From ae9d03498a20cf70b45e7a8a89ae1d10ad24e571 Mon Sep 17 00:00:00 2001
From: EzekielApetu <apetuzee@gmail.com>
Date: Sat, 16 May 2026 19:32:42 +0100
Subject: [PATCH] =?UTF-8?q?chore:=20pre-publish=20hardening=20=E2=80=94=20?=
 =?UTF-8?q?error=20JSON=20tests,=20CHANGELOG=20notes,=20pack=20audit=20fix?=
 =?UTF-8?q?es?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 CHANGELOG.md       |  5 +++++
 package.json       |  1 +
 src/errors.test.ts | 17 +++++++++++++++++
 3 files changed, 23 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 46b6bf8..39a09be 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,6 +27,11 @@ Initial release.
 - **JSON Schema** — `schema/config.schema.json` (draft-07) generated from the `ConfigInput` TypeScript type; published alongside the package for validation in non-TypeScript runtimes.
 - **Dual ESM + CJS publish** via `tsup`. Types included. Zero runtime dependencies.
 
+### Package notes
+
+- **Sourcemaps not published.** Sourcemaps are excluded from the tarball to keep package size minimal. Build from source (`npm run build`) if you need them for production debugging.
+- **Unpacked size: 33.6 KB.** Exceeds the original 30 KB headroom target. Trade-off rationale: the README sections required by the v1 spec (installation, quick start, full API reference, override examples, dynamic config, non-features, framework glue, comparison, versioning) cannot be trimmed without removing required content, and CHANGELOG.md is included per the publish audit spec. All required sections are present.
+
 ### Not included (deferred to v1.1+)
 
 - `createUsage`, `usage.check`, `usage.hasCapacity` — usage tracking
diff --git a/package.json b/package.json
index 95d90a1..859b65b 100644
--- a/package.json
+++ b/package.json
@@ -36,6 +36,7 @@
 		"dist/index.d.cts",
 		"schema",
 		"README.md",
+		"CHANGELOG.md",
 		"LICENSE"
 	],
 	"scripts": {
diff --git a/src/errors.test.ts b/src/errors.test.ts
index fb5039d..c896ab3 100644
--- a/src/errors.test.ts
+++ b/src/errors.test.ts
@@ -37,6 +37,15 @@ describe('AccessDeniedError', () => {
 		const plain = err.toJSON();
 		expect(plain.name).toBe('AccessDeniedError');
 	});
+
+	it('JSON.stringify(err) invokes toJSON and produces full metadata — not {}', () => {
+		const err = new AccessDeniedError('export', 'free', ['pro']);
+		const parsed = JSON.parse(JSON.stringify(err)) as Record<string, unknown>;
+		expect(parsed.name).toBe('AccessDeniedError');
+		expect(parsed.feature).toBe('export');
+		expect(parsed.plan).toBe('free');
+		expect(parsed.requiredPlans).toEqual(['pro']);
+	});
 });
 
 describe('InvalidOverrideError', () => {
@@ -75,4 +84,12 @@ describe('InvalidOverrideError', () => {
 		expect(json.feature).toBe('write');
 		expect(JSON.parse(JSON.stringify(json))).toEqual(json);
 	});
+
+	it('JSON.stringify(err) invokes toJSON and produces full metadata — not {}', () => {
+		const err = new InvalidOverrideError('unknown_feature', 'sso');
+		const parsed = JSON.parse(JSON.stringify(err)) as Record<string, unknown>;
+		expect(parsed.name).toBe('InvalidOverrideError');
+		expect(parsed.reason).toBe('unknown_feature');
+		expect(parsed.feature).toBe('sso');
+	});
 });