release: promote staging to main

.agents/skills/databuddy-internal/SKILL.md

@@ -77,6 +77,7 @@ Keep additions **minimal**: one bullet, a new `rg` hint, or a routing note—eno
 - `packages/sdk`: published analytics SDK for React, Vue, and Node
 - `packages/tracker`: internal tracker script build and release package
 - `packages/encryption`, `packages/notifications`, `packages/cache`, `packages/redis`, `packages/services`, `packages/validation`, `packages/api-keys`: shared infra and domain packages
+- Knip is configured in root `knip.json` (run `bun run knip`); per-workspace test globs are required because the root `test:watch` (`bun test --watch ./apps`) script shadows the Bun plugin's per-workspace script parsing; `apps/cron` is ignored (standalone scripts, no package.json)
 
 Read [codebase-map.md](./references/codebase-map.md) when you need deeper routing guidance.
 

.changeset/sdk-storage-error-fix.md

@@ -0,0 +1,5 @@
+---
+"@databuddy/sdk": patch
+---
+
+`getAnonymousId` and `getSessionId` now return `null` instead of throwing when `localStorage` or `sessionStorage` access raises a `DOMException`. Follows the same try/catch pattern already used by `getProfileId`. URL params continue to take priority without touching storage.

.github/workflows/sdk-e2e.yml

@@ -0,0 +1,63 @@
+name: SDK E2E
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/sdk-e2e.yml"
+      - "packages/sdk/**"
+      - "packages/tracker/**"
+      - "bun.lock"
+      - "package.json"
+      - "turbo.json"
+  pull_request:
+    branches: [main, staging]
+    paths:
+      - ".github/workflows/sdk-e2e.yml"
+      - "packages/sdk/**"
+      - "packages/tracker/**"
+      - "bun.lock"
+      - "package.json"
+      - "turbo.json"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sdk-e2e-${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  sdk-e2e:
+    name: SDK Playwright
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+          restore-keys: ${{ runner.os }}-bun-
+      - run: bun install --frozen-lockfile --ignore-scripts
+      - name: Build sdk and tracker
+        run: bunx turbo run build --filter @databuddy/sdk --filter @databuddy/tracker
+      - name: Install Playwright browser
+        run: bun run --cwd packages/sdk playwright install --with-deps chromium
+      - name: Run sdk E2E
+        run: bun run --cwd packages/sdk playwright test --project=chromium
+      - name: Run tracker E2E
+        run: bun run --cwd packages/tracker playwright test --project=chromium
+      - name: Upload Playwright artifacts
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: sdk-e2e-artifacts
+          path: |
+            packages/sdk/test-results
+            packages/tracker/test-results
+          if-no-files-found: ignore
+          retention-days: 7

CONTRIBUTING.md

@@ -18,12 +18,15 @@ git clone https://github.com/databuddy-analytics/Databuddy.git
 cd databuddy
 ```
 
-2. Install dependencies:
+2. Install dependencies (requires Bun 1.2.0+, check with `bun --version`):
 
 ```bash
 bun install
 ```
 
+> [!NOTE]
+> Bun 1.2.0 is the minimum for `catalog:` dependency support. The repo pins an exact version in the `packageManager` field of `package.json`; match it with `bun upgrade` or by installing that version from https://bun.sh.
+
 3. Set up environment variables:
 
 ```bash

apps/api/package.json

@@ -10,7 +10,6 @@
     "test:watch": "TZ=UTC bunx --bun vitest"
   },
   "dependencies": {
-    "@ai-sdk/provider": "^3.0.5",
     "@contextcompany/otel": "^1.0.13",
     "@databuddy/ai": "workspace:*",
     "@databuddy/api-keys": "workspace:*",
@@ -22,7 +21,6 @@
     "@databuddy/notifications": "workspace:*",
     "@databuddy/redis": "workspace:*",
     "@databuddy/rpc": "workspace:*",
-    "@databuddy/sdk": "workspace:*",
     "@databuddy/services": "workspace:*",
     "@databuddy/shared": "workspace:*",
     "@databuddy/validation": "workspace:*",
@@ -37,21 +35,17 @@
     "ai": "^6.0.188",
     "autumn-js": "catalog:",
     "bullmq": "^5.78.0",
-    "dayjs": "^1.11.19",
     "elysia": "catalog:",
     "evlog": "catalog:",
-    "jszip": "^3.10.1",
     "keypal": "0.2.0",
     "lru-cache": "^11.2.7",
     "resend": "^4.0.1",
-    "supermemory": "^4.17.0",
     "svix": "^1.84.1",
     "zod": "catalog:"
   },
   "devDependencies": {
     "@databuddy/test": "workspace:*",
     "@types/bun": "catalog:",
-    "mitata": "^1.0.34",
     "vitest": "^4.1.5"
   },
   "peerDependencies": {

apps/api/src/http/cors.ts

@@ -4,7 +4,7 @@ const DATABUDDY_HOST_RE = /(?:^|\.)databuddy\.cc$/;
 const allowedApiOrigins = new Set(config.cors.apiOrigins);
 const MCP_PATHS = new Set(["/v1/mcp", "/v1/mcp/", "/mcp", "/mcp/"]);
 
-export function isMcpRequest(request: Request): boolean {
+function isMcpRequest(request: Request): boolean {
 	return MCP_PATHS.has(new URL(request.url).pathname);
 }
 

apps/api/src/integration/cache-auth-bypass.test.ts

@@ -1,7 +1,7 @@
 import "@databuddy/test/env";
 
 import { flags, targetGroups } from "@databuddy/db/schema";
-import { appRouter, type Context } from "@databuddy/rpc";
+import { appRouter } from "@databuddy/rpc";
 import {
 	addToOrganization,
 	apiKeyContext,
@@ -16,16 +16,12 @@ import {
 	signUp,
 	userContext,
 } from "@databuddy/test";
-import { createProcedureClient } from "@orpc/server";
 import { randomUUIDv7 } from "bun";
 import { afterAll, beforeEach, describe, expect, it } from "vitest";
+import { call } from "./helpers";
 
 const iit = hasTestDb ? it : it.skip;
 
-function call<T>(procedure: T, ctx: Context) {
-	return createProcedureClient(procedure as any, { context: ctx });
-}
-
 async function setupOwnedSite(siteOverrides?: { isPublic?: boolean }) {
 	const user = await signUp();
 	const org = await insertOrganization();

apps/api/src/integration/helpers.ts

@@ -0,0 +1,6 @@
+import type { Context } from "@databuddy/rpc";
+import { type AnyProcedure, createProcedureClient } from "@orpc/server";
+
+export function call<T extends AnyProcedure>(procedure: T, context: Context) {
+	return createProcedureClient(procedure, { context });
+}