fix(build): load colliding AWS credential providers natively

Author: waleedlatif1

.agents/skills/ship/SKILL.md

@@ -55,7 +55,7 @@ When the user runs `/ship`:
 
   **Do NOT blanket-run the domain generators here.** `mship:generate` (`generate-mship-contracts.ts`) is an **umbrella** that drives all nine mothership contract generators (`mship-contracts`, `billing-protocol-contract`, `mship-tools`, the four `trace-*`, `metrics-contract`, `vfs-snapshot-contract`) and biome-formats `apps/sim/lib/copilot/generated/` — never run it *and* its constituents (they write the same files and corrupt each other in parallel), and never run it on an ordinary ship: it reads an **external** copilot-contract source that isn't checked out in most worktrees, so it hard-fails with `ENOENT` and would abort ship for an unrelated reason. `generate:pi-model-catalog` (under `apps/sim`) likewise regenerates from the installed Pi package, not repo source. `scripts/generate-docs.ts` rewrites the integration docs and client-safe catalog; run it when this PR changes their block/icon/landing-content inputs or when `integration-catalog:check` reports drift, then review its broad generated diff. Only when **this PR's diff actually touches** a domain generator's input do you regenerate it deliberately and run its matching `:check` (`bun run mship:check` / the individual `*:check`) — with the external source present.
 
-  **Phase B — run lint + every audit CI enforces, in parallel, and abort ship if any fails.** Before running the commands, compare this list with `.github/workflows/test-build.yml`; when CI adds an audit, run it and update this skill instead of trusting a stale snapshot. The env-flag audit is currently an inline workflow block rather than a package script: when `apps/sim/lib/core/config/env-flags.ts` changed, run that current workflow block verbatim instead of copying a second version into this skill. Run `bun run lint` first (it autofixes formatting and mutates files, so don't parallelize it with the read-only audits), then run the base-sensitive block-registry check, then fan the independent audits out and collect exit codes:
+  **Phase B — run lint + every audit CI enforces, in parallel, and abort ship if any fails.** Before running the commands, compare this list with `.github/workflows/test-build.yml`; when CI adds an audit, run it and update this skill instead of trusting a stale snapshot. Run the inline "Check reviewed Next.js release exception" workflow block when `bunfig.toml` or the root `package.json` changes; it bounds the temporary dependency exception to its reviewed version. The env-flag audit is currently an inline workflow block rather than a package script: when `apps/sim/lib/core/config/env-flags.ts` changed, run that current workflow block verbatim instead of copying a second version into this skill. Run `bun run lint` first (it autofixes formatting and mutates files, so don't parallelize it with the read-only audits), then run the base-sensitive block-registry check, then fan the independent audits out and collect exit codes:
   ```bash
   # autofix formatting first (mutating; not parallel-safe with the audits). Gate its exit too —
   # a non-zero lint (unfixable errors) must abort before the audits run, not be ignored.

.github/workflows/test-build.yml

@@ -213,6 +213,16 @@ jobs:
         with:
           bun-version: 1.4.1
 
+      - name: Check reviewed Next.js release exception
+        run: |
+          bun -e '
+            const config = Bun.TOML.parse(await Bun.file("bunfig.toml").text());
+            const { overrides } = await Bun.file("package.json").json();
+            if (config.install?.minimumReleaseAgeExcludes?.includes("next") && overrides?.next !== "16.3.6") {
+              throw new Error("Remove the Next.js 16.3.6 release-age exception before changing its pin");
+            }
+          '
+
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:

apps/sim/next.config.ts

@@ -92,6 +92,9 @@ const nextConfig: NextConfig = {
   output: isTruthy(env.DOCKER_BUILD) ? 'standalone' : undefined,
   serverExternalPackages: [
     '@1password/sdk',
+    /** These Node credential providers produce colliding chunks in Turbopack 16.3.x. */
+    '@aws-sdk/credential-provider-login',
+    '@aws-sdk/credential-provider-web-identity',
     'ws',
     'isolated-vm',
     '@e2b/code-interpreter',

bunfig.toml

@@ -3,7 +3,8 @@ exact = true
 # Supply-chain gate: only install package versions published at least 7 days ago
 # (blocks freshly published, potentially compromised releases).
 minimumReleaseAge = 604800
-# Reviewed Next.js 16.3.6 security patch; remove after 2026-09-29 once it clears the age gate.
+# CI restricts this reviewed security exception to Next.js 16.3.6.
+# Remove after 2026-09-29 once the pinned release clears the seven-day gate.
 minimumReleaseAgeExcludes = ["next"]
 
 [run]