Convert all scripts/ to typescript

.agents/skills/write-gatekeeper/SKELETON.md

@@ -605,7 +605,7 @@ script sharing a name. Build this one package with `pnpm exec vp run -F <package
 `pnpm --filter` cannot see a task, so `pnpm --filter <package-name> build` reports nothing to run;
 the workspace-wide `pnpm build` picks it up as usual. `deploy` goes through the task rather than
 calling
-`build-gatekeeper-configurator.mjs` itself, so the codegen command lives in one place and cannot
+`build-gatekeeper-configurator.ts` itself, so the codegen command lives in one place and cannot
 drift from the task that declares its env — `wrangler deploy` stays outside vp, since it has side
 effects and needs real credentials.
 

.agents/skills/write-gatekeeper/SKILL.md

@@ -118,8 +118,8 @@ If you use this:
 - UI modules live in `src/configurator/*-ui.tsx`.
 - `resourceUrl()` returns the selected resource URL.
 - `src/configurator/*-types.d.ts` describes the iframe-facing `ui` API.
-- `scripts/build-gatekeeper-configurator.mjs` generates `src/generated/*.txt`.
-- Nothing invokes `build-gatekeeper-configurator.mjs` by hand. `vite.config.ts` re-exports the
+- `scripts/build-gatekeeper-configurator.ts` generates `src/generated/*.txt`.
+- Nothing invokes `build-gatekeeper-configurator.ts` by hand. `vite.config.ts` re-exports the
   shared `build` and `build:configurator` Vite+ tasks from
   `scripts/gatekeeper-configurator-vite-config.ts`; `build` is just `tsc` and depends on
   `build:configurator`, which carries `VITE_FRONTEND_ERROR_REPORTING` in its fingerprint, and

.github/workflows/contribution-policy.yml

@@ -31,7 +31,7 @@ jobs:
           script: |
             const { pathToFileURL } = await import("node:url");
             const policyUrl = pathToFileURL(
-              `${process.env.GITHUB_WORKSPACE}/scripts/contribution-policy.js`,
+              `${process.env.GITHUB_WORKSPACE}/scripts/contribution-policy.ts`,
             );
             const { enforceContributionPolicy } = await import(policyUrl.href);
             await enforceContributionPolicy({ github, context, core });

.gitignore

@@ -21,7 +21,7 @@ packages/workshop-backend/src/generated/browser-export-runtime.txt
 .wrangler/
 .env
 
-# Local dev secrets (loaded by run-dev-server.js)
+# Local dev secrets (loaded by run-dev-server.ts)
 .dev.vars*
 
 # Site-specific deployment configs.

docs/ai-gateway-billing.md

@@ -46,7 +46,7 @@ PUBLIC_BASE_URL=https://your-host
 AUTH_GATEKEEPERS=cloudflare       # allow Cloudflare sign-in/connect (plus any others)
 
 # The Cloudflare gatekeeper's OAuth app (client id/secret live on the gatekeeper Worker; in dev
-# they're seeded from these shell vars by run-dev-server.js):
+# they're seeded from these shell vars by run-dev-server.ts):
 CLOUDFLARE_OAUTH_CLIENT_ID=...
 CLOUDFLARE_OAUTH_CLIENT_SECRET=...
 

docs/oauth-signin.md

@@ -68,7 +68,7 @@ OAuth app with its own redirect URI:
 - GitHub: `${PUBLIC_BASE_URL}/gatekeeper/github/oauth`
 - Cloudflare: `${PUBLIC_BASE_URL}/gatekeeper/cloudflare/oauth`
 
-In local dev, `run-dev-server.js` seeds each gatekeeper's `CLIENT_ID`/`CLIENT_SECRET` from
+In local dev, `run-dev-server.ts` seeds each gatekeeper's `CLIENT_ID`/`CLIENT_SECRET` from
 `GOOGLE_*` / `GITHUB_*` / `CLOUDFLARE_OAUTH_*` shell vars.
 
