objectstack-ai · os-zhuang · Jul 31, 2026 · Jul 31, 2026
diff --git a/.changeset/published-files-whitelist.md b/.changeset/published-files-whitelist.md
@@ -0,0 +1,57 @@
+---
+"@objectstack/formula": patch
+"@objectstack/sdui-parser": patch
+"@objectstack/connector-mcp": patch
+"@objectstack/connector-openapi": patch
+"@objectstack/connector-rest": patch
+"@objectstack/connector-slack": patch
+"@objectstack/embedder-openai": patch
+"@objectstack/knowledge-memory": patch
+"@objectstack/knowledge-ragflow": patch
+"@objectstack/plugin-approvals": patch
+"@objectstack/plugin-email": patch
+"@objectstack/plugin-pinyin-search": patch
+"@objectstack/plugin-reports": patch
+"@objectstack/plugin-sharing": patch
+"@objectstack/plugin-webhooks": patch
+"@objectstack/service-cluster": patch
+"@objectstack/service-cluster-redis": patch
+"@objectstack/service-datasource": patch
+"@objectstack/service-sms": patch
+"@objectstack/trigger-api": patch
+---
+
+chore(packaging): 20 packages stop publishing their sources, tests and build tooling (#4248)
+
+These 20 packages declared no `files` field, so npm fell back to packing the
+whole package directory. `npm pack --dry-run` on `@objectstack/plugin-webhooks`
+listed **21 files** — 15 under `src/`, three of them unit tests
+(`auto-enqueuer.test.ts`, `bootstrap-declared-webhooks.test.ts`, …), plus the
+build-time `scripts/i18n-extract.config.ts`. `dist/` lands on top of that at
+publish time rather than instead of it, so consumers were installing the
+TypeScript sources and the test suite alongside the artifact they asked for.
+
+Each now declares `"files": ["dist", "README.md"]`, matching the 29 packages
+that already did. Nothing a consumer imports moves: every `main` / `types` /
+`exports` target in all 20 already resolved inside `dist/`, which the new
+`check:published-files` guard verifies rather than assumes. The visible change
+is a smaller install and a smaller dependency-scanning surface — `npm pack` on
+`@objectstack/plugin-webhooks` now yields 2 files plus `dist/`.
+
+The other half of the fix is the gate. Half the packages declaring `files` and
+half not was the #3786 shape — a hand-copied convention with nothing enforcing
+it, where whoever forgets the line gets no signal at all. `check:published-files`
+(new, wired into the always-required `lint` job) holds every non-private
+workspace package to four invariants: `files` is **declared**; it is
+**sufficient** (covers every entry point, so tightening a whitelist cannot ship
+a package that fails to resolve); it is **minimal** (admits no test, test-harness
+config or build script); and anything beyond `dist` + `README.md` is
+**registered** with a reason, reconciled in both directions so a stale exemption
+is an error rather than dead text. `@objectstack/spec` is the one package with
+registered extras — its `.zod.ts` sources, JSON Schemas, liveness ledgers and
+`CHANGELOG.md` are product, not build input.
+
+This also closes an assumption #4206 was resting on. Excluding `<pkg>/scripts/**`
+from the docs-drift implementation test is sound only while no package publishes
+`scripts/` as runtime code; that held, but it held because someone read all three
+offenders by hand. It is now checked on every PR.
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
@@ -166,6 +166,22 @@ jobs:
       - name: Node-version drift guard
         run: pnpm check:node-version
 
+      # #4248 packaging-hygiene guard. Without a `files` whitelist npm packs the
+      # whole package directory, and 20 of the 49 publishable packages declared
+      # none — so consumers installed TypeScript sources, unit tests and build
+      # tooling, with dist/ landing on top of them rather than instead of them
+      # (@objectstack/plugin-webhooks: 21 files, three of them unit tests). The
+      # other 29 did declare it, so this was a hand-copied line with no gate —
+      # the #3786 shape, where whoever forgets it gets no signal at all. Also
+      # checks the whitelist is SUFFICIENT (covers every entry point, so
+      # tightening one cannot ship a package that fails to resolve) and MINIMAL
+      # (admits no test or build script), which keeps #4206's "`<pkg>/scripts/**`
+      # is never runtime code" assumption continuously verified instead of
+      # hand-checked. Runs its own --self-test first: the pattern semantics can
+      # be wrong while every package is right.
+      - name: Published-files whitelist guard
+        run: pnpm check:published-files
+
   typecheck:
     name: TypeScript Type Check
     runs-on: ubuntu-latest

diff --git a/package.json b/package.json
@@ -40,7 +40,8 @@
     "check:wildcard-fallthrough": "node scripts/check-wildcard-fallthrough.mjs --self-test && node scripts/check-wildcard-fallthrough.mjs",
     "check:console-sha": "node scripts/check-console-sha.mjs",
     "check:release-notes": "node scripts/check-release-notes.mjs",
-    "check:node-version": "node scripts/check-node-version.mjs"
+    "check:node-version": "node scripts/check-node-version.mjs",
+    "check:published-files": "node scripts/check-published-files.mjs --self-test && node scripts/check-published-files.mjs"
   },
   "keywords": [
     "objectstack",

