fix: publish only what consumers need, without the development condition

[V3RON]

Description

Published packages now ship only what consumers need, and their exports resolve in every bundler mode.

• files allowlists: every publishable package has an explicit files field.

  • Plugins ship dist and CHANGELOG.md. require-profiler-plugin also ships src/metro/setup.js, which its Metro integration loads by path.
  • Libraries ship dist plus what their exports point at.
  • @rozenite/ui keeps src for Tailwind's @source, plus fonts/, fonts.css and styles.css.
  • Dev-host fixtures (rozenite.config.ts), tests, fixtures, configs and tsbuildinfo no longer ship.

• No development condition in published manifests. A root .pnpmfile.cjs beforePacking hook strips it from every package's exports on pnpm pack and pnpm publish; changeset publish uses pnpm publish. The workspace keeps the condition, so tsconfig customConditions and the playground still resolve to source.

  • The 8 plugins' own ./sdk exports drop development: './sdk.ts' as well.
  • ./sdk still points at dist/sdk/sdk.js and sdk.d.ts, which ship as before.

• CLI: rozenite build no longer writes development: './sdk.ts' into a plugin's ./sdk export, and removes that legacy value from existing plugins. An author's own development value is kept. If a plugin has publishConfig.exports, the managed entries are synced into it. Plugins created with rozenite generate publish ["dist"].

• Dead references removed: the templates entries in metro and repack, and TEMPLATE_DIR in middleware, all pointed at files that don't exist.

• Guard: every publishable package has a package-contents test, built on inspectPackedPackage in @rozenite/test-utils. It runs pnpm pack and checks that:

  • every exports, main, module, types, react-native and bin target, for every condition, is in the tarball;
  • published exports equal source exports minus development;
  • no workspace: dependency leaks;
  • no rozenite.config.*, test, fixture, tsbuildinfo or build config ships;
  • no shipped module imports a left-out file.

  .pnpmfile.cjs is a global Turborepo input, so editing the hook re-runs every guard.

• Docs: agents/package-creation.md describes the allowlist, the development policy and the guard.

Related Issue

Closes #559

Context

Published size, all 33 packages, rebuilt from scratch on both sides:

	Before	After
Unpacked	66.5 MB	21.8 MB
.tgz	12.9 MB	6.7 MB

expo-atlas-plugin drops from 43 MB to 295 kB, because 4,222 Metro test fixtures no longer ship. Every package now ships its CHANGELOG.md.

The development bug. Before, a consumer project using webpack 5 in development mode could not resolve agent-bridge, agent-shared, agent-sdk, metro, repack, middleware or lynx-dev. Vite 7 dev threw ERR_RESOLVE_PACKAGE_ENTRY_FAIL. Plugin /sdk imports and vite-plugin resolved to .ts source inside node_modules. After this change, everything resolves to dist.

Why a pnpm hook. It replaces 16 hand-copied publishConfig.exports maps. pnpm records the hook's checksum in the lockfile, so editing it needs a pnpm install; otherwise frozen installs fail loudly. npm publish would ignore the hook, but releases go through changeset publish, which uses pnpm publish.

Behaviour note. In the playground's on-device e2e:network run, @rozenite/{network-activity,storage}-plugin/sdk now resolves to the built dist instead of sdk.ts. docs/agents/network-activity-e2e.md already says to rebuild the plugin before each run.

Not changed, noted:

• @rozenite/web's .d.ts.map files point at src, which isn't published. Editors fall back to the .d.ts, as for lynx, plugin-bridge and testing.
• packages/web/src/__tests__/webpack.test.ts was never wired up on main, and fails with "DefaultToolLauncher must be mocked". Web's test script now runs only the guard.

Testing

• git fetch origin main && pnpm checks:affected && pnpm test:affected: passed, 72 test tasks. The guard was also run uncached across all 35 test tasks; the slowest guard took about 16 s against a 120 s timeout.
• Before/after tarball comparison, every package rebuilt from a clean dist:
  • every removed file justified as dev-only;
  • 0 missing export targets and 0 import regressions;
  • 0 development conditions in any packed manifest.
• Consumer smoke test outside the repo, from the packed tarballs:
  • 102 subpath resolutions with require and import;
  • real loads of the sdk entries, tools, the Metro, Re.Pack and webpack integrations, vite-plugin and lynx/rspeedy;
  • rozenite --help and rozenite skills list.
• Bundler probe: Vite 7 dev and webpack 5 in dev and production modes resolve every package to dist.
• Publish path: a real pnpm publish, and changeset publish --no-git-tag for all 33 packages, against a local mock registry. The published manifests have no development.
• Guard mutation tests: each of these fails the guard: an extra file in files, a dropped dist/sdk, a shipped tsbuildinfo, a stale export, and the hook disabled.
• Workspace build: rozenite build across all plugins leaves every package.json unchanged.
• Review: an independent adversarial review ran twice; its findings are fixed.