fix(ci): publish to JSR (Deno project), not npm — repair broken publish (#39)

**This is the 'how did it just surface' repo.** preference-injector is
Deno+ReScript (`deno.json`, JSR name
`@hyperpolymath/preference-injector`, **no `package.json`**), but
`publish.yml` ran `npm ci`/`npm publish` — impossible without a
package.json. Because the publish job only runs **on release**, it
silently failed only at release time, so it stayed invisible until the
provenance audit was the first thing to actually read it.

Fix: switch to **JSR** (the correct registry) — `setup-deno` → `deno
task build` → `deno publish`, with `id-token: write` so JSR records
build provenance natively. Adds the missing `exports` to `deno.json`.

⚠️ First release validates the build chain: `deno task build` runs
`rescript build` — if the ReScript toolchain isn't available in CI (no
package.json to install it from), that's a pre-existing build gap to
close separately. Also note the repo is mid ReScript→AffineScript
migration. 🤖 Generated with [Claude
Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/publish.yml

@@ -8,33 +8,26 @@ on:
   release:
     types: [created]
 
+# This is a Deno + ReScript project (deno.json, JSR name @hyperpolymath/
+# preference-injector, no package.json) — it publishes to JSR, not npm. The
+# previous npm publish could never run (npm needs a package.json). JSR records
+# build provenance natively from the OIDC token (id-token: write below).
 jobs:
-  publish-npm:
+  publish-jsr:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
       contents: read
-      id-token: write
-
+      id-token: write   # JSR build provenance is minted from this
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Setup Deno
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
         with:
-          node-version: '20.x'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests
-        run: npm test
-
-      - name: Build
-        run: npm run build
-
-      - name: Publish to npm
-        run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          deno-version: v2.x
+      - name: Build (ReScript -> JS)
+        run: deno task build
+      - name: Test
+        run: deno task test
+      - name: Publish to JSR
+        run: deno publish

deno.json

@@ -1,6 +1,7 @@
 {
   "name": "@hyperpolymath/preference-injector",
   "version": "2.0.0",
+  "exports": "./src/rescript/PreferenceInjector.bs.js",
   "tasks": {
     "dev": "deno run --watch --allow-all src/rescript/PreferenceInjector.bs.js",
     "start": "deno run --allow-all src/rescript/PreferenceInjector.bs.js",
@@ -22,7 +23,10 @@
     "pqc-kyber": "npm:pqc-kyber@1.0.0"
   },
   "compilerOptions": {
-    "lib": ["deno.window", "deno.unstable"],
+    "lib": [
+      "deno.window",
+      "deno.unstable"
+    ],
     "strict": true,
     "allowJs": true,
     "checkJs": false
@@ -34,16 +38,34 @@
     "semiColons": true,
     "singleQuote": true,
     "proseWrap": "preserve",
-    "include": ["src/", "tests/", "examples/", "scripts/"],
-    "exclude": ["*.bs.js"]
+    "include": [
+      "src/",
+      "tests/",
+      "examples/",
+      "scripts/"
+    ],
+    "exclude": [
+      "*.bs.js"
+    ]
   },
   "lint": {
     "rules": {
-      "tags": ["recommended"],
-      "exclude": ["no-unused-vars"]
+      "tags": [
+        "recommended"
+      ],
+      "exclude": [
+        "no-unused-vars"
+      ]
     },
-    "include": ["src/", "tests/", "examples/", "scripts/"],
-    "exclude": ["*.bs.js"]
+    "include": [
+      "src/",
+      "tests/",
+      "examples/",
+      "scripts/"
+    ],
+    "exclude": [
+      "*.bs.js"
+    ]
   },
   "lock": false
 }