@sentry/api 1.25.0 → 1.26.0

package/README.md

@@ -553,7 +553,7 @@ Generic helpers delegate cancellation to your fetcher. Pass its signal through t
 
 `@sentry/api/client` is the request layer the Sentry CLI and MCP servers share, built on the generated operations. It uses only web-standard APIs (`fetch`, `Request`, `Headers`, `URL`, `AbortSignal`, `crypto.subtle`), so it runs in Node, Cloudflare Workers, and browsers. Hosts inject what differs between them:
 
-- **Transport.** `createApiTransport` sets `Authorization` from a `CredentialProvider`, refreshes the credential once after a 401, times out each attempt, retries through the shared retry policy (429 for any method; 500, 502, 503, 504, timeouts, and network errors only for GET, HEAD, OPTIONS, or writes marked idempotent), follows redirects only to trusted origins, and serves and invalidates cached GETs. The host passes credentials, a `TransportCache`, the request-scoped `fresh` hook, a logger, a span hook, and its error classes.
+- **Transport.** `createApiTransport` sets `Authorization` from a `CredentialProvider`, refreshes the credential once after a 401, times out each attempt, retries through the shared retry policy (429 for any method; 500, 502, 503, 504, timeouts, and network errors only for GET, HEAD, OPTIONS, or writes marked idempotent), follows redirects only to trusted origins, and serves and invalidates cached GETs. `CredentialProvider.current` receives the request URL and the organization and project its path targets (`parseApiPathScope`), so a host with several logins can pick the one that can reach that organization. The host passes credentials, a `TransportCache`, the request-scoped `fresh` hook, a logger, a span hook, and its error classes.
 - **Request core.** `createApiClientCore` sends `<origin>/api/0<path>` through the transport and throws the status's `ApiError` subclass for an error response. `sdkClient` gives a generated operation a client that sends through the same path.
 - **Response cache.** The cache policy (`lookupResponse`, `storeResponse`, tiers, identity-scoped keys, invalidation) works on any `CacheStore` and `BodyCodec`. `createMemoryStore` is a byte-budgeted in-memory store. Compressing codecs need host APIs such as `node:zlib`, so hosts supply them.
 - **Validation.** Endpoint wrappers validate responses with any [Standard Schema](https://standardschema.dev) validator the host passes in, such as the `@sentry/api/zod` or `@sentry/api/valibot` schemas. The client depends on neither.

