`/pattern/g`) to replace all matches in a string.
+     *
+     * **Note**: Patterns are applied to string values only, not to field names or paths.
+     *
+     * @example
+     * ```typescript
+     * patterns: [
+     *   /\b\d{3}-\d{2}-\d{4}\b/g,      // Social Security Number
+     *   /\d{4}-\d{4}-\d{4}-\d{4}/g,    // Credit Card
+     *   /Bearer\s+[A-Za-z0-9._-]+/g    // Bearer tokens
+     * ]
+     * ```
+     */
+    patterns?: RegExp[];
+    /**
+     * Replacement string for scrubbed values
+     *
+     * @default '[SCRUBBED]'
+     *
+     * @example
+     * ```typescript
+     * replacement: '[REDACTED]'     // Custom replacement text
+     * replacement: '***'            // Simple masking
+     * replacement: ''               // Empty string (removes content)
+     * ```
+     */
+    replacement?: string;
+    /**
+     * Whether to recursively scrub nested objects
+     *
+     * When `true`, the scrubber traverses the entire object tree.
+     * When `false`, only top-level fields are scrubbed.
+     *
+     * @default true
+     *
+     * @example
+     * ```typescript
+     * recursive: false  // Only scrub top-level fields
+     * ```
+     */
+    recursive?: boolean;
+}
+/**
+ * Result of a scrub operation
+ *
+ * Contains the scrubbed data along with metadata about what was scrubbed.
+ *
+ * @template T - The type of the scrubbed data (same as input type)
+ *
+ * @example
+ * ```typescript
+ * const scrubber = new Scrubber({ fields: ['password'] });
+ * const result = scrubber.scrub({ user: 'john', password: 'secret' });
+ *
+ * console.log(result.data);           // { user: 'john', password: '[SCRUBBED]' }
+ * console.log(result.scrubbed);       // true
+ * console.log(result.scrubbedPaths);  // ['password']
+ * ```
+ */
+export interface ScrubResult<T> {
+    /**
+     * The scrubbed data with sensitive values replaced
+     *
+     * This is a deep clone of the input with scrubbed values replaced.
+     * The original input is never mutated.
+     */
+    data: T;
+    /**
+     * Whether any scrubbing occurred
+     *
+     * `true` if at least one value was scrubbed, `false` if no sensitive data was found.
+     *
+     * Useful for logging or metrics to track scrubbing activity.
+     */
+    scrubbed: boolean;
+    /**
+     * Array of paths that were scrubbed
+     *
+     * Contains dot-notation paths for all fields that were scrubbed.
+     * Useful for debugging, auditing, or understanding what data was redacted.
+     *
+     * @example
+     * ```typescript
+     * ['password', 'user.email', 'request.headers.authorization']
+     * ```
+     */
+    scrubbedPaths: string[];
+}

package/lib/lib/domains/domains.js

@@ -1,9 +1,8 @@
-import { parse } from 'psl';
+import { color, hux } from '@heroku/heroku-cli-util';
 import { ux } from '@oclif/core';
-import { hux } from '@heroku/heroku-cli-util';
-import { color } from '@heroku-cli/color';
+import { parse } from 'psl';
 const wait = function (ms) {
-    return new Promise(function (resolve) {
+    return new Promise(resolve => {
         setTimeout(resolve, ms);
     });
 };
@@ -43,24 +42,25 @@ export async function waitForDomains(heroku, app) {
 }
 export function printDomains(domains, message) {
     domains = domains.filter(domain => domain.kind === 'custom');
-    const domains_with_type = domains.map(domain => Object.assign({}, domain, { type: type(domain) }));
+    const domains_with_type = domains.map(domain => ({ ...domain, type: type(domain) }));
     if (domains_with_type.length === 0) {
-        hux.styledHeader(`${message}  Add a custom domain to your app by running ${color.cmd('heroku domains:add <yourdomain.com>')}`);
+        hux.styledHeader(`${message}  Add a custom domain to your app by running ${color.code('heroku domains:add <yourdomain.com>')}`);
     }
     else {
         hux.styledHeader(`${message}  Update your application's DNS settings as follows`);
         hux.table(domains_with_type, {
             domain: {
-                header: 'Domain',
                 get: ({ hostname }) => hostname,
+                header: 'Domain',
             },
             recordType: {
-                header: 'Record Type',
                 get: ({ type }) => type,
+                header: 'Record Type',
             },
+            // eslint-disable-next-line perfectionist/sort-objects
             dnsTarget: {
-                header: 'DNS Target',
                 get: ({ cname }) => cname,
+                header: 'DNS Target',
             },
         });
     }
@@ -91,7 +91,7 @@ export async function waitForCertIssuedOnDomains(heroku, app) {
             retries++;
         }
         if (someFailed(domains)) {
-            ux.action.stop(color.red('!'));
+            ux.action.stop(color.failure('!'));
             throw new Error('ACM not enabled for some domains');
         }
         ux.action.stop();

