Cut the scaffolding that had no audience

.github/workflows/_managed-d1.yml

@@ -44,7 +44,7 @@ jobs:
           path: retained
           merge-multiple: true
       - name: Verify the retained candidate before spending Cloudflare resources
-        run: node scripts/workflows/verify-candidate-artifact.mjs --candidate "retained/${{ inputs.candidate-filename }}" --sha256 "${{ inputs.candidate-sha256 }}"
+        run: node scripts/workflows/verify-candidate-artifact.ts --candidate "retained/${{ inputs.candidate-filename }}" --sha256 "${{ inputs.candidate-sha256 }}"
   verify:
     name: Verify against real D1
     needs: preflight
@@ -91,9 +91,9 @@ jobs:
           GITHUB_TOKEN: "${{ github.token }}"
         run: |
           echo "==> Listing managed evidence artifacts already uploaded by run ${{ github.run_id }}"
-          node scripts/github-run-artifacts.mjs --repository "${{ github.repository }}" --run-id "${{ github.run_id }}" --prefix "managed-d1-evidence-${{ github.run_id }}-" --output managed-artifacts.json
+          node scripts/github-run-artifacts.ts --repository "${{ github.repository }}" --run-id "${{ github.run_id }}" --prefix "managed-d1-evidence-${{ github.run_id }}-" --output managed-artifacts.json
           echo "==> Selecting evidence that attests this exact candidate, if a previous attempt produced any"
-          node scripts/select-managed-d1-evidence.mjs --artifacts managed-artifacts.json --repository "${{ github.repository }}" --run-id "${{ github.run_id }}" --sha256 "${{ inputs.candidate-sha256 }}" --source-commit "${{ inputs.source-commit }}" --trigger "${{ inputs.trigger }}" --output selection.json --github-output "$GITHUB_OUTPUT"
+          node scripts/select-managed-d1-evidence.ts --artifacts managed-artifacts.json --repository "${{ github.repository }}" --run-id "${{ github.run_id }}" --sha256 "${{ inputs.candidate-sha256 }}" --source-commit "${{ inputs.source-commit }}" --trigger "${{ inputs.trigger }}" --output selection.json --github-output "$GITHUB_OUTPUT"
           echo "==> Selection:"
           cat selection.json
 
@@ -124,15 +124,15 @@ jobs:
           test -n "$CLOUDFLARE_ACCOUNT_ID" || { echo "::error::CLOUDFLARE_ACCOUNT_ID is empty; the repository variable is missing"; exit 1; }
           echo "==> Provisioning disposable D1 resources and verifying candidate ${{ inputs.candidate-sha256 }} (mode: ${{ inputs.mode }})"
           echo "    exact state is persisted to managed-d1-state.json so cleanup can run even if this step dies"
-          node scripts/managed-d1.mjs verify --candidate "$PWD/retained/${{ inputs.candidate-filename }}" --sha256 "${{ inputs.candidate-sha256 }}" --source-commit "${{ inputs.source-commit }}" --run-id "${{ github.run_id }}" --run-attempt "${{ github.run_attempt }}" --run-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" --trigger "${{ inputs.trigger }}" --mode "${{ inputs.mode }}" --evidence-path managed-d1-evidence.json --state-path managed-d1-state.json --sqlc "$(command -v sqlc)"
+          node scripts/managed-d1.ts verify --candidate "$PWD/retained/${{ inputs.candidate-filename }}" --sha256 "${{ inputs.candidate-sha256 }}" --source-commit "${{ inputs.source-commit }}" --run-id "${{ github.run_id }}" --run-attempt "${{ github.run_attempt }}" --run-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" --trigger "${{ inputs.trigger }}" --mode "${{ inputs.mode }}" --evidence-path managed-d1-evidence.json --state-path managed-d1-state.json --sqlc "$(command -v sqlc)"
       - name: Last-resort cleanup from persisted exact state
         if: ${{ always() && steps.lookup.outputs.mode == 'create' && !hashFiles('managed-d1-evidence.json') }}
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
         run: |
           echo "::warning::verification produced no evidence file; deleting every resource recorded in managed-d1-state.json"
-          node scripts/managed-d1.mjs cleanup --state-path managed-d1-state.json --report cleanup-recovery.json
+          node scripts/managed-d1.ts cleanup --state-path managed-d1-state.json --report cleanup-recovery.json
 