 ## Storage / bindings

docs/public-server.md

@@ -13,7 +13,7 @@ connect the account's capabilities. There's no single switch — the pieces turn
 | Configure | Effect |
 | --- | --- |
 | `AUTH_GATEKEEPERS=cloudflare,google,github` | Allowlists which connected gatekeepers may be used to sign in. Each shows a "Continue with …" button alongside username/password. |
-| Each gatekeeper's OAuth credentials (on the gatekeeper Worker) | Required for that gatekeeper to actually authenticate. In dev, seeded from `GOOGLE_*` / `GITHUB_*` / `CLOUDFLARE_OAUTH_*` shell vars (see `run-dev-server.js`). |
+| Each gatekeeper's OAuth credentials (on the gatekeeper Worker) | Required for that gatekeeper to actually authenticate. In dev, seeded from `GOOGLE_*` / `GITHUB_*` / `CLOUDFLARE_OAUTH_*` shell vars (see `run-dev-server.ts`). |
 | `ENABLE_CLOUDFLARE_LIMITS=true` | Enables the free daily limit + Cloudflare-credits top-up flow. Billing reads a token from the connected Cloudflare gatekeeper. |
 | `DISABLE_PASSWORD_AUTH=true` | Hides username/password, leaving gatekeeper sign-in only (ignored unless `AUTH_GATEKEEPERS` is non-empty, to avoid lockout). |
 

package.json

@@ -6,21 +6,21 @@
   "packageManager": "pnpm@11.17.0+sha512.cca3cea332ad254bb84145f966d19f4879615210346fc92c79a047f23a0d7b3cca3c3792f0076ba1f1831d277efbcf0a9119b31a9a60eca7fb3d6231f331ef72",
   "scripts": {
     "build": "vp run -r --cache build",
-    "run-local": "node scripts/run-local.mjs",
-    "test": "node --test 'scripts/**/*.test.js' 'scripts/**/*.test.ts' && vp run --filter '!cloudflare-os' --cache test",
+    "run-local": "node scripts/run-local.ts",
+    "test": "node --test 'scripts/**/*.test.ts' && vp run --filter '!cloudflare-os' --cache test",
     "preview:config": "node scripts/preview/preview.ts config",
     "preview:deploy": "node scripts/preview/preview.ts deploy",
     "preview:delete": "node scripts/preview/preview.ts delete",
     "preview:sweep": "node scripts/preview/preview.ts sweep",
     "dev-client": "cd packages/workshop-frontend && pnpm run dev",
-    "dev-server": "node run-dev-server.js",
+    "dev-server": "node scripts/run-dev-server.ts",
     "clean": "vp run -r clean",
     "lint:check": "vp lint",
     "lint:fix": "vp lint --fix",
     "types:check": "pnpm run build",
     "types:scripts": "tsc -p scripts/tsconfig.json",
     "lint": "pnpm run lint:check && pnpm run types:scripts && pnpm run types:check",
-    "types:generate": "node scripts/generate-worker-types.mjs"
+    "types:generate": "node scripts/generate-worker-types.ts"
   },
   "devDependencies": {
     "@types/node": "26.1.0",

packages/configurator-ui/src/index.ts

@@ -167,7 +167,7 @@ export function Fragment(_props: { children?: unknown }): unknown {
 
 // JSX ambient types for configurator UI `.tsx` modules. These globals only apply when something
 // imports this package, which is intended only for sandboxed configurator UI modules compiled by
-// `scripts/build-gatekeeper-configurator.mjs`. Workshop and gatekeeper-server code should NOT
+// `scripts/build-gatekeeper-configurator.ts`. Workshop and gatekeeper-server code should NOT
 // import from this package to avoid clashing with React's `JSX` namespace.
 declare global {
   namespace JSX {

