@@ -14,7 +14,7 @@
  * @module
  */
 
-import { createHmac, randomUUID } from "node:crypto";
+import { randomUUID } from "node:crypto";
 import {
   mkdir,
   readdir,
@@ -26,6 +26,11 @@ import {
   writeFile,
 } from "node:fs/promises";
 import { join } from "node:path";
+import {
+  buildCacheKey as buildIdentityCacheKey,
+  classifyUrl,
+  FALLBACK_TTL_MS,
+} from "@sentry/toolkit-core/response-cache";
 import CachePolicy from "http-cache-semantics";
 import pLimit from "p-limit";
 
@@ -39,127 +44,20 @@ import { recordCacheHit, withCacheSpan } from "./telemetry.js";
 const log = logger.withTag("response-cache");
 
 // ---------------------------------------------------------------------------
-// TTL tiers — used as fallback when the server sends no cache headers
-// ---------------------------------------------------------------------------
-
-/**
- * TTL tier classification for URLs.
- *
- * - `stable`: data that changes infrequently (orgs, projects, teams,
- *   organization event details, trace-item details)
- * - `volatile`: data that changes often (issues and their events, project
- *   event details, full traces, log and span queries)
- * - `no-cache`: never cache (polling endpoints like autofix state)
- *
- * No tier treats a response as immutable. Event payloads embed mutable
- * fields (`nextEventID`, user reports, release data), `latest`/`oldest`/
- * `recommended` resolve to different events over time, and traces gain
- * spans as they arrive (getsentry/sentry#128818).
- */
-type TtlTier = "stable" | "volatile" | "no-cache";
-
-/** Fallback TTL durations by tier (milliseconds). `no-cache` uses 0 as a sentinel. */
-const FALLBACK_TTL_MS: Record<TtlTier, number> = {
-  stable: 5 * 60 * 1000, // 5 minutes
-  volatile: 60 * 1000, // 60 seconds
-  "no-cache": 0,
-};
-
-/**
- * URL patterns grouped by TTL tier.
- *
- * Checked in tier priority order (no-cache → volatile).
- * "stable" has no patterns — it is the default fallback when nothing else matches.
- *
- * TODO: Classify by generated operation metadata from `@sentry/api` instead
- * of URL regexes, once it ships per-operation metadata
- * (getsentry/sentry-api-schema#81) and a route-keyed operation map
- * (getsentry/sentry-api-schema#102).
- */
-const URL_TIER_REGEXPS: Readonly<Record<TtlTier, readonly RegExp[]>> = {
-  // Polling endpoints where state changes rapidly
-  "no-cache": [/\/(?:autofix|root-cause)\//],
-  volatile: [
-    // Issue endpoints: lists, detail views, and issue events such as
-    // `/issues/{id}/events/latest/`
-    /\/issues\//,
-    /[?&]dataset=(?:logs|spans)/,
-    /\/trace-logs\//,
-    // Full traces gain spans as they arrive
-    /\/trace\/[0-9a-f]{32}\//,
-    // Project event details embed `nextEventID`/`previousEventID` and user
-    // reports, and reprocessing can change them for the same ID
-    /\/projects\/[^/]+\/[^/]+\/events\/[^/?]+\/?(?:\?|$)/,
-  ],
-  // Default fallback — no patterns needed
-  stable: [],
-};
-
-/** Tier check order — stable is the default and has no patterns to check. */
-const TIER_CHECK_ORDER: readonly TtlTier[] = ["no-cache", "volatile"];
-
-/**
- * Classify a URL into a TTL tier for fallback caching.
- *
- * @param url - Full URL string (with query params)
- * @returns The TTL tier
- * @internal Exported for testing
- */
-export function classifyUrl(url: string): TtlTier {
-  for (const tier of TIER_CHECK_ORDER) {
-    for (const pattern of URL_TIER_REGEXPS[tier]) {
-      if (pattern.test(url)) {
-        return tier;
-      }
-    }
-  }
-  return "stable";
-}
-
-// ---------------------------------------------------------------------------
-// Cache key generation
+// Cache keys — tiers, keys, and invalidation prefixes live in toolkit-core
 // ---------------------------------------------------------------------------
 
 /**
- * Build a deterministic cache key from the active identity + method + URL.
- *
- * Query params are sorted alphabetically so `?a=1&b=2` and `?b=2&a=1`
- * produce the same key. The identity fingerprint scopes entries per
- * bearer token so switching accounts never serves another user's data.
+ * Build the cache key for the active identity + method + URL.
  *
  * @internal Exported for testing
  */
-export function buildCacheKey(
+export async function buildCacheKey(
   method: string,
   url: string,
   identity = getIdentityFingerprint(),
-): string {
-  const normalized = normalizeUrl(method, url);
-  return createHmac("sha256", identity).update(normalized).digest("hex");
-}
-
-/**
- * Normalize method + URL into a stable string for cache key derivation.
- * Sorts query params alphabetically for deterministic key generation.
- *
- * @throws {TypeError} If the URL cannot be parsed
- * @internal Exported for testing
- */
-export function normalizeUrl(method: string, url: string): string {
-  const parsed = new URL(url);
-  const sortedParams = new URLSearchParams(
-    [...parsed.searchParams.entries()].sort(([a], [b]) => {
-      if (a < b) {
-        return -1;
-      }
-      if (a > b) {
-        return 1;
-      }
-      return 0;
-    }),
-  );
-  parsed.search = sortedParams.toString() ? `?${sortedParams.toString()}` : "";
-  return `${method.toUpperCase()}|${parsed.toString()}`;
+): Promise<string> {
+  return await buildIdentityCacheKey(method, url, identity);
 }
 
