Theoretically PHP is better, (it's not visible to visitor), only way you can tell that someone is using PHP is when you find a file in his server ( if it's in external file and you need to know exact name you're looking for, and then you only know that file "exists", not what it's inside - some crawlers are looking for known or common PHP names like kclient.php, cloak.php, black.php etc.). PHP mixed in HTML code looks like plain HTML to visitors, they can't know it's even there. Downside is you can't use it everywhere.
JS is client side language, it is visible in the source code and accesible to visitors (therefore bots and crawlers) - but telling it's obviously worse is oversimplification. JS might as well be a simple code that calls for external PHP file (so you can use JS in places where you can't upload and run your own PHP code, like Shopify etc), so in that case it can be also blocked for bots. They see a call, but can't tell what it is, or they can be tricked to think it's actualy something else. Depends on bots also, and what code are they looking for.
I don't use JCI myself, but I'd suspect them to use the mixed JS/PHP version , so I wouldn't worry about it, they probably both work.
Only thing that will not work well (or not for a long time anyway) would be brutal JS redirection placed in obvious way in the code ( but I've also seen that kind of "cloaking", frontend API call to IP quality checker and redirect based on response) and it was live for few days, so plenty of options that "can" work.
Actually sometimes I just switch content on a server from white to black (delete white, upload black), Google sees it of course, but I still run it for months, go figure