chore(deno): drop root package.json stub (standards#253)#133
Merged
Conversation
The root package.json was a pure stub:
{name, version, "private": true, "type": "module", "license": "MPL-2.0",
"dependencies": {}}
Zero scripts, zero runtime deps. Standards#253 (npm → Deno estate
migration) flags `package.json` without `deno.json` for review. This
root manifest signals no npm toolchain dependency and can simply go.
The npm-publish target at `tools/tree-sitter-twasm/package.json`
(tree-sitter grammar with native binding via tree-sitter-cli) is
unchanged — that is a Class C carve-out (npm-publishable consumer
artifact) and remains on npm.
Refs: standards#253 STEP 3 (smallest-first batch).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
hyperpolymath
enabled auto-merge (squash)
May 30, 2026 20:45
🔍 Hypatia Security ScanFindings: 84 issues detected
View findings[
{
"reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
"type": "unpinned_action",
"file": "governance.yml",
"action": "pin_sha",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in boj-build.yml",
"type": "missing_timeout_minutes",
"file": "boj-build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in c5-regenerate.yml",
"type": "missing_timeout_minutes",
"file": "c5-regenerate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in cargo-audit.yml",
"type": "missing_timeout_minutes",
"file": "cargo-audit.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in codeql.yml",
"type": "missing_timeout_minutes",
"file": "codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
},
{
"reason": "Issue in dogfood-gate.yml",
"type": "missing_timeout_minutes",
"file": "dogfood-gate.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
hyperpolymath
pushed a commit
that referenced
this pull request
Jun 1, 2026
The smoke job ran a bare `npm install` that has failed with ENOENT on every PR since #133 removed the root package.json (commit d8ea28d, "chore(deno): drop root package.json stub"). The repo is Deno-first now; there is no package.json for npm to read. Guard the step so it runs npm install only when a package.json exists, and otherwise emits a CI warning explaining the Deno migration. The downstream parser/smoke/property/benchmark steps are already guarded on their artefacts, and the aspect + proof steps are dependency-free, so the smoke job now goes green at source rather than red on a missing manifest. Resolves the pre-existing smoke failure surfaced on PR #149.
hyperpolymath
added a commit
that referenced
this pull request
Jun 1, 2026
Closes the #132 Phase-1→Phase-2 capstone gate ("a contributor can `tw build` → run the `.wasm` on Wasmtime"). - emit() now exports the linear `memory` so a host (Wasmtime, JS) can read/write region data. - tests/execute.rs: capstone execution gate — asserts the emitted example-01 module passes `wasmtime compile` (full engine validation + Cranelift codegen, version-stable), with `get_player_hp` invocation best-effort. Skips gracefully when wasmtime is absent. Verified executing on wasmtime 45.0.0 (get_player_hp -> 0). - ci(e2e): guard the smoke job's `npm install` for the Deno migration (#133 removed root package.json) so the smoke job is green at source. Verified: cargo test --workspace --locked green (codegen + verifier); clippy -D warnings clean. Part of Phase 1 (#49).
hyperpolymath
pushed a commit
that referenced
this pull request
Jun 1, 2026
…ed network The OCaml/AffineScript path failed in container/CI envs. Four real fixes, each surfaced by running it: - apt-get update returns 100 on denylisted 3rd-party PPAs (deadsnakes/ondrej 403) -> tolerate (`|| true`); opam is in universe, already indexed. - opam refuses to init as root -> export OPAMROOTISOK=1. - opam's bwrap sandbox fails in containers -> --disable-sandboxing. - opam.ocaml.org/index.tar.gz is denylisted (403) -> point the default repo at the github.com git mirror (github is reachable), same lesson as Deno. Also activate the switch env (eval opam env) and add a final binary check so the script can't report success without producing affinescript. Justfile deps-audit: drop the vacuous `npm audit` (no package.json since #133); use `cargo audit` (guarded) — the real dep audit for this Rust/Deno repo.
hyperpolymath
added a commit
that referenced
this pull request
Jun 1, 2026
…o Deno (#133/#253) (#150) ## What Two related estate-toolchain changes: **1. Durable provisioning** — `tools/provision.sh` (exposed as `just provision` / `just setup`, wired into `setup.sh`) installs: - **Deno** — the JS runtime, fetched from the **GitHub release assets**. `deno.land` / `dl.deno.land` are denied by the network policy (`x-deny-reason: host_not_allowed`), but `github.com` release downloads are reachable — same channel that works for wasmtime/just. - **wasmtime** — the #132 capstone execution gate, via crates.io. - **AffineScript** — the parser/codegen compiler. It is an **OCaml** program (built from `hyperpolymath/affinescript` with opam + dune at the SHA pinned in `c5-regenerate.yml`), **not** an npm package — `@hyperpolymath/affinescript` 404s on npmjs. The stale `deps` recipe (which ran `npm ci` against the `package.json` that #133 removed) is replaced with a real toolchain check. **2. node → Deno harness migration** (estate #133 / standards#253) — the `node tests/*.mjs` runners now run under **Deno** with scoped permissions (`--allow-read --allow-write --allow-run --allow-env --allow-sys`): - `deno.json` (tasks + config), the Justfile `deno_run` recipes, `e2e.yml` (smoke + build-e2e jobs install Deno from the release assets), and `tests/e2e.sh`. - The `.mjs` were already Deno-shaped (`node:` imports, `import.meta.url`-derived `__dirname`), so the change is mechanical — no source edits to the harnesses. **Cleanup** — removed the ReScript-era leftovers `deno.lock` + `package-lock.json`, and the stale `rescript build` / `node_modules/@rescript` references in the E2E script. ## Why `@hyperpolymath/affinescript` is OCaml, so it was never an npm/Deno/Bun package — there's nothing to "migrate" for the compiler. The only JS-runtime surface is the `.mjs` harnesses, and the estate standard is **Deno** (#133/#253), not Bun. This PR makes the toolchain reproducible and finishes the node→Deno harness move. ## Verification (local, deno 2.8.1) - `deno task test-aspect` / `test-proof` — green - `just deps` (deno/cargo/wasmtime ok), `just test-aspect` / `test-proof` — green - `E2E_BUILD=0 bash tests/e2e.sh` — **47 passed / 0 failed / 7 skipped** - `tools/provision.sh` runs clean (idempotent skip when tools present) The CI Deno-install steps + full `e2e.yml` flow are verified by this PR's own run. ## Note on AffineScript `provision.sh` *can* build AffineScript here (`github.com` clone is reachable, opam is apt-installable) but it's a ~5-min OCaml build, so I didn't run it in this session — it's codified per the authoritative `c5-regenerate.yml` recipe. Building it is the unblock for the #127 front-end→IR seam. https://claude.ai/code/session_01Rq4da8i2uGnDUfanSB1Hx4 --- _Generated by [Claude Code](https://claude.ai/code/session_01Rq4da8i2uGnDUfanSB1Hx4)_ --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
STEP 3 of campaign #253 (npm → Deno estate migration).
package.jsonwas a pure stub (name,version,"private": true,"type": "module", emptydependencies). Zero scripts, zero runtime deps — pure dead weight.package.jsonwithoutdeno.jsonfor review; this root manifest signals no npm toolchain dependency and can simply go.tools/tree-sitter-twasm/package.jsonUNTOUCHED — that is a Class C carve-out (npm-publishable tree-sitter grammar with native bindings viatree-sitter-cli).Test plan
git ls-files | grep package.jsonreturns onlytools/tree-sitter-twasm/package.json(the carve-out).:nodejs_detecteddoesn't flag — root no longer carries an npm signal.🤖 Generated with Claude Code