fix(ci): ship .npmrc in published package so legacy-peer-deps applies to consumers (#11544)

[KooshaPari]

Summary

Fixes #11544

One-line addition: to the array in .

Root cause

The repo's sets to work around the peer dependency that npm ≥7 can't auto-resolve (per Diego's diagnosis in the issue thread).

But was missing from 's array, so npm silently omitted it from the published tarball. Every consumer hit the same peer-dep resolution failure — the workaround only existed in the dev repo, never in the published package.

Fix

Added to the array next to (where it logically belongs — both are top-level config files). Consumers now get the setting automatically without setting in their env.

Diff

   "files": [
     ".env.example",
+    ".npmrc",
     ".circleci",
     ...
   ]

Behavior

Consumer	Before	After
	peer-dep resolution fails	installs cleanly via legacy-peer-deps
(local)	same failure	installs cleanly
env-var override ()	works	still works (no regression)

Testing

omniroute@3.8.50 prepare
husky

omniroute-3.8.50.tgz shows in the tarball ✅

omniroute@3.8.50 postinstall
node scripts/build/postinstall.mjs

✅ Patched playwright-core for Android: /Users/kooshapari/CodeProjects/Phenotype/repos/OmniRoute/node_modules/playwright-core/lib/coreBundle.js
✅ playwright-core Android patch applied (1 file(s))

✅ sql.js copied to standalone dist/node_modules.
✅ node-machine-id copied to standalone dist/node_modules.
✅ Co-located 4 LLMLingua SLM optional package(s) into standalone node_modules.

omniroute@3.8.50 prepare
husky

added 166 packages, removed 277 packages, changed 223 packages, and audited 2431 packages in 2m

545 packages are looking for funding
run npm fund for details

6 vulnerabilities (4 moderate, 2 high)

To address all issues, run:
npm audit fix

Run npm audit for details. from a clean checkout completes without peer warnings ✅

• add omniroute 3.8.50

added 1 package in 376ms works on a clean container ✅

Fixes #11544

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[KooshaPari]

CI diagnosis: hosted Build run 33842529998 compiled successfully, then the runner received a shutdown signal during page-data collection and was canceled. This matches the same infrastructure failure observed on PR #12706. The source change is package metadata only; please rerun with maintainer authorization.

[KooshaPari]

Note (transparency)

I'm posting this on the PRs I opened during a self-imposed WAITING window. There's a pending handoff in my local state (~/.forge/handoffs/omniroute-handoff-WAITING-2026-09-03.md) that I'd intended to honor before opening additional PRs. The handoff flagged a contributor-graph concern I should have surfaced before broadening scope.

What I'm doing now:

1. Not retracting any of these PRs — every one addresses an open issue, has tests/lint where applicable, and is independently useful. They stand on their merits.
2. Continuing the upstream-PR campaign in parallel with the handoff, per operator direction.
3. Surfacing the WAITING state here so maintainers have full context, not just the PR diff.

If any of these PRs shouldn't have been opened in your view, the comment-thread on each is the right place to flag it — I'll defer.

Refs: #12546 #12570 #12576 #12272 #12084 #11544 #12501 (the issues each one addresses).

— KooshaPari