 // ---------------------------------------------------------------------------
@@ -451,10 +349,10 @@ export async function getCachedResponse(
   let key: string;
   // oxlint-disable-next-line sentry-cli/no-silent-catch -- grandfathered silent catch — see #1531; drain by adding log.debug()/log.warn() or re-throwing.
   try {
-    key = buildCacheKey(method, url, identity);
+    key = await buildCacheKey(method, url, identity);
   } catch {
-    // Malformed URL — skip cache lookup. The request itself will surface
-    // any real URL error.
+    // Malformed URL or empty identity — skip cache lookup. The request
+    // itself will surface any real URL error.
     return;
   }
 
@@ -570,9 +468,9 @@ export async function storeCachedResponse(
   let key: string;
   // oxlint-disable-next-line sentry-cli/no-silent-catch -- grandfathered silent catch — see #1531; drain by adding log.debug()/log.warn() or re-throwing.
   try {
-    key = buildCacheKey(method, url, identity);
+    key = await buildCacheKey(method, url, identity);
   } catch {
-    // Malformed URL — skip caching this response
+    // Malformed URL or empty identity — skip caching this response
     return;
   }
 
 
@@ -11,13 +11,13 @@
 import { setTimeout as sleepMs } from "node:timers/promises";
 import type { SentryClient } from "@sentry/api";
 import { getTraceData } from "@sentry/node-core/light";
+import { computeInvalidationPrefixes } from "@sentry/toolkit-core/response-cache";
 import {
   formatAuthHeader,
   normalizeAuthToken,
   trimAuthToken,
 } from "./auth-header.js";
 import { maybeWarnEnvTokenIgnored } from "./auth-hint.js";
-import { computeInvalidationPrefixes } from "./cache-keys.js";
 import {
   DEFAULT_SENTRY_URL,
   getConfiguredSentryUrl,
 
@@ -1884,16 +1884,15 @@ describe("getLogs", () => {
 
     const result = await getLogs("my-org", "my-project", ids);
 
-    // Should have made 2 separate requests
-    expect(capturedUrls).toHaveLength(2);
-
-    // First batch: 100 IDs
-    const url1 = new URL(capturedUrls[0]);
-    expect(url1.searchParams.get("per_page")).toBe(String(API_MAX_PER_PAGE));
-
-    // Second batch: 50 IDs
-    const url2 = new URL(capturedUrls[1]);
-    expect(url2.searchParams.get("per_page")).toBe("50");
+    // One request of 100 IDs and one of 50. The batches run in parallel, so
+    // they can reach fetch in either order.
+    const perPage = capturedUrls.map((url) =>
+      new URL(url).searchParams.get("per_page"),
+    );
+    expect(perPage).toHaveLength(2);
+    expect(perPage).toEqual(
+      expect.arrayContaining([String(API_MAX_PER_PAGE), "50"]),
+    );
 
     // Results from both batches should be flattened
     expect(result).toHaveLength(2);
 
@@ -7,18 +7,16 @@
 
 import {
   array,
+  asyncProperty,
   constantFrom,
   assert as fcAssert,
   property,
   string,
   tuple,
 } from "fast-check";
+import { classifyUrl, normalizeUrl } from "@sentry/toolkit-core/response-cache";
 import { describe, expect, test } from "vitest";
-import {
-  buildCacheKey,
-  classifyUrl,
-  normalizeUrl,
-} from "../../src/lib/response-cache.js";
+import { buildCacheKey } from "../../src/lib/response-cache.js";
 import { DEFAULT_NUM_RUNS } from "../model-based/helpers.js";
 
 // ---------------------------------------------------------------------------
@@ -66,52 +64,60 @@ const sentryUrlArb = tuple(
 // ---------------------------------------------------------------------------
 
 describe("property: buildCacheKey", () => {
-  test("produces a 64-char hex string (SHA-256)", () => {
-    fcAssert(
-      property(methodArb, sentryUrlArb, (method, url) => {
-        expect(buildCacheKey(method, url)).toMatch(/^[0-9a-f]{64}$/);
+  test("produces a 64-char hex string (SHA-256)", async () => {
+    await fcAssert(
+      asyncProperty(methodArb, sentryUrlArb, async (method, url) => {
+        expect(await buildCacheKey(method, url)).toMatch(/^[0-9a-f]{64}$/);
       }),
       { numRuns: DEFAULT_NUM_RUNS },
     );
   });
 