package/lib/lib/domains/wait-for-domain.js

@@ -1,8 +1,7 @@
-import { color } from '@heroku-cli/color';
-import { hux } from '@heroku/heroku-cli-util';
+import { color, hux } from '@heroku/heroku-cli-util';
 import { ux } from '@oclif/core';
 export default async function waitForDomain(app, heroku, domain) {
-    ux.action.start(`Waiting for ${color.green(domain.hostname || 'domain')}`);
+    ux.action.start(`Waiting for ${color.name(domain.hostname || 'domain')}`);
     while (domain.status === 'pending') {
         await hux.wait(5000);
         const { body: updatedDomain } = await heroku.get(`/apps/${app}/domains/${domain.id}`);

package/lib/lib/local/env-file-validator.js

@@ -1,9 +1,9 @@
+import { color } from '@heroku/heroku-cli-util';
 import * as fs from 'fs';
-import { color } from '@heroku-cli/color';
 export function validateEnvFile(envFile, warn) {
     const resolvedEnvFile = envFile || '.env';
     if (fs.existsSync(resolvedEnvFile) && !fs.statSync(resolvedEnvFile).isFile()) {
-        warn(`The specified location for the env file, ${color.bold(resolvedEnvFile)}, is not a file, ignoring.`);
+        warn(`The specified location for the env file, ${color.label(resolvedEnvFile)}, is not a file, ignoring.`);
         return '';
     }
     return resolvedEnvFile;

package/lib/lib/local/fork-foreman.js

@@ -1,3 +1,4 @@
+import { ux } from '@oclif/core';
 import { fork as forkChildProcess } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -27,9 +28,9 @@ export function fork(argv) {
     const script = getForemanScriptPath();
     const nf = forkChildProcess(script, argv, { stdio: 'inherit' });
     return new Promise(resolve => {
-        nf.on('exit', function (code) {
+        nf.on('exit', (code) => {
             if (code !== 0)
-                process.exit(code);
+                ux.exit(code);
             resolve();
         });
     });

package/lib/lib/members/util.js

@@ -1,20 +1,20 @@
+import { color } from '@heroku/heroku-cli-util';
 import { ux } from '@oclif/core';
-import { color } from '@heroku-cli/color';
 export const inviteMemberToTeam = async function (email, role, team, heroku) {
-    ux.action.start(`Inviting ${color.cyan(email)} to ${color.magenta(team)} as ${color.green(role)}`);
+    ux.action.start(`Inviting ${color.user(email)} to ${color.team(team)} as ${color.green(role)}`);
     await heroku.request(`/teams/${team}/invitations`, {
-        headers: {
+        body: { email, role }, headers: {
             Accept: 'application/vnd.heroku+json; version=3.team-invitations',
-        }, method: 'PUT',
-        body: { email, role },
+        },
+        method: 'PUT',
     });
     ux.action.stop();
 };
 export const addMemberToTeam = async function (email, role, groupName, heroku, method = 'PUT') {
-    ux.action.start(`Adding ${color.cyan(email)} to ${color.magenta(groupName)} as ${color.green(role)}`);
+    ux.action.start(`Adding ${color.user(email)} to ${color.team(groupName)} as ${color.green(role)}`);
     await heroku.request(`/teams/${groupName}/members`, {
-        method: method,
         body: { email, role },
+        method,
     });
     ux.action.stop();
 };

package/lib/lib/orgs/utils.js

@@ -1,12 +1,11 @@
+import { color, hux } from '@heroku/heroku-cli-util';
 import { ux } from '@oclif/core';
-import { hux } from '@heroku/heroku-cli-util';
-import { color } from '@heroku-cli/color';
 export const printGroups = function (teams, type) {
     const typeLabel = type.label ?? 'Team';
     teams = teams.sort((a, b) => (a.name || '').localeCompare(b.name || ''));
     hux.table(teams, {
         name: {
-            get: ({ name }) => color.green(name),
+            get: ({ name }) => color.team(name),
             header: typeLabel,
         },
         role: {

