Several packages publish build artifacts (temp/*.tsbuildinfo, .turbo/turbo-build.log) to npm

[timotheeguerin]

Problem

11 packages publish build artifacts to npm. Users downloading @typespec/spec-coverage-sdk get a 150 KB TypeScript incremental-build cache and nothing else new — 81% of the tarball is junk.

Measured from the tarballs currently on the npm registry (npm pack @typespec/<name>):

Package	Unpacked	Build artifacts	Waste
@typespec/spec-coverage-sdk	184.8 KB	150.0 KB	81.2%
@typespec/spector	585.9 KB	232.3 KB	39.6%
@typespec/protobuf	406.2 KB	114.3 KB	28.2%
@typespec/spec-api	214.6 KB	53.1 KB	24.7%
@typespec/http-server-js	1.32 MB	118.8 KB	9.0%
@typespec/http-specs	1.32 MB	114.5 KB	8.7%
@typespec/http-client	290.8 KB	4.0 KB	1.4%
@typespec/http-canonicalization	493.4 KB	1.5 KB	0.3%
@typespec/mutator-framework	476.2 KB	1.3 KB	0.3%
@typespec/emitter-framework	1.51 MB	2.9 KB	0.2%
@typespec/http-client-js	1.10 MB	143 B	0.0%

The offending files:

$ npm pack @typespec/spector && tar tzf typespec-spector-*.tgz | grep -E 'temp/|\.turbo/'
package/temp/.tsbuildinfo            231704   # tsc incremental cache
package/.turbo/turbo-build.log          605   # captured build output

@typespec/emitter-framework additionally ships a package/package.json.bak, left behind by the release tooling.

Cause

These are exactly the 11 publishable packages whose package.json has no files field, so npm pack falls back to .gitignore-based filtering. .gitignore is only consulted for files npm doesn't already know about, and it does not stop .turbo/ or temp/ from being packed even though both are ignored:

$ grep -nE '^(temp|\.turbo)$' .gitignore
171:temp
252:.turbo

Every other publishable package in the repo declares files and is unaffected.

Side effect

.turbo/turbo-build.log captures stdout of the build, including the compiler version banner and CLI spinner frames:

$ tsp compile . --warn-as-error --import @typespec/library-linter --no-emit
TypeSpec compiler v1.14.0

⠙ Compiling...✔ Compiling

That makes tarball size non-deterministic across builds. It broke the package-size PR check in Azure/typespec-azure, where every core package showed a phantom few-byte delta on an unrelated PR: Azure/typespec-azure#5182 (comment)

Suggested fix

Add a files field to the 11 packages listed above, matching what the rest of the repo already does. A repo-level lint/test asserting that every publishable package declares files would keep it from regressing.

[github-actions]

🎯 Issue Triage

Several TypeSpec packages are publishing build artifacts (temp/*.tsbuildinfo, .turbo/turbo-build.log, package.json.bak) to npm because they lack a files field in package.json, wasting up to 81% of tarball size and causing non-deterministic package sizes.

Category: Bug
Area: eng

🔍 Analysis

• Root cause: 11 publishable packages have no files field in package.json, so npm pack falls back to .gitignore-based filtering, which fails to exclude .turbo/ and temp/ directories.
• Affected packages: spec-coverage-sdk, spector, protobuf, spec-api, http-server-js, http-specs, http-client, http-canonicalization, mutator-framework, emitter-framework, http-client-js
• Secondary issue: emitter-framework ships a package.json.bak left by release tooling
• Real-world impact: Non-deterministic tarball sizes broke the package-size PR check in Azure/typespec-azure (see typespec-azure#5182)
• Fix: Add files field to each affected package, matching existing packages in the repo; optionally add a lint rule to prevent regression

📝 Suggested next steps

• Add files field to the 11 affected packages, following the pattern of already-compliant packages in the repo
• Remove/clean up package.json.bak artifact from emitter-framework release tooling
• Add a repo-level lint/test asserting every publishable package declares files

Generated by Agentic Triage