[BUG] pack and publish don't respect inverse glob

[argomez]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

If you use an inverse glob in package.json files array, directories that should be included are not traversed since v9 release. This is also an issue in v10.

Expected Behavior

Directories that match inverse glob should be traversed, so that test directories etc. can be excluded from distributions.

Steps To Reproduce

https://github.com/argomez/npm-files-glob has a simple setup which you can run npm pack in the different versions to compare behavior.

Package setup

➜  npm-files-glob git:(main) ✗ tree
.
├── README.md
├── dist
│   ├── __test__
│   │   └── test.js
│   ├── index.js
│   └── util
│       └── util.js.js
└── package.json

4 directories, 5 files
➜  npm-files-glob git:(main) ✗ cat package.json
{
  "name": "npm-files-glob",
  "version": "1.0.0",
  "files": [
    "dist/!(__test__)"
  ]
}

v8.19.4

v8 respects the inverse glob and includes dist/util/util.js

npm-files-glob git:(main) ✗ nvm use v16 && npm -v && npm pack
Now using node v16.20.2 (npm v8.19.4)
8.19.4
npm notice
npm notice 📦  npm-files-glob@1.0.0
npm notice === Tarball Contents ===
npm notice 880B README.md
npm notice 0B   dist/index.js
npm notice 0B   dist/util/util.js.js
npm notice 94B  package.json

v9.9.0

v9 does not traverse dist/util directory

npm-files-glob git:(main) ✗ node -v && npm -v && npm pack
v18.18.2
9.9.0
npm notice
npm notice 📦  npm-files-glob@1.0.0
npm notice === Tarball Contents ===
npm notice 880B README.md
npm notice 0B   dist/index.js
npm notice 94B  package.json

Environment

• npm: v9.9.0
• Node.js: v18.18.2
• OS Name: MacOS Sonoma 14.0
• System Model Name: MacBook Air

[wraithgar]

npm adheres more strictly to the glob spec now, and this meant that we stopped interpreting a normal glob as a "globstar". That was treated as a regression and partially fixed this in npm/npm-packlist#147.

You can fix this today by making your glob more correct i.e. dist/**/!(__test__).

We may look into trying to fix this for the inverse syntax but it's probably safest if you update your files entry.

[wraithgar]

This is being tracked at npm/npm-packlist#152