chore(packages): restrict published files to build output

[frederikprijck]

What

Add a files allowlist to all four @a0/* packages so npm-published tarballs ship only what consumers need. Today no package has a files field or .npmignore, so npm pack bundles src/, tests/, and dev tooling configs (tsconfig.json, eslint.config.mjs, vitest.config.ts, and evals-core's scripts/) alongside dist/.

Package	Now ships
@a0/evals	dist (+ README.md, added by npm automatically)
@a0/evals-core	dist
@a0/evals-graders	dist
@a0/evals-reporter	dist + src/templates

Why evals-reporter is different

Its nunjucks templates (report.html.j2, report.css) live in src/templates/, are not copied into dist/ by tsc, and are loaded at runtime via report.ts's dist/../src/templates fallback. A plain files: ["dist"] would install and import fine but throw the moment a report is rendered — so src/templates stays in its allowlist.

evals-core has a similar shape (two prompt .md files) but they're inlined into dist at build time by generate-prompts.mjs, so dist alone is safe there.

Verification

Packed all four, installed them into a fresh copy of apps/auth0-evals outside the workspace (no symlinks), then:

• npm install — all four resolve locally
• npm run build — compiles against the installed packages
• a0-eval --help / a0-eval run --help — CLI bin + import graph load
• a0-eval report — rendered a full 28 KB HTML report, proving the reporter's templates resolve from the installed tarball

No source/behavior changes — files fields only. Pre-existing docker.test.ts failures in this environment (Docker unavailable) are unrelated and reproduce on clean main.

Summary by CodeRabbit

• Chores
  • Updated package publishing configuration to include only required build output.
  • Preserved necessary reporter templates in the published package.
  • Reduced unnecessary files in distributed packages.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 834c8493-2010-4c6a-9a68-dcd6d3dfca53

📥 Commits

Reviewing files that changed from the base of the PR and between 3e91dfe and 499aa04.

📒 Files selected for processing (4)

• packages/evals-core/package.json
• packages/evals-graders/package.json
• packages/evals-reporter/package.json
• packages/evals/package.json

---

📝 Walkthrough

Walkthrough

Four package manifests now define explicit npm publication whitelists. Three include only dist, while evals-reporter includes both dist and src/templates.

Changes

Package publishing

Layer / File(s)	Summary
Add package publication whitelists packages/evals-core/package.json, packages/evals-graders/package.json, packages/evals-reporter/package.json, packages/evals/package.json	Each manifest adds a files array restricting published contents to the specified directories.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: limiting package publishing to build output files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch npm-packaging-files-field

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 Checkov (3.3.8)

packages/evals-core/package.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

packages/evals-graders/package.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

packages/evals-reporter/package.json

Traceback (most recent call last):
File "/usr/local/bin/checkov", line 2, in
from checkov.main import Checkov
ModuleNotFoundError: No module named 'checkov'

• 1 others

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}