From 6f1fa8668f23e646044d73b071bc744dbe5194a1 Mon Sep 17 00:00:00 2001
From: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Date: Thu, 25 Jun 2026 10:28:29 +0100
Subject: [PATCH] =?UTF-8?q?fix(ci):=20publish=20to=20JSR=20(Deno=20project?=
 =?UTF-8?q?),=20not=20npm=20=E2=80=94=20repair=20broken=20publish?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

preference-injector is Deno + ReScript (deno.json, JSR name, NO package.json),
but publish.yml ran 'npm ci / npm publish' — which can never work without a
package.json (this is why the failure only ever surfaced at release time). The
correct registry is JSR. Switches publish.yml to setup-deno -> deno task build
-> deno publish, with id-token: write so JSR records build provenance natively.
Adds the required 'exports' to deno.json (was missing, so JSR couldn't resolve
the entry).

NOTE: first release will validate the build chain — 'deno task build' runs
'rescript build', which needs the ReScript toolchain available in CI; if that
toolchain isn't wired (no package.json to install rescript from), that's a
pre-existing build gap to close separately.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/publish.yml | 37 ++++++++++++++---------------------
 deno.json                     | 36 +++++++++++++++++++++++++++-------
 2 files changed, 44 insertions(+), 29 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 3c42e4f..d7a4371 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -8,33 +8,26 @@ on:
   release:
     types: [created]
 
+# This is a Deno + ReScript project (deno.json, JSR name @hyperpolymath/
+# preference-injector, no package.json) — it publishes to JSR, not npm. The
+# previous npm publish could never run (npm needs a package.json). JSR records
+# build provenance natively from the OIDC token (id-token: write below).
 jobs:
-  publish-npm:
+  publish-jsr:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
       contents: read
-      id-token: write
-
+      id-token: write   # JSR build provenance is minted from this
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - name: Setup Deno
+        uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
         with:
-          node-version: '20.x'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests
-        run: npm test
-
-      - name: Build
-        run: npm run build
-
-      - name: Publish to npm
-        run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          deno-version: v2.x
+      - name: Build (ReScript -> JS)
+        run: deno task build
+      - name: Test
+        run: deno task test
+      - name: Publish to JSR
+        run: deno publish
diff --git a/deno.json b/deno.json
index d8e5a21..a773cf8 100644
--- a/deno.json
+++ b/deno.json
@@ -1,6 +1,7 @@
 {
   "name": "@hyperpolymath/preference-injector",
   "version": "2.0.0",
+  "exports": "./src/rescript/PreferenceInjector.bs.js",
   "tasks": {
     "dev": "deno run --watch --allow-all src/rescript/PreferenceInjector.bs.js",
     "start": "deno run --allow-all src/rescript/PreferenceInjector.bs.js",
@@ -22,7 +23,10 @@
     "pqc-kyber": "npm:pqc-kyber@1.0.0"
   },
   "compilerOptions": {
-    "lib": ["deno.window", "deno.unstable"],
+    "lib": [
+      "deno.window",
+      "deno.unstable"
+    ],
     "strict": true,
     "allowJs": true,
     "checkJs": false
@@ -34,16 +38,34 @@
     "semiColons": true,
     "singleQuote": true,
     "proseWrap": "preserve",
-    "include": ["src/", "tests/", "examples/", "scripts/"],
-    "exclude": ["*.bs.js"]
+    "include": [
+      "src/",
+      "tests/",
+      "examples/",
+      "scripts/"
+    ],
+    "exclude": [
+      "*.bs.js"
+    ]
   },
   "lint": {
     "rules": {
-      "tags": ["recommended"],
-      "exclude": ["no-unused-vars"]
+      "tags": [
+        "recommended"
+      ],
+      "exclude": [
+        "no-unused-vars"
+      ]
     },
-    "include": ["src/", "tests/", "examples/", "scripts/"],
-    "exclude": ["*.bs.js"]
+    "include": [
+      "src/",
+      "tests/",
+      "examples/",
+      "scripts/"
+    ],
+    "exclude": [
+      "*.bs.js"
+    ]
   },
   "lock": false
 }