Merge remote-tracking branch 'origin/staging' into feat/deploy-workflow-resource-panel

Author: Bill Leoutsakos

.agents/skills/add-column-type/SKILL.md

@@ -15,7 +15,7 @@ This was not always true: adding `currency` originally took ~40 edits across 32
 Do **not** hunt for places to edit. Add your type to the `ColumnType` union first and let `tsc` produce the list:
 
 ```bash
-cd apps/sim && bunx tsc --noEmit -p tsconfig.json
+cd apps/sim && bun run type-check
 ```
 
 You will get two errors, naming `column-types/registry.ts` and `column-types/registry.server.ts`. Register in both.
@@ -153,7 +153,7 @@ Registering the *type* is compiler-enforced. Registering its *metadata* is not,
 
 ## Final Validation (Required)
 
-1. **`cd apps/sim && bunx tsc --noEmit -p tsconfig.json`** — must be clean. If any file *outside* `column-types/` errors, that file has a hardcoded type list; fix it to read the registry.
+1. **`cd apps/sim && bun run type-check`** — must be clean. If any file *outside* `column-types/` errors, that file has a hardcoded type list; fix it to read the registry.
 2. **Grep for leaks** — `grep -rnE "(===|!==) '{id}'|case '{id}':" apps/sim --include='*.ts' --include='*.tsx' | grep -v column-types/`. (All three forms: a plain `!==` and a `case` are how half of `currency`'s real branches are written.) Hits are expected; judge each. A hit is fine when it mounts a specific React component or encodes a genuinely one-off behavior (`json`'s mono textarea, `date`'s timezone-aware parsing). A hit is a **leak** when it restates something the registry could answer — an icon, a label, a colour, an operator set, a cast, a coercion. Leaks get a registry field, not a new branch.
 3. **Run the suite** — `bunx vitest run lib/table 'app/workspace/[workspaceId]/tables' lib/api app/api/table app/api/v1 lib/copilot/tools/server/table`. Existing tests must pass **unchanged**; needing to edit one means you changed behavior for the other types.
 4. **`bun run lint:check`, `bun run check:api-validation`, `bun run check:client-boundary`** from the repo root.

.agents/skills/add-enrichment/SKILL.md

@@ -128,7 +128,7 @@ export const ENRICHMENT_REGISTRY: EnrichmentRegistry = {
 
 ## Step 5: Verify
 
-1. `bunx tsc --noEmit` (from `apps/sim`, `NODE_OPTIONS=--max-old-space-size=8192`) and `bunx biome check` on the changed files.
+1. `bun run type-check` (from `apps/sim`) and `bunx biome check` on the changed files.
 2. In a table → **+ New column → Enrichments** → pick the new enrichment, map its inputs to columns, name the output column(s), Save. Confirm it appears in the catalog with its icon/description.
 3. With hosted keys (or a workspace BYOK key) configured for each provider's service, run a row and confirm the cell fills; the dev-server log shows `Enrichment hit { provider }`. A row whose providers all miss completes blank; a row where every provider errored shows an error cell.
 

.claude/commands/add-column-type.md

@@ -14,7 +14,7 @@ This was not always true: adding `currency` originally took ~40 edits across 32
 Do **not** hunt for places to edit. Add your type to the `ColumnType` union first and let `tsc` produce the list:
 
 ```bash
-cd apps/sim && bunx tsc --noEmit -p tsconfig.json
+cd apps/sim && bun run type-check
 ```
 
 You will get two errors, naming `column-types/registry.ts` and `column-types/registry.server.ts`. Register in both.
@@ -152,7 +152,7 @@ Registering the *type* is compiler-enforced. Registering its *metadata* is not,
 
 ## Final Validation (Required)
 
-1. **`cd apps/sim && bunx tsc --noEmit -p tsconfig.json`** — must be clean. If any file *outside* `column-types/` errors, that file has a hardcoded type list; fix it to read the registry.
+1. **`cd apps/sim && bun run type-check`** — must be clean. If any file *outside* `column-types/` errors, that file has a hardcoded type list; fix it to read the registry.
 2. **Grep for leaks** — `grep -rnE "(===|!==) '{id}'|case '{id}':" apps/sim --include='*.ts' --include='*.tsx' | grep -v column-types/`. (All three forms: a plain `!==` and a `case` are how half of `currency`'s real branches are written.) Hits are expected; judge each. A hit is fine when it mounts a specific React component or encodes a genuinely one-off behavior (`json`'s mono textarea, `date`'s timezone-aware parsing). A hit is a **leak** when it restates something the registry could answer — an icon, a label, a colour, an operator set, a cast, a coercion. Leaks get a registry field, not a new branch.
 3. **Run the suite** — `bunx vitest run lib/table 'app/workspace/[workspaceId]/tables' lib/api app/api/table app/api/v1 lib/copilot/tools/server/table`. Existing tests must pass **unchanged**; needing to edit one means you changed behavior for the other types.
 4. **`bun run lint:check`, `bun run check:api-validation`, `bun run check:client-boundary`** from the repo root.

