From 4e4ce16fdb3c993ebadf87026c8c30089ac1a4c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juan=20Nicol=C3=A1s=20Urrutia=20Salcedo?=
 <60118356+nicourrutia98@users.noreply.github.com>
Date: Sat, 20 Jun 2026 20:52:31 -0500
Subject: [PATCH] fix(publish): include dist/ in npm tarball + add
 publish-guard CI

- Add prepack script (clean + build) so npm pack + npm publish both emit dist/
- Tighten prepublishOnly to run tests before prepack
- Make clean cross-platform (node:fs.rmSync instead of rm -rf)
- Add publish-guard workflow: pack on tag/PR, fail if dist/ missing
- Verifies dist/index.js, index.d.ts, lambda/sse-writer.js, providers/openai-compatible.js

v2.0.0 was published without dist/ because prepublishOnly did not run during
npm pack, and the clean script was not cross-platform. v2.0.1 will include it.

Downstream consumer (Sociedad Opita PR #9) needs
\import { streamText } from '@opita/ocais'\ to work after fresh install.
---
 .github/workflows/publish-guard.yml | 66 +++++++++++++++++++++++++++++
 package.json                        |  5 ++-
 2 files changed, 69 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/publish-guard.yml

diff --git a/.github/workflows/publish-guard.yml b/.github/workflows/publish-guard.yml
new file mode 100644
index 0000000..32f4d7e
--- /dev/null
+++ b/.github/workflows/publish-guard.yml
@@ -0,0 +1,66 @@
+name: publish-guard
+
+on:
+  push:
+    tags:
+      - 'v*'
+  pull_request:
+    paths:
+      - 'package.json'
+      - '.github/workflows/publish-guard.yml'
+  workflow_dispatch:
+
+jobs:
+  verify-tarball:
+    name: Verify dist/ in npm tarball
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Test
+        run: npm test
+
+      - name: Pack
+        run: npm pack
+
+      - name: Verify dist/ in tarball
+        run: |
+          set -e
+          TGZ=$(ls opita-ocais-*.tgz | head -n 1)
+          echo "Inspecting $TGZ"
+          tar -tzf "$TGZ"
+          if ! tar -tzf "$TGZ" | grep -q "package/dist/index.js"; then
+            echo "ERROR: dist/index.js missing from tarball"
+            exit 1
+          fi
+          if ! tar -tzf "$TGZ" | grep -q "package/dist/index.d.ts"; then
+            echo "ERROR: dist/index.d.ts missing from tarball"
+            exit 1
+          fi
+          if ! tar -tzf "$TGZ" | grep -q "package/dist/lambda/sse-writer.js"; then
+            echo "ERROR: dist/lambda/sse-writer.js missing from tarball"
+            exit 1
+          fi
+          if ! tar -tzf "$TGZ" | grep -q "package/dist/providers/openai-compatible.js"; then
+            echo "ERROR: dist/providers/openai-compatible.js missing from tarball"
+            exit 1
+          fi
+          echo "OK: dist/ present in tarball"
+
+      - name: Upload tarball artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: ocais-tarball
+          path: opita-ocais-*.tgz
+          if-no-files-found: error
\ No newline at end of file
diff --git a/package.json b/package.json
index e29c870..181b600 100644
--- a/package.json
+++ b/package.json
@@ -28,8 +28,9 @@
     "build": "tsc",
     "typecheck": "tsc --noEmit",
     "test": "node --test --experimental-strip-types tests/*.test.ts",
-    "clean": "rm -rf dist",
-    "prepublishOnly": "npm run clean && npm run build"
+    "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
+    "prepack": "npm run clean && npm run build",
+    "prepublishOnly": "npm test && npm run prepack"
   },
   "keywords": [
     "ai",