fix(ci): build dist/ before npm publish + bump 1.4.1 (#3)

The publish workflow ran `npm publish` with NO build, but dist/ is gitignored —
so the checkout had no dist/ and the tarball shipped an EMPTY dist/. Published
1.4.0 resolved as a version but every subpath 404'd (`Module not found:
@hanzo/brand/registry`), breaking every consumer's build (console embed).

Add `npm ci && npm run build` before publish (tsup builds index/loader/hero/cli
/brand-id/registry/marks). Bump to 1.4.1 so the working build supersedes the
empty 1.4.0 (caret ^1.4.0 consumers resolve up to it). --no-provenance to avoid
a 422 on the token publish.

Co-authored-by: hanzo-dev <[email protected]>

.github/workflows/npm-publish.yml

@@ -34,11 +34,19 @@ jobs:
           else
             echo "skip=false" >> "$GITHUB_OUTPUT"
           fi
+      # dist/ is gitignored (built, never committed), so the checkout has NO
+      # dist/. Without this build the publish tarball ships an EMPTY dist/ — the
+      # package resolves as a version but every subpath 404s (this shipped the
+      # broken 1.4.0: `Module not found: @hanzo/brand/registry`). Build first.
+      - name: Install + build
+        if: steps.check.outputs.skip != 'true'
+        run: |
+          npm ci
+          npm run build
       - name: Publish
         if: steps.check.outputs.skip != 'true'
-        # --provenance requires the package to already exist on the registry
-        # with provenance enabled. Pass --no-provenance until first manual
-        # publish lands; flip back to --provenance after.
-        run: npm publish --access public
+        # --no-provenance: provenance requires the package to already exist on the
+        # registry with provenance enabled; a token publish would 422 otherwise.
+        run: npm publish --access public --no-provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@hanzo/brand",
-  "version": "1.3.4",
+  "version": "1.4.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@hanzo/brand",
-      "version": "1.3.4",
+      "version": "1.4.1",
       "license": "MIT",
       "dependencies": {
         "@hanzo/logo": "^1.0.11"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hanzo/brand",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "Official brand assets and design system for Hanzo AI",
   "main": "dist/index.js",
   "module": "dist/index.mjs",