[sentry-junior]

This is step 1 of moving the CLI onto @sentry/api generated operations. The goal is an Oxlint rule that bans the apiRequest* helpers with no allowlist. @BYK chose that scope ("Also ban apiRequest* helpers") when the lint follow-up to #2062 was scoped. Since the rule can't land until every call site has moved, it isn't in this PR.

#2062 bumps @sentry/api to 1.44.0 too and moves lib/objectstore.ts. This PR leaves objectstore.ts alone, so whichever PR merges second only needs a lockfile rebase.

What changed

• @sentry/api 1.26.0 → 1.44.0 in the catalog and in minimumReleaseAgeExclude. The regenerated alert.md and event.md skill references are included.
• 18 apiRequest* call sites now use generated operations:
  • alerts: deleteIssueAlertRule → deleteOrganizationWorkflow
  • chunk-upload:
    • getChunkUploadOptions → getOrganizationChunkUploadOptions. ChunkServerOptionsSchema still validates the response because the SDK type doesn't include maxWait.
    • New assembleDebugFiles → assembleProjectDebugFiles
    • New assembleArtifactBundle → assembleOrganizationArtifactBundle
  • sourcemaps, dart-symbols, proguard, debug-files: their assemble and poll calls now go through the chunk-upload wrappers above (7 sites). pollAssembly/pollDifAssembly take an assemble callback.
  • conversations: getConversationSpans → retrieveOrganizationAiConversation
  • issues: getIssueByShortId → resolveOrganizationShortId
  • preprod-artifacts:
    • getBuildInstallDetails → getOrganizationPreprodArtifactInstallDetails
    • Latest base snapshot → getOrganizationPreprodArtifactSnapshotLatestBase (a 404 still returns null)
  • releases: setCommitsWithRefs → updateOrganizationRelease. The ./.. path-segment checks stay because the SDK's path serializer lets them through.
  • replays: getReplay → getOrganizationReplay
  • traces:
    • getTraceMeta → getOrganizationTraceMeta
    • fetchTransactionsPage/fetchSpansPage → listOrganizationEvents
• infrastructure.ts gets validateResponse and unwrapValidatedResult, so call sites that already validated responses with Zod still do that on SDK results. No new as casts on query or body types.

Behavior notes

• HTTP error messages for the moved calls now read <context>: <status> (from unwrapResult/throwApiError) instead of API request failed: …. The 401/403 enrichment is unchanged.
• throwApiError doesn't attach the api_response_headers Sentry context that the helper path set.
• Pagination, region routing (getOrgSdkConfig), caching and idempotency are unchanged.

Tests

• chunk-upload.test.ts and proguard.test.ts now test at the fetch level (mockFetch + setOrgRegion). New cases cover maxWait, schema mismatch, 404, and both assemble endpoints.
• debug-files.test.ts mocks the new assembleDebugFiles.
• preprod-artifacts.test.ts mocks getOrgSdkConfig, with new cases for a null body, a 500, and a schema mismatch.
• The existing fetch-level tests for alerts, short IDs, conversations, releases and traces pass unchanged.

Gate

• pnpm run tsc and pnpm run lint: pass.
• pnpm run test: fails only on sandbox environment problems that also fail on main. CI is the real check.
  • The root run aborts in codemod-cli3to4 because the sandbox lacks GLIBC_2.35.
  • pnpm -r --no-bail run test: every package passes except the CLI, which has 5 failures (12881 passed). All 5 are file-permission tests that fail on main in the same sandbox: completions (2), upgrade acquireLock, db/resilient readonly, and dsn/code-scanner unreadable files.

Remaining call sites (39 + 2 raw fetches)

(a) Missing from the public schema: needs getsentry/sentry API docs

• auth.ts GET /api/0/ (root). Used for the token check; dynamic.
• dashboards.ts GET /organizations/{org}/dashboards/{id}/revisions/
• dashboards.ts POST /organizations/{org}/dashboards/{id}/revisions/{rev}/restore/
• issues.ts GET /issues/{id}/ (unscoped issue lookup)
• issues.ts PUT /issues/{id}/ (unscoped update fallback)
• issues.ts raw customFetch GET /shared/issues/{shareId}/ (getSharedIssue)
• logs.ts GET /organizations/{org}/trace-logs/
• org-auth-tokens.ts GET, POST /organizations/{org}/org-auth-tokens/, DELETE …/{tokenId}/
• organizations.ts GET /users/me/regions/
• preprod-artifacts.ts:
  • POST /projects/{org}/{project}/files/preprodartifacts/assemble/ (build assemble)
  • GET …/preprodartifacts/snapshots/upload-options/
  • Snapshot archive status and trigger at …/snapshots/{id}/archive/
  • Raw customFetch openSnapshotArchive
• projects.ts GET /organizations/{org}/projects/?query=dsn:{key} (×2). The list op has no query param.
• releases.ts GET /organizations/{org}/releases/{version}/previous-with-commits/
• traces.ts GET /projects/{org}/{project}/trace-items/{itemId}/
• trials.ts GET /customers/{org}/ and PUT /customers/{org}/product-trial/
• users.ts GET /auth/

These look intentionally private, so publishing them needs a call from the API owners: /customers/* (billing, getsentry), /users/me/regions/, the /api/0/ root, /auth/, previous-with-commits, trace-logs, trace-items, and the preprod/snapshot internals.

(b) In the schema, but the generated types don't match what the CLI sends or reads

• alerts.ts ×2, GET /organizations/{org}/workflows/: no projectSlug filter, and the CLI sends string ids.
• code-mappings.ts POST bulk code mappings: the CLI sends a camelCase body; the schema is snake_case.
• conversations.ts list: no sort query param.
• dashboards.ts events-timeseries: yAxis is an array and dataset is optional in the CLI.
• dashboards.ts events: dataset can be null or a value outside the enum.
• explore.ts events-timeseries: array yAxis, string interval.
• explore.ts events: free-form dataset.
• issues.ts GET org issue: the collapse enum is only release|stats|tags.
• issues.ts PUT org issue: every update body field is required.
• issues.ts PUT /organizations/{org}/issues/ (merge): updateOrganizationIssues also requires every body field.
• replays.ts list: the field enum lacks info_ids/warning_ids.
• replays.ts replay-count: no data_source=events.
• seer.ts ×3, /organizations/{org}/issues/{id}/autofix/: no mode=explorer.
• traces.ts GET /organizations/{org}/trace/{id}/: no timestamp/limit/project params.
• preprod-artifacts.ts POST …/preprodartifacts/snapshots/: the body type is never, and the CLI sends a zstd body.

(c) Dynamic or upload transport, not Sentry API operations

• Chunk uploads POST to the server-provided chunk URL.
• Preprod build download fetches the external installUrl.
• rawApiRequest/prepareRawApiRequest back the sentry api passthrough command.

via @BYK.

--

View Session [Sentry]

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sentry-local	Ready	Preview	Nov 7, 2026 12:57am UTC