Merge branch 'main' into fix/issue-42-extern-parsing

Author: hyperpolymath

.build/dune-project

@@ -36,6 +36,9 @@
   (cmdliner (>= 1.2))
   (yojson (>= 2.1))
   (alcotest (and (>= 1.7) :with-test))
-  (odoc (and (>= 2.4) :with-doc)))
+  (odoc (and (>= 2.4) :with-doc))
+  (js_of_ocaml (>= 5.0))
+  (js_of_ocaml-ppx (>= 5.0))
+  (ocamlformat (and (>= 0.26) :with-test)))
  (tags
   (programming-language compiler webassembly affine-types dependent-types row-polymorphism effects ocaml)))

.claude/CLAUDE.md

@@ -70,18 +70,20 @@ Both are FOSS with independent governance (no Big Tech).
 
 ### TypeScript Exemptions (Approved)
 
-The "no new TypeScript" rule has nine approved exemptions in this repo. These paths are *not* policy violations — they are documented carve-outs because the file format or downstream consumer requires TypeScript:
+The "no new TypeScript" rule has seven approved exemptions in this repo. These paths are *not* policy violations — they are documented carve-outs because the file format or downstream consumer requires TypeScript:
 
 | Path | Files | Rationale | Unblock condition |
 |---|---|---|---|
 | `packages/affine-js/types.d.ts` | 1 | TypeScript declaration file — the public API contract by which JS callers consume AffineScript-compiled artefacts. `.d.ts` is TS by definition. | Generate from canonical compiler output (issue: see ROADMAP). |
-| `packages/affine-ts/types.d.ts` | 1 | Same, for TS callers. | Same as above. |
-| `editors/vscode/src/extension.ts` | 1 | VS Code extension entry point. Path pinned by `package.json`'s `main` field. | AffineScript issue #35 (Node-target codegen). |
 | `affinescript-deno-test/*.ts` | 6 | Deno-based test harness for AffineScript itself: `cli.ts`, `mod.ts`, `lib/{compile,discover,runner}.ts`, `example/smoke_driver.ts`. Deno test runner is TS-native. | AffineScript stdlib + Deno bindings (no scheduled issue). |
 
 Adding to this list requires explicit user approval and an unblock condition. New TypeScript files outside this list are still banned per the policy table above.
 
-The 5 external references to `affinescript-deno-test/` (CI workflow, status docs, history docs) and the 3 references to `packages/affine-{js,ts}/` (status docs, Deno config) are why physical relocation into a `vendor/` subtree was rejected — the relocation cost exceeded the visibility benefit when the directories are already named clearly.
+**Closed exemptions:**
+- `editors/vscode/src/extension.ts` — closed 2026-05-03 by issue #35 Phase 3 (Node-target codegen + Vscode bindings landed). Source of truth is now `editors/vscode/src/extension.affine`, compiled to `out/extension.cjs`. Re-introducing the .ts file is blocked by `tools/check-no-extension-ts.sh` (wired into `just check` and `.github/workflows/ci.yml`).
+- `packages/affine-ts/` — removed 2026-05-11 (issue #66 closed won't-do). TypeScript is not a first-class consumer; TS callers should use `@hyperpolymath/affine-js` directly and supply their own typings.
+
+The 5 external references to `affinescript-deno-test/` (CI workflow, status docs, history docs) and the references to `packages/affine-js/` (status docs, Deno config) are why physical relocation into a `vendor/` subtree was rejected — the relocation cost exceeded the visibility benefit when the directories are already named clearly.
 
