[Vivswan]

What this changes

isPacked: files entries read as literal paths, matched by equality or prefix
  ->  publint (pack: "npm") over a scratch package carrying the manifest and a stub at every file it points at,
      level warning, strict: the policy lint:package already runs

differential, old against publint over npm's real pack list, 14 manifests:
  real, plain, outside-files export or types, a glob missing its .d.ts, empty files, no trailing slash, parent dir   same verdict
  bin outside files, files as globs, ./-prefixed entries, a bare basename, a negation beside its directory          differ; each is npm's real behavior

How

• npm packs bins whatever files says, so a bin outside files now passes where the old loop refused; a !lib/pkg/index.js beside lib/pkg/ is now refused where the prefix match let it through. The real manifest uses none of these.
• The test pins npm as the packer because npm publishes the package; lint:package in CI auto-detects bun from the lockfile.
• Library: publint 0.3.25, already a direct devDependency; withTempDir from the test helpers.

Proof

• Tests: package-json 7 pass (two new: the real manifest yields no message, and an export outside files pins the FILE_NOT_PUBLISHED line); dropping lib/pkg/ from files fails with four such lines.
• Gates: typecheck, fleet biome 0, member-shape 0, line cap.

Technical details

• publint on the real manifest reports nothing at any level; on the unbuilt tree only FILE_DOES_NOT_EXIST for the six lib/pkg targets, which is why the test stubs them.
• Runtime: about four seconds for the two npm pack --dry-run runs; npm comes from the runner image, as package-smoke already assumes.
• Files: test/config/package-json.test.ts.

[github-actions]

File size check

0 over a hard cap (fails), 6 warning(s).

File	Size	Tier	Cap
src/engine/diff.ts:56	11 comment lines	warn	10
src/github/api-error.ts:9	11 comment lines	warn	10
src/problem.ts:73	18 comment lines	warn	10
src/sections/contract/errors.ts:13	11 comment lines	warn	10
src/sections/contract/module.ts:55	12 comment lines	warn	10
src/sections/shared/list/decl.ts:265	14 comment lines	warn	10

Split the file, wrap the line, shorten or exempt the comment, or list the path in .file-size-allow.local with a # reason.

5 managed file(s) skipped; repo-platform owns them.

[Copilot]

🟢 Approval recommended

The focused test-only changes preserve existing checks and verify an unpublished export, with no blocking defects identified.

No open issues 🎉

What changed in this PR

This PR checks package file inclusion using publint with npm's actual pack list, replacing literal path matching in the manifest tests.

Changes:

• Creates a temporary package with stubbed export, declaration, and bin targets.
• Runs publint with npm packing and strict warning checks.
• Adds checks for the real manifest and an unpublished export while preserving existing manifest assertions.

File	Description
test/​config/​package-json.test.ts	Replaces the path-prefix packing check with publint and adds positive and negative packaging tests.

_{Review effort: Balanced}