P0: Establish clean npm package boundary and publication evidence

[mrnicholasbcarter-code]

Objective

Make npm packaging and public install claims truthful and reproducible.

Acceptance criteria

• npm pack --dry-run contains only intended files.
• Generated tarball, logs, coverage, and local artifacts are excluded.
• Clean temp-directory install and import smoke pass.
• Build, lint, tests, and package export checks pass.
• README install command resolves only after publication is verified, otherwise says unreleased.
• OIDC publish workflow has a dry-run gate and release notes.

Assigned execution route

• Primary: agy/gemini-3.5-flash-low.
• Review: agy/gemini-3.1-pro-low.

Release impact

P0.

[mrnicholasbcarter-code]

Baseline 2026-07-13: 98 Jest tests passed, TypeScript build passed, but npm pack --dry-run includes coverage/, the existing tarball, repository workflows/docs, and source tests because no .npmignore is present. This remains a P0 packaging gap.

[mrnicholasbcarter-code]

Atomic commit 195363c adds .npmignore and removes the generated tarball from the working tree. Verification: 98 Jest tests passed, TypeScript build passed, and npm pack --dry-run --json now contains 17 intended files only: runtime dist, package.json, README, LICENSE, CHANGELOG, and editor metadata. Coverage, source, tests, workflows, logs, and tarballs are excluded. Remaining AC is publication workflow verification, so this ticket moves to Review, not Done.

[mrnicholasbcarter-code]

Follow-up to package commit 195363c: the README and source now state that npm publication is unverified and use OmniRoute defaults. Package dry-run remains limited to 17 intended runtime/docs files. Publication workflow verification remains open.

[mrnicholasbcarter-code]

Implemented and pushed in commit a564471. Package metadata/exports, files boundary, release metadata, and clean-install commands are documented. Verified npm ci, npm run build, npm test -- --runInBand (23 passed), and npm pack --dry-run; please review/close.

[mrnicholasbcarter-code]

Status: in progress. Current slice adds a reproducible npm pack inventory check, clean temporary-directory runtime/import and TypeScript declaration smoke, package dependency-boundary correction, CI dry-run gate, and OIDC publication hardening. TDD reproduction currently proves the shipped middleware declarations fail in a clean consumer because Express types are not declared as a package dependency/peer boundary.