Dashboard › cli › Distillation
7fd8e0b3-1479-4f52-985c-4503a26aff4e["lore_tm_v1_3v__PX0iCj___jxCYudZ0G1wTD6WJqszJE7fJEcT79Y","lore_tm_v1_rB_ZYEhquF2k5vowrY-O8ntwMW5_urtkffaehNGof34","lore_tm_v1_Y2HIJZ_DY6OW0j0g-zN6wQ5ohXWa7JcaFLpEzDYOV9E","lore_tm_v1_x9P3cfk0HxQWEefPM7kZHza3tIM1PpAEsy34XXvWrvg","lore_tm_v1_fyG1QOvFZgJikJ1LAJpgqTh55E8r6P9wN8p85hHF_T8","lore_tm_v1_WVfknqiLPiY4wy2OenqtIpYEkS8hquf0YiwvMVQW5SE","lore_tm_v1_YXPDRiL4qFbFUiRb8CMKL5cZsceUl4ZISVWK0gM2XUw","lore_tm_v1_anGoJvECuxdLmiN8bSTPJmU5LYDS8mkjmhWbwHdoIbw","lore_tm_v1_1_8cGMgA3cdJ7bZ_bycc0jvMjSQ45Hf-IhHiZK3V9t4","lore_tm_v1_vtipGoh7iqXJmpK0OJbVNxifXXnhm4AZPcS7XSbWQ-8","lore_tm_v1_-Nr4YQMLGkMn_NRv6_L8RuJ36Z-ZGb_rgdf3mgOsP_g","lore_tm_v1_MBrHVsoFyluPx9QQZn2HUNIND8zjGdI9aFnsmCGLrrw","lore_tm_v1_kxI4GQ0ij7_PvjCVvcLgYhcbqtzsZvOF4XJqWbTFJDs","lore_tm_v1_zbm0HFcJsPU5pBQlalVdEOsbErJBKjTCZJAyaUhS6tA","lore_tm_v1_ICkBCbD3B1q6FcjtxeEe3N0HxKV0vumy-qhQ5bPk4_M","lore_tm_v1_o4_wFDTaRDNL-_Mmzb3XL-7BWUcMguyyPDo2I25xBVA","lore_tm_v1_mM-yMWMIX9yEQqwSS6hsWXwaQgjrZEfypPYQjJtTp4U","lore_tm_v1_vMkrjvaYhIh-9ajwwGBG-bVY-Tmh4j_8r4eG4NMPtYU","lore_tm_v1_T_i73m2C-KBFzpmwUlZy5DfQ8sxgJcRNxIdvh-orx-s","lore_tm_v1_yLqCwoT7HWpIulncOauOtyRwhfU3dTbC-B6nBt2ORmo","lore_tm_v1_fc2CEw4fUZb7ubjAIWDdOPQbNW2z82lhR49JLqtfBHM","lore_tm_v1_fN7CDJSOheHz1k49jo8iQGVOTQ9gA9ilhdBZEHN-Gm0"]
Date: Sep 10, 2026
zstdCompressAsync is guarded because zstdCompress is unavailable on Node.js < 22.15, avoiding promisify(undefined) at import time.packages/cli/src/lib/db/schema.ts, packages/cli/src/lib/db/regions.ts, packages/cli/src/lib/token-host.ts, packages/cli/src/lib/region.ts, and packages/cli/src/lib/api/organizations.ts.packages/cli/src/lib/db/regions.ts now uses process-local trustedRegionOrigins: Map<string, Set<string>>, keyed by normalized control-silo sourceOrigin, plus seededSourceOrigins: Set<string>. registerTrustedRegionOrigins(sourceOrigin, urls) normalizes both source and URLs before adding valid origins.seedTrustedRegionOriginsIfNeeded(sourceOrigin) lazy-loads only provenance-matching persisted entries via SELECT DISTINCT region_url FROM org_regions WHERE source_origin = ?; if the DB/table is unavailable, it catches the error and relies on explicit registration after a trusted response.registerTrustedRegionUrls(sourceOrigin, urls) publicly registers regional URLs announced by a control silo before persistence, allowing trusted fan-out. isTrustedRegionOrigin(origin, sourceOrigin) normalizes the source, lazy-seeds only matching-provenance rows, and returns whether that source’s trusted set contains the normalized requested origin.clearTrustedHostState() and test-only resetTrustedRegionUrlsForTesting() clear both trustedRegionOrigins and seededSourceOrigins; clearTrustedHostState() is called by clearAuth() but deliberately preserves the login trust anchor in token-host.ts for re-authentication.OrgRegionRow now includes nullable source_origin; OrgRegionEntry includes required sourceOrigin described as the control-silo origin that returned regionUrl, required for host trust, plus optional orgId, orgName, and orgRole.getOrgRegion(orgSlug, sourceOrigin) and getOrgByNumericId(numericId, sourceOrigin) query org_regions constrained by normalized source_origin, preventing cross-credential region-cache reuse. getOrgByNumericId returns { slug, regionUrl } only when both numeric ID and provenance match.setOrgRegion(orgSlug, regionUrl, sourceOrigin) persists normalized source_origin and registers the region URL as trusted for that source. setOrgRegions(entries) transaction-upserts rows including normalized entry provenance and registers every entry’s region URL afterward.clearOrgRegions() deletes all org_regions rows and clears process-local trusted-host state.getCachedOrganizations() remains