fix: better source validation and refine required source fields

[knudtty]

Summary

Large refactor changing the TSource type to a true discriminated union. This means that the expected fields for kind: 'log' will differ from those for 'trace', 'session', 'metrics'.

How to test locally or on Vercel

1. yarn dev
2. Play around with the app, especially around source creation, source edits, and loading existing sources from a previous version

References

• Linear Issue: References HDX-3352
• Related PRs:

Ref: HDX-3352

[changeset-bot]

🦋 Changeset detected

Latest commit: 402547a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@hyperdx/common-utils	Patch
@hyperdx/api	Patch
@hyperdx/app	Patch
@hyperdx/otel-collector	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hyperdx-oss	Ready	Preview, Comment	Mar 17, 2026 8:57pm

[github-actions]

PR Review

• ⚠️ createdAt lost on kind-change — In updateSource (sources.ts), the replaceOne replacement object manually sets updatedAt but never preserves existing.createdAt. Since replaceOne replaces the entire document and Source.collection bypasses Mongoose timestamps, createdAt will be wiped on kind change → Add createdAt: existing.createdAt to the replacement object.

• ⚠️ replaceOne has no team filter — Source.collection.replaceOne({ _id: existing._id }, replacement) only filters by _id. While team ownership was verified earlier, adding team: existing.team to the filter would make this more defensive against TOCTOU edge cases → Source.collection.replaceOne({ _id: existing._id, team: existing.team }, replacement).

• ⚠️ Two @ts-expect-error suppressions — createSource and updateSource both use @ts-expect-error to work around Mongoose discriminator type incompatibilities. These are load-bearing suppressions that could hide regressions if the underlying types change → Worth investigating if the type can be properly narrowed (e.g., via overloads or explicit casting with a comment explaining why it's safe).

• ℹ️ Source cast to unknown as mongoose.Model<ISource> — SourceModel is cast to Source via double assertion (as unknown as mongoose.Model<ISource>). Combined with the @ts-expect-errors, this means Mongoose discriminator type interactions are entirely untyped. Not a blocker if tests cover the behavior, but worth noting as a maintenance risk.

[github-actions]

E2E Test Results

❌ 10 tests failed • 80 passed • 3 skipped • 1112s

Status	Count
✅ Passed	80
❌ Failed	10
⚠️ Flaky	3
⏭️ Skipped	3

Tests ran across 4 shards in parallel.

View full report →