refactor: remove remaining Zod usage after valibot migration #1371

Jared you should shift this issue to https://github.com/getsentry/sentry-api-schema repo

@MathurAditya724 I'll work on the transition over at sentry-api-schema separately. This is to track the removal of Zod from the CLI itself.

Jared, @sentry/api@0.256.0 is out now, check it out and see if we can switch to valibot completely

Can you pick this up and open a PR for it?

@BYK opened a first-pass draft PR for this: #1388.

wanted to flag two things before going further, since one is a behavior-adjacent call and the other affects how we scope the rest:

1. the valibot entrypoint forces an @sentry/api bump — which narrows the issue-status union. the ./valibot export only actually ships a file as of @sentry/api 0.256.0 (0.253–0.255 advertise ./valibot in their exports map but ship no valibot.js). so removing @sentry/api/zod requires bumping ^0.253.0 → ^0.256.0. that bump narrows GetOrganizationIssueResponse["status"] and drops resolvedInNextRelease and muted, which tripped the ISSUE_STATUSES satisfies drift-guard in types/sentry.ts.

in the PR i kept those two statuses (they're still emitted by the retrieve-issue endpoint and still rendered by the CLI via STATUS_ICONS/STATUS_LABELS/STATUS_COLORS) and relaxed the guard to a deliberate superset — no rendering change. but it's your call: keep the superset (my pick, zero UX regression), or strictly follow the narrowed SDK union and drop them from rendering?

2. the "remaining" zod is larger than the three bullets, and can't be split cleanly. there are actually ~18 files still importing zod, and two shared hubs make it effectively all-or-nothing:

• lib/api/infrastructure.ts — schema?: z.ZodType<T> + .safeParse() is used by ~30 callsites; changing the type migrates them all at once.
• lib/formatters/output.ts — extractSchemaFields reads zod internals for ~16 commands' --help/--fields docs; valibot's runtime shape differs and needs a rewrite.

the replay SDK validator was the only piece safe to migrate in isolation, so that (plus the unblocking dep bump) is what #1388 does. the rest is a bigger, coordinated change — happy to take it on in a follow-up once you confirm the status-union direction above. full breakdown is in the PR description.

Jared, first pass got merged. Let's finish this off

JARED

JARED DONALD DUNN, get the follow up PR. NOW.

Jared, finish the work which byk is talking about