Proposal to change package.json "files" semantics

[isaacs]

In the next major version bump, make the following change to how package.json files are handled.

For the purposes of this discussion, it is assumed to only refer to package.json manifests containing a files array. package.json files without a files list are currently ignored for the purpose of determining package contents, and will continue to be.

Current Behavior

Currently, package.json is treated as a sort of "reverse ignore" file if it has a files list. The set of rules it provides are !${x} and !${x}/** for each entry x in the files list.

Challenges of Current Behavior

For a common files list like ["index.js","lib"], this will result in an anti-ignore list of:

!index.js
!index.js/**
!lib
!lib/**

This means that a file at lib/.DS_Store will be included.

If a .npmignore or .gitignore file is present in the same directory as the package.json file, it is ignored in favor of the files list.

If a package.json file is found nested somewhere else in the tree, it is treated as an ignore file, even if it is not in a "package". (Ie, in the root or a node_modules subfolder.)

Reasoning about this interaction is particularly difficult, especially as a rule can override a previous one. Consider:

{
  "files": [
    "dist",
    "!dist/**/*.test.js",
    "dist/tests/"
  ]
}

It's not immediately obvious that a file at dist/tests/x.test.js will be included in this scenario.

Despite the complications, many users have come to depend on some of the weird edges, by simply trying things and keeping what seems to work. So, great care must be taken in any change, even a good change.

Proposal

Instead of treating package.json as a fancy ignore file, use it to hijack the readdir call in start() for the root and any folder that's a package in node_modules.

If a package.json with files exists, then resolve the globs it provides. Turn each one into a set of files in order, and if there's a !, then remove any matches from the set thus far. Then, send that to onReaddir instead of the actual results of fs.readdir. (If there's no package.json with files, then just do fs.readdir.)

[isaacs]

closed in v2