build(scripts): convert every remaining .mjs/.d.mts pair to real .ts

Same motivation as the prior commit, extended to scripts/: a hand-maintained
.d.mts alongside a .mjs is exactly the duplicated-declaration problem the
TypeScript migration was supposed to eliminate, and it can silently drift
from the real implementation with no compiler ever checking it. Converts
all 39 remaining scripts/*.mjs files that had one -- the mcp-release/
orb-release family, every docs/settings/schema drift checker, and the rest
of the standalone generators -- to real .ts, inferring each function's
types from its actual behavior rather than trusting the old declaration,
per the pattern proven out on the miner/mcp packages. Nothing in scripts/
was ever part of Codecov's coverage surface, so this adds no coverage
obligation; it's a straight type-safety and drift-elimination win.

Real drift the old .d.mts files had already accumulated, found while
converting:
- check-schema-drift.ts read a table's name via SQLiteTable.Symbol.Name,
  an @internal drizzle-orm symbol never in its public type exports (which
  is exactly why the old hand-written declaration typed it without
  complaint) -- switched to the public getTableName().
- ci-duration-report.ts's WorkflowRun type was missing the `event` field
  the code actually filters on.
- orb-release-core.ts's IMAGE_RELEVANT_PREFIXES still named two sibling
  scripts by their old .mjs filenames, now renamed here too -- a commit
  touching either file under its real name would have silently stopped
  counting as image-relevant.

Every consumer updated to match: .js-suffixed import specifiers (Vite/
esbuild/Wrangler already resolve these to the sibling .ts, same as the
prior commit), test imports, and every real invocation site. A script
whose own file stays .mjs but now imports something converted here (e.g.
check-mcp-package.mjs importing forbidden-content.ts) needs tsx instead
of plain node, since only tsx (not node --experimental-strip-types)
resolves a same-directory .ts import transitively; a script with zero
local imports uses --experimental-strip-types directly, cheaper than
spawning tsx. Covers every affected npm script, the three release-watch
GitHub workflows (which previously needed no npm install at all --
added ./.github/actions/setup-workspace to each), the Dockerfile, and
deploy-selfhost-prebuilt.sh.

That last category caught two live regressions already sitting on this
branch from the prior commit, beyond the one this commit's own
check-miner-deployment-docs.ts conversion fixes (that one's what's been
failing this PR's own CI): packages/loopover-miner/scripts/
generate-env-reference.mjs (npm run miner:env-reference, part of
test:ci) and the Dockerfile/deploy-selfhost-prebuilt.sh's
validate-selfhost-sourcemap invocations were both silently broken the
same way -- caught by grepping for every remaining literal .mjs
reference to a converted filename repo-wide, not by any test, since the
one existing test for the miner env-reference generator imports it
through Vite (which already tolerates the mismatch) rather than
spawning it as the real subprocess the npm script actually runs.

Author: JSONbored

.claude/skills/contributing-to-loopover/SKILL.md

@@ -202,7 +202,7 @@ Run the matching command(s) and **commit the regenerated file(s)** — CI fails
 | A Cloudflare binding/var in `wrangler.jsonc` | `npm run cf-typegen` | `worker-configuration.d.ts` |
 | Drizzle schema (`src/db/schema.ts`) | `npm run drizzle:generate` | the new `migrations/NNNN_*.sql` |
 | Added a raw-SQL migration | (none — just author it) | next **contiguous** `migrations/NNNN_snake.sql` |
-| `src/selfhost/**` (or a few other scanned files — see `scripts/gen-selfhost-env-reference.mjs`'s `DEFAULT_SOURCE_ROOTS`) adding/removing an `env.SOMETHING` read | `npm run selfhost:env-reference` | `apps/loopover-ui/src/lib/selfhost-env-reference.ts` — the doc cites the file only (not `file:line`, deliberately, so an unrelated line shift elsewhere in the file never makes this go stale) |
+| `src/selfhost/**` (or a few other scanned files — see `scripts/gen-selfhost-env-reference.ts`'s `DEFAULT_SOURCE_ROOTS`) adding/removing an `env.SOMETHING` read | `npm run selfhost:env-reference` | `apps/loopover-ui/src/lib/selfhost-env-reference.ts` — the doc cites the file only (not `file:line`, deliberately, so an unrelated line shift elsewhere in the file never makes this go stale) |
 | CLI command surface | `npm run command-reference` | the generated command-reference doc |
 | UI files (`apps/loopover-ui/**`) | `npm --workspace @loopover/ui run format` | formatted files |
 

