[RRFC] npm publish should fail when the `files` is misconfig in package.json

[aladdin-add]

this is from npm/feedback#425

Motivation ("The Why")

it's a common error there is something wrong in the files in package.json.

• typo, e.g. mian.js( should be main.js)
• files been renamed, but pkg.files not updated, e.g. template => templates.

currently npm will publish successfully even with no warnings. I think it make sense to throw an error in this kind of cases.

Example

example in the OP npm/feedback#425

How

Current Behaviour

Desired Behaviour

throw an error/warning if found unmatched patterns (might be a breaking change).

References

• n/a

[naugtur]

+1
There should be a check step in publish. You get the list of files with icons represe ting I'd they were found etc. and an explicit question if this is fine.

[aladdin-add]

IMHO, the similar check should also be applied to pkg.main, pkg.bin, pkg.exports.

an example: https://github.com/mzohaibqc/less-bundle-promise/blob/14f1fb15740f3b3eaf2acaa0ac814b37c0fbc205/package.json#L25

the file build/index.js does not exists, so an error/warning would be thrown when publishing.

[isaacs]

This was discussed last week, and revisited this week. https://github.com/npm/rfcs/blob/latest/meetings/2021-06-23.md#issue-390-rrfc-npm-publish-should-fail-when-the-files-is-misconfig-in-packagejson---aladdin-add

Unfortunately, since files is a list of globs, rather than filenames, and those globs can be negated, and the inclusion of a folder implies the inclusion of its child entries, this idea quickly gets explosively complicated.

This is a case where npm cannot reasonably infer the user's intent in a general way. If you want to build a prepublishOnly or prepare script that performs some checking, ensuring that every glob in the files list matches at least one file, and handle all the edge cases in an opinionated way, then that is what I would recommend. Otherwise, I think we're going to keep just doing exactly what we're told, without expanding or changing the semantics of which files must be found in the package list.