package/lib/lib/pg/backups.d.ts

@@ -1 +1,17 @@
-export {};
+import { APIClient } from '@heroku-cli/command';
+import type { BackupTransfer } from './types.js';
+declare class Backups {
+    protected app: string;
+    protected heroku: APIClient;
+    protected logsAlreadyShown: Set<string>;
+    constructor(app: string, heroku: APIClient);
+    protected displayLogs(logs: BackupTransfer['logs']): void;
+    filesize(size: number, opts?: {}): string;
+    name(transfer: BackupTransfer): string;
+    num(name: string): Promise<number | undefined>;
+    protected poll(transferID: string, interval: number, verbose: boolean, appId: string): AsyncGenerator<unknown, void, unknown>;
+    status(transfer: BackupTransfer): string;
+    wait(action: string, transferID: string, interval: number, verbose: boolean, app: string): Promise<void>;
+}
+declare function factory(app: string, heroku: APIClient): Backups;
+export default factory;

package/lib/lib/pg/backups.js

@@ -1,175 +1,151 @@
-export {};
-/*
-import color from '@heroku-cli/color'
-import {APIClient} from '@heroku-cli/command'
-import {ux} from '@oclif/core'
-import heredoc from 'tsheredoc'
-import host from './host'
-import type {BackupTransfer} from './types'
-import bytes = require('bytes')
-
-function prefix(transfer: BackupTransfer) {
-  if (transfer.from_type === 'pg_dump') {
-    if (transfer.to_type === 'pg_restore') {
-      return 'c'
+import { createRequire as _createRequire } from "module";
+const __require = _createRequire(import.meta.url);
+import { color, utils } from '@heroku/heroku-cli-util';
+import { ux } from '@oclif/core';
+import tsheredoc from 'tsheredoc';
+const bytes = __require("bytes");
+const heredoc = tsheredoc.default;
+function prefix(transfer) {
+    if (transfer.from_type === 'pg_dump') {
+        if (transfer.to_type === 'pg_restore') {
+            return 'c';
+        }
+        return transfer.schedule ? 'a' : 'b';
+        // eslint-disable-next-line no-else-return
     }
-
-    return transfer.schedule ? 'a' : 'b'
-
-    // eslint-disable-next-line no-else-return
-  } else {
-    if (transfer.to_type === 'pg_restore') {
-      return 'r'
+    else {
+        if (transfer.to_type === 'pg_restore') {
+            return 'r';
+        }
+        return 'b';
     }
-
-    return 'b'
-  }
 }
-
 class Backups {
-  protected app: string
-  protected heroku: APIClient
-  protected logsAlreadyShown = new Set<string>()
-
-  constructor(app: string, heroku: APIClient) {
-    this.app = app
-    this.heroku = heroku
-  }
-
-  public filesize(size: number, opts = {}): string {
-    Object.assign(opts, {
-      decimalPlaces: 2,
-      fixedDecimals: true,
-    })
-    return bytes(size, opts)
-  }
-
-  public status = (transfer: BackupTransfer): string => {
-    if (transfer.finished_at && transfer.succeeded) {
-      const warnings = transfer.warnings
-      if (warnings > 0) {
-        return `Finished with ${warnings} warnings`
-      }
-
-      return `Completed ${transfer.finished_at}`
+    app;
+    heroku;
+    logsAlreadyShown = new Set();
+    constructor(app, heroku) {
+        this.app = app;
+        this.heroku = heroku;
     }
-
-    if (transfer.finished_at) {
-      return `Failed ${transfer.finished_at}`
-    }
-
-    if (transfer.started_at) {
-      return `Running (processed ${this.filesize(transfer.processed_bytes)})`
+    displayLogs(logs) {
+        for (const log of logs) {
+            if (this.logsAlreadyShown.has(log.created_at + log.message)) {
+                continue;
+            }
+            this.logsAlreadyShown.add(log.created_at + log.message);
+            ux.stdout(`${log.created_at} ${log.message}`);
+        }
     }
-
-    return 'Pending'
-  }
-
-  public num = async (name: string) => {
-    let m = name.match(/^[abcr](\d+)$/)
-    if (m) return Number.parseInt(m[1], 10)