.claude/commands/add-enrichment.md

@@ -127,7 +127,7 @@ export const ENRICHMENT_REGISTRY: EnrichmentRegistry = {
 
 ## Step 5: Verify
 
-1. `bunx tsc --noEmit` (from `apps/sim`, `NODE_OPTIONS=--max-old-space-size=8192`) and `bunx biome check` on the changed files.
+1. `bun run type-check` (from `apps/sim`) and `bunx biome check` on the changed files.
 2. In a table → **+ New column → Enrichments** → pick the new enrichment, map its inputs to columns, name the output column(s), Save. Confirm it appears in the catalog with its icon/description.
 3. With hosted keys (or a workspace BYOK key) configured for each provider's service, run a row and confirm the cell fills; the dev-server log shows `Enrichment hit { provider }`. A row whose providers all miss completes blank; a row where every provider errored shows an error cell.
 

.claude/rules/global.md

@@ -65,3 +65,10 @@ const filtered = filterUndefined(obj)
 
 ## Package Manager
 Use `bun` and `bunx`, not `npm` and `npx`.
+
+## Type-checking
+`tsc` must resolve to the native (Go) TypeScript 7 compiler. Do not remove the `@typescript/native` alias from the root `devDependencies` — nothing imports it, and deleting it looks harmless.
+
+`apps/sim` needs `@typescript/typescript6` for its runtime TypeScript API, and that package depends on `@typescript/old` — an alias of `typescript@6` — which declares its own `tsc` bin. Package managers pick bin winners by lexical sort rather than dependency depth, so `@typescript/old` beats `typescript` and `node_modules/.bin/tsc` silently becomes the JavaScript TypeScript 6 compiler: identical diagnostics, ~10x slower (83s vs 8s on `apps/sim`). The `@typescript/native` alias exists only to sort ahead of `@typescript/old`.
+
+`bun run check:native-typecheck` fails the build if a bare `tsc` stops reporting 7.x — which is also what a newly added package that sorts ahead of `@typescript/native` and ships a `tsc` bin would look like. See [microsoft/typescript-go#4567](https://github.com/microsoft/typescript-go/issues/4567).

.claude/skills/add-settings-page/SKILL.md

@@ -37,7 +37,7 @@ Key paths:
    hand-roll a Save button, a `beforeunload`, or an "Unsaved changes" modal —
    they're centralized. See the "Save / Discard + unsaved-changes guard" section
    in `.claude/rules/sim-settings-pages.md`.
-5. **Verify:** `cd apps/sim && bunx tsc --noEmit`; `bunx biome check --write <file>`.
+5. **Verify:** `cd apps/sim && bun run type-check`; `bunx biome check --write <file>`.
 
 ## Mode B — Audit existing settings pages
 
@@ -76,7 +76,7 @@ For each page component, confirm the checklist in `.claude/rules/sim-settings-pa
    unless they're also being changed for an unrelated, deliberate reason.
 7. Remove now-unused imports (`ChipInput`/`Search`) ONLY after grepping that
    they are not still used elsewhere in the file (e.g. by a detail view).
-8. **Verify the whole sweep:** `tsc --noEmit`, `biome check` on every touched
+8. **Verify the whole sweep:** `bun run type-check`, `biome check` on every touched
    file, and run the affected pages' tests. Diff each file against the base and
    confirm the change is purely structural before shipping.
 
@@ -105,5 +105,5 @@ contract. Then, per page:
 7. Check what the old row rendered *beside* the title (a badge, a timestamp, a
    transport label). The row's title truncates as one unit, so anything folded
    into it can be ellipsised away — move it to `description` or `badge`.
-8. Verify: `tsc --noEmit`, `biome check`, the page's tests, and a diff read of
+8. Verify: `bun run type-check`, `biome check`, the page's tests, and a diff read of
    every converted block for lost props, conditions, and `key` placement.

