* chore(typescript): upgrade to TypeScript 7 (native Go compiler)
Bumps typescript to ^7.0.2 across every workspace package. Full
bun run type-check/lint/build/test all pass; apps/sim's type-check
(the one needing an 8GB heap bump) drops from ~55s to ~7s wall time.
Migration fixes required by TS7's stricter defaults:
- baseUrl removed: drop it from 5 tsconfigs (paths already resolved
relative to tsconfig dir, so behavior is unchanged) and prefix the
one bare (non-relative) paths entry each in apps/sim and
apps/realtime with './'
- moduleResolution=node10 removed: switch packages/cli and
packages/ts-sdk to "bundler", matching the rest of the monorepo
- types now defaults to [] instead of auto-including every @types/*
package: add "types": ["node"] to the shared base tsconfig (this
is fundamentally a Node monorepo, so this restores prior behavior
in one place instead of duplicating it per-package), add explicit
@types/node deps to packages that now rely on it transitively via
@sim/db/@sim/logger, and add "declare module '*.css'" to the two
packages with plain (non-module) CSS side-effect imports that
TS7's stricter checker now flags
- packages/logger's isomorphic `typeof window` check no longer needs
DOM lib in every consumer: replaced with `'window' in globalThis`
- packages/testing and apps/realtime's fetch/DOM mocks need DOM lib
where they're compiled, since they model the browser Fetch API
- the `typescript` npm package no longer exports the classic
Compiler API from its main entry (moved to unstable/ast subpaths);
apps/sim's Function-block route used it at runtime to strip
import statements from user code, so that one call site now uses
Microsoft's official transition package, @typescript/typescript6
- Next.js 16.2.6's own TypeScript-detection heuristic hardcodes a
path TS7 no longer ships, and its auto-install fallback assumes
npm/pnpm; added @typescript/native-preview as a devDependency to
apps/sim and apps/docs so Next detects a valid native compiler
instead of trying (and failing) to auto-install one
Not merging yet: TS 7.0.2 published today and is still inside this
repo's bunfig.toml minimumReleaseAge (7-day) supply-chain gate, so
`bun install` will fail for everyone until 2026-07-15. Opening this
now to get it through review; hold the actual merge until then.
* fix(typescript): address Greptile review findings on TS7 upgrade
- packages/logger: 'window' in globalThis treats a shim that leaves
globalThis.window explicitly undefined as browser-only, silently
dropping production server logs. Restore the original
typeof !== 'undefined' semantics via an inline cast instead, so it
stays correct without requiring DOM lib in every consumer.
- packages/ts-sdk, packages/cli: both are tsc-built, published as
Node ESM (package.json "type": "module" with an "exports" map).
"moduleResolution": "bundler" is too permissive for that target -
it accepts import patterns (e.g. extensionless relative imports)
that Node's actual ESM resolver rejects at runtime. Switch both to
"module"/"moduleResolution": "nodenext", the correct pairing for a
published Node ESM package. Verified real tsc builds (not just
--noEmit) still succeed for both.
* chore(bunfig): temporarily disable minimumReleaseAge gate for TS7 install
TS 7.0.2 published today, still inside the 7-day gate. Lowering to 0
to unblock this merge; will restore to 604800 in an immediate follow-up
commit right after merging.
* feat(secrets): ingest env secrets at container runtime instead of fanning into ECS taskdef
The app/socket ECS taskdefs were ~42KB, ~93% of which was the secrets[] array:
268 pointer entries each restating the full ~78-char secret ARN, marching toward
the 64KB taskdef limit and growing ~150 bytes per hosted key added. The secret
blob itself is only ~18KB/268 keys.
Move secret delivery to container boot: new @sim/runtime-secrets loadRuntimeSecrets()
reads SIM_ENV_SECRET_ID, fetches the combined secret once, and hydrates process.env
(no-clobber, no-op when unset, fail-fast). Bootstrap entrypoints for app + realtime
await it before importing the real server (env-flags reads env at module load). The
app bootstrap is bun-bundled in the Dockerfile builder stage since it runs outside
the Next standalone bundle; realtime keeps full node_modules and runs the TS entry.
Backward-compatible: with the current fan-out taskdef the loader no-ops and the app
reads the injected env vars unchanged. The matching infra change (empty secrets[] +
SIM_ENV_SECRET_ID) ships separately, after this image is live.
* fix(runtime-secrets): address review feedback
- Move the binary-secret guard outside the retry loop (sendWithRetry) so a
missing SecretString throws immediately instead of burning 3 attempts + backoff.
- Bound each Secrets Manager request with AbortSignal.timeout(5s) so a stalled
response can't hang boot indefinitely.
- Drop the redundant @aws-sdk/client-secrets-manager pin from apps/realtime; it
resolves transitively via @sim/runtime-secrets.
- Add a test for the non-retriable binary-secret path.
Waleed