 ### Package Management
 
@@ -97,3 +99,32 @@ The 5 external references to `affinescript-deno-test/` (CI workflow, status docs
 - SHA-pinned dependencies
 - SPDX license headers on all files
 
+## Hypatia and gitbot-fleet standing rules
+
+Standing governance rules for the Hypatia review bot and the gitbot-fleet
+auto-merge bot. These are estate-wide policies; this section is the canonical
+copy that bots read at PR-review time. Keep this section standalone so it can
+be read cold without requiring the rest of CLAUDE.md as context.
+
+### DOC-FORMAT
+Rule: All documentation files in docs/ must use .adoc extension.
+Exception: GitHub community-health files must use .md by name (CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, CHANGELOG.md, README.md).
+Action (Hypatia): On any PR that adds or renames a docs/ file with .md extension (excluding the above exceptions), post a review comment requesting rename to .adoc and request-changes.
+Action (gitbot): Reject auto-merge for any PR with a docs/ .md file that is not a community-health file name.
+
+### DOC-DEDUP
+Rule: Before creating a new docs/specs/*.adoc or adding a major new section to SPEC.adoc, search existing specs for overlapping coverage.
+Action (Hypatia): On any PR that closes the same issue number as another open PR, post a comment listing both PRs and ask the author to confirm which is canonical.
+Action (gitbot): Block merge if two open PRs share a "Closes #N" reference to the same issue.
+
+### STACK-SIGNAL
+Rule: A docs PR that documents a feature implemented in a sibling feature PR must declare the dependency in its PR body.
+Format: Add a line "Depends on: #NNN" near the top of the PR body.
+Action (Hypatia): On any docs PR whose title or body references types/grammar/syntax added in an open feat PR, check whether "Depends on:" is present; if missing, request it.
+Action (gitbot): Do not auto-merge a PR with "Depends on: #NNN" until #NNN is merged.
+
+### ISSUE-CLOSURE
+Rule: An issue is closed only by explicit merge of a PR with "Closes #N" OR by explicit human comment agreement in the issue thread. bots may not self-close issues.
+Action (Hypatia): When asked to close an issue, confirm via a reply on the issue thread before doing so.
+Action (gitbot): Never use GitHub's "close issue" API directly; only close via PR merge with "Closes #N" keywords.
+

.github/workflows/ci.yml

@@ -43,6 +43,14 @@ jobs:
       - name: Run face-transformer regression tests
         run: opam exec -- ./tools/run_face_transformer_tests.sh
 
+      - name: Issue #35 Phase 3 — block extension.ts regression
+        # The vscode extension is now authored in extension.affine and
+        # compiled to extension.cjs. Re-introducing extension.ts would
+        # silently drift the source-of-truth back to TypeScript, which
+        # the policy forbids. See tools/check-no-extension-ts.sh for
+        # rationale + recovery instructions.
+        run: ./tools/check-no-extension-ts.sh
+
       - name: Check formatting
         run: opam exec -- dune build @fmt
 

.github/workflows/codeql.yml

@@ -31,12 +31,12 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v3.28.1
+        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.28.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v3.28.1
+        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.28.1
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/hypatia-scan.yml

@@ -86,7 +86,7 @@ jobs:
           echo "- Medium: $MEDIUM" >> $GITHUB_STEP_SUMMARY
 
       - name: Upload findings artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: hypatia-findings
           path: hypatia-findings.json

.github/workflows/scorecard-enforcer.yml

@@ -30,7 +30,7 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v3
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3
         with:
           sarif_file: results.sarif
 

.github/workflows/scorecard.yml

@@ -27,6 +27,6 @@ jobs:
           results_format: sarif
 
       - name: Upload results
-        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v3.31.8
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v3.31.8
         with:
           sarif_file: results.sarif

.github/workflows/semgrep.yml

@@ -29,7 +29,7 @@ jobs:
           SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
         with:
           sarif_file: semgrep.sarif
         if: always()

.github/workflows/stdlib-naming.yml

@@ -24,7 +24,7 @@ jobs:
   enforce-lowercase-stdlib:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Enforce lowercase .affine filenames in stdlib/
         run: |

.machine_readable/6a2/META.a2ml

@@ -667,5 +667,5 @@ consequences = """
 """
 references = [
   "docs/DESIGN-VISION.adoc (faces section)",
-  "docs/specs/faces.md (to be written)",
+  "docs/specs/faces.adoc",
 ]