perf(deps-dev): use native TypeScript for SDK builds
The existing SDK emit build uses TypeScript 5.8.3. This changes npm run build to native TypeScript 7.0.2 through an explicit alias, while retaining 5.8.3 for ESLint's compiler API. The alias and build script are configured in the canonical root gen.yaml and mirrored in the generated package/normal npm lock so Speakeasy can reproduce them. The SDK release version is unchanged.
CI scope: this PR introduces no workflows or jobs. The compiler-migration workflow additions have been removed, and pre-existing workflows are unchanged. This deletion changes no compiler, dependency graph, source or benchmarked command, so the recorded performance measurements remain applicable. Hosted results and bot reviews below refer to the earlier commits explicitly linked; they are not claims about the cleanup commit. The cleanup independently passed diff/reference checks and a scoped security/Forge review.
--rootDir src preserves the existing emitted file layout, and --types estree,json-schema preserves the two ambient declaration packages discovered by the legacy compiler. Strictness and compiler source selection stay unchanged. Both packages expose a tsc binary, so documented commands select them explicitly.
The migration-only pull request workflow has been removed. Existing generation, publishing and tagging workflows are unchanged. Output comparisons and compiler-version assertions remain one-off migration evidence; there is no committed migration validator or new recurring CI job.
Local full emit benchmark
| Compiler | Median | Range | Measured samples |
|---|---|---|---|
| TypeScript 5.8.3 | 16.388096s | 16.164721–17.128409s | 7 |
| TypeScript 7.0.2 | 1.937164s | 1.781391–2.013328s | 7 |
88.18% less time, 8.46× as fast, 14.451s saved per measured full emit. This is a local compiler measurement, not total CI duration.
macOS arm64, 14 logical CPUs, Node 22.22.0. Two warmup pairs precede seven measured pairs, with execution order alternating. All 18 compiler processes exit 0. The unchanged configuration has incremental: false; each process performs a full emit while filesystem/OS caches remain warm and emitted files are overwritten in place. npm startup and output cleanup are excluded. Other audit agents paused heavy jobs, but unrelated host load remained high (one-minute observations about 28–49); no idle-host or universal speedup claim.
Both actual selected binaries were version-asserted during this one-off benchmark. The original command/options and final native command check identical closures: 1,071 project source files and 16 non-compiler dependency declaration files. The measured checkout was isolated from unrelated parent-workspace ambient packages.
| Pair | 5.8.3 seconds | 7.0.2 seconds |
|---|---|---|
| 1 | 16.935727 | 1.981374 |
| 2 | 16.164721 | 1.923934 |
| 3 | 17.064612 | 1.937164 |
| 4 | 17.128409 | 1.988439 |
| 5 | 16.322920 | 1.879804 |
| 6 | 16.388096 | 1.781391 |
| 7 | 16.362481 | 2.013328 |
Reproduce after npm ci in a fresh checkout without unrelated ancestor node_modules:
node node_modules/typescript/bin/tsc --version
node node_modules/@typescript/native/bin/tsc --version
# Original full emit command:
node node_modules/typescript/bin/tsc
# Final full emit command, also used by npm run build:
node node_modules/@typescript/native/bin/tsc --rootDir src --types estree,json-schema
Warm each command twice, then collect seven pairs while alternating which runs first. Keep the same installed graph and source tree throughout.
Validation and boundaries
- The complete original 3,557-blob Git checkout was verified. Original build and existing lint pass; the final native build/lint and CommonJS
StackOneexport load pass without making API requests. This repository has no test script or checked-in unit tests, so no unit-suite pass is claimed. - All 1,071 emitted JavaScript files and 1,071 public declaration files are byte-identical. Both compilers emit the same 4,284 file paths. The 1,108 differing source maps differ only in
mappings; file/source names, paths and content remain identical. - All 128 original npm package records and 115 legacy dependency records are unchanged. Exactly 21 official native compiler/platform records were added. Independent security review verified SRI, platform/engine constraints, all 20 optional native edges and absence of lifecycle hooks in the additions. The final Forge pass found no actionable issues. GitHub’s push response reports 11 existing default-branch dependency alerts (8 high, 3 moderate); this scoped review does not clear those alerts or claim the repository is vulnerability-free.
- Local baseline installation used a disposable frozen dependency fixture, followed by verification of all 128 original npm paths, 3,558 package files and 189 resolution edges in npm layout. The native alias/platform were installed through an actual offline npm fixture. Final local
npm ci --dry-runpasses; a complete ordinary localnpm cidid not dispatch. That installation boundary is now closed by the successful hosted normalnpm cidescribed below. - Full Speakeasy regeneration was not run. The installed CLI is 1.531.0 while the recorded generation used 1.724.0; its authenticated generator-version request failed sandbox DNS and bounded escalated attempts did not start. The canonical dependency/script keys are documented in Speakeasy's TypeScript configuration reference, and the checked-in workflow uses this generator configuration. The one-off migration check verified these settings against the generated package; this is not a generation run. Existing regeneration and publishing workflows are unchanged; the pinned reusable npm publisher uses Node 24.x.
Full raw timings, load samples, scope identities and validation/security reports are retained in the task's continuation/evidence/generated-sdk directory; reproduction driver: continuation/benchmark_generated_sdk.py.
Historical hosted validation and review
Cleanup commit 48d79b6280470d98eb9dd14b5b99d14448445377 removes the migration validator and its CI invocation. It changes no compiler version, dependency graph, build option or generated SDK source, so the accepted benchmark and one-off output comparison remain applicable without a new timing run.
The historical validate job passed on Ubuntu 24.04.5, Node 22.22.0 and npm 10.9.4 using GitHub's synthetic merge of this head into the unchanged base. Normal npm ci installed 130 packages; npm run build and npm run lint both passed. That migration-only workflow is now removed; this successful run is historical evidence, not an ongoing CI gate. No dual-compiler execution, exact-version assertion or output-parity validator was retained.
The earlier hosted migration validation on d7403b0ea8031f7a3eda5ed5e25883e20b4fb3bc also passed the one-off generator/output comparison. That historical evidence and the local raw results remain retained; they are not a recurring maintenance contract. Full Speakeasy regeneration remains unverified.
Previous-head Cubic review 5478608340 found zero code issues across the three cleanup files and still explicitly requests human sign-off for the major compiler migration. It is a COMMENTED review, not an approval. Independent cleanup security review and the final Forge review found no actionable issues. Copilot exhausted its quota on the earlier head; no previous-head Copilot check or completed Copilot review is claimed, and no retry was requested. No approval or merge was performed by an agent.
No code-scanning pass is claimed: Code scanning Needs setup, Secret scanning is Disabled, and Dependabot is enabled. Current hosted npm audit reports 16 vulnerabilities (14 high, 2 moderate); the earlier GitHub default-branch notice reports 11 alerts. These are separate inventories. Original package records are unchanged, and no audit fix or scanner-setting change was performed.