chore(calm-suite): A1 — remove vestigial config and rewrite file: deps to bare workspace

[gjs-opsflo]

Description

A1 of the 5-PR Phase 1 sequence under Track A — #2649 (parent epic #2600). Removes vestigial config from calm-suite/calm-studio/ and rewrites every deep file: workspace dep to bare semver "*", then regenerates the root lockfile. No behaviour change.

The purpose of A1 is to shrink the surface area before A3's large git mv: npm 11 auto-symlinks "*" workspace deps regardless of path depth, so once these refs become path-agnostic, A3 can move calm-suite/calm-studio/ → root without touching dependency declarations.

What this PR does

Deletions (8 paths)

• calm-suite/calm-studio/vercel.json — no Vercel deploy target for this workspace.
• calm-suite/calm-studio/package.json — the calmstudio-workspace root manifest was a nested-workspace artifact; the repo-root package.json already declares calm-suite/calm-studio/packages/* and calm-suite/calm-studio/apps/* as workspaces.
• calm-suite/calm-studio/packages/calmscript/ — DSL stub, not consumed by any other package.
• calm-suite/calm-studio/apps/studio/.releaserc.json
• calm-suite/calm-studio/packages/calm-core/.releaserc.json
• calm-suite/calm-studio/packages/extensions/.releaserc.json
• calm-suite/calm-studio/packages/mcp-server/.releaserc.json
• calm-suite/calm-studio/packages/calmscript/.releaserc.json (via dir delete)

Rewrites (11 file: → bare "*" across 6 package.json files)

• packages/calm-core: @finos/calm-models
• packages/mcp-server: @calmstudio/calm-core (deps + devDeps), @finos/calm-models
• packages/github-action: @calmstudio/calm-core, @calmstudio/mcp
• packages/vscode-extension: @calmstudio/mcp
• packages/web-component: @calmstudio/calm-core, @calmstudio/extensions
• apps/studio: @calmstudio/calm-core, @calmstudio/extensions

Lockfile regenerated in a separate atomic commit. All 6 @calmstudio/* workspace symlinks resolve and all 19 rollup platform-specific optional dependency variants are preserved (matches origin/main shape — validate-lockfile CI guard upheld).

Pre-flight: multi-semantic-release dry-run

Before deleting the 5 .releaserc.json files, ran npx multi-semantic-release --dry-run from calm-suite/calm-studio/ after temporarily removing the configs. Result: exit 0, all 8 packages loaded, all plugins resolved. Per-package .releaserc.json files are vestigial — multi-semantic-release discovers config from the root release field or package-level defaults.

Deviations from the documented ritual

1. Lockfile regeneration. AGENTS.md's rm -rf node_modules package-lock.json && npm install ritual crashes inside arborist.buildIdealTree with TypeError: Cannot read properties of null (reading 'matches') on both npm 11.12.1 (Corepack) and npm 10.9.7. The same crash reproduces on plain origin/main with no rewrites, confirming this is a pre-existing arborist dedupe bug, not a regression from A1. Workaround: incremental npm install --package-lock-only against the existing origin/main lockfile (preserves hoist decisions including minimatch@3.1.5 at root — vsce CJS-requires that shape), then npm ci. Bitwise-equivalent to the documented ritual for the fields validate-lockfile CI checks (19 rollup platform variants). An earlier attempt used npm install --force to bypass the buggy PlaceDep.pruneDedupable path, but --force skips dedupe and left minimatch@9.0.9 nested under calm-plugins/vscode/, breaking @vscode/vsces CJS require("minimatch") in CI — replaced by the incremental method in a629650e.

2. ./mvnw verify not run locally. Quarkus 3.34 requires Java 17+, only Java 11 (Temurin) available in the local environment. Maven verification deferred to CI on this PR.

3. calmguard-docs build failure is pre-existing. npm run build fails in calm-suite/calm-guard/docs with Cannot find package '@docusaurus/faster'. Verified by stashing all A1 changes and running npm ci && npm run build --workspace calmguard-docs against unmodified origin/main — same failure. Not in A1 scope.

What was deliberately NOT touched

• calm-suite/calm-guard/package.json's @finos/calm-cli: "^1.33.0" — real semver-published dep, not a file: workspace ref.
• calmscript UI residue in apps/studio (Toolbar.svelte, +page.svelte, export.ts, CodePanel.svelte) — Phase 2 (STUDIO-01) owns these.
• All non-workspace deps (ajv, react, next, etc.).

Type of Change

• 🔧 Chore (maintenance, dependencies, CI, etc.)

Affected Components

• CLI (cli/)
• Schema (calm/)
• CALM AI (calm-ai/)
• CALM Hub (calm-hub/)
• CALM Hub UI (calm-hub-ui/)
• CALM Server (calm-server/)
• CALM Widgets (calm-widgets/)
• Documentation (docs/)
• Shared (shared/)
• VS Code Extension (calm-plugins/vscode/)
• Dependencies
• CI/CD

Also affects calm-suite/calm-studio/ workspaces (calm-core, mcp-server, github-action, vscode-extension, web-component, apps/studio).

