From af9d81839d5ca6a2cb6d63048a9e19e8f4d073b3 Mon Sep 17 00:00:00 2001
From: Reynaldo Endis <reynaldo.endis@gmail.com>
Date: Mon, 5 Oct 2026 18:25:49 +0000
Subject: [PATCH] fix(release): declare the repository for npm provenance

The first automated publish of the Studio 0.2.0 packages was rejected by
npm with E422: provenance verification requires package.json repository.url
to match the GitHub repository, and neither package declared it. Trusted
Publishing itself succeeded; nothing was published.

Declare the repository in both packages, and have the release workflow set
it on the runner copy before packing so versions tagged before this change
(v3.4.0) can still be published.
---
 .github/workflows/release.yml              | 6 ++++++
 studio/packages/editor-core/package.json   | 5 +++++
 studio/packages/web-component/package.json | 5 +++++
 3 files changed, 16 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 35a18dc..fe9d8d0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -234,6 +234,12 @@ jobs:
               echo "$name@$version is already on npm; skipping."
               continue
             fi
+            # npm provenance requires repository.url to match this repository.
+            # Set it on the runner copy so tags made before the field existed
+            # can still be published.
+            (cd "$dir" && npm pkg set repository.type=git \
+              "repository.url=https://github.com/${GITHUB_REPOSITORY}" \
+              "repository.directory=$dir")
             # pnpm pack rewrites workspace:* to the real version.
             tarball=$(cd "$dir" && pnpm pack --pack-destination "$RUNNER_TEMP/packages" | tail -1)
             if tar -xOzf "$tarball" package/package.json | grep -q '"workspace:'; then
diff --git a/studio/packages/editor-core/package.json b/studio/packages/editor-core/package.json
index 308b429..5242bea 100644
--- a/studio/packages/editor-core/package.json
+++ b/studio/packages/editor-core/package.json
@@ -54,5 +54,10 @@
     "tsup": "^8.5.0",
     "typescript": "^5.7.3",
     "vitest": "^4.1.11"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/rendis/statepro",
+    "directory": "studio/packages/editor-core"
   }
 }
diff --git a/studio/packages/web-component/package.json b/studio/packages/web-component/package.json
index 2ba4592..85971ed 100644
--- a/studio/packages/web-component/package.json
+++ b/studio/packages/web-component/package.json
@@ -37,5 +37,10 @@
     "typescript": "^5.7.3",
     "vitest": "^4.1.11",
     "jsdom": "^26.0.1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/rendis/statepro",
+    "directory": "studio/packages/web-component"
   }
 }