deps: migrate to use the SDK for the certs topic

[jdodson]

Summary

Migrate all 10 certs commands to use the SDK.

Commands

• certs, certs:generate, certs:info, certs:remove, certs:update
• certs:auto, certs:auto:enable, certs:auto:disable, certs:auto:refresh
• certs:add

Also

• Deleted dead helper lib/certs/domains.ts.
• Dropped the ACM-wait code from lib/domains/domains.ts (shared with the domains topic — only the wait logic went, presentation stayed).
• certs:auto:refresh was blocked on a schema gap; @heroku/types@4.0.1
  fixes it, so it's included here.

Type of Change

Breaking Changes (major semver update)

• Add a ! after your change type to denote a change that breaks current behavior

Feature Additions (minor semver update)

• feat: Introduces a new feature to the codebase

Patch Updates (patch semver update)

• fix: Bug fix
• deps: Dependency upgrade
• revert: Revert a previous commit
• chore: Change that does not affect production code
• refactor: Refactoring existing code without changing behavior
• test: Add/update/remove tests

Testing

The SDK uses heroku-fetch, which reads a netrc file — so log in with
HEROKU_NETRC_WRITE=true. Use a throwaway test app. Some steps are
destructive (remove, auto:disable).

Setup

• Pull down this branch
• npm i && npm run build
• ./bin/run logout
• HEROKU_NETRC_WRITE=true ./bin/run login

Create an app + custom domain to test against

• Create a new app
• Scale up a web dyno on the app
• ./bin/run domains:add test.example.com --app APP
  • adds a custom domain — this is what certs:add associates the cert with
    and what certs:auto reports ACM status for
  • point the domain's DNS CNAME at the target it prints if you want ACM to
    actually reach cert issued (otherwise it stays pending, which is fine
    for exercising the code path)

If you only want to smoke-test the cert CRUD commands (generate/add/list/
info/update/remove) and skip ACM, a plain apps:create app is enough —
no domain or paid dyno needed.

certs:generate — makes a self-signed cert on disk

• ./bin/run certs:generate test1.example.com --app APP --selfsigned --now
  • writes test1.example.com.crt and test1.example.com.key

certs:add — the interactive path (needs the 2 certs above)

• ./bin/run certs:add test1.example.com.crt test1.example.com.key --app APP
  • adds the cert, prompts to pick domains to associate

certs (list)

• ./bin/run certs --app APP
  • lists both certs in a table — note each cert Name

certs:info

• ./bin/run certs:info --app APP --name CERT_NAME
  • shows cert details
• ./bin/run certs:info --app APP --name CERT_NAME --show-domains
  • also lists associated domains

certs:update — reuse the generated files

• ./bin/run certs:update test1.example.com.crt test1.example.com.key --app APP --name CERT_NAME
  • reports the cert was updated

certs:auto:enable / auto / auto:refresh / auto:disable

• ./bin/run certs:auto:enable --app APP
  • reports ACM enabled
• ./bin/run certs:auto --app APP
  • shows ACM status table
• ./bin/run certs:auto:refresh --app APP
  • reports ACM refreshed (this is the previously-blocked command — the
    PATCH must send a body, not silently no-op)
• ./bin/run certs:auto:disable --app APP --confirm APP
  • reports ACM disabled

certs:remove (destructive — do last)

• ./bin/run certs:remove --app APP --name CERT_NAME --confirm APP
  • removes the cert; ./bin/run certs --app APP no longer lists it

Cleanup

• Remove the remaining test cert, delete the local .crt/.key files
• ./bin/run apps:destroy --app APP --confirm APP (if you made a throwaway app)
• ./bin/run logout

Related Issues

GUS work item: https://gus.lightning.force.com/lightning/r/ADM_Work__c/a07EE00002eHYVDYA4/view