[michaeloboyle]

Summary

Two package.json changes so a consumer can depend on sqlite-graph at a pinned commit (github:michaeloboyle/sqlite-graph#<sha>) instead of a checkout path:

• "prepare": "npm run build". npm runs prepare for git dependencies, so the install gets a built dist. dist/ is gitignored, so without this a git install has no code.
• "files": ["dist", "README.md", "LICENSE", "CHANGELOG.md"]. The installed package carries the build output and docs only.

First consumer: graph lab (michaeloboyle/bddgraph lab/graph-lab), which today loads /Volumes/black box/github/sqlite-graph/dist by absolute path and lagged main for ten weeks unnoticed. Part of the PKM decision "consumers bind to commits, not paths" (ADR-0153, in progress).

Evidence

Check	Result
Red: npm install github:michaeloboyle/sqlite-graph#942835e into a scratch project	package has no dist/
Green: same with #97bc982	dist/ present; require('sqlite-graph') loads; createNode/createEdge/traverse run
Lockfile	resolved: git+ssh://...sqlite-graph.git#97bc9828... (exact commit recorded)
files	installed tree is CHANGELOG.md dist LICENSE package.json README.md

Verification: inline self-check by the authoring session (config-only change), not an independent agent. Nothing under src/ or tests/ changed; CI's three test jobs are the gate.

Revert: git revert the squash commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UkPPxXPqpZDv12PSugDzm7

[Copilot]

Note

Copilot was unable to complete this review at the selected tier due to model policy or plan restrictions.

🟡 Changes recommended

The change introduces a redundant build hook in package.json, causing build to run twice during publish workflows and creating avoidable time cost and potential inconsistency, so the script setup needs adjustment before approval.

1 open issue

• Prepare hook duplicates build during publish and pack · New

What changed in this PR

This pull request updates the npm packaging/lifecycle configuration so consumers can install sqlite-graph directly from a pinned Git commit and still receive a usable built dist/ output (without relying on local checkout paths). Review note (nit): adding prepare to run npm run build may make the build run redundantly alongside prepublishOnly during publish/pack; consider consolidating build hooks to avoid duplicate work.

Changes:

• Add a prepare script to run the build for Git-based installs so dist/ is present.
• Add a files allowlist to include only dist/ and core docs/licenses in the installed/packed artifact.

File	Summary
package.json	Adds prepare build hook for Git installs and a files allowlist to ship dist/ plus README/LICENSE/CHANGELOG only.

_{Review effort: Balanced}