Sub-path exports broken in published tarball — .npmignore excludes dist/src/

[coopernetes]

Results of my testing today with directly upgrading our Git Proxy deployment from v1.19.2 (private internal fork with minor modifications) to v2.0.0-rc.5 - the plugin system in particular needs some fixing.

Summary

All sub-path exports (@finos/git-proxy/plugin, @finos/git-proxy/proxy/actions, @finos/git-proxy/db, etc.) introduced in v2 are broken in the published npm tarball (2.0.0-rc.5). Only the main entry point (dist/index.js) is included; all files under dist/src/ are missing.

Root cause

The .npmignore contains an unanchored src/ pattern:

src/

This matches any directory named src at any depth, so it excludes both:

• src/ (intended — TypeScript source)
• dist/src/ (unintended — compiled output required by the exports map in package.json)

You can verify by running npm pack --dry-run — the output only includes dist/index.* and dist/proxy.config.json, nothing under dist/src/.

Impact

Any consumer importing from a sub-path export gets MODULE_NOT_FOUND:

import { PushActionPlugin } from '@finos/git-proxy/plugin';    // ❌
import { Step } from '@finos/git-proxy/proxy/actions';          // ❌
import { getRepos } from '@finos/git-proxy/db';                 // ❌

The main entry (@finos/git-proxy) also fails at runtime because dist/index.js requires ./src/config/file (resolves to dist/src/config/file.js — also missing).

Suggested fix

Option A — Anchor the pattern in .npmignore so it only matches the top-level directory:

-src/
+/src/

Option B — Switch from .npmignore to a files allowlist in package.json (more explicit, less error-prone):

"files": ["dist/"]

Reproduction

npm run build

npm pack @finos/git-proxy@2.0.0-rc.5 --dry-run
# observe: no dist/src/ files in output

npm install @finos/git-proxy@2.0.0-rc.5
node -e "require('@finos/git-proxy/plugin')"
# Error: Cannot find module '@finos/git-proxy/dist/src/plugin.js'

[jescalada]

Just wanted to add that it's necessary to run npm run build before packing in order to reproduce/test fixes for this. 🙂