Add missing build infrastructure and implement developer stubs (esbuild, src/, sync_lock, cmd_build, cmd_install)

[Copilot]

The npm build pipeline was broken (esbuild.config.mjs and src/ missing); several /* TODO */ / /* stub */ developer cues in C and Python were unimplemented. Transitive d3 runtime deps were also absent from package-lock.json.

Build infrastructure

• esbuild.config.mjs — bundles src/js/main.ts → dist/js/bundle.js; supports --watch flag for dev
• tsconfig.json (root) — enables npm run lint (tsc --noEmit) against src/**/*.ts
• eleventy.config.mjs — wires Eleventy: src/ input → dist/ output; injects default graph data
• src/js/main.ts — D3 force-directed dependency graph visualizer; uses /// <reference types="..."> triple-slash directives for ambient d3 types
• src/index.njk + src/css/style.css — homepage template and base styles

Stub implementations

Ppm-lib/Pypm.c — sync_lock()

// was: /* TODO: read pypm.lock, download wheels to cache, pip-install –no-index */
int rc = system(".venv/bin/pip install -r pypm.lock -q"
                " --find-links .wheelhouse 2>/dev/null"
                " || pip install -r pypm.lock -q");

Venv-pip first; falls back to system pip. Skips gracefully if pypm.lock absent.

ppm_cli.py — cmd_build()
Replaced stub print with pip wheel --no-deps --wheel-dir <out> <root>.

ppm_cli.py — cmd_install()
Reads PPM.lock, builds spec list, runs pip install [--find-links <wheelhouse>] for offline-first installs.

Dependencies

package-lock.json updated to include previously missing transitive d3 runtime packages (d3-color, d3-dispatch, d3-ease, d3-interpolate, d3-quadtree, d3-timer, d3-transition) required by the committed d3 direct deps.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.