npm publish leaks ~180 compiled .test.js files + source maps into the package

[drwhofan2k18-pixel]

Release hygiene — bloat in the published package

npm pack (the publish artifact) ships ~180 compiled .test.js files and ~15 .map source maps to consumers, because files in package.json allowlists whole directories that contain them and there is no .npmignore.

Evidence (v0.11.0)

package.json:

"files": ["dist", "extensions", "extensions/dashboard-client/dist", "src", "README.md", "LICENSE"]

• dist/ contains the compiled *.test.js for every test file (e.g. dist/extensions/mega-compact.test.js, dist/src/store/turns/sqlite-store.test.js, …). ~180 of them ship.
• There is no .npmignore to exclude them.
• Result: npm pack produces a 1.8 MB tarball / 7.1 MB unpacked, a large fraction of which is test code consumers can't use.

Sample of leaking test files:

dist/extensions/conflict-scan.test.js
dist/extensions/dashboard-server-s32.test.js
dist/extensions/dashboard-server.test.js
dist/extensions/dashboard-server/api-contracts.test.js
...

(Note: extensions/dashboard-client/dist/assets/*.js.map are Vite build source maps — those are a separate judgment call; some teams ship dashboard source maps for debuggability. The compiled dist/**/*.test.js files have no such justification.)

Impact

• Consumers download ~1.8 MB of test code they don't run.
• Minor: the published package exposes internal test fixtures/harnesses.

Suggested fix (low-risk, ~bloat reduction)

Add an .npmignore (or tighten the files globs) to exclude compiled tests and, if not wanted, source maps:

# .npmignore
**/*.test.*
**/*.test.js
**/*.test.d.ts
dist/**/*.test.*
# optionally, if dashboard source maps aren't wanted:
# extensions/dashboard-client/dist/**/*.map

files allowlist + .npmignore exclusions compose in npm (exclusions win). Verify with npm pack --dry-run before publishing.

Environment

• Verified on tag v0.11.0 (commit 293d7d1).
• Found via a release-artifact QA pass (npm pack --dry-run).