Dashboard › cli › Distillation
108a5080-0763-4459-a0a1-862073beaff1["lore_tm_v1_2evPvn3QlvpQTRqPOO17x_Pbb_CsPC0QKUb3IO_di80","lore_tm_v1_r-qOi9rSS-_eiDmDXnjiYsqwU_EyDThqGALo29NqGwA","lore_tm_v1_Va7ar6fbFIl2ewMBd6z0RVRdRBmqPmiJGFjJBN9lU6o","lore_tm_v1_Paqvprw4G3OR0DZ8xXcLNgeCLGCD55WvMHYiY3NZI7Q","lore_tm_v1_oxLo1vU154rly3BCXWGp9FGlBuKsiCuZ3yJr-rTSEjA","lore_tm_v1_N9dvm_zAq-tNkioerbXx1DNcPhG5xW8e0UKht4pPdZE","lore_tm_v1_Oqk2pbI7WENF7nFdJ7CXLio0PyO7zxJoWw4IdzN9_TQ"]
Date: Sep 10, 2026
@sentry/api SDK always includes response on the returned object in source, spreading { request, response } into every return value.packages/cli/src/lib/api.ts, SDK-backed result handling can rely on result.response; parseSentryLinkHeader is exported as parseLinkHeader.api.ts defines auto-pagination with a maximum-page cap and a maximum concurrent API-request limit for organization/region fan-out; when the page cap is reached it warns that results may be incomplete.apiRequestToRegion() builds requests as ${config.baseUrl}/api/0/${normalizedEndpoint}${queryString}, conditionally Zstandard-compresses request bodies when bodyEncoding === "zstd" and zstdCompressAsync exists, and returns { data: T; headers: Headers }.api.ts preserves non-UTF-8 binary response payloads rather than text-decoding them; textual payloads are UTF-8 decoded and then JSON-parsed when possible.http://sentry.io is never legitimate and a crafted plaintext URL must not inherit SaaS trust.packages/cli/src/lib/sentry-urls.ts separates hostname-only SaaS routing from credential trust: isSentrySaasUrl(url) accepts sentry.io and subdomains regardless of scheme/port for routing/testing, while isSaaSTrustOrigin(url) requires https:, an empty/default port, and isSentrySaasUrl(url) for host-scoping trust.packages/cli/src/lib/sentry-urls.ts, getSentryBaseUrl() resolves getConfiguredSentryUrl() ?? DEFAULT_SENTRY_URL; getOrgBaseUrl(orgSlug) creates an org subdomain only for SaaS URLs and otherwise returns the configured self-hosted base unchanged.normalizeOrigin(input: string | URL | Request | undefined | null) in packages/cli/src/lib/sentry-urls.ts returns canonical scheme://host[:port] via new URL(raw).origin, rejects bare hostnames and unparsable inputs with undefined; normalizeUserInputToOrigin(input) first uses normalizeUrl() so bare user-supplied hostnames receive an https:// prefix.packages/cli/src/lib/sentry-urls.ts URL-builder routing: SaaS URLs use org subdomains; self-hosted URLs use path-scoped organizations. Builders include buildOrgUrl, buildProjectUrl, buildIssueUrl, buildEventSearchUrl, buildOrgSettingsUrl, buildSeerSettingsUrl, buildBillingUrl, buildLogsUrl, buildReplayUrl, buildDashboardsListUrl, and buildDashboardUrl.setEnv(); getEnv() returns process.env in CLI mode.packages/cli/src/lib/env.ts, library mode calls setEnv(env) with a merged environment copy, assigning module-local _env; it does not mutate the consumer’s process.env.SENTRY_CONFIG_DIR value and never delete it; deletion causes later test files whose module-level code or hooks read the variable to receive undefined.packages/cli/test/helpers.ts config-directory test cleanup closes the database; resets auth-token, auth-row, stored-creds, and identity-fingerprint caches; restores process.env[CONFIG_DIR_ENV_VAR] only when savedConfigDir !== undefined; then calls cleanupTestDir(dir). The omitted deletion branch intentionally avoids the delete process.env anti-pattern because preload.ts always sets SENTRY_CONFIG_DIR.useEnvSandbox(keys) in packages/cli/test/helpers.ts saves listed environment values, clears all listed keys before each test, then restores saved defined values and deletes keys that were originally absent after each test.resetHostScopingState() in packages/cli/test/helpers.ts dynamically imports and resets resetEnvTokenHostForTesting(), regions.resetTrustedRegionUrlsForTesting(), and resetLoginTrustAnchorForTesting() to prevent env-token snapshots, login trust anchors, and trusted-region extensions leaking across tests.mintSntrysToken(payload) in packages/cli/test/helpers.ts JSON-serializes payload, base64-encodes UTF-8 content with trailing = padding stripped, and returns sntrys_${b64}_test-secret-tail; the fixed secret tail is intentionally irrelevant to parsing and matches the server’s generate_token shape.extractFetchUrl(input: RequestInfo | URL) in packages/cli/test/helpers.ts returns a string input unchanged, URL.href for a URL, and .url for a Request.SENTRY_FORCE_ENV_TOKEN, configured Sentry URLs, host scoping, auto-login host guards, and auth behavior. Relevant test files include packages/cli/test/lib/auth-hint.test.ts, packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts, packages/cli/test/lib/security/auto-login-host-guard.test.ts, packages/cli/test/lib/region.test.ts, packages/cli/test/lib/constants.test.ts, packages/cli/test/lib/db/auth.test.ts, packages/cli/test/lib/db/auth.property.test.ts, and packages/cli/test/lib/db/auth.host.test.ts.packages/cli/test/lib/security/auto-login-host-guard.test.ts includes coverage that scope-recovery re-authentication against the stored-token host is allowed with no default URL, while an injected host differing from the stored-token host is refused.