fix(shim): relicense the JSR shim package to MPL-2.0

[hyperpolymath]

Summary

• JSR validates the license field in deno.json against the SPDX list and rejects unrecognised identifiers. The repo's house licence PMPL-1.0-or-later is custom (Polymath Public License) — not on the SPDX list — so the v0.1.2 publish failed:

  Failed to publish @hyperpolymath/affinescript at 0.1.2:
    The license specified in the "license" field of your configuration file, or in the LICENSE file was not recognized.
  

• Relicense the shim package to MPL-2.0 (Mozilla Public License 2.0): SPDX-recognised, OSI-approved, and the direction the estate has been moving (per the wider PMPL-vs-MPL-2.0 discussion).

Scope is deliberately narrow

Only 5 files under packages/affinescript-cli/:

• deno.json — "license": "MPL-2.0"
• mod.js, mod.d.ts, pins.js, mod_test.js — SPDX-License-Identifier header

Out of scope (separate decision):

• Repo-wide PMPL → MPL-2.0 sweep across bin/, lib/, runtime/, affinescriptiser/, tools/*/, …
• The code generators in OCaml + Rust that emit PMPL headers when scaffolding new files
• Adding LICENSE-MPL-2.0 to LICENSES/

The wider sweep needs explicit owner approval; flagged for follow-up.

Verification

• deno publish --dry-run → clean, 4 files, no warnings.
• deno test mod_test.js → 6/6 green.
• SPDX validator accepts MPL-2.0.

After merge

Last blocker for the v0.1.2 JSR publish: package exists ✓, OIDC trusted publisher is wired ✓, types are typed ✓, license is now SPDX ✓. Re-dispatch publish-jsr.yml after merge and 0.1.2 should finally land on https://jsr.io/@hyperpolymath/affinescript.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 42 issues detected

Severity	Count
🔴 Critical	13
🟠 High	17
🟡 Medium	12

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stray AI.a2ml in root -- use 0-AI-MANIFEST.a2ml only",
    "type": "banned",
    "file": "AI.a2ml",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Superseded by 0-AI-MANIFEST.a2ml",
    "type": "banned",
    "file": "AI.djot",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/example/smoke_driver.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/cli.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence