fix(build): reduce published package size by fixing files field

[Kyzgor]

• What kind of change does this PR introduce?

  Bug fix (build / packaging). It removes compiled test fixtures that are still shipped in the
  published permitio npm package.

• What is the current behavior? (link: Published package contains many unnecessary file #90)

  The files allowlist in package.json already scopes the published package to build/ (so the
  dev tree — src/, docs/, .github/, etc. — is not shipped), and !**/*.spec.* already
  excludes compiled spec files. However, the non-spec test fixtures compiled into
  build/tests/ — fixtures.js, fixtures.mjs, fixtures.d.ts, and their source maps — are not
  .spec.* files, so they slip past the negation and end up in the tarball. The field also lists a
  CHANGELOG.md that does not exist in the repo (npm warns on it) and uses an overly broad
  !**/*.json negation that is incorrect for an allowlist.

  "files": ["build", "!**/*.spec.*", "!**/*.json", "CHANGELOG.md", "LICENSE", "README.md"]

• What is the new behavior (if this is a feature change)?

  The files field is scoped to exclude the compiled test tree and drop the dead/over-broad entries:

  "files": ["build", "!build/tests", "!build/**/*.spec.*", "LICENSE", "README.md"]

  Verified with npm pack --dry-run (Node 20). The published tarball no longer contains any
  build/tests/ or *.spec.* artifacts, while the entire public API surface is preserved:

  Metric	Before (current main)	After
  files	1772	1767
  packed (tarball)	6062 KB	5730 KB (−332 KB)
  unpacked	~89 MB	~84 MB (−4.9 MB)

  Removed (exactly 5 files): build/tests/fixtures.{d.ts,js,js.map,mjs,mjs.map}. Still present and
  verified: build/index.js, build/index.mjs, build/index.d.ts, LICENSE, README.md,
  package.json. No non-test build/ output is dropped.

• Other information:

  Reproducible before/after evidence

  # after (this branch):
  npm pack --dry-run --json --ignore-scripts --foreground-scripts=false
  #   entryCount: 1767   size: 5730.4 KB   unpackedSize: 86321.0 KB
  
  # before (base main package.json, same build output):
  #   entryCount: 1772   size: 6062.1 KB   unpackedSize: 91359.1 KB
  
  # delta: -5 files (build/tests/fixtures.*), -331.7 KB packed, -5038 KB unpacked
  # forbidden patterns in tarball after: src/=0 docs/=0 .github/=0 yarn.lock=0 *.spec.*=0 build/tests/=0
  

  What's NOT in this PR: no dependency changes, no tsconfig/tsup/build-script changes, no
  CHANGELOG.md addition or release-tooling wiring. A cleaner long-term follow-up — scoping tsup's
  entry so src/tests/** never compiles into build/ at all — is tracked separately.

  The security/snyk (permit) check ERRORs on this PR; it is an external/integration issue on fork
  PRs (this PR changes no dependencies) and is unrelated to the change. A maintainer re-run/waiver
  would clear it.

  Fixes Published package contains many unnecessary file #90

[Kyzgor]

The security/snyk (permit) check is showing an ERROR state. This PR changes no dependencies (it only edits the files field in package.json), so this looks like an external/integration failure on the Snyk side for fork PRs rather than a vulnerability introduced here. Could a maintainer re-run it (or waive it for this fork PR)? Happy to help if anything is needed on my end.

[zeevmoney]

Thanks for this, @Kyzgor — and for the clear before/after npm pack numbers. 🙏

We're closing it because it's superseded by #127 (PER-15197), which fixes the same files field as part of the 202 MB → 3.5 MB package-size work. #127 takes a more robust explicit-allowlist approach (build/**/*.d.ts + build/index.{js,mjs}) and also disables tsup sourcemaps, and the two would conflict on the same field. The test-artifact problem you identified here is real and is handled there. Appreciate the contribution.