Add repository field to package.json (#9)

Required for npm provenance verification — npm checks that the
repository URL matches the GitHub repo publishing the package.

Co-authored-by: Ona <no-reply@ona.com>

.github/workflows/publish.yml

@@ -4,6 +4,10 @@ on:
   release:
     types: [published]
 
+permissions:
+  id-token: write  # Required for OIDC
+  contents: read
+
 jobs:
   publish:
     runs-on: ubuntu-latest
@@ -15,12 +19,17 @@ jobs:
 
       - uses: oven-sh/setup-bun@v2
 
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+
       - run: bun install
 
       - run: bun run build
 
       - run: bun test
 
-      - run: bun publish --access public --provenance
+      - run: bunx npm publish --provenance --access public
         env:
           NPM_CONFIG_REGISTRY: https://registry.npmjs.org

package.json

@@ -6,6 +6,10 @@
     "access": "public"
   },
   "description": "JSX factory for json-render. Write JSX, get Spec JSON.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/kennethnym/jrx"
+  },
   "type": "module",
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",