npm package fails to import in 0.2.23 because published tarball is missing dist/index.js

[marioja]

Summary

ruvector@0.2.23 cannot be imported after a fresh install because the published npm package declares:

• main: dist/index.js
• types: dist/index.d.ts

but the published tarball does not include those files.

Severity

High

Environment

• npm registry package: ruvector@0.2.23
• Node: reproduced on Node 20+
• Package manager: reproduced with pnpm
• Also reproduced with CommonJS require()

Expected Behavior

A fresh install of ruvector@0.2.23 should allow:

await import('ruvector')

and/or:

require('ruvector')

without runtime resolution errors.

Actual Behavior

Both ESM import and CJS require fail because Node cannot resolve dist/index.js from the installed package.

ESM error

Error: Cannot find package '.../node_modules/ruvector/dist/index.js' imported from ...

CJS error

Error: Cannot find module '.../node_modules/ruvector/dist/index.js'. Please verify that the package.json has a valid "main" entry

Steps to Reproduce

1. Create an empty directory.
2. Add a package.json with:

{
  "name": "ruvector-023-check",
  "private": true,
  "dependencies": {
    "ruvector": "0.2.23"
  }
}

3. Install dependencies.
4. Run:

node -e "import('ruvector').then(()=>console.log('esm-ok')).catch(err=>{console.error(err);process.exit(1)})"

5. Run:

node -e "try{require('ruvector');console.log('cjs-ok')}catch(err){console.error(err);process.exit(1)}"

Additional Evidence

Running:

npm view ruvector@0.2.23 main types

returns:

{
  "main": "dist/index.js",
  "types": "dist/index.d.ts"
}

But inspecting the published tarball:

npm pack ruvector@0.2.23
tar -tf ruvector-0.2.23.tgz

shows no package/dist/index.js or package/dist/index.d.ts in the archive.

The tarball appears to include files like src/decompiler/*, bin/*, and wasm/*, but not the declared dist entrypoints.

Impact

• Fresh installs of ruvector@0.2.23 are unusable as a library.
• Any project using ^0.2.19 can drift to 0.2.23 and start failing at runtime after reinstalling dependencies.
• Consumers are forced to pin away from the latest publish or patch the package locally.

Suggested Fix

Republish 0.2.23 (or a newer version) with the built dist/ output included, or update the package entrypoints/files list so the published artifact matches the declared main and types fields.

[marioja]

I am surprised how version 0.2.23 can work as it is. Am I missing something?

[proffesor-for-testing]

Thanks @marioja — your repro (especially the npm pack + tar -tf breadcrumb showing exactly which paths were missing from the published tarball) made root-cause confirmation immediate. That's the kind of bug report that turns a guessing game into a five-minute fix.

This is now resolved in ruvector@0.2.25 (just published).

Fix

Landed in #403 (commit ceee9fd6):

1. Build artifact now ships. The published tarball includes dist/ again — package/dist/index.js, package/dist/index.d.ts, plus dist/core/onnx-embedder.js and dist/core/rvf-wrapper.js that were also missing.
2. Structural gate — so this can't recur silently. New scripts/verify-dist.js scans bin/cli.js for every require('../dist/...') site and asserts each path exists locally. Wired into prepublishOnly after npm run build:

   -  "prepublishOnly": "npm run build"
   +  "prepublishOnly": "npm run build && npm run verify-dist"

   0.2.23 slipped through because tsc either didn't run or failed silently. With this gate, publish itself fails loudly if any required dist artifact is absent — independent of whether the publisher remembers to run the build manually.

Verified against 0.2.25 from npm

$ npm pack ruvector@0.2.25 && tar -tf ruvector-0.2.25.tgz | grep "package/dist"
package/dist/index.js
package/dist/index.d.ts
package/dist/core/onnx-embedder.js
package/dist/core/rvf-wrapper.js
... (134 files total)

$ npm install ruvector@0.2.25
$ node -e "import('ruvector').then(m => console.log('esm-ok:', Object.keys(m).slice(0,3)))"
esm-ok: [ 'ASTParser', 'AdamOptimizer', 'AdaptiveEmbedder' ]

$ node -e "console.log('cjs-ok:', Object.keys(require('ruvector')).slice(0,3))"
cjs-ok: [ 'VectorDb', 'VectorDB', 'NativeVectorDb' ]

Both of your failing cases (ESM import and CJS require) now resolve cleanly. You can drop any local pin on 0.2.19 — ^0.2.25 (or floating ahead of 0.2.23) is safe again.

(Posting as a comment — my GitHub account doesn't have permission to close maintainer-side; @ruvnet please close when you see this.)