chore: pre-publish hardening

CHANGELOG.md

@@ -27,6 +27,11 @@ Initial release.
 - **JSON Schema** — `schema/config.schema.json` (draft-07) generated from the `ConfigInput` TypeScript type; published alongside the package for validation in non-TypeScript runtimes.
 - **Dual ESM + CJS publish** via `tsup`. Types included. Zero runtime dependencies.
 
+### Package notes
+
+- **Sourcemaps not published.** Sourcemaps are excluded from the tarball to keep package size minimal. Build from source (`npm run build`) if you need them for production debugging.
+- **Unpacked size: 33.6 KB.** Exceeds the original 30 KB headroom target. Trade-off rationale: the README sections required by the v1 spec (installation, quick start, full API reference, override examples, dynamic config, non-features, framework glue, comparison, versioning) cannot be trimmed without removing required content, and CHANGELOG.md is included per the publish audit spec. All required sections are present.
+
 ### Not included (deferred to v1.1+)
 
 - `createUsage`, `usage.check`, `usage.hasCapacity` — usage tracking

package.json

@@ -36,6 +36,7 @@
 		"dist/index.d.cts",
 		"schema",
 		"README.md",
+		"CHANGELOG.md",
 		"LICENSE"
 	],
 	"scripts": {

src/errors.test.ts

@@ -37,6 +37,15 @@ describe('AccessDeniedError', () => {
 		const plain = err.toJSON();
 		expect(plain.name).toBe('AccessDeniedError');
 	});
+
+	it('JSON.stringify(err) invokes toJSON and produces full metadata — not {}', () => {
+		const err = new AccessDeniedError('export', 'free', ['pro']);
+		const parsed = JSON.parse(JSON.stringify(err)) as Record<string, unknown>;
+		expect(parsed.name).toBe('AccessDeniedError');
+		expect(parsed.feature).toBe('export');
+		expect(parsed.plan).toBe('free');
+		expect(parsed.requiredPlans).toEqual(['pro']);
+	});
 });
 
 describe('InvalidOverrideError', () => {
@@ -75,4 +84,12 @@ describe('InvalidOverrideError', () => {
 		expect(json.feature).toBe('write');
 		expect(JSON.parse(JSON.stringify(json))).toEqual(json);
 	});
+
+	it('JSON.stringify(err) invokes toJSON and produces full metadata — not {}', () => {
+		const err = new InvalidOverrideError('unknown_feature', 'sso');
+		const parsed = JSON.parse(JSON.stringify(err)) as Record<string, unknown>;
+		expect(parsed.name).toBe('InvalidOverrideError');
+		expect(parsed.reason).toBe('unknown_feature');
+		expect(parsed.feature).toBe('sso');
+	});
 });