* fix(security): xlsx CVE bump and bundled security hardening
* fix(stripe): use configured secret key for SDK init
Avoids leaving a recognisable placeholder string in heap dumps and
error serialisations. Webhook verification remains a purely local
HMAC operation; the SDK's constructor key is unused by it.
Addresses Greptile feedback on #4481.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(stripe): use static Stripe.webhooks for verification
Avoids instantiating a Stripe client just to access constructEvent.
The webhook signing secret is per-trigger (user-provided whsec_…) and
unrelated to our billing STRIPE_SECRET_KEY, so coupling them was wrong.
Stripe.webhooks is exposed as a static — no client, no API key needed.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* fix(ci): revert client-bundled tools to avoid .server import in client
* fix(security): collapse 403 to 404 on v1 detail-by-ID routes
* chore(security): remove unused validateAgiloftInstanceUrl helper
* fix(security): bump minimatch + clean up scripts/ workspace
Resolves CVE-2026-27903 (GHSA-7r86-cg39-jmmj) by adding a root-level
minimatch ^10.2.5 override. Also resolves CVE-2026-0969 in next-mdx-remote
(bumped to ^6.0.0).
Cleanup:
- Make scripts/ a proper bun workspace (root workspaces array)
- Remove duplicate scripts/package-lock.json (this repo uses bun)
- Remove redundant scripts/bun.lock (now hoisted to root)
- Remove vestigial scripts/setup-doc-generator.sh
- Slim scripts/package.json to its real deps (glob, yaml)
- Gitignore stray package-lock.json files
- Update scripts/README.md
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* update infra and remove railway
* feat(tools): add generic mail sending block/tools, updated docs script
* Revert "update infra and remove railway"
This reverts commit abfa2f8d51.
* remove message id
* updated type
* feat(domain): drop the
* change all references for Sim Studio to Sim
* change back license and notice
* lint
---------
Co-authored-by: waleedlatif <waleedlatif@waleedlatifs-MacBook-Pro.local>
* added turborepo
* finished turbo migration
* updated gitignore
* use dotenv & run format
* fixed error in docs
* remove standalone deployment in prod
* fix ts error, remove ignore ts errors during build
* added formatter to the end of the docs generator
* added scaffolding for auto-generating docs for integrations based on block definition, get rendering error for mdx pages
* page renders, have to add more useful information
* standardized tool naming convention, added script to autogenerate docs for integrations, added docs for each tool
* re-generated docs, updated CONTRIBUTING.md to reflect new format
* added a dedicated tools page
* added additional information for tools, added manual section logic to docs producer
* added a link back to sim studio, fixed z level issue on mobile, added better intro
* updated script to more accurately reflect the params for each tool, as well as the overall blocks' output
