Dashboard › cli › Distillation
900a4abe-981a-400d-97b3-5cd9659a514f["lore_tm_v1_tk6A0Qa_U6gMY733bN-VZHUecCzC1-XfQeTNA2kJ7Vk","lore_tm_v1_uU4opb0jzjQd-d-stexm36kNOKCJ8kJf75AV6EQYJyY"]
validateMethod() therefore permits offline mode only when method === "curl" and rejects offline use with other installation methods.stripTrailingSep(p) strips a trailing path separator only when p.length > 1; it never strips the separator from a bare root such as /, while allowing entries like ~/.local/bin/ and ~/.local/bin to compare equally.resolveUpgradeSource() returns the successful source probe response so the caller never repeats the request; only HTTP 404 advances to the next source, while every other HTTP error or network failure aborts immediately.new UpgradeTransportError(buildTlsErrorDetail(error)), and other source-probe connection failures throw new UpgradeTransportError(\Failed to connect to GitHub: ${stringifyUnknown(error)}`), replacing UpgradeError("network_error", ...)`.fetchUpgradeProbe() preserves cancellation provenance: if options.signal?.aborted, it throws options.signal.reason; an Error named "AbortError" is also rethrown unchanged.validateStableVersion(data.version, "npm registry"), replacing the narrower check that only rejected a missing data.version with "No version found in npm registry"."never uses the cached target after %s".sentry cli defaults ca-cert via getDefaultCaCert(), 2. the trimmed NODE_EXTRA_CA_CERTS environment variable; the first readable PEM wins.tryReadPem(path) logs readCaCertFile(path) failures and returns undefined.readCaCertFile(path) synchronously reads UTF-8 PEM content and returns { ok: true, content }; unreadable/missing files return { ok: false, reason: \CA certificate file not found or not readable: ${path}` }, and files lacking "-----BEGIN CERTIFICATE-----"return reason"File does not contain PEM certificate data (expected -----BEGIN CERTIFICATE-----)."`CaSource = "default" | "env" | "none" and process-level cache fields resolved, resolvedSource, resolvedLabel, hasResolved, and warnedSaas.ca-cert SQLite default throws, CA resolution logs "Failed to read stored ca-cert default from database" and falls through to environment-variable sources rather than aborting.rootCertificates using [...rootCertificates, pem].join("\n") because Bun’s tls.ca replaces its default Mozilla CA bundle; getCustomTlsOptions() returns { tls: { ca: combined } } or undefined when no custom CA is configured.setDefaultCACertificates from node:tls; injectIntoNodeTls(customPem) installs [...rootCertificates, customPem] process-wide so built-in fetch() trusts the custom CA. Node 22 treats this as a no-op and relies on native NODE_EXTRA_CA_CERTS handling.setDefaultCACertificates() are nonfatal and logged at debug level as "Failed to set Node.js default CA certificates: ${err}"; successful injection logs "Injected custom CA into Node.js TLS trust store".warnIfSaasWithEnvCa(targetUrl) emits a one-time warning only when the loaded CA source is "env" and isSentrySaasUrl(targetUrl) is true. A stored default configured through sentry cli defaults ca-cert counts as explicit acknowledgment and suppresses the warning.resolvedLabel, says custom CA certificates are being used for sentry.io connections, and gives the suppression command sentry cli defaults ca-cert /path/to/cert.pem..cause chain: 1. "unable to get local issuer certificate", 2. "unable to verify the first certificate", 3. "UNABLE_TO_VERIFY_LEAF_SIGNATURE", 4. "DEPTH_ZERO_SELF_SIGNED_CERT", 5. "SELF_SIGNED_CERT_IN_CHAIN"."CERT_HAS_EXPIRED" and "ERR_TLS_CERT_ALTNAME_INVALID" because expired certificates and hostname mismatches are not repairable by adding a custom CA and would make CA-setup guidance misleading.getTlsCertErrorMessage(error) walks nested Error.cause values with a Set<unknown> cycle guard and returns the first message matching a TLS CA-trust pattern; this extracts the root TLS failure from Node’s generic TypeError: fetch failed wrapper.isTlsCertError(error) is defined as whether getTlsCertErrorMessage(error) returns a value; buildTlsErrorDetail(error) uses the root TLS message when available and distinguishes failures that occur even after custom CAs are loaded.