refactor(cli): remove remaining zod usage, migrate to valibot

[jared-outpost]

finishes the zod→valibot migration from #1370/#1388 and drops the zod dependency entirely. covers all three coupling categories in #1371 plus the ~13 self-contained schema files that were still on zod.

what changed

• @sentry/api/zod → @sentry/api/valibot (types/sentry.ts, types/feedback.ts): switched to the v*-prefixed SDK schemas and reworked the .pick/.partial/.shape/.element derivations. valibot has no .extend, so extensions are composed via object({ ...Base.entries, ... }).
• central response validator (lib/api/infrastructure.ts + lib/api/logs.ts): z.ZodType<T> → GenericSchema<unknown, T>, schema.safeParse(x) → safeParse(schema, x), result.data/result.error.issues → result.output/result.issues. the Sentry telemetry context key is renamed zod_validation → schema_validation (⚠️ see note below).
• zod-internals introspection (lib/formatters/output.ts): extractSchemaFields/zodTypeToString read zod's _def.typeName/.shape; rewritten against valibot's runtime shape (.entries/.wrapped/.options + getDescription()), including pipe/coercion type resolution and descriptions nested under wrapper schemas.
• migrated the remaining self-contained z.object schemas (types/conversation, dashboard, replay, seer; lib/api/proguard, code-mappings, chunk-upload, dart-symbols, debug-files, preprod-artifacts, conversations, dashboards), commands/code-mappings/upload.ts, and the affected test suites' schema API usage.
• dropped zod from packages/cli/package.json + refreshed the lockfile.

testing

• tsc --noEmit: clean
• biome check ./src ./test: clean (933 files)
• generated skill docs regenerate unchanged — confirms the introspection rewrite is output-identical to the zod version
• full test/lib, test/types, test/commands suites pass (1800+ tests)

notes for reviewers

• telemetry key rename zod_validation → schema_validation in Sentry setContext — if any dashboards/alerts key off zod_validation, they'll need updating.
• @sentry/api zod peer: @sentry/api@0.256.0 still declares an optional zod: ^3.24.0 peer. with the CLI's direct zod dep removed, transitive zod (from AI SDKs) floats to v4, so pnpm prints a benign unmet-optional-peer warning. install and --frozen-lockfile both succeed; our usage goes through the valibot entrypoint so zod isn't needed at runtime.
• caught + fixed two migration regressions during self-review via the generated-docs oracle: a dropped nullable on AIConversationDetailsSchema.title, and ReplayViewOutputSchema accidentally spreading the list-item base instead of the details schema (dropping clicks/replay_type).

Closes #1371

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0108cd2. Configure here.}

[cursor]

Validation errors omit failing field paths

Low Severity

Valibot issue messages do not include their paths, so joining only issue.message removes the failing field names previously present in ZodError.message. API format failures become ambiguous, especially when several fields produce identical type errors.

Additional Locations (2)

• packages/cli/src/lib/api/logs.ts#L110-L114
• packages/cli/src/lib/api/replays.ts#L131-L136

 

^{Reviewed by Cursor Bugbot for commit 0108cd2. Configure here.}