diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index a8428c9..62cbd1c 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -6,8 +6,8 @@ workflows:
     '.github/workflows/benchmarks.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/github-script@v9.0.0'
-        - 'actions/setup-node@v7.0.0'
-        - 'actions/upload-artifact@v7.0.1'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'oven-sh/setup-bun@v2.2.0'
     '.github/workflows/boj-build.yml':
         - 'actions/checkout@v7.0.1'
     '.github/workflows/casket-pages.yml':
@@ -16,16 +16,18 @@ workflows:
         - 'actions/configure-pages@v6.0.0'
         - 'actions/deploy-pages@v5.0.1'
         - 'actions/upload-pages-artifact@v5.0.0'
-        - 'haskell-actions/setup@v2.12.0'
+        - 'haskell-actions/setup@v2.12.1'
     '.github/workflows/codeql.yml':
         - 'actions/checkout@v7.0.1'
-        - 'github/codeql-action@v4.38.0'
+        - 'github/codeql-action@v4.38.3'
     '.github/workflows/dogfood-gate.yml':
         - 'actions/checkout@v7.0.1'
         - 'hyperpolymath/deed-ecosystem@main'
         - 'hyperpolymath/k9-ecosystem@main'
-    '.github/workflows/governance.yml': []
-    '.github/workflows/hypatia-scan.yml': []
+    '.github/workflows/governance.yml':
+        - 'metadatastician/standards@7e9b1de272dc110f9653836b9a2f6cd43000bfe7'
+    '.github/workflows/hypatia-scan.yml':
+        - 'metadatastician/standards@7e9b1de272dc110f9653836b9a2f6cd43000bfe7'
     '.github/workflows/instant-sync.yml':
         - 'peter-evans/repository-dispatch@v4.0.1'
     '.github/workflows/k9-svc-validation.yml':
@@ -34,13 +36,13 @@ workflows:
     '.github/workflows/labels.yml': []
     '.github/workflows/lint.yml':
         - 'actions/checkout@v7.0.1'
-        - 'actions/setup-node@v7.0.0'
-        - 'actions/upload-artifact@v7.0.1'
+        - 'oven-sh/setup-bun@v2.2.0'
     '.github/workflows/locale-validation.yml':
         - 'actions/checkout@v7.0.1'
-        - 'actions/setup-node@v7.0.0'
-        - 'actions/upload-artifact@v7.0.1'
-    '.github/workflows/mirror.yml': []
+        - 'actions/upload-artifact@v7.0.2'
+        - 'oven-sh/setup-bun@v2.2.0'
+    '.github/workflows/mirror.yml':
+        - 'metadatastician/standards@7e9b1de272dc110f9653836b9a2f6cd43000bfe7'
     '.github/workflows/pages.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/deploy-pages@v5.0.1'
@@ -49,13 +51,15 @@ workflows:
         - 'dawidd6/action-send-mail@v22'
     '.github/workflows/release.yml':
         - 'actions/checkout@v7.0.1'
-        - 'actions/setup-node@v7.0.0'
+        - 'oven-sh/setup-bun@v2.2.0'
         - 'softprops/action-gh-release@v3.0.3'
     '.github/workflows/rescript-deno-ci.yml':
         - 'actions/checkout@v7.0.1'
-        - 'denoland/setup-deno@v2.0.5'
-    '.github/workflows/scorecard.yml': []
-    '.github/workflows/secret-scanner.yml': []
+        - 'oven-sh/setup-bun@v2.2.0'
+    '.github/workflows/scorecard.yml':
+        - 'metadatastician/standards@7e9b1de272dc110f9653836b9a2f6cd43000bfe7'
+    '.github/workflows/secret-scanner.yml':
+        - 'metadatastician/standards@7e9b1de272dc110f9653836b9a2f6cd43000bfe7'
     '.github/workflows/workflow-linter.yml':
         - 'actions/checkout@v7.0.1'
 dependencies:
@@ -79,24 +83,29 @@ dependencies:
         commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
         owner_id: 44036562
         repo_id: 438112499
+    'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333':
+        ref: 'v8.0.2'
+        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
+        owner_id: 44036562
+        repo_id: 192626254
     'actions/github-script@v9.0.0':
         ref: 'v9.0.0'
         commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
         owner_id: 44036562
         repo_id: 205262760
-    'actions/setup-node@v7.0.0':
-        ref: 'v7.0.0'
-        commit: 'sha1-820762786026740c76f36085b0efc47a31fe5020'
-        owner_id: 44036562
-        repo_id: 189476904
     'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
         ref: 'v7.0.0'
         commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
         owner_id: 44036562
         repo_id: 192625955
-    'actions/upload-artifact@v7.0.1':
-        ref: 'v7.0.1'
-        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
+    'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
         owner_id: 44036562
         repo_id: 192625955
     'actions/upload-pages-artifact@v5.0.0':
@@ -111,19 +120,34 @@ dependencies:
         commit: 'sha1-67ce3558d613188179559c61d3565140cf389968'
         owner_id: 9713907
         repo_id: 222439721
-    'denoland/setup-deno@v2.0.5':
+    'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed':
         ref: 'v2.0.5'
         commit: 'sha1-22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
         owner_id: 42048915
