fix: verified correctness and safety fixes

.github/workflows/sdk-e2e.yml

@@ -0,0 +1,63 @@
+name: SDK E2E
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/sdk-e2e.yml"
+      - "packages/sdk/**"
+      - "packages/tracker/**"
+      - "bun.lock"
+      - "package.json"
+      - "turbo.json"
+  pull_request:
+    branches: [main, staging]
+    paths:
+      - ".github/workflows/sdk-e2e.yml"
+      - "packages/sdk/**"
+      - "packages/tracker/**"
+      - "bun.lock"
+      - "package.json"
+      - "turbo.json"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sdk-e2e-${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.head_ref || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  sdk-e2e:
+    name: SDK Playwright
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: "1.3.14"
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: ~/.bun/install/cache
+          key: ${{ runner.os }}-bun-${{ hashFiles('bun.lock') }}
+          restore-keys: ${{ runner.os }}-bun-
+      - run: bun install --frozen-lockfile --ignore-scripts
+      - name: Build sdk and tracker
+        run: bunx turbo run build --filter @databuddy/sdk --filter @databuddy/tracker
+      - name: Install Playwright browser
+        run: bun run --cwd packages/sdk playwright install --with-deps chromium
+      - name: Run sdk E2E
+        run: bun run --cwd packages/sdk playwright test --project=chromium
+      - name: Run tracker E2E
+        run: bun run --cwd packages/tracker playwright test --project=chromium
+      - name: Upload Playwright artifacts
+        if: failure()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: sdk-e2e-artifacts
+          path: |
+            packages/sdk/test-results
+            packages/tracker/test-results
+          if-no-files-found: ignore
+          retention-days: 7

apps/api/package.json

@@ -10,7 +10,6 @@
     "test:watch": "TZ=UTC bunx --bun vitest"
   },
   "dependencies": {
-    "@ai-sdk/provider": "^3.0.5",
     "@contextcompany/otel": "^1.0.13",
     "@databuddy/ai": "workspace:*",
     "@databuddy/api-keys": "workspace:*",
@@ -22,7 +21,6 @@
     "@databuddy/notifications": "workspace:*",
     "@databuddy/redis": "workspace:*",
     "@databuddy/rpc": "workspace:*",
-    "@databuddy/sdk": "workspace:*",
     "@databuddy/services": "workspace:*",
     "@databuddy/shared": "workspace:*",
     "@databuddy/validation": "workspace:*",
@@ -37,21 +35,17 @@
     "ai": "^6.0.188",
     "autumn-js": "catalog:",
     "bullmq": "^5.78.0",
-    "dayjs": "^1.11.19",
     "elysia": "catalog:",
     "evlog": "catalog:",
-    "jszip": "^3.10.1",
     "keypal": "0.2.0",
     "lru-cache": "^11.2.7",
     "resend": "^4.0.1",
-    "supermemory": "^4.17.0",
     "svix": "^1.84.1",
     "zod": "catalog:"
   },
   "devDependencies": {
     "@databuddy/test": "workspace:*",
     "@types/bun": "catalog:",
-    "mitata": "^1.0.34",
     "vitest": "^4.1.5"
   },
   "peerDependencies": {

apps/api/src/http/cors.ts

@@ -4,7 +4,7 @@ const DATABUDDY_HOST_RE = /(?:^|\.)databuddy\.cc$/;
 const allowedApiOrigins = new Set(config.cors.apiOrigins);
 const MCP_PATHS = new Set(["/v1/mcp", "/v1/mcp/", "/mcp", "/mcp/"]);
 
-export function isMcpRequest(request: Request): boolean {
+function isMcpRequest(request: Request): boolean {
 	return MCP_PATHS.has(new URL(request.url).pathname);
 }
 

apps/api/src/integration/cache-auth-bypass.test.ts

@@ -1,7 +1,7 @@
 import "@databuddy/test/env";
 
 import { flags, targetGroups } from "@databuddy/db/schema";
-import { appRouter, type Context } from "@databuddy/rpc";
+import { appRouter } from "@databuddy/rpc";
 import {
 	addToOrganization,
 	apiKeyContext,
@@ -16,16 +16,12 @@ import {
 	signUp,
 	userContext,
 } from "@databuddy/test";
-import { createProcedureClient } from "@orpc/server";
 import { randomUUIDv7 } from "bun";
 import { afterAll, beforeEach, describe, expect, it } from "vitest";
+import { call } from "./helpers";
 
 const iit = hasTestDb ? it : it.skip;
 