Commit Message Format ✅

Both commits use the calm-suite scope (still valid pre-A3) and are DCO-signed:

• chore(calm-suite): A1 — remove vestigial config and rewrite file: deps to bare workspace
• chore(deps): regenerate lockfile after A1 file: → bare-workspace rewrite

Testing

• I have tested my changes locally
• I have added/updated unit tests (no behaviour change — no new tests needed)
• All existing tests pass

Local verification (Mac, Node 22.22.2, npm 11.12.1):

• npm run build: ✓ green for all workspaces except pre-existing calmguard-docs failure (reproduces on origin/main).
• npm test: ✓ green — all 3859+ tests pass across 15 workspaces (calm-models 190, calm-widgets 842, shared 842, cli 385, calm-server 11, calm-hub-ui 747, calm-plugins/vscode 433, calm-guard 111, calm-studio packages+apps 690).
• STRUCT-01 smoke assertions all pass: 6 @calmstudio/* symlinks resolved (≥ relaxed -ge 4 threshold per 01-VALIDATION.md), 8 vestigial paths removed, 0 "file: refs remain in calm-suite/calm-studio/.

Checklist

• My commits follow the conventional commit format
• I have updated documentation if necessary (no user-facing doc changes — internal config only)
• I have added tests for my changes (if applicable)
• My changes follow the project's coding standards

Refs #2649 (Track A), #2600 (parent epic). A2..A5 will follow.

[gjs-opsflo]

CI fix pushed (force-push to chore/phase1-a1). Rev a629650e replaces the original lockfile commit 8428f6e5.

Root cause: The original commit used npm install --force to bypass the pre-existing arborist.buildIdealTree crash described in the PR body. --force skips PlaceDep.pruneDedupable, so minimatch@9.0.9 got nested under calm-plugins/vscode/node_modules/ instead of letting minimatch@3.1.5 hoist to root. @vscode/vsce CJS-requires the v3 default-export function shape and broke with the v9 named-export shape:

Error: (0 , minimatch_1.minimatch) is not a function

Fix: Instead of regenerating the lockfile from scratch, keep the origin/main lockfile and run an incremental update from the new package.json edits:

git checkout origin/main -- package-lock.json
rm -rf node_modules
npm install --package-lock-only   # incremental — keeps origin/main's hoist decisions
npm ci                            # clean install from updated lockfile

Verified locally:

• node_modules/minimatch = 3.1.5 (hoisted to root, matches origin/main)
• No calm-plugins/vscode/node_modules/minimatch entry
• 19 rollup platform-specific binaries preserved (validate-lockfile guard)
• npm run package --workspace calm-plugins/vscode → exits 0, .vsix packaged
• All 3859+ vitest tests still pass
• npm run build still green for everything except the pre-existing calmguard-docs @docusaurus/faster failure (unchanged from origin/main, documented above)

PR body's "Deviations from the documented ritual" section is now accurate as of a629650e.

[rocketstack-matt]

Thanks for the quick turnaround on the packaging fix — dropping the @vscode/vsce > minimatch override and regenerating resolves the minimatch is not a function failure I was seeing; I verified locally that npm ci + npm run package:vscode now packages the VSIX cleanly and validate-lockfile-platforms still passes. A1 scope itself looks right: the deletions and the file: → bare-workspace rewrites are clean, and nothing imports the removed @calmstudio/calmscript.

One thing left before this is safe to merge, on the "no behaviour change" criterion — see the inline comment on the deleted calm-suite/calm-studio/package.json. Removing that manifest breaks automated-release-calm-studio.yml. It won't show up as a check here because that workflow only runs on push to main, but the merge of this PR touches calm-suite/calm-studio/**, so it'll fire on main straight after merge and fail.

Given A1 is explicitly the "remove vestigial release config" step, I think the cleanest fix is to also delete automated-release-calm-studio.yml in this PR (the per-package .releaserc.json and the multi-semantic-release tooling it drove are already going). If you'd rather keep that workflow removal with the CI-path changes in A3, that's fine too — but let's make the deferral explicit and tracked so main doesn't sit with a red release job in between.

[rocketstack-matt]

Deleting this calmstudio-workspace manifest leaves automated-release-calm-studio.yml broken. That workflow does working-directory: calm-suite/calm-studio then npx multi-semantic-release, and multi-semantic-release relies on this file's workspaces array (and the multi-semantic-release devDep declared right here) to discover the @calmstudio/* packages. With no package.json in that directory and no release field at the repo root, the release job fails.

The --dry-run referenced in the PR description was run with this manifest still present (only the .releaserc.json files removed), so it didn't exercise the post-merge state.

Suggest deleting automated-release-calm-studio.yml in this PR alongside the rest of the vestigial release config, or deferring it explicitly to A3 with a tracking note.

[gjs-opsflo]

@rocketstack-matt thank you for catching the automated-release-calm-studio.yml break — that workflow runs only on push to main so I'd missed it. Force-pushed 676f665d taking your second suggestion (defer the manifest deletion to A3 where it co-locates with the path move and the workflow's working-directory: update).

What changed in this rev:

1. Kept calm-suite/calm-studio/package.json (the calmstudio-workspace manifest) — so multi-semantic-release still finds the workspaces array.
2. Trimmed one line from it: removed packages/calmscript from workspaces[] (that directory is deleted in this PR, so the entry would dangle).
3. Regenerated the lockfile via the incremental method (origin/main lockfile + npm install --package-lock-only) instead of the earlier --force approach, which preserves origin/main's hoist tree.

Verified locally:

• npm ci exits 0
• npm run package --workspace calm-plugins/vscode exits 0 (vsce packages an 8.5 MB .vsix)
• cd calm-suite/calm-studio && npx multi-semantic-release --dry-run exits 0 (all 8 @calmstudio/* packages discovered via the workspaces array — the exact path the workflow takes)

Defer note (A3 scope): The calmstudio-workspace manifest gets deleted in A3 (the large git mv calm-suite/* → root PR) where the workflow's working-directory: calm-suite/calm-studio line also has to change to working-directory: calm-studio anyway, so it's the natural place to delete the now-unnecessary intermediate manifest.

Re-requesting review.