         repo_id: 356423100
-    'github/codeql-action@v4.38.0':
+    'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8':
+        ref: 'v1'
+        commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8'
+        owner_id: 1940490
+        repo_id: 260749683
+    'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393':
+        ref: 'v3.0.0'
+        commit: 'sha1-51f63319f592f97930c73d9c46184d20bd206393'
+        owner_id: 26415196
+        repo_id: 297874902
+    'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63':
         ref: 'v4.38.0'
         commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
         owner_id: 9919
         repo_id: 259445878
-    'haskell-actions/setup@v2.12.0':
-        ref: 'v2.12.0'
-        commit: 'sha1-6037f33647c3f17758a2356c80fc4a53d7e0685d'
+    'github/codeql-action@v4.38.3':
+        ref: 'v4.38.3'
+        commit: 'sha1-24c54180a607b1449ed407dd24f251e4e9147c8d'
+        owner_id: 9919
+        repo_id: 259445878
+    'haskell-actions/setup@v2.12.1':
+        ref: 'v2.12.1'
+        commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
         owner_id: 75048950
         repo_id: 623796603
     'hyperpolymath/deed-ecosystem@main':
@@ -136,6 +160,39 @@ dependencies:
         commit: 'sha1-c1a34884054fabf0e9de81dbf68f4ba7874e85f1'
         owner_id: 6759885
         repo_id: 1275650185
+    'metadatastician/standards@7e9b1de272dc110f9653836b9a2f6cd43000bfe7':
+        ref: 'main'
+        commit: 'sha1-7e9b1de272dc110f9653836b9a2f6cd43000bfe7'
+        owner_id: 297579217
+        repo_id: 1116521501
+        uses:
+            - 'actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
+            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+            - 'actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333'
+            - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+            - 'denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed'
+            - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
+            - 'editorconfig-checker/action-editorconfig-checker@51f63319f592f97930c73d9c46184d20bd206393'
+            - 'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124'
+            - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63'
+            - 'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e'
+            - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
+            - 'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555'
+    'ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e':
+        ref: 'v2.5.0'
+        commit: 'sha1-fa7117db83c52d787ae5a89f350999701505d78e'
+        owner_id: 67707773
+        repo_id: 421101922
+    'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6':
+        ref: 'v2.2.0'
+        commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
+        owner_id: 108928776
+        repo_id: 512644635
+    'oven-sh/setup-bun@v2.2.0':
+        ref: 'v2.2.0'
+        commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
+        owner_id: 108928776
+        repo_id: 512644635
     'peter-evans/repository-dispatch@v4.0.1':
         ref: 'v4.0.1'
         commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
@@ -156,31 +213,11 @@ dependencies:
         commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
         owner_id: 44036562
         repo_id: 197814629
-    'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a':
-        ref: 'v7.0.1'
-        commit: 'sha1-043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
-        owner_id: 44036562
-        repo_id: 192625955
-    'dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772':
-        ref: 'stable'
-        commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
-        owner_id: 1940490
-        repo_id: 260749683
-    'editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c':
-        ref: 'v2.2.0'
-        commit: 'sha1-840e866d93b8e032123c23bac69dece044d4d84c'
-        owner_id: 26415196
-        repo_id: 297874902
     'erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124':
         ref: 'v1.24.1'
         commit: 'sha1-54075bcc5e249e4758d363f27d099f55d843f124'
         owner_id: 47606891
         repo_id: 331103973
-    'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
-        ref: 'v2.4.4'
-        commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
-        owner_id: 67707773
-        repo_id: 421101922
     'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':
         ref: 'v0.10.0'
         commit: 'sha1-e83874834305fe9a4a2997156cb26c5de65a8555'
diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index 3abb575..9dceb32 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -1,7 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
-# This workflow is managed by gh actions-lock.
 name: Performance Benchmarks
 
