Strengthen package smoke assertions

README.md

@@ -191,4 +191,4 @@ npm run package:smoke
 npm run release:check
 ```
 
-The package smoke uses `npm pack --dry-run` so the published file list can be reviewed without publishing.
+The package smoke uses `npm pack --dry-run` and fails if the CLI, library entrypoint, license, security policy, changelog, or contribution guide would be missing from the published tarball.

package.json

@@ -24,7 +24,7 @@
     "check": "tsc --noEmit",
     "test": "npm run build && node --test tests/*.test.mjs",
     "smoke": "bash scripts/smoke.sh",
-    "package:smoke": "npm pack --dry-run",
+    "package:smoke": "npm run build && node scripts/package-smoke.mjs",
     "release:check": "npm run check && npm test && npm run build && npm run smoke && npm run package:smoke"
   },
   "keywords": [

scripts/package-smoke.mjs

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+import { execFileSync } from "node:child_process";
+
+const requiredFiles = [
+  "dist/cli.js",
+  "dist/index.js",
+  "README.md",
+  "LICENSE",
+  "SECURITY.md",
+  "CHANGELOG.md",
+  "CONTRIBUTING.md",
+];
+
+const output = execFileSync("npm", ["pack", "--dry-run", "--json"], {
+  encoding: "utf8",
+  stdio: ["ignore", "pipe", "inherit"],
+});
+
+const [pack] = JSON.parse(output);
+const packedFiles = new Set(pack.files.map((file) => file.path));
+const missing = requiredFiles.filter((file) => !packedFiles.has(file));
+
+if (missing.length > 0) {
+  console.error(`Package smoke failed; missing ${missing.join(", ")}`);
+  process.exit(1);
+}
+
+console.log(`Package smoke passed with ${pack.files.length} files.`);