Switch CLI from Zod to Valibot

[sentry-junior]

Switch the Sentry CLI runtime validation from Zod to Valibot to reduce startup overhead.

• CLI currently uses Zod for config, OAuth, API response validation, and related types
• Valibot chosen over ArkType for lower startup cost; ArkType is a better fit for long-running processes
• Related context on Zod memory overhead: https://x.com/bentlegen/status/2084750022063579522

Requested by Burak Yigit Kaya.

--

View Junior Session [Sentry]

[MathurAditya724]

Hey Jared, Create a PR which resolves this issue

[BYK]

Jared?

[MathurAditya724]

Hey Jared — the previous run got interrupted mid-task by an infrastructure deploy (Phase 1 → Phase 2 cutover), so its progress was lost. Please retry from scratch: open a PR that switches the CLI's runtime validation from Zod to Valibot per this issue. Note the earlier finding that some Zod schemas come transitively from @sentry/api; migrate the CLI's own validation (config, OAuth, API response types) to Valibot and call out anything that must stay on Zod due to that coupling.

[MathurAditya724]

jared status?

[jared-outpost]

on it — migrating the CLI's self-contained runtime validation (OAuth device-flow responses, config file schema, DSN cache, qrcode options) from zod to valibot.

heads up on scope: a chunk of the CLI's zod usage is coupled to zod in ways that can't be swapped in isolation, so those stay on zod for now and i'll call them out in the PR:

• types/sentry.ts, types/feedback.ts, lib/api/replays.ts compose/consume auto-generated schemas from @sentry/api/zod (external, zod-based)
• lib/api/infrastructure.ts is the central response validator every lib/api/* schema flows through; it also reads ZodError.issues for telemetry
• lib/formatters/output.ts introspects zod internals (_def.typeName) for --help/skill generation

opening a draft PR with the uncoupled migration shortly.

[BYK]

Jared, where's my PR?

[MathurAditya724]

Jared, my fav bot can you finish up and create the PR for this, pretty please ❤️

[jared-outpost]

done — opened #1370 (draft) 🎉

migrated the uncoupled runtime validation to valibot: OAuth device-flow responses, the config file schema, the DSN cache schemas, and qrcode options. 69 tests across the affected suites pass, biome is clean, and no new type errors.

as flagged earlier, these stay on zod (called out in the PR body as follow-up candidates): @sentry/api/zod-coupled schemas (types/sentry.ts, types/feedback.ts, lib/api/replays.ts), the central response validator lib/api/infrastructure.ts, and the zod-internals introspection in lib/formatters/output.ts.