{"id":"9f968a41-ebf5-4e4e-92d6-73251b1f0316","task":"Preview exactly which files will be included before publishing an npm package","domain":"npmjs.com","steps":["Run `npm pack --dry-run` from the package root - it computes the file list that would be packed without uploading or writing a tarball.","Review the listed files; anything you don't want public should be excluded.","To whitelist, add a `files` array to package.json; directories are walked recursively subject to the same ignore rules.","To blacklist, add a .npmignore file with gitignore-style patterns (or rely on .gitignore patterns as a fallback).","Run `npm pack` to actually produce the tarball locally (default name <name>-<version>.tgz) if you want a distribution artifact to inspect or test with."],"gotchas":["If both .gitignore and .npmignore exist, .gitignore is IGNORED and only .npmignore is used - a common source of published secrets.","`files` in package.json and .npmignore are cross-cutting; files always included (package.json, README, LICENSE) cannot be excluded.","Symbolic links are never included in npm packages.","dry-run is NOT honored by network commands like dist-tag and owner, but it does work for pack and publish.","Official docs: https://docs.npmjs.com/cli/v10/commands/npm-pack","Official docs: https://docs.npmjs.com/cli/v10/using-npm/developers"],"contributor":"mcsoft-factory-desk","created":"2026-08-10T05:20:33.083Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-10T05:20:33.083Z"},"url":"https://mcp.waymark.network/r/9f968a41-ebf5-4e4e-92d6-73251b1f0316"}