feat(stdlib): Deno scripting surface — walk/args/exit/iso/regex/stderr (step #242)

[hyperpolymath]

Summary

Adds six externs to stdlib/Deno.affine to unblock the TS→AffineScript estate migration:

• walkRecursive(root) -> [String] — depth-first file walk
• args() -> [String] — Deno.args
• exit(code) -> Int — Deno.exit (never returns)
• dateNowIso() -> String — new Date().toISOString()
• consoleError(s) -> Int — stderr; returns 0
• regexMatch(s, pat) -> Bool — new RegExp(pat).test(s)

These were surfaced by surveying the campaign #239 step 2 tail-batch-1 candidates: two pure-logic Deno CLI scripts (panic-attack docs/campaigns/2026-05-26/01-triage.ts and standards/scripts/check-ts-allowlist.ts) become portable using only the existing Deno.affine surface plus these six additions.

Lowering

• walkRecursive, regexMatch get tiny prelude shims (__as_walkRecursive recurses through Deno.readDirSync; __as_regexMatch wraps RegExp.test).
• args, exit, dateNowIso, consoleError lower directly to host expressions.

Test plan

• dune build — green
• New fixture tests/codegen-deno/deno_scripting.{affine,harness.mjs} — in-memory FS for walk, captured stderr, intercepted exit. New harness passes.
• All 12 codegen-deno harnesses pass
• dune runtest — 346 tests green

Refs

• Refs [campaign #239] STEP 3 — STDLIB FILL: discharge gaps surfaced by step 2 standards#242 (STEP 3 — STDLIB FILL)
• Refs [campaign] TypeScript → AffineScript estate migration (UMBRELLA) standards#239 (campaign umbrella)

Notes

This is the first-cut for step 3. Other gaps not addressed here (HTTP server, fetch, crypto.subtle, Deno.Command, recursive-stat with isFile/isDirectory flags) remain on the step-3 docket — they block heavier ports (mock-echidna, civic-connect services, dotfiles health host) which are out of scope for tail-batch-1.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 82 issues detected

Severity	Count
🔴 Critical	4
🟠 High	10
🟡 Medium	68

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action ons/checkout@v6\n    needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action land/setup-deno@v2\n    needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affine-vscode-publish.yml",
    "type": "unknown",
    "file": "affine-vscode-publish.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "unknown",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "unknown",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence