build(scripts): convert the last 14 standalone .mjs scripts to real .ts (#7751)

* build(scripts): convert every remaining .mjs/.d.mts pair to real .ts

Same motivation as the prior commit, extended to scripts/: a hand-maintained
.d.mts alongside a .mjs is exactly the duplicated-declaration problem the
TypeScript migration was supposed to eliminate, and it can silently drift
from the real implementation with no compiler ever checking it. Converts
all 39 remaining scripts/*.mjs files that had one -- the mcp-release/
orb-release family, every docs/settings/schema drift checker, and the rest
of the standalone generators -- to real .ts, inferring each function's
types from its actual behavior rather than trusting the old declaration,
per the pattern proven out on the miner/mcp packages. Nothing in scripts/
was ever part of Codecov's coverage surface, so this adds no coverage
obligation; it's a straight type-safety and drift-elimination win.

Real drift the old .d.mts files had already accumulated, found while
converting:
- check-schema-drift.ts read a table's name via SQLiteTable.Symbol.Name,
  an @internal drizzle-orm symbol never in its public type exports (which
  is exactly why the old hand-written declaration typed it without
  complaint) -- switched to the public getTableName().
- ci-duration-report.ts's WorkflowRun type was missing the `event` field
  the code actually filters on.
- orb-release-core.ts's IMAGE_RELEVANT_PREFIXES still named two sibling
  scripts by their old .mjs filenames, now renamed here too -- a commit
  touching either file under its real name would have silently stopped
  counting as image-relevant.

Every consumer updated to match: .js-suffixed import specifiers (Vite/
esbuild/Wrangler already resolve these to the sibling .ts, same as the
prior commit), test imports, and every real invocation site. A script
whose own file stays .mjs but now imports something converted here (e.g.
check-mcp-package.mjs importing forbidden-content.ts) needs tsx instead
of plain node, since only tsx (not node --experimental-strip-types)
resolves a same-directory .ts import transitively; a script with zero
local imports uses --experimental-strip-types directly, cheaper than
spawning tsx. Covers every affected npm script, the three release-watch
GitHub workflows (which previously needed no npm install at all --
added ./.github/actions/setup-workspace to each), the Dockerfile, and
deploy-selfhost-prebuilt.sh.

That last category caught two live regressions already sitting on this
branch from the prior commit, beyond the one this commit's own
check-miner-deployment-docs.ts conversion fixes (that one's what's been
failing this PR's own CI): packages/loopover-miner/scripts/
generate-env-reference.mjs (npm run miner:env-reference, part of
test:ci) and the Dockerfile/deploy-selfhost-prebuilt.sh's
validate-selfhost-sourcemap invocations were both silently broken the
same way -- caught by grepping for every remaining literal .mjs
reference to a converted filename repo-wide, not by any test, since the
one existing test for the miner env-reference generator imports it
through Vite (which already tolerates the mismatch) rather than
spawning it as the real subprocess the npm script actually runs.

* build(scripts): convert the last 14 standalone .mjs scripts to real .ts

Closes out the scripts/ TypeScript migration this branch's base commit
started: every remaining scripts/*.mjs file that had no paired .d.mts
(so wasn't covered by the prior "convert every .mjs/.d.mts pair"
commit) is now real .ts, type-checked against its actual behavior
instead of running untyped. Covers the actionlint/build-selfhost/
check-migrations/compute-test-shards/rees-coverage/smoke-observability-
{metrics,traces}/smoke-ui-browser/check-{mcp,miner}-package/
check-mcp-release-candidate/check-orb-{release,stable-release}-due/
check-changelog families.

Every consumer updated to match: package.json scripts, GitHub
workflows (orb-beta-release, orb-stable-release-pr, publish-miner,
release-selfhost, selfhost, test-timing-refresh), the Dockerfile and
.dockerignore, deploy-selfhost-prebuilt.sh, and comment-only references
across src/queue/processors.ts, packages/loopover-engine's deny-hooks,
the selfhost stub files, and the self-hosting docs pages. A script
invoked directly as a subprocess (not a same-directory .ts import)
keeps plain `node --experimental-strip-types`; one that imports another
local .ts file (e.g. check-orb-release-due.ts importing
orb-release-core.ts) needs tsx instead, since only tsx -- not node's
native strip-types -- resolves a `.js`-suffixed specifier to a sibling
.ts transitively.

Real invocations verified for every converted script against this
repo's own state (migrations, git tags, the packed npm tarballs, a
live loopover.ai smoke check, actionlint/composite-action lint), not
just typecheck -- including reproducing rees-coverage.ts's one
pre-existing, already-tolerated (`|| true` in ci.yml) analyzer-metadata
ENOENT quirk against the original .mjs to confirm it predates this
conversion rather than being introduced by it.

