tunnel: package hygiene — split build/dist, untrack artifacts, harden publish

[joelgwebber]

Summary

Cleans up the tunnel package's publish flow so the tarball is always self-contained and local builds can't get into a half-built state.

The phantom-diff problem. `rollup.config.mjs` had `input` and `output` pointing at the same file (`build/src/third_party/index.js`). `npm run build` produced a 6-line ESM re-export there; `npm run bundle` overwrote it with a 38k-line bundled artifact. The state on disk swung between the two depending on which command ran last, producing perpetual "changes" in `build/` whenever the artifact was committed.

The fix.

• Untrack `build/` and `dist/`. Both are reproducible; nothing in git should track them. Phantom diff disappears.
• Split outputs into disjoint trees. `tsc` → `build/` (used by tests + dev), `rollup` → `dist/index.js` (the published binary). They no longer fight over a path.
• Bundle the whole CLI into one file. `dist/index.js` is a single self-contained ESM file containing the Node-version-check shim, `main.ts`, and all bundled deps. Tarball ships exactly two files: `dist/index.js` (1.2 MB) + `package.json`.
• Lifecycle scripts on rails.
  • `clean` wipes both `build/` and `dist/`.
  • `build = clean && tsc` — always fresh, never stale.
  • `bundle = build && rollup` — bundle implies build.
  • `test = build && node --test` — self-bootstrapping; works from a clean tree.
  • `prepack = bundle` — runs on both `npm pack` AND `npm publish` (more robust than `prepublishOnly`, which only fires for publish). Drops the redundant `prepublishOnly`.
  • `verify = npm pack --dry-run` — quick "what would ship?" sanity.
• `main.ts` walks up to find package.json instead of hard-coding `../..`. The bundled file at `dist/index.js` is one level above `package.json`; the tsc output at `build/src/main.js` is two levels above. Walk-up handles both.

Test plan

• `npm test` from a clean tree (127 tests pass).
• `npm pack --dry-run` shows exactly `dist/index.js` + `package.json`.
• Install the packed tarball into an empty dir (`npm init -y && npm install `); `./node_modules/.bin/subtext-tunnel --version` prints the package version with no transitive `node_modules` pulled.
• After merge, the next publish runs `prepack` automatically and produces the same tarball shape.

🤖 Generated with Claude Code