diff --git a/packages/connectors/connector-mcp/package.json b/packages/connectors/connector-mcp/package.json
@@ -35,5 +35,9 @@
     "integration",
     "ai",
     "tools"
+  ],
+  "files": [
+    "dist",
+    "README.md"
   ]
 }
diff --git a/packages/connectors/connector-openapi/package.json b/packages/connectors/connector-openapi/package.json
@@ -33,5 +33,9 @@
         "swagger",
         "integration",
         "api"
-    ]
+    ],
+  "files": [
+    "dist",
+    "README.md"
+  ]
 }
diff --git a/packages/connectors/connector-rest/package.json b/packages/connectors/connector-rest/package.json
@@ -32,5 +32,9 @@
     "rest",
     "integration",
     "http"
+  ],
+  "files": [
+    "dist",
+    "README.md"
   ]
 }
diff --git a/packages/connectors/connector-slack/package.json b/packages/connectors/connector-slack/package.json
@@ -32,5 +32,9 @@
     "slack",
     "integration",
     "messaging"
+  ],
+  "files": [
+    "dist",
+    "README.md"
   ]
 }
diff --git a/packages/formula/package.json b/packages/formula/package.json
@@ -41,5 +41,9 @@
   "bugs": "https://github.com/objectstack-ai/objectstack/issues",
   "publishConfig": {
     "access": "public"
-  }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ]
 }
diff --git a/packages/plugins/embedder-openai/package.json b/packages/plugins/embedder-openai/package.json
@@ -36,5 +36,9 @@
     "zhipu",
     "siliconflow",
     "ollama"
+  ],
+  "files": [
+    "dist",
+    "README.md"
   ]
 }
diff --git a/packages/plugins/knowledge-memory/package.json b/packages/plugins/knowledge-memory/package.json
@@ -33,5 +33,9 @@
     "rag",
     "memory",
     "in-memory"
+  ],
+  "files": [
+    "dist",
+    "README.md"
   ]
 }
diff --git a/packages/plugins/knowledge-ragflow/package.json b/packages/plugins/knowledge-ragflow/package.json
@@ -32,5 +32,9 @@
     "knowledge",
     "rag",
     "ragflow"
+  ],
+  "files": [
+    "dist",
+    "README.md"
   ]
 }
diff --git a/packages/plugins/plugin-approvals/package.json b/packages/plugins/plugin-approvals/package.json
@@ -37,5 +37,9 @@
     "approval",
     "workflow",
     "process"
+  ],
+  "files": [
+    "dist",
+    "README.md"
   ]
 }
diff --git a/packages/plugins/plugin-email/package.json b/packages/plugins/plugin-email/package.json
@@ -32,5 +32,9 @@
     "plugin",
     "email",
     "smtp"
+  ],
+  "files": [
+    "dist",
+    "README.md"
   ]
 }
diff --git a/packages/plugins/plugin-pinyin-search/package.json b/packages/plugins/plugin-pinyin-search/package.json
@@ -33,5 +33,9 @@
     "search",
     "pinyin",
     "i18n"
+  ],
+  "files": [
+    "dist",
+    "README.md"
   ]
 }
diff --git a/packages/plugins/plugin-reports/package.json b/packages/plugins/plugin-reports/package.json
@@ -33,5 +33,9 @@
     "reports",
     "scheduling",
     "email"
+  ],
+  "files": [
+    "dist",
+    "README.md"
   ]
 }
diff --git a/packages/plugins/plugin-sharing/package.json b/packages/plugins/plugin-sharing/package.json
@@ -34,5 +34,9 @@
     "sharing",
     "rbac",
     "security"
+  ],
+  "files": [
+    "dist",
+    "README.md"
   ]
 }
diff --git a/packages/plugins/plugin-webhooks/package.json b/packages/plugins/plugin-webhooks/package.json
@@ -44,5 +44,9 @@
     "type": "git",
     "url": "https://github.com/objectstack-ai/objectstack.git",
     "directory": "packages/plugins/plugin-webhooks"
-  }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ]
 }
diff --git a/packages/sdui-parser/package.json b/packages/sdui-parser/package.json
@@ -37,5 +37,9 @@
   "bugs": "https://github.com/objectstack-ai/objectstack/issues",
   "publishConfig": {
     "access": "public"
-  }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ]
 }
diff --git a/packages/services/service-cluster-redis/package.json b/packages/services/service-cluster-redis/package.json
@@ -41,5 +41,9 @@
     "type": "git",
     "url": "https://github.com/objectstack-ai/objectstack.git",
     "directory": "packages/services/service-cluster-redis"
-  }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ]
 }
diff --git a/packages/services/service-cluster/package.json b/packages/services/service-cluster/package.json
@@ -44,5 +44,9 @@
     "type": "git",
     "url": "https://github.com/objectstack-ai/objectstack.git",
     "directory": "packages/services/service-cluster"
-  }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ]
 }
diff --git a/packages/services/service-datasource/package.json b/packages/services/service-datasource/package.json
@@ -59,5 +59,9 @@
   "bugs": "https://github.com/objectstack-ai/objectstack/issues",
   "publishConfig": {
     "access": "public"
-  }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ]
 }
diff --git a/packages/services/service-sms/package.json b/packages/services/service-sms/package.json
@@ -31,5 +31,9 @@
     "sms",
     "aliyun",
     "twilio"
+  ],
+  "files": [
+    "dist",
+    "README.md"
   ]
 }
diff --git a/packages/triggers/trigger-api/package.json b/packages/triggers/trigger-api/package.json
@@ -30,5 +30,9 @@
     "trigger",
     "webhook",
     "automation"
+  ],
+  "files": [
+    "dist",
+    "README.md"
   ]
 }