packages/gatekeeper-cloudflare/README.md

@@ -53,7 +53,7 @@ CLIENT_ID=your-client-id-here
 CLIENT_SECRET=your-client-secret-here
 ```
 
-In local dev, `run-dev-server.js` will also seed these from `CLOUDFLARE_OAUTH_CLIENT_ID` /
+In local dev, `run-dev-server.ts` will also seed these from `CLOUDFLARE_OAUTH_CLIENT_ID` /
 `CLOUDFLARE_OAUTH_CLIENT_SECRET` if you'd rather set them in the root `.dev.vars`. A per-package
 `.env` takes precedence and keeps the credential with the gatekeeper that uses it.
 

packages/gatekeeper-confluence/README.md

@@ -80,7 +80,7 @@ CONFLUENCE_CLIENT_ID=your-client-id
 CONFLUENCE_CLIENT_SECRET=your-client-secret
 ```
 
-`run-dev-server.js` maps `CONFLUENCE_CLIENT_ID` / `CONFLUENCE_CLIENT_SECRET` into the Worker's
+`run-dev-server.ts` maps `CONFLUENCE_CLIENT_ID` / `CONFLUENCE_CLIENT_SECRET` into the Worker's
 `CLIENT_ID` / `CLIENT_SECRET` vars. For production, set `CLIENT_ID` and `CLIENT_SECRET` as secrets
 on the deployed Worker and set `BASE_URL` to the public gatekeeper URL.
 

packages/gatekeeper-context/vite.config.ts

@@ -16,7 +16,7 @@ export default defineConfig({
       // survive a later disabled-reporting cache hit and could be collected as if they matched the
       // current bundle. This runs every time, before the cache lookup.
       'clean:error-reporting-artifacts': {
-        command: 'node ../../scripts/clean-error-reporting-artifacts.mjs .',
+        command: 'node ../../scripts/clean-error-reporting-artifacts.ts .',
         cache: false,
       },
       // A task rather than a package.json script so `input` can be stated explicitly: automatic

packages/gatekeeper-notion/README.md

@@ -7,7 +7,7 @@ databases. Runs as its own Cloudflare Worker and is auto-discovered by the backe
 ## Auth
 
 OAuth 2.0 public connection. Configure a Notion **public integration** and provide its client
-credentials to the worker as `CLIENT_ID` / `CLIENT_SECRET`. For local dev, `run-dev-server.js`
+credentials to the worker as `CLIENT_ID` / `CLIENT_SECRET`. For local dev, `run-dev-server.ts`
 maps `NOTION_CLIENT_ID` / `NOTION_CLIENT_SECRET` (e.g. from a root `.dev.vars`) into those vars.
 
 The integration's **redirect URI** must match `<BASE_URL>/oauth`, which in local dev defaults to

packages/gatekeeper-scheduler/vite.config.ts

@@ -17,7 +17,7 @@ export default defineConfig({
       // survive a later disabled-reporting cache hit and could be collected as if they matched the
       // current bundle. This runs every time, before the cache lookup.
       "clean:error-reporting-artifacts": {
-        command: "node ../../scripts/clean-error-reporting-artifacts.mjs .",
+        command: "node ../../scripts/clean-error-reporting-artifacts.ts .",
         cache: false,
       },
       // A task rather than a package.json script so `input` can be stated explicitly: automatic

packages/gatekeeper-slack/README.md

@@ -12,7 +12,7 @@ OAuth 2.0 using a **user token** (`xoxp-…`), requested via `user_scope` (not a
 agent sees exactly what the connecting user can see — including private channels, DMs, and search.
 
 Create a Slack app (https://api.slack.com/apps) and provide its client credentials to the worker
-as `CLIENT_ID` / `CLIENT_SECRET`. For local dev, `run-dev-server.js` maps `SLACK_CLIENT_ID` /
+as `CLIENT_ID` / `CLIENT_SECRET`. For local dev, `run-dev-server.ts` maps `SLACK_CLIENT_ID` /
 `SLACK_CLIENT_SECRET` (e.g. from a root `.dev.vars`) into those vars.
 
