chore: allowlist published files via package.json files instead of .npmignore

[RobinBol]

Follow-up to #213. Instead of extending the .npmignore denylist every time a new top-level file appears, this switches to an explicit files allowlist in package.json and deletes .npmignore.

A denylist fails open: anything new at the root ships unless someone remembers to exclude it. An allowlist fails closed. This repo already demonstrated the problem locally, where an untracked .claude/settings.local.json ended up in npm pack output.

"files": [
  "index.d.ts",
  "lib"
],

index.js is not listed because npm force-includes the main target. index.d.ts is listed because npm does not force-include the types target, only package.json, README, LICENSE, main, browser and bin (see npm-packlist processPackage).

Effect on the published package

Baseline is the actual published zigbee-clusters@3.6.0 tarball, not a local working tree.

	published 3.6.0	this PR
entries	66	60
lib/ files	56	56

Removed: .nvmrc, .prettierrc, AGENTS.md, tsconfig.json, scripts/generate-types.mts, scripts/template.d.ts.txt

Added: nothing.

The two scripts/ files were already dropped by #213, so the net new change is four dev-only config/doc files. index.js, index.d.ts, README.md, package.json and all 56 lib/ files are the identical set (verified with diff on the sorted file lists).

Verification

• No reference to any removed file from index.js, index.d.ts or lib/.
• No deep imports of zigbee-clusters/… in node-homey-os, node-homey-zigbeedriver or node-homey-zigbee. Third-party Homey apps can still deep-import, which is why all of lib/ stays in the allowlist.
• tsconfig.json was the only removal with any risk. It has declaration: false, skipLibCheck: false and no include, so it is not usable as an extends base, and index.d.ts is an ambient declare module "zigbee-clusters" that resolves without it.
• Packed the tarball and installed it into a clean project: require('zigbee-clusters') returns all 62 exports, deep imports of lib/clusters/onOff and lib/util resolve, and tsc --strict on a consumer importing from the package exits 0.
• npm test 92 passing, npm run lint exit 0 on Node 24.

Deleting .npmignore is behaviour-neutral here: none of its patterns (build, docs, test, scripts, .eslintrc.json, .eslintignore, .editorconfig, .github) match anything inside lib/, and everything else is now excluded by the allowlist.

Second commit: stop tracking .DS_Store

The root .DS_Store was committed to the repository. It never reached the published package, because .DS_Store is one of npm-packlist's default ignores, but it does not belong in git either. It is now untracked and added to .gitignore, which also covers the Finder files sitting under lib/, test/ and build/.

This does not change the tarball: npm pack --dry-run is identical before and after, still 60 entries.

[Copilot]

Pull request overview

This PR makes npm publishing “fail closed” by switching from a root-level .npmignore denylist to an explicit files allowlist in package.json, reducing the risk of accidentally shipping new top-level dev/config files.

Changes:

• Add a files allowlist in package.json to explicitly publish only index.d.ts and lib/ (with npm still including the main entrypoint).
• Remove .npmignore, relying on the allowlist for package contents control.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Adds a files allowlist to control what goes into the published tarball.
.npmignore	Removes the old denylist now that publishing is governed by package.json#files.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 4 changed files in this pull request and generated no new comments.