-    m = name.match(/^o[ab]\d+$/)
-    if (m) {
-      const {body: transfers} = await this.heroku.get<BackupTransfer[]>(`/client/v11/apps/${this.app}/transfers`, {hostname: host()})
-      const transfer = transfers.find(t => this.name(t) === name)
-      if (transfer) return transfer.num
+    filesize(size, opts = {}) {
+        Object.assign(opts, {
+            decimalPlaces: 2,
+            fixedDecimals: true,
+        });
+        return bytes(size, opts);
     }
-  }
-
-  public name = (transfer: BackupTransfer) => {
-    const oldPGBName = transfer.options && transfer.options.pgbackups_name
-    if (oldPGBName) return `o${oldPGBName}`
-    return `${prefix(transfer)}${(transfer.num || '').toString().padStart(3, '0')}`
-  }
-
-  public wait = async (action: string, transferID: string, interval: number, verbose: boolean, app: string) => {
-    if (verbose) {
-      ux.log(`${action}...`)
+    name(transfer) {
+        const oldPGBName = transfer.options?.pgbackups_name;
+        if (oldPGBName)
+            return `o${oldPGBName}`;
+        return `${prefix(transfer)}${(transfer.num || '').toString().padStart(3, '0')}`;
     }
-
-    ux.action.start(action)
-    try {
-      for await (const backupSucceeded of this.poll(transferID, interval, verbose, app || this.app)) {
-        if (backupSucceeded) {
-          ux.action.stop()
-          break
+    async num(name) {
+        let m = name.match(/^[abcr](\d+)$/);
+        if (m)
+            return Number.parseInt(m[1], 10);
+        m = name.match(/^o[ab]\d+$/);
+        if (m) {
+            const { body: transfers } = await this.heroku.get(`/client/v11/apps/${this.app}/transfers`, { hostname: utils.pg.host() });
+            const transfer = transfers.find(t => this.name(t) === name);
+            if (transfer)
+                return transfer.num;
         }
-      }
-    } catch (error) {
-      ux.action.stop('!')
-      ux.error(error as Error)
     }
-  }
+    async *poll(transferID, interval, verbose, appId) {
+        const tty = process.env.TERM !== 'dumb' && process.stderr.isTTY;
+        let backup = {};
+        let failures = 0;
+        const quietUrl = `/client/v11/apps/${appId ?? this.app}/transfers/${transferID}`;
+        const verboseUrl = quietUrl + '?verbose=true';
+        const url = verbose ? verboseUrl : quietUrl;
+        while (failures < 21) {
+            try {
+                ({ body: backup } = await this.heroku.get(url, { hostname: utils.pg.host() }));
+            }
+            catch (error) {
+                if (failures++ > 20) {
+                    throw error;
+                }
+            }
+            if (verbose) {
+                this.displayLogs(backup.logs);
+            }
+            else if (tty) {
+                const msg = backup.started_at ? this.filesize(backup.processed_bytes) : 'pending';
+                const log = backup.logs?.pop();
+                if (log) {
+                    ux.action.status = `${msg}\n${log.created_at + ' ' + log.message}`;
+                }
+                else {
+                    ux.action.status = msg;
+                }
+            }
+            if (backup?.finished_at) {
+                if (backup.succeeded) {
+                    yield true;
+                    break;
+                }
+                // logs is undefined unless verbose=true is passed
+                ({ body: backup } = await this.heroku.get(verboseUrl, { hostname: utils.pg.host() }));
+                throw new Error(heredoc(`
+          An error occurred and the backup did not finish.
 
-  protected displayLogs(logs: BackupTransfer['logs']) {
-    for (const log of logs) {
-      if (this.logsAlreadyShown.has(log.created_at + log.message)) {
-        continue
-      }
+          ${backup.logs.slice(-5).map(l => l.message).join('\n')}
 