.claude/skills/contributing-to-loopover/reference.md

@@ -67,7 +67,7 @@ validate the real publishable artifact still compiles and packs cleanly.
 Every `vitest.config.ts` in the repo (root, `vitest.workers.config.ts`, and every workspace with its own
 config) wires this as `globalSetup`, so it runs once before any test file regardless of how vitest was
 invoked — including a direct `npx vitest run test/unit/<file>.test.ts`, which this doc's own §6 ("Iterate,
-then verify") recommends for fast iteration. `scripts/check-node-version.mjs`'s `pretest*` hooks
+then verify") recommends for fast iteration. `scripts/check-node-version.ts`'s `pretest*` hooks
 (`package.json`) only cover 5 high-traffic npm script names (`test`, `test:ci`, `test:coverage`,
 `test:workers`, `ui:test`) as a genuinely-faster fail there (before npm even spawns vitest) — they are a
 nicety on top of the globalSetup guarantee, not a substitute for it. An earlier version of this guard was

.github/workflows/ci-duration-report.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Pull ci.yml run stats
         env:
           GITHUB_TOKEN: ${{ github.token }}
-        run: node scripts/ci-duration-report.mjs --days=7 --output=ci-duration-report.json
+        run: node --experimental-strip-types scripts/ci-duration-report.ts --days=7 --output=ci-duration-report.json
       - name: Write summary
         run: |
           node <<'NODE'

.github/workflows/ci.yml

@@ -117,8 +117,8 @@ jobs:
               - 'apps/loopover-extension/**'
               - 'apps/loopover-miner-extension/**'
               - 'packages/loopover-ui-kit/**'
-              - 'scripts/build-extension.mjs'
-              - 'scripts/build-miner-extension.mjs'
+              - 'scripts/build-extension.ts'
+              - 'scripts/build-miner-extension.ts'
               - 'package.json'
               - 'package-lock.json'
             # Backend changes that can drift the OpenAPI contract the UI type-checks against, but say
@@ -370,7 +370,7 @@ jobs:
         if: ${{ github.event_name == 'push' || needs.changes.outputs.observability == 'true' }}
         env:
           NODE_OPTIONS: ""
-        run: node scripts/validate-observability-configs.mjs
+        run: node --experimental-strip-types scripts/validate-observability-configs.ts
       # Runs ahead of Typecheck AND "Test with coverage" (#ci-engine-build-order): src/mcp/find-opportunities.ts
       # (root backend, since #2281/#3985) imports packages/loopover-miner/lib/opportunity-fanout.js --
       # a .js-suffixed specifier esbuild/Vite resolve straight to the real (gitignored, uncompiled)
@@ -523,7 +523,7 @@ jobs:
       - name: Miner package check
         if: ${{ github.event_name == 'push' || needs.changes.outputs.miner == 'true' || needs.changes.outputs.engine == 'true' }}
         run: npm run test:miner-pack
-      # scripts/check-miner-deployment-docs.mjs reads packages/loopover-engine/src/miner/**/*.ts
+      # scripts/check-miner-deployment-docs.ts reads packages/loopover-engine/src/miner/**/*.ts
       # (ENGINE_MINER_DIR) to build the registered-commands list checked against DEPLOYMENT.md, so an
       # engine-only PR touching that directory used to skip this audit entirely.
       - name: Miner deployment docs audit

.github/workflows/gittensor-impact.yml

@@ -1,6 +1,6 @@
 name: Gittensor Impact
 
-# Renders the README contributor-impact card with scripts/gittensor-impact-card.mjs
+# Renders the README contributor-impact card with scripts/gittensor-impact-card.ts
 # (our own script, styled to this repo's brand — see apps/loopover-ui/src/styles.css)
 # and publishes it to the gittensor-impact-assets branch, which the README embeds
 # directly. No third-party action: this replaced matthewevans/gittensor-impact-action
@@ -39,7 +39,7 @@ jobs:
           node-version: 22.23.1
 