 on:
@@ -9,7 +7,6 @@ on:
     branches: [ main, develop ]
   workflow_dispatch:
 
-
 permissions:
   actions: read
   contents: read
@@ -34,20 +31,28 @@ jobs:
           ref: ${{ github.base_ref }}
           path: base
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v7.1.0
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2.2.0
         with:
-          node-version: '18.x'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
+          bun-version: latest
 
       - name: Run translation benchmarks
-        run: node benchmarks/translation-bench.js > bench-translation.txt
+        run: |
+          if [ ! -f index.js ]; then
+            echo "No library entry (index.js); skip translation benches"
+            echo "skipped" > bench-translation.txt
+            exit 0
+          fi
+          bun benchmarks/translation-bench.js > bench-translation.txt
 
       - name: Run comparison benchmarks
-        run: node benchmarks/comparison-bench.js > bench-comparison.txt
+        run: |
+          if [ ! -f index.js ]; then
+            echo "No library entry (index.js); skip comparison benches"
+            echo "skipped" > bench-comparison.txt
+            exit 0
+          fi
+          bun benchmarks/comparison-bench.js > bench-comparison.txt
 
       - name: Combine benchmark results
         run: |
@@ -90,6 +95,5 @@ jobs:
       - name: Performance regression check
         if: github.event_name == 'pull_request'
         run: |
-          # This is a placeholder for more sophisticated regression checking
           echo "Performance regression check would run here"
           echo "Compare current benchmarks with base branch"
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index e7aa4e9..4094b9f 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -17,4 +17,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@fad242d35291de1898242d6737ba02b74a59a2f2
+    uses: metadatastician/standards/.github/workflows/governance-reusable.yml@7e9b1de272dc110f9653836b9a2f6cd43000bfe7
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 886ebe5..6093cbd 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -20,4 +20,4 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@fad242d35291de1898242d6737ba02b74a59a2f2
+    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@7e9b1de272dc110f9653836b9a2f6cd43000bfe7
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 062ed06..2eecba9 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,7 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
-# This workflow is managed by gh actions-lock.
 name: Lint
 
 on:
@@ -10,7 +8,6 @@ on:
   pull_request:
     branches: [ main, develop ]
 
-
 permissions:
   actions: read
   contents: read
@@ -27,28 +24,19 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7.0.1
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v7.1.0
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2.2.0
         with:
-          node-version: '18.x'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
+          bun-version: latest
 
       - name: Run ESLint
-        run: npx eslint i18n.js index.js test/ examples/ tools/ --max-warnings=0
-
-      - name: Run ESLint with formatter
-        if: failure()
-        run: npx eslint i18n.js index.js test/ examples/ tools/ --format=json --output-file=eslint-report.json
-
-      - name: Upload ESLint report
-        if: failure()
-        uses: actions/upload-artifact@v7.0.2
-        with:
-          name: eslint-report
-          path: eslint-report.json
+        run: |
+          if [ ! -f package.json ]; then
+            echo "No root package.json; skip ESLint (npm-avoidant, bun-port)"
+            exit 0
+          fi
+          bun install --frozen-lockfile
+          bunx eslint i18n.js index.js test/ examples/ tools/ --max-warnings=0
 
   prettier:
     name: Prettier
@@ -61,14 +49,16 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7.0.1
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v7.1.0
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2.2.0
         with:
-          node-version: '18.x'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
+          bun-version: latest
 