# Conflicts:
#	scripts/check-changelog.ts

Author: JSONbored

.dockerignore

@@ -12,7 +12,7 @@ dist-ssr
 coverage
 .git
 .claude
-# The self-host bundle's only entry point is src/server.ts (scripts/build-selfhost.mjs) and `npm ci`
+# The self-host bundle's only entry point is src/server.ts (scripts/build-selfhost.ts) and `npm ci`
 # only ever sees the root package*.json (copied before the rest of the tree) — the loopover-ui
 # workspace app and the test suite are never read during the image build, so keep both out of the
 # build context entirely (measured: ~11MB of this repo's ~22MB tracked-file footprint).
@@ -26,7 +26,7 @@ auth.json
 **/auth.json
 # The review-enrichment service (REES) is a separate Railway service with its own Dockerfile — keep it out of
 # the engine image. EXCEPT analyzer-metadata.json: the main engine's own code (src/review/enrichment-analyzers-
-# taxonomy.ts) imports it directly, so excluding it wholesale breaks `scripts/build-selfhost.mjs`'s esbuild
+# taxonomy.ts) imports it directly, so excluding it wholesale breaks `scripts/build-selfhost.ts`'s esbuild
 # bundle (module resolution failure at build time, not a runtime gap -- caught by the "build + boot smoke test"
 # workflow, which is path-gated and doesn't run on every PR).
 review-enrichment

.github/workflows/ci.yml

@@ -160,14 +160,14 @@ jobs:
               # and the pack check only inspects the tarball. Root src/ cannot
               # affect it, so it is intentionally NOT a trigger here.
               - 'packages/loopover-mcp/**'
-              - 'scripts/check-mcp-package.mjs'
+              - 'scripts/check-mcp-package.ts'
               - 'package-lock.json'
             engine:
               - 'packages/loopover-engine/**'
               - 'package-lock.json'
             miner:
               - 'packages/loopover-miner/**'
-              - 'scripts/check-miner-package.mjs'
+              - 'scripts/check-miner-package.ts'
               - 'package-lock.json'
             # No dedicated build/pack script (unlike mcp/engine/miner above) -- discovery-index is a normal
             # vitest-covered workspace package (packages/discovery-index/src/**/*.ts is in vitest.config.ts's
@@ -217,7 +217,7 @@ jobs:
               - 'control-plane/**'
               - '.github/workflows/ci.yml'
             # Both miner-package test files are self-contained w.r.t. root src/**, the same trust boundary as
-            # mcpCliHarness above: check-miner-package.test.ts only spawns scripts/check-miner-package.mjs as a
+            # mcpCliHarness above: check-miner-package.test.ts only spawns scripts/check-miner-package.ts as a
             # real subprocess (node:child_process + vitest, nothing else), and miner-calibration-types.test.ts
             # only imports the scaffolded packages/loopover-miner/lib/calibration.ts -- neither ever loads
             # root src/ in-process. Mirrors mcpCliHarness's filter shape for the same reason (tooling/config
@@ -927,7 +927,7 @@ jobs:
       # across every push-to-main run). key never actually matches (no save ever uses this literal
       # string); it exists only so the step always falls through to the restore-keys prefix match,
       # picking whatever the most recent refresh wrote. A cache MISS here is always safe: see
-      # scripts/compute-test-shards.mjs's fallback -- it splits evenly across shards when no timing
+      # scripts/compute-test-shards.ts's fallback -- it splits evenly across shards when no timing
       # data is available for a file (or none at all), the same balance vitest's own --shard already
       # gives today, so this can only make shard balance better than today's baseline, never worse.
       - name: Restore test timing cache
@@ -1036,11 +1036,11 @@ jobs:
             # shards, every run sampled. Deliberately not applied to the scoped-selection branch above:
             # that file set isn't known until vitest resolves --changed itself, so a precomputed
             # assignment can't cover it without duplicating vitest's own dependency-graph resolution here.
-            # compute-test-shards.mjs enforces its own hard invariant (the union of all 3 shards' files
+            # compute-test-shards.ts enforces its own hard invariant (the union of all 3 shards' files
             # must exactly equal the discovered file set, no file missing or duplicated) and refuses to
             # write output at all if that's ever violated, so a bug here fails this step loudly rather
             # than silently dropping a test file from CI.
-            node scripts/compute-test-shards.mjs --shards=3 --timing=test-timing.json --output=shard-assignment.json
+            node --experimental-strip-types scripts/compute-test-shards.ts --shards=3 --timing=test-timing.json --output=shard-assignment.json
             mapfile -t SHARD_FILES < <(node -e "console.log(JSON.parse(require('fs').readFileSync('shard-assignment.json','utf8'))['${{ matrix.shard }}'].join('\n'))")
             npm run test:coverage -- --maxWorkers=4 "${SHARD_FILES[@]}" --reporter=default --reporter=blob --reporter=junit --outputFile.blob=blob-report/report-${{ matrix.shard }}.blob --outputFile.junit=reports/junit/vitest.xml "${EXCLUDE_ARGS[@]}"
           fi

