chore(packaging): INT-04 JSR packaging prep — runtime publish-ready, NOT published (Refs #181 #260)

[hyperpolymath]

INT-04 — JSR packaging prep (#181) — NOT published

Bounded packaging prep per owner direction: prepare only, stop before publish. Nothing is published; the workflow is manual-only and owner-gated.

Landed

• deno publish --dry-run green for @hyperpolymath/affine-js and @hyperpolymath/affinescript-tea. Two real packaging defects fixed:
  • test files (loader_test.js/mod_test.js) were being published → publish.exclude in both deno.json.
  • affinescript-tea/mod.js imported affine-js via a cross-package relative path (broken for JSR consumers) → rewired to bare spec @hyperpolymath/affine-js/loader + import map. 9/9 tea tests still green.
• .github/workflows/publish-jsr.yml — manual workflow_dispatch only (never push/merge), JSR OIDC (id-token: write, no token secret), dry_run defaults true, per-package. Publish order load-bearing: affine-js → affinescript-tea.
• docs/PACKAGING.adoc — readiness, order, slow-types note, npm tail.
• INT-04: compiler distribution strategy (native OCaml binary — not JSR/npm) #260 filed — the compiler is a native OCaml binary, not a JSR/npm package; its distribution is a one-way-door design fork (surfaced, not guessed; blocks INT-10).

Verification

dune test --force 278/278 (no compiler change; zero regression). Dry-runs simulate publish only.

Not published. Actual publish needs explicit owner go + JSR/npm auth (see docs/PACKAGING.adoc).

Refs #181 #260. Not Closes — owner closes per ISSUE-CLOSURE.

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 47 issues detected

Severity	Count
🔴 Critical	12
🟠 High	21
🟡 Medium	14

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Stray AI.a2ml in root -- use 0-AI-MANIFEST.a2ml only",
    "type": "banned",
    "file": "AI.a2ml",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Superseded by 0-AI-MANIFEST.a2ml",
    "type": "banned",
    "file": "AI.djot",
    "action": "delete",
    "rule_module": "root_hygiene",
    "severity": "high"
  },
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Action actions/checkout@v4 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action denoland/setup-deno@v2 needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/example/smoke_driver.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/cli.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  },
  {
    "reason": "TypeScript file detected -- banned language",
    "type": "banned_language_file",
    "file": "/home/runner/work/affinescript/affinescript/affinescript-deno-test/mod.ts",
    "action": "flag",
    "rule_module": "cicd_rules",
    "severity": "critical"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence