Inspect the package tarball

A dry-run shows compiled files, types, README, license, manifest, size, and accidental secrets or fixtures. This is a small part of a small slugify-title package that is tested locally, consumed from another project, and published safely, but the boundary it creates affects everything that follows.

The Git repository and the npm tarball are different products; only the tarball is installed by consumers. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

Watch for one shortcut in particular: trying to assume gitignore alone defines the published artifact. It makes later failures harder to locate. Instead, use a focused files list, run npm pack --dry-run, unpack the tarball, and inspect it as a consumer would. Prefer an implementation you can explain from the outside before optimizing it.

Keep the wider goal in view: Turn a useful function into a small package whose public surface and published files are intentional. A short observation with concrete evidence is more useful than a confident sentence with no reproduction path.

Generate the tarball, verify every included file, and make the check fail if a fixture or environment file appears. Hand the result to someone else and see whether the behavior is clear without an oral explanation.