.cursor/commands/add-column-type.md

@@ -9,7 +9,7 @@ This was not always true: adding `currency` originally took ~40 edits across 32
 Do **not** hunt for places to edit. Add your type to the `ColumnType` union first and let `tsc` produce the list:
 
 ```bash
-cd apps/sim && bunx tsc --noEmit -p tsconfig.json
+cd apps/sim && bun run type-check
 ```
 
 You will get two errors, naming `column-types/registry.ts` and `column-types/registry.server.ts`. Register in both.
@@ -147,7 +147,7 @@ Registering the *type* is compiler-enforced. Registering its *metadata* is not,
 
 ## Final Validation (Required)
 
-1. **`cd apps/sim && bunx tsc --noEmit -p tsconfig.json`** — must be clean. If any file *outside* `column-types/` errors, that file has a hardcoded type list; fix it to read the registry.
+1. **`cd apps/sim && bun run type-check`** — must be clean. If any file *outside* `column-types/` errors, that file has a hardcoded type list; fix it to read the registry.
 2. **Grep for leaks** — `grep -rnE "(===|!==) '{id}'|case '{id}':" apps/sim --include='*.ts' --include='*.tsx' | grep -v column-types/`. (All three forms: a plain `!==` and a `case` are how half of `currency`'s real branches are written.) Hits are expected; judge each. A hit is fine when it mounts a specific React component or encodes a genuinely one-off behavior (`json`'s mono textarea, `date`'s timezone-aware parsing). A hit is a **leak** when it restates something the registry could answer — an icon, a label, a colour, an operator set, a cast, a coercion. Leaks get a registry field, not a new branch.
 3. **Run the suite** — `bunx vitest run lib/table 'app/workspace/[workspaceId]/tables' lib/api app/api/table app/api/v1 lib/copilot/tools/server/table`. Existing tests must pass **unchanged**; needing to edit one means you changed behavior for the other types.
 4. **`bun run lint:check`, `bun run check:api-validation`, `bun run check:client-boundary`** from the repo root.

.cursor/commands/add-enrichment.md

@@ -122,7 +122,7 @@ export const ENRICHMENT_REGISTRY: EnrichmentRegistry = {
 
 ## Step 5: Verify
 
-1. `bunx tsc --noEmit` (from `apps/sim`, `NODE_OPTIONS=--max-old-space-size=8192`) and `bunx biome check` on the changed files.
+1. `bun run type-check` (from `apps/sim`) and `bunx biome check` on the changed files.
 2. In a table → **+ New column → Enrichments** → pick the new enrichment, map its inputs to columns, name the output column(s), Save. Confirm it appears in the catalog with its icon/description.
 3. With hosted keys (or a workspace BYOK key) configured for each provider's service, run a row and confirm the cell fills; the dev-server log shows `Enrichment hit { provider }`. A row whose providers all miss completes blank; a row where every provider errored shows an error cell.
 

.github/workflows/test-build.yml

@@ -162,6 +162,11 @@ jobs:
       - name: Trigger/block initialization cycle audit
         run: bun run check:trigger-block-cycle
 
+      # This job builds with webpack; devs run Turbopack. A specifier only webpack
+      # resolves passes here and breaks every dev server.
+      - name: Import specifier hygiene audit
+        run: bun run check:import-specifiers
+
       - name: SQL Date binding audit
         run: bun run check:sql-date-binding
 
@@ -187,6 +192,12 @@ jobs:
           fi
           bun run check:migrations "$BASE_REF"
 
+      # Runs before the type-check itself: if a bare `tsc` has fallen back to the
+      # JavaScript TypeScript 6 compiler that `@typescript/typescript6` drags in
+      # transitively, the type-check below still passes — it just takes ~10x longer.
+      - name: Native type-check audit
+        run: bun run check:native-typecheck
+
       # Every workspace, not just realtime. packages/emcn, packages/utils,
       # apps/desktop and apps/docs had no type check in CI at all; apps/sim's
       # source was covered only as a side effect of `next build` in the separate

CLAUDE.md

@@ -19,6 +19,7 @@ You are a professional software engineer. All code must follow best practices: a
   - `truncate(str, maxLength, suffix?)` from `@sim/utils/string` — never inline slice + ellipsis
   - `backoffWithJitter(attempt, retryAfterMs, options?)` / `parseRetryAfter(header)` from `@sim/utils/retry` — shared retry pacing; never reimplement exponential backoff inline
 - **Package Manager**: Use `bun` and `bunx`, not `npm` and `npx`
+- **Type-checking**: Run `bun run type-check` (per workspace) or `bunx turbo run type-check` (all of them). Do not remove the `@typescript/native` alias from the root `devDependencies` — nothing imports it, but it is what makes a bare `tsc` resolve to the native TypeScript 7 compiler instead of the ~10x slower JavaScript TypeScript 6 one that `@typescript/typescript6` pulls in transitively. `bun run check:native-typecheck` enforces this
 
 ## Architecture