Inspect and test the tarball

Repository tests cannot prove that the packed manifest, selected files, and transitive dependencies work after installation.

List the package without publishing

cd packages/sdk
pnpm pack --dry-run

Look for the build output, README.md, LICENSE, and package.json. Look for accidental secrets, tests, fixtures, environment files, and large unrelated assets too.

dist/index.d.ts dist/index.d.ts.map dist/index.js dist/index.js.map LICENSE package.json README.md src/index.ts

Inspect the rewritten manifest

sdk_pack_dir=$(mktemp -d)
pnpm pack --pack-destination "$sdk_pack_dir"

tar -xOf \
  "$sdk_pack_dir/your-scope-quiz-sdk-0.1.0.tgz" \
  package/package.json

The packed manifest should point exports and types to dist. A workspace dependency should become a registry version:

"dependencies": {
  "@your-scope/quiz-contracts": "0.1.0",
  "arktype": "^2.2.3"
}

This check catches a package that runs locally through source links but ships references that no consumer can resolve.

Install into a clean consumer

consumer_dir=$(mktemp -d)
cd "$consumer_dir"
pnpm init

Open the generated package.json and inspect it. Tool defaults are not trusted input. If your environment rejects a generated package-manager range, pin an exact version or remove that optional development-engine field.

pnpm add \
  "$sdk_pack_dir/your-scope-quiz-sdk-0.1.0.tgz"

pnpm list --depth 1

The dependency tree must show the SDK, contracts, and runtime schema library. The consumer explicitly installs only the SDK.

Run a consumer-level smoke test

node --input-type=module <<'JS'
import { getQuestions } from "@your-scope/quiz-sdk";

const fakeFetch = async (request) => {
  console.log(request.toString());
  return Response.json({
    questions: [{
      id: "science-1",
      category: "science",
      difficulty: "easy",
      prompt: "Which planet is known as the Red Planet?",
      choices: ["Earth", "Mars"],
    }],
  });
};

const output = await getQuestions(
  { category: "science", count: 1 },
  { baseUrl: "https://quiz.example", fetch: fakeFetch },
);

console.log(output.questions);
JS

This proves Node.js can resolve the packed exports, load transitive dependencies, construct the request, and validate a response.

Compile a clean TypeScript consumer

Add TypeScript in the temporary project, create a small index.ts that imports documented values and types, then run:

pnpm add -D typescript
pnpm exec tsc --noEmit \
  --strict \
  --module NodeNext \
  --moduleResolution NodeNext \
  --target ES2022 \
  index.ts

This catches missing declaration files, broken declaration imports, and exports that work in JavaScript but not in TypeScript.

Exercise the publication path

cd /absolute/path/to/quiz-sdk/packages/sdk
pnpm publish --dry-run

The absolute cd is deliberate. Temporary consumers also contain package.json. Publishing from the wrong directory can target the temporary project instead of the SDK.

Check identity before every real publish

pwd
pnpm pkg get name version

The printed directory, package name, and version must match the intended release.

Check your understanding

  1. Why can workspace tests pass when the tarball is broken?

    Show answer

    Workspace links can load source files and nearby dependencies that are absent or misconfigured in the packed artifact. A clean install removes those hidden advantages.

  2. What must you check before running a real publish command?

    Show answer

    Check the absolute working directory and print the current package name and version. This prevents publishing a temporary consumer or the wrong workspace package.