policy: Bun is tier 1, Deno is being removed — correct local CLAUDE.md (#17)

Owner ruling, 2026-08-26:

> *"deno is to go and bun is the way we are going, put it first
everywhere unless not possible and explain why if not"*

This repo's `.claude/CLAUDE.md` is what an agent reads **first**.
Correcting `hyperpolymath/standards` (#655) fixes one copy of ~372 —
agents read the local one.

## What this PR actually changes

Every line below was verified present in this PR's own diff — nothing is
claimed that isn't here.

| change | in this diff |
|---|---|
| ALLOWED: Deno row → **Bun**, tier 1 | ✅ |
| BANNED: `\| Bun \| Deno \|` row removed | ✅ |
| BANNED: **Deno added**, replacement Bun | ✅ |
| BANNED: Node.js/npm/pnpm/yarn → Bun | ✅ |
| rule: manifest now **required** (`package.json` + `bun.lock`) | ✅ |
| rule: `bun install --production` replaces the node_modules rule | ✅ |
| pkg mgmt: JS deps → Bun, `bunx --no-install --bun` | ✅ |
| repaired blanking scar: `**No new files**` → **No new ReScript files**
| ✅ |
| repaired blanking scar: `Only where cannot` → Only where AffineScript
cannot | ✅ |
| repaired blanking scar: `\| **** \|` → **AffineScript** | ✅ |

> ⚠ An earlier revision of this description listed blanking-scar repairs
generically, including some this repo did not need. `codacy-production`
correctly flagged that as a description/diff mismatch. The table above
is now generated from the diff itself.

## Review feedback addressed

- **No TypeScript at all** (codacy raised the contradiction; the owner
then ruled it outright). The Bun row advertised *"Executes `.ts`
directly"* inside a file that bans TypeScript. Owner ruling: TypeScript
**should not exist at all** — so every `.ts` reference is gone from the
row, including **JS/TS** in its label. It now reads *JS runtime*,
running compiled ESM/JS.
- **Deno missing from BANNED** (codacy): added — the ruling was only
half expressed without it.
- **Unpinned `bunx`** (coderabbitai, Security & Privacy): a bare `bunx
<tool>` can fetch a package outside `bun.lock` and can start Node via a
shebang. Guidance now requires a declared devDependency plus `bunx
--no-install --bun`.

**Not taken:** *"a npm-compatible"* (LanguageTool is wrong — "an" is
correct before a vowel sound); *"`--frozen-lockfile` is redundant"*
(correct, and no such flag was added); the **Nix → Guix** point (real,
but a separate ruling — deliberately not folded into a Deno/Bun change).

## Scope

Policy text only — no code, no workflows, no build files.

Related: #655 (governing document), #658 (Deno→Bun assessment: 18 repos
blocked on `@affinescript/*` npm packages that do not exist), #659
(policy duplicated into ~372 copies).

---------

Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: codacy-production[bot] <61871480+codacy-production[bot]@users.noreply.github.com>

Author: hyperpolymath

.claude/CLAUDE.md

@@ -6,14 +6,14 @@
 
 | Language/Tool | Use Case | Notes |
 |---------------|----------|-------|
-| **** | Primary application code | Compiles to JS, type-safe |
-| **Deno** | Runtime & package management | Replaces Node/npm/bun |
+| **AffineScript** | Primary application code | Compiles to JS, type-safe |
+| **Bun** | JS runtime & package management (tier 1) | Default for all new work. Runs compiled ESM/JS directly — no bundler step. Uses an npm-compatible `package.json` plus `bun.lock` — both are expected, not anti-patterns. |
 | **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools |
 | **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI |
 | **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like |
 | **Gleam** | Backend services | Runs on BEAM or compiles to JS |
 | **Bash/POSIX Shell** | Scripts, automation | Keep minimal |
-| **JavaScript** | Only where  cannot | MCP protocol glue, Deno APIs |
+| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Bun APIs |
 | **Nickel** | Configuration language | For complex configs |
 | **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm |
 | **Julia** | Batch scripts, data processing | Per RSR |
@@ -24,11 +24,11 @@
 
 | Banned | Replacement |
 |--------|-------------|
-|  |  |
-| Node.js | Deno |
-| npm | Deno |
-| Bun | Deno |
-| pnpm/yarn | Deno |
+| Deno | Bun |
+ Deno | Bun |
+ Node.js | Bun |
+| npm | Bun |
+| pnpm/yarn | Bun |
 | Go | Rust |
 | Python | Julia/Rust/ |
 | Java/Kotlin | Rust/Tauri/Dioxus |
@@ -47,9 +47,9 @@ Both are FOSS with independent governance (no Big Tech).
 
 ### Enforcement Rules
 
-1. **No new  files** - Convert existing TS to 
-2. **No package.json for runtime deps** - Use deno.json imports
-3. **No node_modules in production** - Deno caches deps automatically
+1. **No new ReScript files** - Convert existing `.res` to AffineScript (`.affine`)
+2. **Use `package.json` + `bun.lock` for JS runtime deps** - Bun is npm-compatible; a manifest is REQUIRED
+3. **`bun install --production` for production deps** - resolved from `package.json`, pinned via `bun.lock`
 4. **No Go code** - Use Rust instead
 5. **No Python anywhere** - Use Julia for data/batch, Rust for systems,  for apps
 6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus
@@ -58,7 +58,7 @@ Both are FOSS with independent governance (no Big Tech).
 
 - **Primary**: Guix (guix.scm)
 - **Fallback**: Nix (flake.nix)
-- **JS deps**: Deno (deno.json imports)
+- **JS deps**: Bun (`package.json` + `bun.lock`). Declare tooling as a devDependency and run `bunx --no-install --bun <tool>` — a bare `bunx <tool>` can fetch an unpinned package and may start Node via its shebang.
 
 ### Security Requirements