       - name: Check formatting
-        run: npx prettier --check "**/*.{js,json,md,yml,yaml}"
+        run: |
+          if [ ! -f package.json ]; then
+            echo "No root package.json; skip Prettier (npm-avoidant, bun-port)"
+            exit 0
+          fi
+          bun install --frozen-lockfile
+          bunx prettier --check "**/*.{js,json,md,yml,yaml}"
diff --git a/.github/workflows/locale-validation.yml b/.github/workflows/locale-validation.yml
index 37f775e..2f0e6a3 100644
--- a/.github/workflows/locale-validation.yml
+++ b/.github/workflows/locale-validation.yml
@@ -1,7 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
-# This workflow is managed by gh actions-lock.
 name: Locale Validation
 
 on:
@@ -17,7 +15,6 @@ on:
       - 'locales/**'
       - 'tools/**'
 
-
 permissions:
   actions: read
   contents: read
@@ -34,17 +31,13 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7.0.1
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v7.1.0
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2.2.0
         with:
-          node-version: '18.x'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
+          bun-version: latest
 
       - name: Validate locale files
-        run: node tools/locale-validator.js --strict --json > validation-results.json
+        run: bun tools/locale-validator.js --strict --json > validation-results.json
 
       - name: Display validation results
         if: always()
@@ -83,20 +76,16 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7.0.1
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v7.1.0
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2.2.0
         with:
-          node-version: '18.x'
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
+          bun-version: latest
 
       - name: Generate coverage report
-        run: node tools/missing-translations.js --format markdown --output coverage-report.md
+        run: bun tools/missing-translations.js --format markdown --output coverage-report.md
 
       - name: Generate JSON report
-        run: node tools/missing-translations.js --format json --output coverage-report.json
+        run: bun tools/missing-translations.js --format json --output coverage-report.json
 
       - name: Display coverage summary
         run: |
@@ -113,7 +102,6 @@ jobs:
 
       - name: Check coverage threshold
         run: |
-          # Check if any locale has coverage below 80%
           LOW_COVERAGE=$(cat coverage-report.json | jq '.locales | to_entries[] | select(.value.coverage < 80) | .key' -r)
 
           if [ ! -z "$LOW_COVERAGE" ]; then
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index d4d3a0a..303d9c9 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -15,5 +15,15 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@fad242d35291de1898242d6737ba02b74a59a2f2
-    secrets: inherit
+    uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@7e9b1de272dc110f9653836b9a2f6cd43000bfe7
+    secrets:
+      GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
+      BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}
+      CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }}
+      SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }}
+      DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }}
+      GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }}
+      RADICLE_KEY: ${{ secrets.RADICLE_KEY }}
+      R2_ACCESS_KEY_ID: ${{ secrets.R2_ACCESS_KEY_ID }}
+      R2_SECRET_ACCESS_KEY: ${{ secrets.R2_SECRET_ACCESS_KEY }}
+      R2_AGE_RECIPIENT: ${{ secrets.R2_AGE_RECIPIENT }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0267dc1..5bf79a2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,7 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
-# This workflow is managed by gh actions-lock.
 name: Release
 
 on:
@@ -23,39 +21,26 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7.0.1
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v7.1.0
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2.2.0
         with:
-          deno-version: v2.x
-      - name: Build (ReScript -> JS)
-        run: deno task build
+          bun-version: latest
+      - name: Bun version
+        run: bun --version
       - name: Test
-        run: deno task test
-
-  publish-jsr:
-    name: Publish to JSR
-    runs-on: ubuntu-latest
-    needs: test
-    permissions:
-      contents: read
-      id-token: write   # JSR records build provenance from this
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v7.0.1
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v7.1.0
-        with:
-          deno-version: v2.x
-      - name: Build (ReScript -> JS)
-        run: deno task build
-      - name: Publish to JSR
-        run: deno publish
+        run: |
+          if [ -f package.json ]; then
+            bun install --frozen-lockfile
+            bun test
+          else
+            echo "No root package.json; bun runtime smoke only"
+            bun --eval 'console.log("bun ok", Bun.version)'
+          fi
 
