fix(deps): revert next to 16.2.12, its 16.3.0 optimizer deletes live code

Next 16.3.0's Turbopack optimizer models a bare `return <asyncCall>()` tail
call inside an async function as returning the promise object, then propagates
that always-truthy fact through the caller's `await`. Where the result feeds an
`if (x)` whose every branch returns, it concludes the branch is always taken and
deletes everything after it from the emitted bundle.

Two sites shipped to production that way:

- `POST /api/credentials` lost its entire create path — the transaction, the
  org locks, the insert, the audit, the 201. A first-time create fell into the
  existing-credential branch and threw on `existingCredential.id`, so every new
  credential 500'd.
- `upsertAsyncToolCall` collapsed to `async () => await getAsyncToolCall(id)`.
  The insert is simply gone; it returns null for every new async copilot tool
  call. Silent — no error, no failed request.

A differential scan of 71,266 source string literals across `.next/server` and
`.next/static`, comparing images built from the same commit on 16.2.12 and
16.3.0, found exactly these two and nothing else. That scan cannot see dropped
branches with no distinctive string literal, which is why the version goes back
rather than the two sites being patched alone.

Both are also hardened with `return await`, verified to defeat the miscompile in
a minimal reproduction. The TypeScript toolchain cleanup from the original bump
(dropping @typescript/native-preview, `useTypeScriptCli`) is kept.

Author: waleedlatif1

apps/docs/package.json

@@ -31,7 +31,7 @@
     "fumadocs-openapi": "10.8.1",
     "fumadocs-ui": "16.8.5",
     "lucide-react": "^0.511.0",
-    "next": "16.3.0",
+    "next": "16.2.12",
     "next-themes": "^0.4.6",
     "react": "19.2.4",
     "react-dom": "19.2.4",

apps/sim/app/api/credentials/route.ts

@@ -133,15 +133,24 @@ async function findExistingCredentialBySourceWith(
   return null
 }
 
+/**
+ * `return await` is load-bearing, not redundant. Next 16.3.0's Turbopack
+ * optimizer models a bare `return <asyncCall>()` tail call as returning the
+ * promise object, then propagates that always-truthy fact through the caller's
+ * `await`. It concludes `if (existingCredential)` is always taken and — because
+ * every branch inside that block returns — deletes the entire create path from
+ * the emitted bundle, so a first-time create throws on `existingCredential.id`.
+ * Awaiting here makes the optimizer model the resolved value instead.
+ */
 async function findExistingCredentialBySource(params: ExistingCredentialSourceParams) {
-  return findExistingCredentialBySourceWith(db, params)
+  return await findExistingCredentialBySourceWith(db, params)
 }
 
 async function findExistingCredentialBySourceTx(
   tx: Parameters<Parameters<typeof db.transaction>[0]>[0],
   params: ExistingCredentialSourceParams
 ) {
-  return findExistingCredentialBySourceWith(tx, params)
+  return await findExistingCredentialBySourceWith(tx, params)
 }
 
 export const GET = withRouteHandler(async (request: NextRequest) => {

apps/sim/lib/copilot/async-runs/repository.ts

@@ -29,9 +29,18 @@ const WORKFLOW_EXECUTION_CLAIM_PREFIX = 'workflow:'
 // can evaluate modules before instrumentation-node.ts finishes).
 const getAsyncRunsTracer = () => trace.getTracer('sim-copilot-async-runs', '1.0.0')
 
-// Wrap an async DB op in a client-kind span with canonical `db.*` attrs.
-// Cancellation is routed through `markSpanForError` so aborts record the
-// exception event but don't paint spans red.
+/**
+ * Wrap an async DB op in a client-kind span with canonical `db.*` attrs.
+ * Cancellation is routed through `markSpanForError` so aborts record the
+ * exception event but don't paint spans red.
+ *
+ * Every caller writes `return await withDbSpan(...)`. The `await` is
+ * load-bearing, not redundant: Next 16.3.0's Turbopack optimizer models a bare
+ * `return <asyncCall>()` tail call as returning the promise object, then
+ * propagates that always-truthy fact through the caller's `await`. It deleted
+ * the entire insert path from `upsertAsyncToolCall` in the shipped bundle
+ * because `if (existing) return existing` looked always-taken.
+ */
 async function withDbSpan<T>(
   name: string,
   op: string,
@@ -74,7 +83,7 @@ export interface CreateRunSegmentInput {
 }
 
 export async function createRunSegment(input: CreateRunSegmentInput) {
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsCreateRunSegment,
     'INSERT',
     'copilot_runs',
@@ -122,7 +131,7 @@ export async function updateRunStatus(
     requestContext?: Record<string, unknown>
   } = {}
 ) {
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsUpdateRunStatus,
     'UPDATE',
     'copilot_runs',
@@ -150,7 +159,7 @@ export async function updateRunStatus(
 }
 
 async function getLatestRunForExecution(executionId: string) {
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsGetLatestForExecution,
     'SELECT',
     'copilot_runs',
@@ -183,7 +192,7 @@ export async function getLatestRunForStream(streamId: string, userId?: string) {
 }
 
