fix(ci): ship src/data/*.json in published tarball (#148)

Since v0.2.5 the published npm tarball has been missing
`src/data/common-keywords.json` and `src/data/duckdb-keywords.json`,
leaving the `./data/*` exports dead (404 / unresolved module for
consumers). PR #128 split the release into separate `build`/`publish`
jobs, but the build job's `upload-artifact` step omitted `src/`, so
those files weren't on disk when the publish job ran `pnpm publish` —
and npm silently drops `files` entries that don't exist. This adds
`src/data/` to the artifact path so the keyword JSON files reach the
publish job. It also adds a vitest guard
(`src/__tests__/package-exports.test.ts`) that runs `npm pack` and
asserts every `src/`-based `exports` target is present in the tarball,
so the regression can't recur silently.

Verified: `npm pack --dry-run` now lists both JSON files; the new test
passes against the current package and fails if `src/data/*.json` is
dropped from `files`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: Light2Dark

.github/workflows/release.yml

@@ -67,6 +67,7 @@ jobs:
           name: package
           path: |
             dist/
+            src/data/
             package.json
             README.md
             LICENSE

src/__tests__/package-exports.test.ts

@@ -0,0 +1,52 @@
+import { execSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+
+const repoRoot = join(__dirname, "../..");
+
+interface PackedFile {
+  path: string;
+}
+
+/**
+ * Collect every string file path referenced anywhere in the package.json
+ * `exports` map (recursing through conditional-export objects like
+ * `{ import: { types, default } }`).
+ */
+function collectExportTargets(exportsField: unknown, out: string[] = []): string[] {
+  if (typeof exportsField === "string") {
+    out.push(exportsField);
+  } else if (exportsField && typeof exportsField === "object") {
+    for (const value of Object.values(exportsField as Record<string, unknown>)) {
+      collectExportTargets(value, out);
+    }
+  }
+  return out;
+}
+
+describe("published package", () => {
+  // Run the real `npm pack` so we assert against the actual tarball contents,
+  // not the source tree. Regression guard for the `./data/*` exports that
+  // shipped dead in 0.2.5–0.2.7 because `src/data/` was missing at publish time.
+  const packed: PackedFile[] = JSON.parse(
+    execSync("npm pack --dry-run --json", { cwd: repoRoot, encoding: "utf8" }),
+  )[0].files;
+  const packedPaths = new Set(packed.map((f) => f.path));
+
+  const pkg = JSON.parse(readFileSync(join(repoRoot, "package.json"), "utf8"));
+
+  // Only assert source-committed targets (e.g. src/data/*.json). `dist/*`
+  // targets are intentionally skipped: in CI `pnpm test` runs before
+  // `pnpm build`, so dist does not exist yet when this test executes.
+  const sourceTargets = collectExportTargets(pkg.exports)
+    .map((p) => p.replace(/^\.\//, ""))
+    .filter((p) => p.startsWith("src/"));
+
+  it("includes every src/ export target in the tarball", () => {
+    expect(sourceTargets.length).toBeGreaterThan(0);
+    for (const target of sourceTargets) {
+      expect(packedPaths, `${target} is referenced by exports but missing from the npm tarball`).toContain(target);
+    }
+  });
+});