       - id: upload
         name: Upload the managed evidence

.github/workflows/ci.yml

@@ -33,7 +33,7 @@ jobs:
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       - id: config
         name: Read authoritative compatibility inputs
-        run: node scripts/workflows/emit-compatibility-outputs.mjs
+        run: node scripts/workflows/emit-compatibility-outputs.ts
 
   baseline-and-build:
     name: Baseline checks and candidate build
@@ -62,7 +62,7 @@ jobs:
       - name: Run generator unit tests
         run: make test-generator
       - name: Check the compatibility contract is internally consistent
-        run: node scripts/check-compatibility.mjs
+        run: node scripts/check-compatibility.ts
       - name: Build the publication candidate
         run: make build
 
@@ -266,9 +266,9 @@ jobs:
       - name: Verify cell and write actual evidence
         run: |
           echo "==> Verifying the candidate against sqlc ${{ matrix.sqlc.version }}"
-          node scripts/verify-sqlc-compatibility.mjs --candidate "$PWD/candidate/build/plugin.wasm" --sha256 "$(cat candidate/candidate.sha256)" --sqlc-version "${{ matrix.sqlc.version }}" --sqlc "$(command -v sqlc)" --output matrix-result.json
+          node scripts/verify-sqlc-compatibility.ts --candidate "$PWD/candidate/build/plugin.wasm" --sha256 "$(cat candidate/candidate.sha256)" --sqlc-version "${{ matrix.sqlc.version }}" --sqlc "$(command -v sqlc)" --output matrix-result.json
           echo "==> Recording the versions actually observed on this runner as evidence"
-          node scripts/write-compatibility-evidence.mjs result=matrix-result.json output=compatibility-evidence.json node="$(node --version | sed 's/^v//')" npm="$(npm --version)" bun="$(bun --version)"
+          node scripts/write-compatibility-evidence.ts result=matrix-result.json output=compatibility-evidence.json node="$(node --version | sed 's/^v//')" npm="$(npm --version)" bun="$(bun --version)"
           echo "==> Matrix result for sqlc ${{ matrix.sqlc.version }}:"
           cat matrix-result.json
           cat compatibility-evidence.json >>"$GITHUB_STEP_SUMMARY"
@@ -304,4 +304,4 @@ jobs:
         run: |
           echo "==> Comparing verification/compatibility.json against published upstream releases"
           set -o pipefail
-          node scripts/check-upstream-compatibility.mjs 2>&1 | tee -a "$GITHUB_STEP_SUMMARY"
+          node scripts/check-upstream-compatibility.ts 2>&1 | tee -a "$GITHUB_STEP_SUMMARY"

.github/workflows/managed-d1.yml

@@ -35,7 +35,7 @@ jobs:
         uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09
       - id: config
         name: Read authoritative compatibility inputs
-        run: node scripts/workflows/emit-compatibility-outputs.mjs
+        run: node scripts/workflows/emit-compatibility-outputs.ts
   build-candidate:
     name: Build the candidate under managed verification
     needs: default-branch
@@ -115,7 +115,7 @@ jobs:
           test -n "$CLOUDFLARE_API_TOKEN" || { echo "::error::CLOUDFLARE_API_TOKEN is empty; the managed-d1 environment secret is missing"; exit 1; }
           test -n "$CLOUDFLARE_ACCOUNT_ID" || { echo "::error::CLOUDFLARE_ACCOUNT_ID is empty; the repository variable is missing"; exit 1; }
           echo "==> Reaping managed D1 resources left behind by earlier runs; the report lists everything deleted"
-          node scripts/reap-managed-d1.mjs reap --output managed-d1-reaper-report.json
+          node scripts/reap-managed-d1.ts reap --output managed-d1-reaper-report.json
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}