-  test("is deterministic — same inputs produce same key", () => {
-    fcAssert(
-      property(methodArb, sentryUrlArb, (method, url) => {
-        expect(buildCacheKey(method, url)).toBe(buildCacheKey(method, url));
+  test("is deterministic — same inputs produce same key", async () => {
+    await fcAssert(
+      asyncProperty(methodArb, sentryUrlArb, async (method, url) => {
+        expect(await buildCacheKey(method, url)).toBe(
+          await buildCacheKey(method, url),
+        );
       }),
       { numRuns: DEFAULT_NUM_RUNS },
     );
   });
 
-  test("different methods produce different keys for same URL", () => {
-    fcAssert(
-      property(sentryUrlArb, (url) => {
-        expect(buildCacheKey("GET", url)).not.toBe(buildCacheKey("POST", url));
+  test("different methods produce different keys for same URL", async () => {
+    await fcAssert(
+      asyncProperty(sentryUrlArb, async (url) => {
+        expect(await buildCacheKey("GET", url)).not.toBe(
+          await buildCacheKey("POST", url),
+        );
       }),
       { numRuns: DEFAULT_NUM_RUNS },
     );
   });
 
-  test("query param order does not affect the key", () => {
-    fcAssert(
-      property(
+  test("query param order does not affect the key", async () => {
+    await fcAssert(
+      asyncProperty(
         constantFrom("https://us.sentry.io", "https://de.sentry.io"),
         pathSegmentArb,
-        (base, path) => {
+        async (base, path) => {
           const url1 = `${base}/api/0/${path}?a=1&b=2&c=3`;
           const url2 = `${base}/api/0/${path}?c=3&a=1&b=2`;
-          expect(buildCacheKey("GET", url1)).toBe(buildCacheKey("GET", url2));
+          expect(await buildCacheKey("GET", url1)).toBe(
+            await buildCacheKey("GET", url2),
+          );
         },
       ),
       { numRuns: DEFAULT_NUM_RUNS },
     );
   });
 
-  test("method comparison is case-insensitive", () => {
-    fcAssert(
-      property(sentryUrlArb, (url) => {
-        expect(buildCacheKey("get", url)).toBe(buildCacheKey("GET", url));
+  test("method comparison is case-insensitive", async () => {
+    await fcAssert(
+      asyncProperty(sentryUrlArb, async (url) => {
+        expect(await buildCacheKey("get", url)).toBe(
+          await buildCacheKey("GET", url),
+        );
       }),
       { numRuns: DEFAULT_NUM_RUNS },
     );
 
@@ -7,6 +7,7 @@
 
 import { readdir } from "node:fs/promises";
 import { join } from "node:path";
+import { normalizeUrl } from "@sentry/toolkit-core/response-cache";
 import { afterEach, beforeEach, describe, expect, test, vi } from "vitest";
 import { setAuthToken } from "../../src/lib/db/auth.js";
 import {
@@ -15,7 +16,6 @@ import {
   disableResponseCache,
   getCachedResponse,
   invalidateCachedResponsesMatching,
-  normalizeUrl,
   resetCacheState,
   storeCachedResponse,
 } from "../../src/lib/response-cache.js";
@@ -372,27 +372,29 @@ describe("normalizeUrl", () => {
 // ---------------------------------------------------------------------------
 
 describe("buildCacheKey", () => {
-  test("produces a 64-char hex string", () => {
-    expect(buildCacheKey("GET", TEST_URL)).toMatch(/^[0-9a-f]{64}$/);
+  test("produces a 64-char hex string", async () => {
+    expect(await buildCacheKey("GET", TEST_URL)).toMatch(/^[0-9a-f]{64}$/);
   });
 
-  test("is deterministic", () => {
-    expect(buildCacheKey("GET", TEST_URL)).toBe(buildCacheKey("GET", TEST_URL));
+  test("is deterministic", async () => {
+    expect(await buildCacheKey("GET", TEST_URL)).toBe(
+      await buildCacheKey("GET", TEST_URL),
+    );
   });
 
-  test("different methods produce different keys", () => {
-    expect(buildCacheKey("GET", TEST_URL)).not.toBe(
-      buildCacheKey("POST", TEST_URL),
+  test("different methods produce different keys", async () => {
+    expect(await buildCacheKey("GET", TEST_URL)).not.toBe(
+      await buildCacheKey("POST", TEST_URL),
     );
   });
 
-  test("different identities produce different keys for the same URL", () => {
+  test("different identities produce different keys for the same URL", async () => {
     // Switching accounts must route reads/writes through a different
     // namespace so users never see each other's cached data.
     setAuthToken("alice_access", 3600, "alice_refresh");
-    const aliceKey = buildCacheKey("GET", TEST_URL);
+    const aliceKey = await buildCacheKey("GET", TEST_URL);
     setAuthToken("bob_access", 3600, "bob_refresh");
-    const bobKey = buildCacheKey("GET", TEST_URL);
+    const bobKey = await buildCacheKey("GET", TEST_URL);
     expect(aliceKey).not.toBe(bobKey);
   });
 });