refactor: modernize TypeScript and Biome policy

.env.docker.example

@@ -109,6 +109,10 @@ PDPP_GMAIL_ATTACHMENT_BACKFILL_WINDOW_UIDS=
 # Bounds each historical Gmail attachment backfill page by known byte cost
 # (256KiB..4MiB). Leave blank for the connector default.
 PDPP_GMAIL_ATTACHMENT_BACKFILL_PAGE_BYTES=
+# Bounds a served Gmail attachment-recovery run by known byte cost
+# (256KiB..4MiB). Defaults to 4MiB; the legacy backfill variable remains a
+# compatible override when this is blank.
+PDPP_GMAIL_ATTACHMENT_RECOVERY_PAGE_BYTES=
 CHATGPT_USERNAME=
 CHATGPT_PASSWORD=
 # Diagnostic-only: when set to 1, a ChatGPT run performs one redacted
@@ -142,6 +146,8 @@ SLACK_COOKIE=
 #   PDPP_DOCKER_SLACKDUMP_DIR=./packages/polyfill-connectors/.pdpp-tools/slackdump
 PDPP_DOCKER_SLACKDUMP_DIR=./packages/polyfill-connectors/.pdpp-tools/slackdump
 SLACKDUMP_BIN=/opt/pdpp-tools/slackdump/slackdump
+# Remove Slackdump's downloaded-file cache only after PDPP durably accepts a run.
+SLACK_RECLAIM_UPLOADS=
 CHASE_USERNAME=
 CHASE_PASSWORD=
 AMAZON_USERNAME=

.github/workflows/openspec-archive-check.yml

@@ -17,12 +17,12 @@ on:
     paths:
       - ".github/workflows/openspec-archive-check.yml"
       - "openspec/changes/**"
-      - "scripts/openspec-archive-check.mjs"
+      - "scripts/openspec-archive-check.ts"
   pull_request:
     paths:
       - ".github/workflows/openspec-archive-check.yml"
       - "openspec/changes/**"
-      - "scripts/openspec-archive-check.mjs"
+      - "scripts/openspec-archive-check.ts"
   workflow_dispatch: {}
 
 concurrency:
@@ -43,13 +43,23 @@ jobs:
           # read the target tree rather than falling back to the working tree.
           fetch-depth: 0
 
+      - name: Install pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
       - name: Install Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
+          cache: "pnpm"
+
+      - name: Install dependencies
+        env:
+          PATCHRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
+          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
+        run: pnpm install --frozen-lockfile
 
       - name: Run archive-check unit tests
-        run: node --test scripts/openspec-archive-check.test.mjs
+        run: node --test --import tsx scripts/openspec-archive-check.test.ts
 
       - name: Report archive-due changes (non-blocking)
         run: |
@@ -62,8 +72,8 @@ jobs:
             echo '## OpenSpec archive-due report'
             echo
             echo '```'
-            node scripts/openspec-archive-check.mjs --ref "$ref"
+            node --import tsx scripts/openspec-archive-check.ts --ref "$ref"
             echo '```'
           } >> "$GITHUB_STEP_SUMMARY"
           # Mirror to the log too, still non-blocking.
-          node scripts/openspec-archive-check.mjs --ref "$ref"
+          node --import tsx scripts/openspec-archive-check.ts --ref "$ref"