   github-release:
     name: Create GitHub Release
     runs-on: ubuntu-latest
-    needs: publish-jsr
+    needs: test
     permissions:
       contents: write
     steps:
diff --git a/.github/workflows/rescript-deno-ci.yml b/.github/workflows/rescript-deno-ci.yml
index 1a68a9d..672150c 100644
--- a/.github/workflows/rescript-deno-ci.yml
+++ b/.github/workflows/rescript-deno-ci.yml
@@ -1,8 +1,6 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
-# This workflow is managed by gh actions-lock.
-name: ReScript/Deno CI
+name: ReScript/Bun CI
 on:
   push:
     branches: [main, master]
@@ -14,7 +12,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-
 permissions:
   actions: read
   contents: read
@@ -26,28 +23,25 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v7.0.1
-      - uses: denoland/setup-deno@v2.0.5
+      - uses: oven-sh/setup-bun@v2.2.0
         with:
-          deno-version: v1.x
-      
-      - name: Deno lint
-        run: deno lint
-      
-      - name: Deno fmt check
-        run: deno fmt --check
-      
-      - name: Deno test
-        run: deno test --allow-all --coverage=coverage
-      
+          bun-version: latest
+
+      - name: Bun version
+        run: bun --version
+
       - name: ReScript build
         run: |
-          if [ -f "rescript.json" ] || [ -f "bsconfig.json" ]; then
-            npm install
-            npx rescript
+          if [ -f bindings/rescript/package.json ]; then
+            cd bindings/rescript
+            bun install
+            bunx --bun rescript || true
+          elif [ -f rescript.json ] || [ -f bsconfig.json ]; then
+            bun install
+            bunx --bun rescript || true
+          else
+            echo "No ReScript project at repo root; skip"
           fi
-      
-      - name: Type check
-        run: deno check **/*.ts || true
 
   security:
     runs-on: ubuntu-latest
@@ -55,8 +49,9 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v7.0.1
-      - uses: denoland/setup-deno@v2.0.5
+      - uses: oven-sh/setup-bun@v2.2.0
+        with:
+          bun-version: latest
       - name: Check permissions
         run: |
-          # Audit for dangerous permissions
           grep -rE "allow-run|allow-write|allow-env" . || echo "No dangerous permissions"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index a4a0726..9323863 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@fad242d35291de1898242d6737ba02b74a59a2f2
+    uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@7e9b1de272dc110f9653836b9a2f6cd43000bfe7
     permissions:
       contents: read
       security-events: write
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 0014882..b061b36 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -21,5 +21,4 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fad242d35291de1898242d6737ba02b74a59a2f2
-    secrets: inherit
+    uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@7e9b1de272dc110f9653836b9a2f6cd43000bfe7
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index c51d780..0803c4f 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -25,11 +25,18 @@ jobs:
 
       - name: Check SPDX headers
         run: |
+          # Header block, not line 1. gh actions-lock inserts
+          # "# This workflow is managed by gh actions-lock." at line 1;
+          # REUSE allows SPDX anywhere in the leading comment block.
           errors=0
           for f in .github/workflows/*.yml .github/workflows/*.yaml; do
             [ -f "$f" ] || continue
-            if ! head -1 "$f" | grep -q "SPDX-License-Identifier"; then
-              echo "ERROR: $f missing SPDX header"
+            if ! awk '
+              /^[[:space:]]*#/ { if ($0 ~ /SPDX-License-Identifier/) found=1; next }
+              { exit }
+              END { exit found ? 0 : 1 }
+            ' "$f"; then
+              echo "ERROR: $f has no SPDX-License-Identifier in its header comment block"
               errors=$((errors + 1))
             fi
           done