fix(deps): revert next to 16.2.12, its 16.3.0 optimizer deletes live code

[waleedlatif1]

Summary

• Reverts next 16.3.0 -> 16.2.12 across the root overrides, @next/swc-* optional deps, apps/sim, apps/docs, and packages/emcn. Keeps the TypeScript toolchain cleanup from the original bump (@typescript/native-preview dropped, useTypeScriptCli pinned).
• 16.3.0's Turbopack optimizer treats a bare return <asyncCall>() tail call inside an async function as returning the promise object, then carries that always-truthy fact through the caller's await. Where the result feeds an if (x) whose every branch returns, it decides the branch is always taken and deletes everything after it from the emitted bundle.
• Two sites shipped to production that way:
  • POST /api/credentials lost the whole create path (transaction, org locks, insert, audit, 201). New credentials 500'd with TypeError: null is not an object (evaluating 'K.id') — this is the prod canary failure.
  • upsertAsyncToolCall collapsed to async () => await getAsyncToolCall(id). The insert is gone; it returns null for every new async copilot tool call. Silent — no error, no failed request, no canary.
• Both sites also hardened with return await, which defeats the miscompile in a minimal reproduction.

Scope

Built the same commit on 16.2.12 and 16.3.0 and diffed 71,266 distinctive source string literals across .next/server and .next/static. Exactly two literals disappeared — the two above; the client bundle lost none. That scan cannot see dropped branches containing no distinctive string, which is why the version goes back rather than patching the two sites and calling it done.

Type of Change

• Bug fix

Testing

• Minimal Next app reproducing the shape: tail deleted on 16.3.0, present on 16.2.12, identical source. return await, dropping the wrapper, !== null, and hoisting to a nullable let each fix it.
• apps/sim/app/api/credentials/route.test.ts passes (6/6).
• Biome clean on the changed files.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 4, 2026 5:26am

[cursor]

PR Summary

High Risk
Reverts a framework version to fix a compiler bug that deleted production server code (credential creates and async copilot tool inserts); remaining risk is other undiscovered sites with the same return async() pattern until Next 16.3.0 is fixed.

Overview
Reverts Next.js from 16.3.0 to 16.2.12 across root overrides, @next/swc-* optional deps, apps/sim, apps/docs, and packages/emcn, with matching bun.lock updates. The 16.3.0 Turbopack optimizer can miscompile bare return <asyncCall>() inside async functions as returning the promise object, so downstream await + if (existing) branches look always-taken and live code after those branches is deleted from server bundles.

Hardening: findExistingCredentialBySource / findExistingCredentialBySourceTx in the credentials API and every withDbSpan wrapper return in async-runs/repository.ts now use return await (with comments explaining why). That restores correct behavior on 16.3.0 and protects credential create and copilot upsertAsyncToolCall insert paths.

next.config.ts comments are updated to note the version pin while on 16.2.12 (e.g. turbopackFileSystemCacheForBuild stays explicitly false because 16.3.0 would flip the default).

^{Reviewed by Cursor Bugbot for commit 6de3c44. Configure here.}

[greptile-apps]

Greptile Summary

This PR consistently reverts Next.js and its associated environment and compiler packages from 16.3.0 to 16.2.12 to avoid a confirmed Turbopack optimizer regression, while retaining explicit compiler workarounds.

• Aligns Next.js versions across the root workspace, Sim app, docs app, EMCN package, overrides, optional SWC dependencies, and Bun lockfile.
• Adds load-bearing return await expressions to credential lookup and copilot async-run repository wrappers.
• Updates Next configuration comments to document retained cache and TypeScript CLI settings.

Confidence Score: 5/5

The PR appears safe to merge; the downgrade is consistent across manifests and the lockfile, and the async hardening preserves existing runtime behavior.

The changed dependency graph resolves coherently to Next 16.2.12 across supported build targets, while the explicit awaits preserve transaction, tracing, error, and promise semantics and prevent the reported optimizer failure.

Important Files Changed

Filename	Overview
package.json	Aligns root Next, @next/env, and explicitly installed SWC packages on 16.2.12.
bun.lock	Resolves a coherent Next 16.2.12 graph, including matching environment, SWC, PostCSS, and Sharp packages.
apps/sim/app/api/credentials/route.ts	Adds explicit awaits to prevent the documented optimizer from deleting the credential creation path.
apps/sim/lib/copilot/async-runs/repository.ts	Hardens traced async database wrappers against the same optimizer misclassification without changing runtime contracts.
apps/sim/next.config.ts	Retains configuration compatible with 16.2.12 and clarifies why explicit cache and TypeScript CLI settings remain necessary.

_{Reviews (1): Last reviewed commit: "fix(deps): revert next to 16.2.12, its 1..." | Re-trigger Greptile}