.github/workflows/reference-implementation.yml

@@ -6,7 +6,7 @@ name: reference-implementation
 # connector and package workspaces.
 #
 # The apps/console/** trigger is here because two integration tests in the
-# reference suite (composed-origin.test.js, dashboard-proxy-redirect.test.js)
+# reference suite (composed-origin.test.ts, dashboard-proxy-redirect.test.ts)
 # build apps/console and spawn its standalone server to exercise the
 # dashboard/BFF/proxy. The apps/site/** trigger is here because the RS/dataset
 # import-boundary tests read the public sandbox source from apps/site/src/app/
@@ -74,18 +74,18 @@ jobs:
               openspec/changes/complete-mcp-slvp-surface/*|openspec/changes/complete-mcp-slvp-surface/**|\
               docs/research/mcp-slvp-*.md|\
               reference-implementation/*|reference-implementation/**|\
-              scripts/check-console-health-surfaces.mjs|\
-              scripts/check-console-health-surfaces.test.mjs|\
-              scripts/check-owner-journey-acceptance.mjs|\
-              scripts/check-owner-journey-acceptance.test.mjs|\
+              scripts/check-console-health-surfaces.ts|\
+              scripts/check-console-health-surfaces.test.ts|\
+              scripts/check-owner-journey-acceptance.ts|\
+              scripts/check-owner-journey-acceptance.test.ts|\
               scripts/owner-journey-acceptance/*|scripts/owner-journey-acceptance/**|\
-              scripts/stream-evidence-inventory.mjs|\
+              scripts/stream-evidence-inventory.ts|\
               scripts/stream-health-audit/*|scripts/stream-health-audit/**|\
-              scripts/check-stream-health-audit.mjs|\
+              scripts/check-stream-health-audit.ts|\
               docs/reference/stream-evidence-inventory.md|\
               .releaserc.yaml|\
-              scripts/check-package-release-policy.mjs|\
-              scripts/check-package-release-policy.test.mjs|\
+              scripts/check-package-release-policy.ts|\
+              scripts/check-package-release-policy.test.ts|\
               packages/*/package.json)
                 reference_impacting=true
                 break
@@ -140,7 +140,7 @@ jobs:
 
       - name: Test stream health audit
         if: steps.changes.outputs.reference_impacting == 'true'
-        run: node --test reference-implementation/test/stream-health-audit.test.js
+        run: node --test reference-implementation/test/stream-health-audit.test.ts
 
       - name: Test console health surface gate
         if: steps.changes.outputs.reference_impacting == 'true'

.github/workflows/remote-surface.yml

@@ -22,15 +22,15 @@ on:
     branches: [main]
     paths:
       - "reference-implementation/runtime/browser-surface/remote-surface-optional.ts"
-      - "reference-implementation/test/remote-surface-reference-boundary.test.js"
+      - "reference-implementation/test/remote-surface-reference-boundary.test.ts"
       - "reference-implementation/package.json"
       - "apps/console/package.json"
       - ".github/workflows/remote-surface.yml"
       - "pnpm-lock.yaml"
   pull_request:
     paths:
       - "reference-implementation/runtime/browser-surface/remote-surface-optional.ts"
-      - "reference-implementation/test/remote-surface-reference-boundary.test.js"
+      - "reference-implementation/test/remote-surface-reference-boundary.test.ts"
       - "reference-implementation/package.json"
       - "apps/console/package.json"
       - ".github/workflows/remote-surface.yml"
@@ -127,4 +127,4 @@ jobs:
           "
 
       - name: Verify remote-surface reference boundary
-        run: node --test reference-implementation/test/remote-surface-reference-boundary.test.js
+        run: node --test reference-implementation/test/remote-surface-reference-boundary.test.ts

.github/workflows/semantic-release.yml

@@ -55,7 +55,7 @@ jobs:
         run: |
           set -o pipefail
           pnpm exec semantic-release --dry-run 2>&1 | tee "$RUNNER_TEMP/semantic-release-dry-run.log"
-          node scripts/semantic-release-github-output.mjs dry-run "$RUNNER_TEMP/semantic-release-dry-run.log"
+          node --import tsx scripts/semantic-release-github-output.ts dry-run "$RUNNER_TEMP/semantic-release-dry-run.log"
 
   quality:
     name: release quality checks

.github/workflows/spec-check.yml

@@ -8,15 +8,15 @@ on:
       - "apps/site/content/docs/spec-*.md"
       - "apps/site/content/docs/README.md"
       - "package.json"
-      - "scripts/spec-check.mjs"
+      - "scripts/spec-check.ts"
       - "spec-*.md"
   pull_request:
     paths:
       - ".github/workflows/spec-check.yml"
       - "apps/site/content/docs/spec-*.md"
       - "apps/site/content/docs/README.md"
       - "package.json"
-      - "scripts/spec-check.mjs"
+      - "scripts/spec-check.ts"
       - "spec-*.md"
   workflow_dispatch: {}
 

