feat(stdlib): PixiJS 8.x Container transform-and-event surface (bindings #1)

[hyperpolymath]

Summary

Extends the Tier-1 PixiJS binding (#446 row #1) with the 11 most-load-bearing accessors + on/off pointer-event registration. This is the largest single chunk of idaptik's src/bindings/Pixi.res surface still not bound — 215 src/app/*.res files depend on Container transforms and FederatedPointerEvent handlers, so this PR is a forward unblocker for the ReScript→AffineScript migration.

What lands

stdlib/Pixi.affine (+46 lines): 11 new extern fns.

Surface	Externs
Container transforms	pixiContainerSetScale, SetPivot, SetRotation, SetAlpha, SetZIndex, SetSortableChildren, SetEventMode, SetCursor
FederatedPointerEvent registration	pixiContainerOn, pixiContainerOff
Sprite	pixiSpriteSetAnchor

lib/codegen_deno.ml (+22 lines): 11 __as_* prelude helpers + 11 entries in the existing deno_builtins dispatch block, matching the existing wasmCall/motion/pixi pattern.

tests/codegen-deno/pixi_smoke.{affine,harness.mjs} (+80 lines combined): new smokeAccessorsFlow exercises every new extern via the existing harness pattern. MockContainer grows scale/pivot Point mocks + handler Map + the new fields; asserts handler identity is preserved across on(...) → off(...).

docs/bindings-roadmap.adoc row #1 status note expanded — Container 8.x transform-and-event surface promoted from "deferred" to "landed"; remaining deferred items (typed FederatedPointerEvent accessors, parent read accessor with Option-null handling, Point/Rectangle/Circle helper types, sprite atlases, filters, hitArea) listed explicitly.

Design notes

Why pub extern fn pixiContainerSetEventMode(c, mode: String) rather than a sum type? Pixi 8's eventMode values are open strings ("static" / "dynamic" / "passive" / "none" / "auto"). A sum type would either freeze the set or require codegen-tagged-variant lowering that doesn't yet exist on the Deno-ESM backend (deferred to json.affine v0.3, mirroring the WasmValue decision in #467). Matches the existing pattern in stdlib/PixiUI.affine for slider.orientation.

Why handler: Json? The FederatedPointerEvent reaches the handler as a JS object; AffineScript-side code uses existing Json accessors to read e.global.x, e.target, etc. A typed FederatedPointerEvent extern type with dedicated accessor extern fns is the natural follow-up — captured in the roadmap row as a deferred item, not in this PR's scope. The Json handler avoids forcing every caller through a typed surface they may not want.

Anchor is on Sprite, not Container. Pixi 8 keeps the same split as 7.x — Container has no anchor. The binding mirrors that with pixiSpriteSetAnchor rather than putting it on pixiContainerSetAnchor.

Test plan

• dune build bin/main.exe — clean (only the expected parser warnings)
• dune runtest — 354 tests pass
• tools/run_codegen_deno_tests.sh — all 17 harnesses including extended pixi_smoke.harness.mjs OK
• CI build job
• CI tools/run_codegen_deno_tests.sh job
• CI governance + Hypatia (known baselines per repo CLAUDE.md may be red — those are not from this PR)

Refs

• Umbrella: [campaign] AffineScript top-50 framework bindings roadmap (UMBRELLA) #446 (Tier 1 — idaptik blockers)
• Tier-1 sub-issue: [#446 STEP 2] Tier 1 — idaptik blockers (10 bindings) #450
• Row updated: docs/bindings-roadmap.adoc row ci: Bump actions/setup-node from 4.0.2 to 6.3.0 #1
• Prior PixiJS-related PRs for context: feat(stdlib): PixiJS binding restart (bindings #1) #429 (restart on Deno-ESM), feat(stdlib): @pixi/ui binding (bindings #3) #435 (@pixi/ui MVP), feat(stdlib): motion binding — animateMini/tween/spring/ease (bindings #4 → ●) #436 (motion ●), feat(stdlib): @pixi/sound binding (bindings #2) #437 (@pixi/sound)
• Compile-time pattern doc: docs/specs/zig-ffi-patterns.adoc (PR Roadmap tracking + Zig-FFI doc (#19) + hex/base64 encoding (#25) + Int-division codegen fix (#478) #474 — non-conflicting siblings)

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 83 issues detected

Severity	Count
🔴 Critical	2
🟠 High	13
🟡 Medium	68

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action ons/checkout@v6\n    needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action land/setup-deno@v2\n    needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affine-vscode-publish.yml",
    "type": "missing_timeout_minutes",
    "file": "affine-vscode-publish.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence