fix: restore the author metadata that npm drops from the package

[wayfarer3130]

The defect

package.json declared the author as an array:

"author": ["Michael Martinez", "Helmut Dersch"]

npm does not accept an array there. author names one person, and
contributors is the array. npm therefore drops the field, and the published
2.2.0 carries no author at all:

$ npm view @cornerstonejs/jpeg-lossless-decoder-js author --json
{}

The package lost the attribution to the people who wrote the decoder. The
unscoped jpeg-lossless-decoder-js has the same defect, and this fork
inherited it.

The fix

Both original names stay, in the shape npm reads, and the fork's maintainer
joins them:

"author": "Michael Martinez",
"contributors": [
  "Helmut Dersch",
  "Bill Wallace"
]

• Michael Martinez wrote the JavaScript port and the selection value 2 to 7
  support.
• Helmut Dersch wrote the original Java decoder.
• Bill Wallace maintains this fork: the byte-aligned-end-of-scan fix in
  03bb80c0, and the work that publishes it as
  @cornerstonejs/jpeg-lossless-decoder-js.

README.md's acknowledgments section is the source for the first two.

Each entry is a name alone, which is the form the existing entries used. npm
also accepts "Name <email> (url)"; an entry in a published package is public,
so no email is included.

What this releases

The title is fix:, so the merge releases 2.2.1.
tools/check-pr-title.mjs agrees:

::notice::This title releases a patch version when it merges.

Two things follow, and both are the point:

1. It proves the publish path. Nothing has yet published through OIDC
   trusted publishing. 2.2.0 went out by hand, because npm cannot create a
   package name through OIDC. This release exercises release → publish →
   github-release for the first time.
2. It earns a provenance attestation. npm generates one only for a trusted
   publish from CI, so 2.2.0 has none — its dist carries the registry
   signature and no attestations. 2.2.1 will carry one.

If the publish job fails, the version commit and the v2.2.1 tag are already
on main; re-run the workflow with workflow_dispatch and it publishes from
there.

Verified

• npm pkg get author contributors normalizes to a string author and a
  contributors array of two.
• The packed tarball's package.json carries the fields.
• The lint passes and all 54 tests pass.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 97ec3f41-c987-48ff-a288-2dbf422ce940

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}