feat(js): one package.json, every runtime — Bun > Deno > pnpm > npm (Rust tools/js-runtimes, in governance)

.claude/CLAUDE.md

@@ -106,6 +106,7 @@ for the canonical statement.
 |---------------|----------|-------|
 | **AffineScript** | Primary application code | Compiles to typed-wasm; affine/linear types. Replaces ReScript across the estate (RS/TS/JS → AffineScript → typed-wasm). |
 | **Bun** | JS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns. |
+| **Deno** | JS runtime (tier 2) | Permitted, not gated (owner ruling 2026-10-14; order Bun > Deno > pnpm > npm). Reads the same `package.json`; every package carries a generated `deno.lock` (`tools/js-runtimes regen`, `3-practice/LANGUAGE-POLICY.adoc` §1.4). |
 | **Rust/SPARK** | Performance-critical, systems, WASM, CLI tools, safety-critical | "Rust" always means "Rust/SPARK" per terminology note above. Preferred over Ada where reachable. |
 | **Zig** | **APIs, FFIs, gateways, client SDKs (estate default 2026-05-28)**, memory-safe systems where Rust/SPARK is overkill | Zig is the estate-wide default for all API/FFI/gateway/client-SDK work unless explicitly special-cased; Idris2 owns ABIs. Completed V-lang→Zig migration 2026-05-28. |
 | **Idris2** | Formal verification (primary, ABI-style proofs) | ATS2 rejected. Proven-library status in `proven` repo. |
@@ -159,6 +160,8 @@ for the canonical statement.
 >
 > ReScript's ban is uncontested, and its migration destination is **AffineScript**.
 
+> **RULED 2026-10-14 — Deno is permitted again (tier 2).** The owner: *"deno does not need to be absolutely banned"*; the order is **Bun > Deno > pnpm > npm**, npm only as the last resort. The 2026-08-26 and 2026-09-22 rulings quoted below are **superseded**: Deno is back in ALLOWED, its refusal gate and the `deno-allow.txt` ledger are retired, and every package carries all the runtimes' locks through `tools/js-runtimes` (`3-practice/LANGUAGE-POLICY.adoc` §1.3–§1.4). Bun stays first everywhere, and each repository's environment (mise, containers, Guix) provisions it (`js-runtimes provision`).
+>
 > **SUPERSEDED 2026-08-26 — Deno is no longer tier 2.** The owner ruled:
 > *"deno is to go and bun is the way we are going, put it first everywhere unless not
 > possible and explain why if not."* The "Bun > Deno > pnpm > npm" ordering above described
@@ -177,9 +180,8 @@ for the canonical statement.
 | TypeScript | AffineScript | RS/TS/JS → AffineScript → typed-wasm. |
 | ReScript | AffineScript | RS/TS/JS → AffineScript → typed-wasm. |
 | **ReScript** | AffineScript | Banned in new code as of 2026-04-30. Existing `.res` files migrate to `.affine` directly (do not pass through ReScript). |
-| **Deno** | Bun | **Banned 2026-09-22.** Owner ruling: *"deno is over, we're prioritising bun, and using bunx."* `deno.json` task definitions must be ported to `package.json` scripts. Shrink-only ledger: `.machine_readable/deno-allow.txt`. |
 | Node.js | Bun | Bun is Node-compatible; run the code, drop the runtime. |
-| npm | Bun | npm is tier 3 — *permitted, never preferred*, not banned. `package-lock.json` must still not be tracked (standards#67). |
+| npm | Bun | npm is tier 4 — the last resort: *permitted, never preferred*, not banned. `package-lock.json` must still not be tracked (standards#67). |
 | yarn | Bun | yarn is not in the tier list at all. |
 | Go | Rust/SPARK | |
 | **Python** | AffineScript/Rust/SPARK/Julia | Fully banned, no exceptions (SaltStack exception removed 2026-01-03) |
@@ -241,7 +243,7 @@ Both are FOSS with independent governance (no Big Tech).
 
 - **Primary**: Guix (guix.scm)
 - **Nix**: retired — `flake.nix` is not accepted by Governance / Guix packaging policy; a repo with no `guix.scm` packages through a working Containerfile instead
-- **JS deps**: **Bun** (`package.json` + `bun.lock`); `bunx <tool>` to run one-off tooling
+- **JS deps**: **Bun** (`package.json` + `bun.lock`); `bunx <tool>` to run one-off tooling. `tools/js-runtimes regen` keeps `package.json` JCS and regenerates `bun.lock`, `deno.lock` and `pnpm-lock.yaml` together.
 
