🐛 fix(publish): point repository URLs at OpenSourceAGI so provenance validates

[vtempest]

Unblocks npm publishing. Follow-up to #52, but an independent bug.

The failure

Every npm publish --provenance from CI fails with a 422. From the publish run on master right after #52 merged:

npm error code E422
npm error 422 Unprocessable Entity - PUT https://registry.npmjs.org/archiver-web
  Error verifying sigstore provenance bundle: Failed to validate repository information:
  package.json: "repository.url" is "git+https://github.com/vtempest/GRAB-URL.git",
  expected to match "https://github.com/OpenSourceAGI/GRAB-URL" from provenance

Both packages that attempted to publish — archiver-web@1.1.3 and quantum-sphere-loading-icon@1.0.4 — built fine, packed fine, signed their provenance statement, and were then rejected by the registry at the final PUT.

The cause

The repository now lives at OpenSourceAGI/GRAB-URL. The GitHub API reports it with no parent and no source, so it is the canonical repo, not a fork. But repository, bugs and homepage in five package.json files still named vtempest. The provenance attestation is generated from the repository the workflow actually runs in, so npm rejects the mismatch and nothing can publish.

The fix

Repoints those three fields in the root package and in the four packages that publish:

Package
grab-url (root)	repository.url
api2client	repository.url, bugs.url, homepage
archiver-web	repository.url, bugs.url, homepage
loading-animations	repository.url, bugs.url, homepage
quantum-sphere-loading-icon	repository.url, bugs.url, homepage

packages/native-app-wrapper already carried the OpenSourceAGI URLs — this brings the rest in line with it.

author: "vtempest" is deliberately left alone in all five: that is a person, not a repository.

Verification

• Every package.json in the repo still parses.
• npm pack --dry-run unchanged: root 125 dist entries, archiver-web 35, quantum-sphere 12 — this PR touches only metadata.

Two pre-existing issues this run also surfaced

Neither is touched here; noting them so they are not lost.

1. archiver-web's bin entries point at files the build never produces. The publish log warns four times: No bin file found at dist/bin-extract.js / dist/bin-compress.js. The build emits bin-extract.es.js and bin-extract.cjs.js, so extract and compress have been broken for as long as those entries have existed. npm also reports "bin[extract]" script name was cleaned.
2. Tests is still red on master — the yt-dlp design conflict in test/page-archive.test.ts described in 🙈 chore(build): untrack dist/, keep publishing it #52. Unrelated to publishing.

🤖 Generated with Claude Code

https://claude.ai/code/session_01R3wkKQsRoi6k3DTvBRQhHd

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
grab-url	Error		Sep 11, 2026 3:09pm UTC

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[vtempest]

CI: both failing checks are red on master, not caused by this PR

This PR changes five package.json files and nothing else — no source, no tests, no config.

Tests — run #180 on master (0217a98, the merge of #52) is also a failure. Running the suite locally on this branch gives 343 passed / 11 failed, the same 11 as the master baseline. Full analysis and a proposed patch are in my comment on #52: test/page-archive.test.ts is written against a different generation of ytdlp-transfer.ts than the one on disk, and reconciling them is a design decision rather than something to settle inside a metadata PR.

I also checked adversarially that this diff cannot affect tests: nothing in test/ or packages/*/src/ reads repository, bugs or homepage. The only remaining vtempest references in source are @author JSDoc credits, deliberately left alone for the same reason author: "vtempest" is left alone — they credit a person, not a repository.

Vercel — red on master too (commit statuses on 18201a0 and 12dce81 both show Vercel -> failure), and the bot's own payload carries "rootDirectory":"docs". The project's Root Directory still points at the folder #47 deleted, so every deployment fails right after clone. That is a dashboard setting, documented in .claude/architecture/documentation.md by #51, and no code change in any PR can fix it.

Neither is a flake, so no re-run has been spent — both would fail identically.

What this PR does fix is the third check, the one that is genuinely broken by code: Publish to npm has been failing its final registry PUT with a 422 provenance mismatch on every package. That is detailed in the description above.

---

Generated by Claude Code