 App configuration:

packages/gatekeeper-supabase/README.md

@@ -33,7 +33,7 @@ flow.
 ## Configuration
 
 The gatekeeper Worker reads `CLIENT_ID` and `CLIENT_SECRET`. In local development these are seeded
-from shell/`.dev.vars` variables by `run-dev-server.js`:
+from shell/`.dev.vars` variables by `run-dev-server.ts`:
 
 ```
 SUPABASE_CLIENT_ID=<oauth app client id>

packages/gatekeeper-zoominfo/README.md

@@ -47,7 +47,7 @@ is **not** offered as a "Continue with…" sign-in method (`getAuthenticatedEmai
 ## Configuration
 
 The gatekeeper Worker reads `CLIENT_ID` and `CLIENT_SECRET`. In local development these are seeded
-from the root `.dev.vars` by `run-dev-server.js`:
+from the root `.dev.vars` by `run-dev-server.ts`:
 
 ```
 ZOOMINFO_CLIENT_ID=<oauth app client id>

packages/integration-tests/src/harness.ts

@@ -26,7 +26,7 @@ export const TEST_GATEKEEPER_WORKER = "gatekeeper-test";
 export const TEST_GATEKEEPER_BINDING = "TEST";
 export const TEST_VENDOR_ID = TEST_GATEKEEPER_BINDING.toLowerCase();
 
-/** Username that `vars.ADMINS` grants deployment-admin rights to, mirroring run-dev-server.js. */
+/** Username that `vars.ADMINS` grants deployment-admin rights to, mirroring run-dev-server.ts. */
 export const ADMIN_USERNAME = "admin";
 
 // The slice of wrangler.jsonc the harness reads or rewrites. Loose on purpose: everything else a
@@ -64,7 +64,7 @@ export type GatekeeperSpec = {
 // Read a checked-in wrangler.jsonc and make it usable as an *inline* harness config.
 //
 // A worker whose `main` is generated (capnweb-validate) needs `build.cwd` pinned to its own directory
-// or the output lands in the wrong place -- run-dev-server.js pins it for the same reason. `main` then
+// or the output lands in the wrong place -- run-dev-server.ts pins it for the same reason. `main` then
 // has to be absolute too: an inline config has no file path of its own, so wrangler resolves a
 // relative `main` against the harness `root` rather than the worker directory.
 function readWorkerConfig(dir: string): WorkerConfig {
@@ -84,7 +84,7 @@ function workshopConfig(
     patch?: (config: WorkerConfig) => void): WorkerConfig {
   const config = readWorkerConfig(WORKSHOP_DIR);
 
-  // The checked-in config declares no services; run-dev-server.js adds one per gatekeeper. We add
+  // The checked-in config declares no services; run-dev-server.ts adds one per gatekeeper. We add
   // only the ones the suite asked for, so buildGatekeeperVendorMap() discovers exactly those vendors
   // and the observer-config prompt has no surprise rows.
   config.services = gatekeepers.map(gk => ({

packages/workshop-backend/wrangler.jsonc

@@ -39,7 +39,7 @@
   },
 
   // Gatekeeper service bindings and the Workers AI binding are dynamically
-  // added by run-dev-server.js (for dev) and generate-wrangler-prod.js (for
+  // added by run-dev-server.ts (for dev) and generate-wrangler-prod.js (for
   // production).
 
   "migrations": [

pnpm-workspace.yaml

@@ -9,7 +9,7 @@ catalog:
   # Exact: pinned in lockstep with capnweb (declared as a >=0.7.0 peer)
   capnweb-validate: 0.2.4
   # Exact: TypeScript 7 (tsgo). Type-checking runs on the native compiler. Build-time
-  # transpilers that need the JS compiler API (scripts/build-gatekeeper-configurator.mjs)
+  # transpilers that need the JS compiler API (scripts/build-gatekeeper-configurator.ts)
   # use the root "typescript6" npm alias instead; capnweb-validate ships its own
   # JS-based compiler dependency since 0.2.4.
   typescript: 7.0.2