 export async function getRunSegment(runId: string) {
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsGetRunSegment,
     'SELECT',
     'copilot_runs',
@@ -213,7 +222,7 @@ async function createRunCheckpoint(input: {
   agentState: Record<string, unknown>
   providerRequest: Record<string, unknown>
 }) {
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsCreateRunCheckpoint,
     'INSERT',
     'copilot_run_checkpoints',
@@ -247,7 +256,7 @@ export async function upsertAsyncToolCall(input: {
   status?: CopilotAsyncToolStatus
   sealedContext?: AsyncCompletionData
 }) {
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsUpsertAsyncToolCall,
     'UPSERT',
     'copilot_async_tool_calls',
@@ -296,7 +305,7 @@ export async function upsertAsyncToolCall(input: {
 }
 
 export async function getAsyncToolCall(toolCallId: string) {
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsGetAsyncToolCall,
     'SELECT',
     'copilot_async_tool_calls',
@@ -324,7 +333,7 @@ async function markAsyncToolStatus(
   } = {},
   expectedStatuses?: CopilotAsyncToolStatus[]
 ) {
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsMarkAsyncToolStatus,
     'UPDATE',
     'copilot_async_tool_calls',
@@ -382,7 +391,7 @@ export function getClaimedWorkflowExecutionId(claimedBy: string | null | undefin
 
 export async function claimWorkflowToolExecution(toolCallId: string, executionId: string) {
   const claimedBy = `${WORKFLOW_EXECUTION_CLAIM_PREFIX}${executionId}`
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsMarkAsyncToolStatus,
     'UPDATE',
     'copilot_async_tool_calls',
@@ -426,7 +435,7 @@ export async function claimWorkflowToolExecution(toolCallId: string, executionId
 
 export async function releaseWorkflowToolExecutionClaim(toolCallId: string, executionId: string) {
   const claimedBy = `${WORKFLOW_EXECUTION_CLAIM_PREFIX}${executionId}`
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsReleaseClaim,
     'UPDATE',
     'copilot_async_tool_calls',
@@ -464,7 +473,7 @@ export async function releaseWorkflowToolExecutionClaim(toolCallId: string, exec
  * cannot click, type, submit, or navigate twice.
  */
 export async function claimPendingAsyncToolCall(toolCallId: string, claimedBy: string) {
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsMarkAsyncToolStatus,
     'UPDATE',
     'copilot_async_tool_calls',
@@ -545,7 +554,7 @@ export async function replaceTerminalAsyncToolCallResult(input: {
   result: AsyncCompletionData | null
   error: string | null
 }) {
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsMarkAsyncToolStatus,
     'UPDATE',
     'copilot_async_tool_calls',
@@ -588,7 +597,7 @@ export async function recordToolPermissionDecision(
   toolCallId: string,
   decision: CopilotToolPermissionDecision
 ) {
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsMarkAsyncToolStatus,
     'UPDATE',
     'copilot_async_tool_calls',
@@ -619,7 +628,7 @@ export async function recordToolPermissionDecision(
 }
 
 async function listAsyncToolCallsForRun(runId: string) {
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsListForRun,
     'SELECT',
     'copilot_async_tool_calls',
@@ -635,7 +644,7 @@ async function listAsyncToolCallsForRun(runId: string) {
 
 export async function getAsyncToolCalls(toolCallIds: string[]) {
   if (toolCallIds.length === 0) return []
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsGetMany,
     'SELECT',
     'copilot_async_tool_calls',
@@ -649,7 +658,7 @@ export async function getAsyncToolCalls(toolCallIds: string[]) {
 }
 
 export async function claimCompletedAsyncToolCall(toolCallId: string, workerId: string) {
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsClaimCompleted,
     'UPDATE',
     'copilot_async_tool_calls',
@@ -679,7 +688,7 @@ export async function claimCompletedAsyncToolCall(toolCallId: string, workerId:
 }
 
 async function releaseCompletedAsyncToolClaim(toolCallId: string, workerId: string) {
-  return withDbSpan(
+  return await withDbSpan(
     TraceSpan.CopilotAsyncRunsReleaseClaim,
     'UPDATE',
     'copilot_async_tool_calls',

apps/sim/next.config.ts

@@ -219,15 +219,16 @@ const nextConfig: NextConfig = {
      * it lives. Restoring across commits is separately undocumented-as-supported
      * (vercel/next.js#87283 reports stale HTML from a cache built elsewhere).
      *
-     * The explicit pin is load-bearing: 16.3.0 flipped this default to true for
-     * stable (vercel/next.js#94616), so dropping it re-enables the slower cache.
+     * Keep the explicit pin even while we sit on 16.2.12: 16.3.0 flips this
+     * default to true for stable (vercel/next.js#94616), so dropping it would
+     * silently re-enable the slower cache the next time we take that bump.
      */
     turbopackFileSystemCacheForBuild: false,
     /**
      * TypeScript 7 ships no JavaScript compiler API until 7.1, so Next's default
      * checker cannot load it — this shells out to the project-local `tsc` instead.
      * Pinned because the failure mode is not slower type checking but none at all:
-     * 16.2.12 skipped the stage silently in 138ms.
+     * without it 16.2.12 skips the stage silently in 138ms.
      */
     useTypeScriptCli: true,
     preloadEntriesOnStart: false,

apps/sim/package.json

@@ -193,7 +193,7 @@
     "mongodb": "6.19.0",
     "mysql2": "3.14.3",
     "neo4j-driver": "6.0.1",
-    "next": "16.3.0",
+    "next": "16.2.12",
     "next-mdx-remote": "^6.0.0",
     "next-runtime-env": "3.3.0",
     "next-themes": "^0.4.6",