[BUG] npm pack with bundledDependencies ignores files in package.json of dependencies

[nsainaney]

Current Behavior:

When untaring a module that has bundledDependencies generated using npm pack, the node_modules/module-a folder (where module-a is a bundledDependency) contains files that are not in module-a/package.json's files list

Expected Behavior:

node_modules/module-a should only contain files that are in the files section of module-a/package.json

Steps To Reproduce:

1. Set up a project with Module A and Module B
2. Make Module A a bundled dependency of Module B (using npm/yarn link)
3. run npm pack
4. untar the generated tar file

Environment:

• OS: MacOS: 10.15.5
• Node: v12.16.2
• NPM: 6.14.4

[ljharb]

What specific files are showing up that aren't in files? There are a number of files that are always included, like package.json, README.md, etc.

[nsainaney]

Here's a screenshot of the module root contents:

And here's the relevant section of the @c6o/common package.json:

  "main": "lib/index.js",
  "files": [
    "lib"
  ],

And everything (src, tests etc) are all showing up - this is the contents of the untared package:

Thanks

[isaacs]

When you bundle a dependency, you are saying "this is the thing that I want you to include, as it currently is, and I have already set it up how I want it in the bundle".

In other words, this is working as intended. In fact, if we changed it to the expectation suggested here, it would be a big problem, since we don't run build scripts by default for bundled dependencies, and you may have added files to the dep that are required for it to function as intended.

If you are bundling dependencies, make sure that they are installed the way that you want them to be in your package, before running npm publish or npm pack. (The easiest way, of course, is to put them there with npm.)