-function call<T>(procedure: T, ctx: Context) {
-	return createProcedureClient(procedure as any, { context: ctx });
-}
-
 async function setupOwnedSite(siteOverrides?: { isPublic?: boolean }) {
 	const user = await signUp();
 	const org = await insertOrganization();

apps/api/src/integration/helpers.ts

@@ -0,0 +1,6 @@
+import type { Context } from "@databuddy/rpc";
+import { type AnyProcedure, createProcedureClient } from "@orpc/server";
+
+export function call<T extends AnyProcedure>(procedure: T, context: Context) {
+	return createProcedureClient(procedure, { context });
+}

apps/api/src/integration/insights-handlers.test.ts

@@ -13,7 +13,6 @@ import {
 	appRouter,
 	createInternalPrincipal,
 	createRPCContext,
-	type Context,
 } from "@databuddy/rpc";
 import {
 	closeInsightsQueue,
@@ -33,9 +32,9 @@ import {
 	signUp,
 	userContext,
 } from "@databuddy/test";
-import { createProcedureClient, type AnyProcedure } from "@orpc/server";
 import { randomUUIDv7 } from "bun";
 import { afterAll, beforeEach, describe, expect, it } from "vitest";
+import { call } from "./helpers";
 
 const iit = hasTestDb ? it : it.skip;
 
@@ -67,10 +66,6 @@ function investigationOutcome(nextType: "act" | "watch"): InvestigationOutcome {
 	};
 }
 
-function call<T extends AnyProcedure>(procedure: T, context: Context) {
-	return createProcedureClient(procedure, { context });
-}
-
 async function seedExecutableGoalAction() {
 	const member = await signUp();
 	const organization = await insertOrganization();

apps/api/src/integration/link-handlers.test.ts

@@ -1,8 +1,7 @@
 import "@databuddy/test/env";
 
 import { describe, it, expect, beforeEach, afterAll } from "vitest";
-import { createProcedureClient } from "@orpc/server";
-import { appRouter, type Context } from "@databuddy/rpc";
+import { appRouter } from "@databuddy/rpc";
 import {
 	reset,
 	cleanup,
@@ -14,13 +13,10 @@ import {
 	signUp,
 	addToOrganization,
 } from "@databuddy/test";
+import { call } from "./helpers";
 
 const iit = hasTestDb ? it : it.skip;
 
-function call<T>(procedure: T, ctx: Context) {
-	return createProcedureClient(procedure as any, { context: ctx });
-}
-
 beforeEach(() => reset());
 afterAll(() => cleanup());
 

apps/api/src/integration/profile-handlers.test.ts

@@ -6,7 +6,7 @@ import {
 	profileTraitChanges,
 } from "@databuddy/db/schema";
 import { eq } from "@databuddy/db";
-import { appRouter, type Context } from "@databuddy/rpc";
+import { appRouter } from "@databuddy/rpc";
 import {
 	getTraitDistribution,
 	resolveTraitSegment,
@@ -25,15 +25,11 @@ import {
 	signUp,
 	userContext,
 } from "@databuddy/test";
-import { createProcedureClient } from "@orpc/server";
 import { afterAll, beforeEach, describe, expect, it } from "vitest";
+import { call } from "./helpers";
 
 const iit = hasTestDb ? it : it.skip;
 
-function call<T>(procedure: T, ctx: Context) {
-	return createProcedureClient(procedure as any, { context: ctx });
-}
-
 beforeEach(() => reset());
 afterAll(() => cleanup());
 

apps/api/src/integration/uptime-handlers.test.ts

@@ -23,10 +23,10 @@ import {
 	signUp,
 	userContext,
 } from "@databuddy/test";
-import { createProcedureClient, type AnyProcedure } from "@orpc/server";
 import { afterAll, afterEach, beforeEach, describe, expect, it } from "vitest";
 import { randomUUIDv7 } from "bun";
 import type { Job } from "bullmq";
+import { call } from "./helpers";
 
 const canRun =
 	hasTestDb &&
@@ -35,10 +35,6 @@ const canRun =
 const iit = canRun ? it : it.skip;
 const scheduleIds = new Set<string>();
 
-function call<T extends AnyProcedure>(procedure: T, context: Context) {
-	return createProcedureClient(procedure, { context });
-}
-
 beforeEach(async () => {
 	await reset();
 	scheduleIds.clear();

apps/api/src/integration/with-workspace.test.ts

@@ -1,13 +1,7 @@
 import "@databuddy/test/env";
 
 import { afterAll, beforeEach, describe, expect, it } from "vitest";
-import { createProcedureClient } from "@orpc/server";
-import {
-	withWorkspace,
-	withPublicWorkspace,
-	appRouter,
-	type Context,
-} from "@databuddy/rpc";
+import { withWorkspace, withPublicWorkspace, appRouter } from "@databuddy/rpc";
 import {
 	reset,
 	cleanup,
@@ -21,13 +15,10 @@ import {
 	signUp,
 	addToOrganization,
 } from "@databuddy/test";
+import { call } from "./helpers";
 
 const iit = hasTestDb ? it : it.skip;
 
-function call<T>(procedure: T, ctx: Context) {
-	return createProcedureClient(procedure as any, { context: ctx });
-}
-
 beforeEach(() => reset());
 afterAll(() => cleanup());