-      this.logsAlreadyShown.add(log.created_at + log.message)
-      ux.log(`${log.created_at} ${log.message}`)
+          Run ${color.code('heroku pg:backups:info ' + this.name(backup))} for more details.`));
+            }
+            yield new Promise(resolve => {
+                setTimeout(resolve, interval * 1000);
+            });
+        }
     }
-  }
-
-  protected async * poll(transferID: string, interval: number, verbose: boolean, appId: string) {
-    const tty = process.env.TERM !== 'dumb' && process.stderr.isTTY
-    let backup: BackupTransfer = {} as BackupTransfer
-    let failures = 0
-
-    const quietUrl = `/client/v11/apps/${appId ?? this.app}/transfers/${transferID}`
-    const verboseUrl = quietUrl + '?verbose=true'
-
-    const url = verbose ? verboseUrl : quietUrl
-
-    while (failures < 21) {
-      try {
-        ({body: backup} = await this.heroku.get<BackupTransfer>(url, {hostname: host()}))
-      } catch (error) {
-        if (failures++ > 20) {
-          throw error
+    status(transfer) {
+        const { finished_at, processed_bytes, started_at, succeeded, warnings } = transfer;
+        if (finished_at && succeeded) {
+            if (warnings > 0) {
+                return `Finished with ${warnings} warnings`;
+            }
+            return `Completed ${finished_at}`;
         }
-      }
-
-      if (verbose) {
-        this.displayLogs(backup.logs)
-      } else if (tty) {
-        const msg = backup.started_at ? this.filesize(backup.processed_bytes) : 'pending'
-        const log = backup.logs?.pop()
-        if (log) {
-          ux.action.status = `${msg}\n${log.created_at + ' ' + log.message}`
-        } else {
-          ux.action.status = msg
+        if (finished_at) {
+            return `Failed ${finished_at}`;
         }
-      }
-
-      if (backup?.finished_at) {
-        if (backup.succeeded) {
-          yield true
-          break
+        if (started_at) {
+            return `Running (processed ${this.filesize(processed_bytes)})`;
+        }
+        return 'Pending';
+    }
+    async wait(action, transferID, interval, verbose, app) {
+        if (verbose) {
+            ux.stdout(`${action}...`);
+        }
+        ux.action.start(action);
+        try {
+            for await (const backupSucceeded of this.poll(transferID, interval, verbose, app || this.app)) {
+                if (backupSucceeded) {
+                    ux.action.stop();
+                    break;
+                }
+            }
+        }
+        catch (error) {
+            ux.action.stop('!');
+            ux.error(error);
         }
-
-        // logs is undefined unless verbose=true is passed
-        ({body: backup} = await this.heroku.get<BackupTransfer>(verboseUrl, {hostname: host()}))
-
-        throw new Error(heredoc(`
-          An error occurred and the backup did not finish.
-
-          ${backup.logs.slice(-5).map(l => l.message).join('\n')}
-
-          Run ${color.cmd('heroku pg:backups:info ' + this.name(backup))} for more details.`))
-      }
-
-      yield new Promise(resolve => {
-        setTimeout(resolve, interval * 1000)
-      })
     }
-  }
 }
-
-function factory(app: string, heroku: APIClient) {
-  return new Backups(app, heroku)
+function factory(app, heroku) {
+    return new Backups(app, heroku);
 }
-
-export default factory
-*/
+export default factory;

package/lib/lib/pg/download.js

@@ -1,18 +1,18 @@
-import * as fs from 'fs-extra';
-import * as Path from 'path';
-import * as https from 'https';
 import cliProgress from 'cli-progress';
+import fs from 'fs-extra';
+import * as https from 'https';
+import * as Path from 'path';
 export default function download(url, path, opts) {
     const tty = process.stderr.isTTY && process.env.TERM !== 'dumb';
     function showProgress(rsp) {
         const bar = new cliProgress.SingleBar({
-            format: `Downloading ${path}... |{bar}| {percentage}% | ETA: {eta}s | {value}/{total} bytes`,
             barCompleteChar: '\u2588',
             barIncompleteChar: '\u2591',
+            format: `Downloading ${path}... |{bar}| {percentage}% | ETA: {eta}s | {value}/{total} bytes`,
         });
         bar.start(Number.parseInt(rsp.headers['content-length'], 10), 0);
         let total = 0;
-        rsp.on('data', function (chunk) {
+        rsp.on('data', (chunk) => {
             total += chunk.length;
             bar.update(total);
         });
@@ -20,10 +20,10 @@ export default function download(url, path, opts) {
             bar.stop();
         });
     }
-    return new Promise(function (resolve, reject) {
+    return new Promise((resolve, reject) => {
         fs.mkdirSync(Path.dirname(path), { recursive: true });
         const file = fs.createWriteStream(path);
-        https.get(url, function (rsp) {
+        https.get(url, (rsp) => {
             if (tty && opts.progress)
                 showProgress(rsp);
             rsp.pipe(file)