       - name: Render impact card
-        run: node scripts/gittensor-impact-card.mjs JSONbored/loopover gittensor-impact-dark.svg
+        run: node --experimental-strip-types scripts/gittensor-impact-card.ts JSONbored/loopover gittensor-impact-dark.svg
 
       - name: Publish to gittensor-impact-assets
         env:

.github/workflows/mcp-release-please.yml

@@ -126,8 +126,8 @@ jobs:
           set -euo pipefail
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          trusted_sync_script="${RUNNER_TEMP}/sync-release-lockfile-versions.mjs"
-          cp scripts/sync-release-lockfile-versions.mjs "$trusted_sync_script"
+          trusted_sync_script="${RUNNER_TEMP}/sync-release-lockfile-versions.ts"
+          cp scripts/sync-release-lockfile-versions.ts "$trusted_sync_script"
           git remote set-url origin "https://github.com/${GITHUB_REPOSITORY}.git"
           gh auth setup-git
           branches="$(git ls-remote --heads origin 'release-please--branches--main--*' | awk '{print $2}' | sed 's#refs/heads/##')"
@@ -137,7 +137,7 @@ jobs:
           for branch in $branches; do
             git fetch origin "$branch"
             git checkout -B "sync-check-$(printf '%s' "$branch" | tr '/' '-')" "origin/$branch"
-            node "$trusted_sync_script" packages/loopover-mcp packages/loopover-engine packages/loopover-miner packages/loopover-ui-kit
+            node --experimental-strip-types "$trusted_sync_script" packages/loopover-mcp packages/loopover-engine packages/loopover-miner packages/loopover-ui-kit
             if git diff --quiet package-lock.json; then
               echo "package-lock.json already in sync on $branch."
             else

.github/workflows/mcp-release-watch.yml

@@ -24,15 +24,15 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version-file: .nvmrc
+      - name: Setup workspace
+        uses: ./.github/actions/setup-workspace
 
       - name: Check MCP release status
         env:
           GITHUB_TOKEN: ${{ github.token }}
-        run: node scripts/check-mcp-release-due.mjs --json --output mcp-release-due.json --upsert-issue
+        # check-mcp-release-due.ts imports mcp-release-core.ts directly, so it needs tsx (not plain node) to
+        # resolve that local .ts import.
+        run: npx tsx scripts/check-mcp-release-due.ts --json --output mcp-release-due.json --upsert-issue
 
       - name: Summarize MCP release status
         run: |

.github/workflows/mcp-ui-version-sync.yml

@@ -1,7 +1,7 @@
 # Keeps apps/loopover-ui/src/lib/mcp-package.ts's MCP_PACKAGE_KNOWN_LATEST_VERSION -- the client-side
 # graceful-degradation fallback shown when the live npm-registry fetch (useMcpPackageMetadata) fails or hasn't
 # resolved yet -- in sync with @loopover/mcp's real npm dist-tags.latest, without ever requiring a human/agent
-# to notice a new release and manually edit the constant (#6580). scripts/check-ui-mcp-version-copy.mjs's
+# to notice a new release and manually edit the constant (#6580). scripts/check-ui-mcp-version-copy.ts's
 # --write mode does the actual sync; this just runs it on a schedule and keeps a standing PR up to date, the
 # same shape as orb-stable-release-pr.yml. Nothing ships until a maintainer reviews and merges the PR -- this
 # workflow never pushes to main directly.
@@ -38,7 +38,7 @@ jobs:
 
       # No npm ci -- the script only imports Node built-ins.
       - name: Sync the known-latest constant
-        run: node scripts/check-ui-mcp-version-copy.mjs --write
+        run: node --experimental-strip-types scripts/check-ui-mcp-version-copy.ts --write
 