.github/workflows/test-accounting.yml

@@ -0,0 +1,72 @@
+name: test-accounting
+
+# Fail-closed gate for the test-accounting inventory: every tracked file that
+# classifies as an executable test must be planned by exactly one suite or
+# explicitly (and non-expired) excluded. This is the same invariant
+# `runAuthority` now enforces on every real `--run` (see authority.ts), run
+# here independently so a discovery gap is caught on PRs that touch the
+# accounting scripts or the manifest directly, without requiring a full
+# `--suite all` run (which would spawn every package's real test suite,
+# including PostgreSQL-gated reference-implementation profiles this
+# workflow has no business depending on).
+#
+# Path-scoped like spec-check.yml/openspec-archive-check.yml: this only
+# needs to run when the accounting scripts or the manifest itself change.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/test-accounting.yml"
+      - "scripts/test-accounting/**"
+      - "test-accounting.manifest.json"
+  pull_request:
+    paths:
+      - ".github/workflows/test-accounting.yml"
+      - "scripts/test-accounting/**"
+      - "test-accounting.manifest.json"
+  workflow_dispatch: {}
+
+concurrency:
+  group: test-accounting-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  inventory:
+    name: inventory closure + unit tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          # inventory_base_sha must resolve as an ancestor of HEAD.
+          fetch-depth: 0
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "22"
+          cache: "pnpm"
+
+      - name: Fetch inventory baseline
+        run: |
+          base_sha="$(node -p 'require("./test-accounting.manifest.json").inventory_base_sha')"
+          git fetch --no-tags origin "$base_sha"
+          git merge-base --is-ancestor "$base_sha" HEAD
+
+      - name: Install dependencies
+        env:
+          PATCHRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
+          PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: "1"
+        run: pnpm install --frozen-lockfile
+
+      - name: Check inventory closure (every executable test planned or excluded)
+        run: pnpm test-accounting:inventory
+
+      - name: Test the accounting scripts themselves
+        run: pnpm test-accounting:test

.npmrc

@@ -0,0 +1 @@
+child-concurrency=1

.releaserc.yaml

@@ -63,25 +63,25 @@ plugins:
             section: "Reverts"
           - type: docs
             section: "Documentation"
-            hidden: true
+            effect: hidden
           - type: style
             section: "Styles"
-            hidden: true
+            effect: hidden
           - type: chore
             section: "Miscellaneous Chores"
-            hidden: true
+            effect: hidden
           - type: refactor
             section: "Code Refactoring"
-            hidden: true
+            effect: hidden
           - type: test
             section: "Tests"
-            hidden: true
+            effect: hidden
           - type: build
             section: "Build System"
-            hidden: true
+            effect: hidden
           - type: ci
             section: "Continuous Integration"
-            hidden: true
+            effect: hidden
   - - "@semantic-release/release-notes-generator"
     - preset: conventionalcommits
       presetConfig:
@@ -132,25 +132,25 @@ plugins:
             section: "Reverts"
           - type: docs
             section: "Documentation"
-            hidden: true
+            effect: hidden
           - type: style
             section: "Styles"
-            hidden: true
+            effect: hidden
           - type: chore
             section: "Miscellaneous Chores"
-            hidden: true
+            effect: hidden
           - type: refactor
             section: "Code Refactoring"
-            hidden: true
+            effect: hidden
           - type: test
             section: "Tests"
-            hidden: true
+            effect: hidden
           - type: build
             section: "Build System"
-            hidden: true
+            effect: hidden
           - type: ci
             section: "Continuous Integration"
-            hidden: true
+            effect: hidden
   - - "@semantic-release/npm"
     - pkgRoot: "packages/cli"
   - - "@semantic-release/npm"
@@ -166,4 +166,4 @@ plugins:
       labels: false
       releasedLabels: false
   - - "@semantic-release/exec"
-    - publishCmd: "node scripts/semantic-release-github-output.mjs publish ${nextRelease.version} ${nextRelease.gitTag}"
+    - publishCmd: "node --import tsx scripts/semantic-release-github-output.ts publish ${nextRelease.version} ${nextRelease.gitTag}"