Distillation

Date: September 10, 2026

• 🟡 (12:00) packages/cli/src/lib/errors.ts added UpgradeTransportError extends UpgradeError; its constructor calls super("network_error", message) and sets this.name = "UpgradeTransportError", distinguishing transport failures from HTTP or metadata failures.
• 🟡 (12:00) packages/cli/src/lib/ghcr.ts expanded from 520 to 659 lines and now imports valid as semverValid from semver; PRIMARY_UPGRADE_SOURCE, parseUpgradeJson, and UpgradeSource from ./binary.js; and UpgradeTransportError alongside UpgradeError from ./errors.js.
• 🟡 (12:00) packages/cli/src/lib/ghcr.ts changed GHCR_REPO from the hard-coded "getsentry/cli" to PRIMARY_UPGRADE_SOURCE.ghcrRepo, while retaining the documented public default repository.
• 🟡 (12:00) GHCR source selection supports an UpgradeSource, including detection via "ghcrRepo" in sourceOrSignal; source-aware requests use source.ghcrRepo rather than the fixed GHCR_REPO.
• 🟡 (12:00) fetchManifest(token, tag, signal?, source = PRIMARY_UPGRADE_SOURCE) now accepts an upgrade source and builds its URL as ${GHCR_REGISTRY}/v2/${source.ghcrRepo}/manifests/${tag}.
• 🟡 (12:00) fetchNightlyManifest(token, signal?, source = PRIMARY_UPGRADE_SOURCE) now forwards both signal and source to fetchManifest(token, GHCR_TAG, signal, source).
• 🟡 (12:00) downloadNightlyBlob(token, digest, signal?, source = PRIMARY_UPGRADE_SOURCE) now builds the blob endpoint as ${GHCR_REGISTRY}/v2/${source.ghcrRepo}/blobs/${digest} instead of using a fixed repository.
• 🟡 (12:00) GHCR blob downloading retains manual redirect handling because ghcr.io may return 301, 302, 307, or 308; forwarding the Authorization header through an automatic redirect to Azure Blob Storage can produce HTTP 404. A direct HTTP 200 is also accepted.
• 🟡 (12:00) GHCR tag-list parsing replaced an unchecked response.json() cast with parseUpgradeJson(response, signal, "GHCR tag list returned invalid metadata"). It now requires a non-null object; returns [] when tags is absent; requires tags to be an array containing only strings; and otherwise throws UpgradeError("network_error", "GHCR tag list returned invalid metadata").
• 🟡 (12:01) packages/cli/src/lib/release-notes.ts expanded from 122 to 129 lines and replaced GITHUB_RELEASES_URL with source-aware imports getGitHubReleasesUrl, PRIMARY_UPGRADE_SOURCE, and UpgradeSource from ./binary.js.
• 🟡 (12:01) packages/cli/src/lib/release-notes.ts now imports isNormalizedForSource, NormalizedGitHubReleases, and normalizeStableReleases from ./delta-upgrade.js in addition to GitHubRelease, enabling source-branded normalization of stable release metadata.
• 🟡 (12:01) Stable release-note handling added source-aware options and a normalization path that reuses releases when isNormalizedForSource(releases, source) succeeds; release versions continue to strip a leading v via release.tag_name.replace(VERSION_PREFIX_RE, "").
• 🟡 (12:01) fetchStableChangelog changed from positional arguments (fromVersion, toVersion, maxItems?, prefetchedReleases?) to one FetchChangelogOptions & { source: UpgradeSource } object. It normalizes caller-provided releases with normalizeChangelogReleases(prefetchedReleases, source), otherwise fetches via fetchReleasesForChangelog(source), returns null for an empty release list, and builds output through buildChangelogSummaryForSource(releases, fromVersion, toVersion, { maxItems, source }).
• 🟡 (12:01) fetchNightlyChangelog(fromVersion, toVersion, source, maxItems?) now requires the selected UpgradeSource, ensuring nightly release-note retrieval follows the source chosen during version discovery.
• 🟡 (12:01) Nightly changelog timestamp boundaries remain deliberate: GitHub’s inclusive since is set to (fromTs + 1) * 1000 to exclude the currently installed commit, and GitHub’s exclusive until is set to (toTs + 1) * 1000 to include the target commit.
• 🟡 (12:01) Release-note filtering still recognizes exactly three conventional-commit categories through COMMIT_PREFIX_TO_CATEGORY: feat → features, fix → fixes, and perf → performance; commits containing #skip-changelog are excluded and only the first line of multiline messages is used.