.github/workflows/orb-beta-release.yml

@@ -1,6 +1,6 @@
 # Automated ORB (self-host container image, ghcr.io/jsonbored/loopover-selfhost) beta channel.
 # Daily (or on demand via workflow_dispatch), checks whether any image-relevant commit has landed
-# since the last orb-v tag (scripts/check-orb-release-due.mjs / scripts/orb-release-core.ts) and,
+# since the last orb-v tag (scripts/check-orb-release-due.ts / scripts/orb-release-core.ts) and,
 # if so, cuts the next `orb-vX.Y.Z-beta.N` tag and dispatches release-selfhost.yml to build + publish
 # it -- fully unattended: that workflow's `environment:` routes an actual beta version to
 # `release-beta` (no required reviewers), while a stable/rc version still requires the human-gated
@@ -40,11 +40,11 @@ jobs:
 
       - name: Check whether an ORB beta is due
         id: report
-        # check-orb-release-due.mjs imports orb-release-core.ts directly, so it needs tsx (not plain node) to
-        # resolve that local .ts import.
+        # check-orb-release-due.ts imports orb-release-core.ts directly via a `.js` specifier, so it needs tsx
+        # (not plain node) to resolve that local .ts import.
         run: |
           set -euo pipefail
-          npx tsx scripts/check-orb-release-due.mjs --json --output orb-release-due.json
+          npx tsx scripts/check-orb-release-due.ts --json --output orb-release-due.json
           node <<'NODE'
           const fs = require("node:fs");
           const report = JSON.parse(fs.readFileSync("orb-release-due.json", "utf8"));

.github/workflows/orb-stable-release-pr.yml

@@ -4,7 +4,7 @@
 # doesn't fit release-please's directory-component model the way packages/loopover-mcp and
 # packages/loopover-engine do (see mcp-release-please.yml). Same UX contract as those, hand-rolled: on the
 # same schedule (or on demand), (re)compute the next stable version from conventional commits since the last
-# STABLE orb-v tag (scripts/check-orb-stable-release-due.mjs / orb-release-core.ts's buildOrbStableReleaseReport)
+# STABLE orb-v tag (scripts/check-orb-stable-release-due.ts / orb-release-core.ts's buildOrbStableReleaseReport)
 # and keep a standing `release-orb-stable` branch + PR in sync with that proposal. Nothing ships until a
 # maintainer reviews and merges it -- see orb-stable-release-tag.yml for what happens then. Never touches the
 # daily fully-unattended beta channel (orb-beta-release.yml).
@@ -39,11 +39,11 @@ jobs:
 
       - name: Check whether a stable ORB release is due
         id: report
-        # check-orb-stable-release-due.mjs imports orb-release-core.ts directly, so it needs tsx (not plain
-        # node) to resolve that local .ts import.
+        # check-orb-stable-release-due.ts imports orb-release-core.ts directly via a `.js` specifier, so it
+        # needs tsx (not plain node) to resolve that local .ts import.
         run: |
           set -euo pipefail
-          npx tsx scripts/check-orb-stable-release-due.mjs --json --output orb-stable-release-due.json
+          npx tsx scripts/check-orb-stable-release-due.ts --json --output orb-stable-release-due.json
           node <<'NODE'
           const fs = require("node:fs");
           const report = JSON.parse(fs.readFileSync("orb-stable-release-due.json", "utf8"));

.github/workflows/publish-miner.yml

@@ -97,7 +97,7 @@ jobs:
         run: npm run build --workspace @loopover/miner
 
       # Reuses the exact allowlist/required-files/forbidden-content check test:ci already runs on
-      # every PR (scripts/check-miner-package.mjs) -- a dry-run pack, so it doesn't produce the real
+      # every PR (scripts/check-miner-package.ts) -- a dry-run pack, so it doesn't produce the real
       # tarball this job packs+uploads below.
       - name: Validate packed file list
         run: npm run test:miner-pack

.github/workflows/release-selfhost.yml

@@ -135,7 +135,7 @@ jobs:
         run: npm run build --workspace @loopover/engine
 
       - name: Build self-host bundle for release
-        run: node scripts/build-selfhost.mjs --all
+        run: node --experimental-strip-types scripts/build-selfhost.ts --all
 
       - name: Validate release source map
         run: node --experimental-strip-types scripts/validate-selfhost-sourcemap.ts