globally queried rather than provenance-filtered; it returns complete org_id/org_name rows newer than ORG_CACHE_TTL_MS = 7 * 24 * 60 * 60 * 1000 (7 days), unless disableOrgCache() has set orgCacheDisabled. getCachedOrgRole(orgSlug) similarly returns a non-null role newer than that TTL.packages/cli/src/lib/token-host.ts imports isTrustedRegionOrigin and extends isOriginTrustedFor(requestInput, anchorHost): it accepts exact/SaaS-equivalent anchors through isHostTrusted, otherwise accepts a normalized request origin only if isTrustedRegionOrigin(requestOrigin, anchorHost) validates it under that anchor’s provenance.https://sentry.io and *.sentry.io. getActiveTokenHost() prefers usable stored OAuth host unless an env token is present with SENTRY_FORCE_ENV_TOKEN; then it uses getEnvTokenHost().registerLoginTrustAnchor(url) stores a normalized explicit --url or boot-time env origin; .sentryclirc does not register it. isLoginTrustAnchorFor(host) requires an actual host-trust match, preventing stale anchors from admitting another host. With no active token, isRequestOriginTrusted() returns true; custom headers instead fail closed absent an active token or login anchor.packages/cli/src/lib/resolve-target.ts’s normalizeNumericOrg(orgId) preserves nonnumeric identifiers; for numeric IDs it first calls getOrgByNumericId(orgId), then dynamically imports and runs listOrganizationsUncached() on cache miss, retries the cache, and falls back to the original ID if refresh fails or cannot resolve it. This supports DSN numeric IDs because some endpoints reject them with 404/403.packages/cli/src/lib/db/regions.ts, packages/cli/src/lib/resolve-target.ts, and packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts.src/lib/db/regions.ts, src/lib/resolve-target.ts, src/lib/token-host.ts, and test/lib/security/refresh-token-poison.test.ts; it suggested multiline formatting and sorted imports. No fixes were applied in that first check.test.poolOptions was removed in Vitest 4 and prior poolOptions must be top-level options.test/lib/db/auth.host.test.ts test clearAuth evicts region-URL allow-list but PRESERVES login trust anchor expected isTrustedRegionOrigin("https://us.host-a.com") true after calling obsolete registerTrustedRegionUrls(["https://us.host-a.com"]); the new provenance API requires source origin. Other 3 test files passed (50 tests).packages/cli/test/lib/db/auth.host.test.ts and packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts.test/lib/security/sntrys-claim-mismatch.test.ts test forced env token never uses a region cached for stored OAuth correctly avoided the cached OAuth region but assertion regex expected /Failed to get chunk upload options|Invalid chunk upload options/i; received Unexpected response format from organizations/cached-org/chunk-upload/. Other 3 test files passed (51 tests).packages/cli/test/lib/security/sntrys-claim-mismatch.test.ts to accommodate the actual safe failure response.test.poolOptions deprecation warning and informational host-scoped credential migration logs for https://legacy-configured.example.com and https://sentry.io.TS2322 in src/lib/db/regions.ts(258,9): normalizeOrigin(entry.sourceOrigin ?? DEFAULT_SENTRY_URL) has type string | undefined, incompatible with batch-upsert Record<string, string | number | null>. Assistant identified this as an optional provenance persistence normalization issue.setOrgRegions() used entry.sourceOrigin ?? DEFAULT_SENTRY_URL both for source_origin persistence and registerTrustedRegionUrls; DEFAULT_SENTRY_URL is intended as fallback when fixture/legacy entry provenance is absent.packages/cli/src/lib/db/regions.ts to fix the TypeScript optional-provenance issue; broader affected-suite validation was planned but not yet reported.