# v0.1.2 — Fix OIDC Provenance Publish

## TL;DR

Adds `repository.url` to package.json so npm OIDC provenance verification passes. v0.1.1 publish failed because sigstore couldn't match the package to the GitHub repo.

## What Changed

| Change | Why |
|--------|-----|
| `repository.url` added to package.json | npm OIDC provenance requires this field to match the GitHub repo URL — without it, sigstore verification fails with E422 |

## Context

npm's Trusted Publisher flow signs a provenance statement linking the published package to the exact GitHub Actions run. The verification step checks that `package.json#repository.url` matches the repo in the provenance bundle. Our package.json was missing this field entirely, causing:

```
E422 — Error verifying sigstore provenance bundle:
  package.json: "repository.url" is "",
  expected to match "https://github.com/luutuankiet/firefox-docker-mcp"
```