 ### Documentation Format
 

.githooks/validate-lint-format.sh

@@ -18,8 +18,8 @@
 #     found" means a broken environment, not an exempt one. Skipping there
 #     would report success having examined nothing.
 #
-#   * DENO is neither: it is BANNED, so no Deno toolchain is ever summoned.
-#     Its section refuses rather than checks — see it below.
+#   * DENO is neither: no Deno toolchain is summoned. Deno is tier 2
+#     (permitted, not gated); its section records what it saw — see below.
 #
 #   * OPTIONAL LINTER MISSING (hlint, fourmolu) → reported as an explicit
 #     SKIP line, not as a pass, and CI remains the authority. These are add-ons
@@ -146,40 +146,18 @@ else
   LEDGER+=("nickel: not staged")
 fi
 
-# ── Deno (BANNED — a REFUSAL, not a lint) ───────────────────────────────
+# ── Deno (tier 2 — permitted, not gated) ────────────────────────────────
 #
-# Owner ruling: "deno is over, we're prioritising bun, and using bunx."
-#
-# This section used to install nothing and run `deno fmt --check` / `deno lint`
-# over staged JS in a tree that tracked a deno.json, behind a `warn`. That
-# lint-checked — and thereby blessed — the very thing the warning called
-# banned, and it summoned a banned toolchain to do it.
-#
-# It now refuses. The question it asks is deliberately NARROWER than CI's:
-#
-#   * CI asks "does this repository still carry Deno debt?", and answers it
-#     against the central shrink-only ledger
-#     `.machine_readable/deno-allow.txt` in `standards`.
-#   * This hook CANNOT ask that — it runs inside a caller's checkout and has
-#     no access to that ledger — and must not fake an answer. It asks instead
-#     "is THIS COMMIT ADDING Deno debt?", which is answerable right here.
-#
-# STAGED is `--diff-filter=ACM`, so a DELETED deno.json never appears: paying
-# the debt down is never blocked, only growing it. That is the same
-# shrink-only direction the central ledger enforces, reached without one.
+# Owner ruling 2026-10-14: Deno is not banned; the order is Bun, Deno, pnpm,
+# npm. From 2026-09-22 to 2026-10-14 this hook refused any commit that added
+# or modified a deno.json(c); the ruling retired that refusal along with the
+# central ledger. The hook now records what it saw and passes.
 DENO_CFG="$(staged_matching '(^|/)deno\.jsonc?$')"
 DENO_TRACKED="$(git ls-files -- 'deno.json' '*/deno.json' 'deno.jsonc' '*/deno.jsonc' | grep -c . || true)"
 if [ -n "$DENO_CFG" ]; then
-  fail "Deno is BANNED (owner ruling 2026-08-26 — Bun is the estate runtime). This commit ADDS or MODIFIES $(echo "$DENO_CFG" | grep -c .) Deno config file(s):"
-  while IFS= read -r cfg; do [ -n "$cfg" ] && echo "          - $cfg" >&2; done <<< "$DENO_CFG"
-  echo "        Port the deno.json 'tasks' map to package.json scripts run by" >&2
-  echo "        'bun run' — 'bun run' does NOT read a deno.json tasks map — and" >&2
-  echo "        delete the config. Deleting a deno.json is never blocked here." >&2
-  echo "        A genuinely grandfathered repository is exempted CENTRALLY, in" >&2
-  echo "        .machine_readable/deno-allow.txt in hyperpolymath/standards, not" >&2
-  echo "        by a local bypass." >&2
+  LEDGER+=("deno: $(echo "$DENO_CFG" | grep -c .) Deno config file(s) staged — permitted (tier 2; Bun preferred)")
 else
-  LEDGER+=("deno: no deno.json(c) added or modified (repo tracks ${DENO_TRACKED}; the ledgered CI gate is the authority on existing debt)")
+  LEDGER+=("deno: no deno.json(c) staged (repo tracks ${DENO_TRACKED})")
 fi
 
 # ⚠ Dropping the Deno lint leaves staged `.js`/`.jsx`/`.mjs`/`.cjs` with NO

.github/workflows/actions.lock

@@ -68,8 +68,10 @@ workflows:
     '.github/workflows/governance-reusable.yml':
         - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
         - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393'
         - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
+        - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
     '.github/workflows/governance.yml': []
     '.github/workflows/hypatia-scan-reusable.yml':
         - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
@@ -82,6 +84,10 @@ workflows:
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/instant-sync.yml':
         - 'peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697'
+    '.github/workflows/js-runtimes-reusable.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+        - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
     '.github/workflows/k9-contractile.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/label-triage.yml': []
@@ -142,6 +148,8 @@ workflows:
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/self-test.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+        - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+        - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
     '.github/workflows/settings-drift-detect.yml':
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
@@ -214,6 +222,11 @@ dependencies:
         repo_id: 496012378
         uses:
             - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
+    'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
+        ref: 'v2.0.5'
+        commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+        owner_id: 42048915
+        repo_id: 356423100
     'dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067':
         ref: 'v1'
         commit: 'sha1-7e38f4b43b4db5c8dd498af069a4f6196df1d067'