package/dist/api-client/api-path.d.ts

@@ -30,5 +30,25 @@ export declare function buildSentryApiUrl(baseUrl: string, endpoint: string): st
  * ```
  */
 export declare function apiPath(strings: TemplateStringsArray, ...values: (string | number)[]): string;
+/** The organization, and project when present, an API path targets. */
+export type ApiPathScope = {
+    organization: string;
+    project?: string;
+};
+/**
+ * The organization, and project when present, a Sentry API request targets,
+ * read from its path: `/organizations/{org}/`, `/projects/{org}/{project}/`,
+ * `/teams/{org}/`, and `/organizations/{org}/projects/{project}/`.
+ *
+ * Accepts a full URL, whose path must contain `/api/0/` (a self-hosted
+ * install may serve it under a prefix), or a path relative to `/api/0/` with
+ * or without that prefix. Undefined for unscoped paths, list endpoints such
+ * as `/organizations/`, and schema placeholders.
+ *
+ * Hosts with several credentials use it to pick the one that can reach the
+ * organization; {@link createApiTransport} passes it to
+ * `CredentialProvider.current`.
+ */
+export declare function parseApiPathScope(urlOrPath: string): ApiPathScope | undefined;
 /** `path` with `query` appended, or `path` alone when `query` is empty. */
 export declare function withQuery(path: string, query: URLSearchParams): string;

package/dist/api-client/index.js

@@ -240,6 +240,41 @@ function apiPath(strings, ...values) {
     return acc + literal + encoded;
   }, "");
 }
+var API_PATH_IDENTIFIER = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+function isApiPathIdentifier(segment) {
+  return segment !== void 0 && API_PATH_IDENTIFIER.test(segment);
+}
+function apiPathSegments(urlOrPath) {
+  const isUrl = URL.canParse(urlOrPath);
+  const path = isUrl ? new URL(urlOrPath).pathname : urlOrPath.split(/[?#]/, 1)[0] ?? "";
+  const segments = path.split("/").filter((segment) => segment.length > 0);
+  for (let index = 0; index < segments.length - 1; index += 1) {
+    if (segments[index] === "api" && segments[index + 1] === "0") {
+      return segments.slice(index + 2);
+    }
+  }
+  return isUrl ? void 0 : segments;
+}
+function parseApiPathScope(urlOrPath) {
+  const segments = apiPathSegments(urlOrPath);
+  if (!segments) {
+    return;
+  }
+  const [resource, organization, next, project] = segments;
+  if (!isApiPathIdentifier(organization)) {
+    return;
+  }
+  if (resource === "organizations") {
+    return next === "projects" && isApiPathIdentifier(project) ? { organization, project } : { organization };
+  }
+  if (resource === "projects") {
+    return isApiPathIdentifier(next) ? { organization, project: next } : { organization };
+  }
+  if (resource === "teams") {
+    return { organization };
+  }
+  return;
+}
 function withQuery(path, query) {
   const queryString = query.toString();
   return queryString ? `${path}?${queryString}` : path;
@@ -1703,7 +1738,7 @@ function createApiTransport(config) {
     const run = async () => {
       const startTime = performance.now();
       const elapsed = () => (performance.now() - startTime).toFixed(0);
-      const credential = credentials ? await credentials.current() : ANONYMOUS;
+      const credential = credentials ? await credentials.current(credentialRequest(url)) : ANONYMOUS;
       const lookup = cache && method === "GET" && !options.validateRedirects && !config.fresh?.() ? await cache.lookup({
         url,
         requestHeaders: lookupHeaders(credential),
@@ -1737,6 +1772,10 @@ function createApiTransport(config) {
   }
   return { request };
 }
+function credentialRequest(url) {
+  const scope = parseApiPathScope(url);
+  return scope ? { url, scope } : { url };
+}
 async function drainBody(response, signal) {
   const drained = response.body?.pipeTo(new WritableStream());
   if (!drained) {
@@ -1858,6 +1897,7 @@ export {
   normalizeStatsPeriod,
   normalizeUrl,
   paginate,
+  parseApiPathScope,
   parseRetryDelayMs,
   parseStatsPeriod,
   readErrorResponse,

package/dist/api-client/transport.d.ts

@@ -10,6 +10,7 @@
  * and spans.
  */
 import { type RetryPolicy } from "./retry.js";
+import { type ApiPathScope } from "./api-path.js";
 import type { CacheLookup } from "./response-cache/policy.js";
 type FetchInput = Request | string | URL;
 /** The fields the transport reads; hosts extend it with their own. */
@@ -18,9 +19,23 @@ export type TransportCredential = {
     /** Stable hash of the login, for cache scoping; never a raw token. */
     identity: string;
 };
+/** The request a credential is chosen for; see {@link CredentialProvider.current}. */
+export type CredentialRequest = {
+    url: string;
+    /**
+     * The organization, and project when present, the URL path targets
+     * ({@link parseApiPathScope}). Absent for unscoped paths.
+     */
+    scope?: ApiPathScope;
+};
 export type CredentialProvider<C extends TransportCredential> = {
-    /** The credential for a new request, before any refresh. Cache lookups use it. */
-    current(): C | Promise<C>;
+    /**
+     * The credential for a new request, before any refresh. Cache lookups use
+     * it. A host with several logins can use `request.scope` to pick the one
+     * that can reach the organization. The URL is already built, so the
+     * credential must be valid for its origin.
+     */
+    current(request: CredentialRequest): C | Promise<C>;
     /** Called after a cache miss, before the first attempt, to refresh ahead of expiry. */
     prepare?(credential: C): Promise<C>;
     /** After a 401: the refreshed credential, or undefined when it cannot refresh. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/api",
-  "version": "1.25.0",
+  "version": "1.26.0",
   "description": "Official auto-generated TypeScript client for the Sentry public REST API",
   "keywords": [
     "sentry",