.github/workflows/selfhost.yml

@@ -1,6 +1,6 @@
 # Self-host stack CI (#980/#982). Provides integration coverage the main CI can't:
 #   1. Postgres integration test — needs a real PG service container
-#   2. Self-host bundle build validation (build-selfhost.mjs)
+#   2. Self-host bundle build validation (build-selfhost.ts)
 #   3. Docker image build + container smoke test (/health, /ready, /metrics)
 # Unit tests and typecheck are NOT duplicated here — the main CI validate job covers them.
 name: self-host
@@ -11,7 +11,7 @@ on:
     paths:
       - "src/selfhost/**"
       - "src/server.ts"
-      - "scripts/build-selfhost.mjs"
+      - "scripts/build-selfhost.ts"
       - "scripts/validate-selfhost-sourcemap.ts"
       - "Dockerfile"
       - "docker-compose.yml"
@@ -27,7 +27,7 @@ on:
     paths:
       - "src/selfhost/**"
       - "src/server.ts"
-      - "scripts/build-selfhost.mjs"
+      - "scripts/build-selfhost.ts"
       - "scripts/validate-selfhost-sourcemap.ts"
       - "Dockerfile"
       - "docker-compose.yml"
@@ -97,7 +97,7 @@ jobs:
         run: PG_TEST_URL=postgres://postgres:devpw@localhost:5432/loopover npx vitest run test/integration/selfhost-pg.test.ts
 
       - name: Build the self-host bundle
-        run: node scripts/build-selfhost.mjs
+        run: node --experimental-strip-types scripts/build-selfhost.ts
 
       - name: Validate self-host source map
         run: node scripts/validate-selfhost-sourcemap.ts

.github/workflows/test-timing-refresh.yml

@@ -2,7 +2,7 @@ name: Test timing refresh
 
 # Pulls per-test-file historical duration data from Codecov's Test Analytics API (see
 # scripts/fetch-test-timing.ts) and caches it for validate-tests' duration-aware shard bin-packer
-# (scripts/compute-test-shards.mjs, ci.yml's "Test with coverage" step) to consume. Runs on a schedule
+# (scripts/compute-test-shards.ts, ci.yml's "Test with coverage" step) to consume. Runs on a schedule
 # rather than per-PR: Codecov doesn't publish a numeric rate limit for this read endpoint, and this
 # repo's PR volume (hundreds/day) makes "query fresh on every PR" a real risk of hitting one, for data
 # that doesn't meaningfully change run-to-run anyway.

Dockerfile

@@ -22,7 +22,7 @@ RUN npm ci --ignore-scripts
 RUN npm --workspace @loopover/engine run build
 # --all: bundle every dependency into one self-contained dist/server.mjs, so the runtime image needs no
 # node_modules (≈10× smaller). The bundle has zero `cloudflare:*` imports (stubbed at build), so no loader.
-RUN node scripts/build-selfhost.mjs --all
+RUN node --experimental-strip-types scripts/build-selfhost.ts --all
 RUN node --experimental-strip-types scripts/validate-selfhost-sourcemap.ts
 
 # --- runtime base: slim, non-root -----------------------------------------------------------------------
@@ -69,7 +69,7 @@ ARG INSTALL_VISUAL_REVIEW=false
 COPY package*.json ./
 RUN if [ "$INSTALL_VISUAL_REVIEW" = "true" ]; then npm install puppeteer-core@22.13.1 --ignore-scripts; fi
 # sharp (#4370): esbuild marks it `external` in the --all bundle (a native per-platform binary can't be
-# bundled into dist/server.mjs, see scripts/build-selfhost.mjs), so it must be installed separately here,
+# bundled into dist/server.mjs, see scripts/build-selfhost.ts), so it must be installed separately here,
 # same reason as puppeteer-core above -- but unconditional (not behind an opt-in build-arg): it's a core
 # dependency of the vision-image-downscale path, not an optional external-sidecar feature. --ignore-scripts
 # is safe here: sharp's own platform binary ships as an npm `optionalDependencies` entry

apps/loopover-ui/content/docs/self-hosting-operations.mdx

@@ -1136,7 +1136,7 @@ scripts above pointed at an older target:
   `deploy-selfhost-prebuilt.sh`.
 
 <Callout variant="warn" title="Migrations are forward-only">
-  This repo has no down-migration convention — `scripts/check-migrations.mjs` only enforces a
+  This repo has no down-migration convention — `scripts/check-migrations.ts` only enforces a
   contiguous, non-colliding numbering, not a reverse path. If a migration has already run forward
   against the live database, rolling back the app code is **not safe in general**: older code can
   break against a newer schema (a dropped/renamed column, a NOT NULL column it never writes, a