       - name: Check for a diff
         id: diff

.github/workflows/orb-beta-release.yml

@@ -1,14 +1,14 @@
 # Automated ORB (self-host container image, ghcr.io/jsonbored/loopover-selfhost) beta channel.
 # Daily (or on demand via workflow_dispatch), checks whether any image-relevant commit has landed
-# since the last orb-v tag (scripts/check-orb-release-due.mjs / scripts/orb-release-core.mjs) and,
+# since the last orb-v tag (scripts/check-orb-release-due.mjs / scripts/orb-release-core.ts) and,
 # if so, cuts the next `orb-vX.Y.Z-beta.N` tag and dispatches release-selfhost.yml to build + publish
 # it -- fully unattended: that workflow's `environment:` routes an actual beta version to
 # `release-beta` (no required reviewers), while a stable/rc version still requires the human-gated
 # `release` environment. Promoting a beta to a stable release stays a manual `git tag orb-vX.Y.Z` by
 # a maintainer -- this workflow never bumps orb-manifest.json's version or cuts a non-beta tag.
 #
 # Deliberately independent of the MCP package's release automation (mcp-release-watch.yml /
-# mcp-release-core.mjs) -- see scripts/orb-release-core.mjs's own header for why.
+# mcp-release-core.ts) -- see scripts/orb-release-core.ts's own header for why.
 name: orb-beta-release
 
 on:
@@ -35,16 +35,16 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version-file: .nvmrc
+      - name: Setup workspace
+        uses: ./.github/actions/setup-workspace
 
       - name: Check whether an ORB beta is due
         id: report
+        # check-orb-release-due.mjs imports orb-release-core.ts directly, so it needs tsx (not plain node) to
+        # resolve that local .ts import.
         run: |
           set -euo pipefail
-          node scripts/check-orb-release-due.mjs --json --output orb-release-due.json
+          npx tsx scripts/check-orb-release-due.mjs --json --output orb-release-due.json
           node <<'NODE'
           const fs = require("node:fs");
           const report = JSON.parse(fs.readFileSync("orb-release-due.json", "utf8"));
@@ -60,7 +60,7 @@ jobs:
       # push alone. Mirrors publish-engine.yml / publish-mcp.yml's identical reasoning and tagging
       # idiom.
       # Exposes created=true/false so the dispatch step below never fires against a tag this run didn't
-      # actually just create -- a defense-in-depth backstop (independent of orb-release-core.mjs's own
+      # actually just create -- a defense-in-depth backstop (independent of orb-release-core.ts's own
       # correctness) against ever re-triggering a build for an already-published version/tag.
       - name: Tag the new beta
         id: tag

.github/workflows/orb-stable-release-pr.yml

@@ -1,10 +1,10 @@
 # Automated ORB (self-host container image, ghcr.io/jsonbored/loopover-selfhost) STABLE-channel Release PR --
 # the release-please-equivalent for ORB, whose cross-cutting image-relevant scoping (src/** shared with
-# UI/MCP-only subtrees it must exclude -- see orb-release-core.mjs's IMAGE_RELEVANT_PREFIXES/EXCLUDED_PREFIXES)
+# UI/MCP-only subtrees it must exclude -- see orb-release-core.ts's IMAGE_RELEVANT_PREFIXES/EXCLUDED_PREFIXES)
 # doesn't fit release-please's directory-component model the way packages/loopover-mcp and
 # packages/loopover-engine do (see mcp-release-please.yml). Same UX contract as those, hand-rolled: on the
 # same schedule (or on demand), (re)compute the next stable version from conventional commits since the last
-# STABLE orb-v tag (scripts/check-orb-stable-release-due.mjs / orb-release-core.mjs's buildOrbStableReleaseReport)
+# STABLE orb-v tag (scripts/check-orb-stable-release-due.mjs / orb-release-core.ts's buildOrbStableReleaseReport)
 # and keep a standing `release-orb-stable` branch + PR in sync with that proposal. Nothing ships until a
 # maintainer reviews and merges it -- see orb-stable-release-tag.yml for what happens then. Never touches the
 # daily fully-unattended beta channel (orb-beta-release.yml).
@@ -34,16 +34,16 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Setup Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
-        with:
-          node-version-file: .nvmrc
+      - name: Setup workspace
+        uses: ./.github/actions/setup-workspace
 
       - name: Check whether a stable ORB release is due
         id: report
+        # check-orb-stable-release-due.mjs imports orb-release-core.ts directly, so it needs tsx (not plain
+        # node) to resolve that local .ts import.
         run: |
           set -euo pipefail
-          node scripts/check-orb-stable-release-due.mjs --json --output orb-stable-release-due.json
+          npx tsx scripts/check-orb-stable-release-due.mjs --json --output orb-stable-release-due.json
           node <<'NODE'
           const fs = require("node:fs");
           const report = JSON.parse(fs.readFileSync("orb-stable-release-due.json", "utf8"));