fix: streamline npm publish artifacts

Author: rockyshi1993

.github/workflows/publish.yml

@@ -66,6 +66,6 @@ jobs:
           npm whoami --registry=https://registry.npmjs.org/
 
       - name: Publish to npm
-        run: npm publish --provenance --access public
+        run: npm publish --provenance --access public --ignore-scripts
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

CHANGELOG.md

@@ -9,7 +9,7 @@
 
 | Version | Date | Summary | Details |
 |---------|------|---------|---------|
-| [v2.0.0](./changelogs/v2.0.0.md) | 2026-06-01 | 🎉 **v2.0.0 — TypeScript rewrite**: full TypeScript source, cache-hub integration, schema-dsl `^2.0.3` TS dependency, Apache-2.0 licensing, English README, MultiLevel cache support, v1 API compat preserved, JSDoc coverage complete, `getPoolStats/getPoolHealth` keyed by pool name, v1 compat fixes included, workspace smooth-upgrade bridge validated for downstream consumers | [View](./changelogs/v2.0.0.md) |
+| [v2.0.0](./changelogs/v2.0.0.md) | 2026-06-01 | 🎉 **v2.0.0 — TypeScript rewrite**: full TypeScript source, cache-hub integration, schema-dsl `^2.0.3` TS dependency, Apache-2.0 licensing, English README, MultiLevel cache support, v1 API compat preserved, optimized npm artifact boundary without default sourcemaps, JSDoc coverage complete, `getPoolStats/getPoolHealth` keyed by pool name, v1 compat fixes included, workspace smooth-upgrade bridge validated for downstream consumers | [View](./changelogs/v2.0.0.md) |
 | [v1.3.0](https://github.com/vextjs/monSQLize/blob/main/changelogs/v1.3.0.md) | 2026-04-27 | 🆕 **新功能**：链式池访问 API — `pool(name)` / `use(dbName)` / `scopedCollection()` / `scopedModel()` 四个公开方法，支持多连接池多数据库路由，connection 合并语义，TypeScript 类型签名完整覆盖 | [查看](https://github.com/vextjs/monSQLize/blob/main/changelogs/v1.3.0.md) |
 | [v1.2.3](https://github.com/vextjs/monSQLize/blob/main/changelogs/v1.2.3.md) | 2026-04-26 | 🐛 **Bug Fix**：`model()` 方法修复注册 key 直接作为 MongoDB 集合名的问题，优先读 `definition.collection > definition.name`，注册 key 仅作 fallback，向后兼容 | [查看](https://github.com/vextjs/monSQLize/blob/main/changelogs/v1.2.3.md) |
 | [v1.2.2](https://github.com/vextjs/monSQLize/blob/main/changelogs/v1.2.2.md) | 2026-04-24 | 🆕 **新功能**：Model 数据源绑定 — `connection: { pool?, database? }` 支持 Model 绑定指定连接池和/或数据库，四种组合路由，向后兼容；🐛 **Bug Fix**：修复 `Model._clear()` 导致 `msq.model()` 实例缓存失效失效，populate 关系丢失问题 | [查看](https://github.com/vextjs/monSQLize/blob/main/changelogs/v1.2.2.md) |

README.md

@@ -475,6 +475,8 @@ npm run release:preflight
 
 Release preflight runs linting, type checks, size guards, runtime checks, compatibility checks, refactor guards, the default test suite, and `npm pack --dry-run`.
 
+`npm run release:publish` runs the preflight gate once and then calls `npm publish --ignore-scripts` so the final publish step does not repeat the full lifecycle gate. Raw `npm publish` is still guarded by `prepublishOnly`.
+
 Optional commands:
 
 ```bash
@@ -494,9 +496,10 @@ Key release-readiness points:
 
 - TypeScript rewrite completed for the current runtime and test entry points.
 - Package exports are consolidated under `dist/cjs`, `dist/esm`, and `dist/types`.
+- npm packages include the runtime bundles and declaration files only; source maps are disabled by default and can be generated locally with `MONSQLIZE_BUILD_SOURCEMAPS=1 npm run build`.
 - v1 smooth-upgrade compatibility has been validated against the target workspace consumers.
 - `schema-dsl` follows the npm `latest` TypeScript line `^2.0.3`; deprecated `2.3.x` mistake releases are intentionally excluded.
-- GitHub Actions publishes to npm from `v*` tags after running `npm run release:preflight`.
+- GitHub Actions publishes to npm from `v*` tags after running `npm run release:preflight`; the publish step skips duplicate lifecycle scripts because the gate already ran in the same job.
 
 ## Roadmap
 
@@ -532,4 +535,3 @@ monSQLize is released under the [Apache License 2.0](./LICENSE).
 - Issues: [GitHub Issues](https://github.com/vextjs/monSQLize/issues)
 - npm: [monsqlize](https://www.npmjs.com/package/monsqlize)
 - Website: [https://vextjs.github.io/monSQLize/](https://vextjs.github.io/monSQLize/)
-

changelogs/v2.0.0.md

@@ -206,6 +206,8 @@ All public API surface now carries complete English JSDoc:
 - The transaction/cache-lock unit test was stabilized, and release preflight now runs the default `npm test` gate before pack dry-run.
 - Runtime dependency `schema-dsl` now follows npm `latest` TypeScript line `^2.0.3`; deprecated mistake releases in the `2.3.x` range are explicitly excluded from the upgrade target.
 - Project licensing is now Apache-2.0, and the package README is published in English for npm and GitHub users.
+- npm package artifacts are limited to runtime CJS / ESM bundles, public `.d.ts` declarations, and release documentation. Source maps are disabled by default and excluded from the package boundary even when generated locally.
+- GitHub Actions publish flow now runs `release:preflight` once before `npm publish --ignore-scripts`, avoiding duplicate `prepublishOnly` lifecycle execution inside the final publish step while preserving raw `npm publish` safeguards.
 
 ---
 

docs/release-preflight.md

@@ -19,8 +19,9 @@ npm run release:preflight
 4. 运行 `npm run verify:fast`
 5. 运行 `npm test`
 6. 运行 `npm pack --dry-run`
-7. `npm publish` 会先触发 `prepublishOnly`，从而执行同一套 `release:preflight`
-8. **不会**运行 `npm run verify:release`（后者依赖私有真实环境，属于操作者显式 opt-in 的补充复核）
+7. 原始 `npm publish` 仍会通过 `prepublishOnly` 触发同一套 `release:preflight`，防止绕过门禁
+8. 仓库发布 workflow 和 `npm run release:publish` 会先显式执行 `release:preflight`，再用 `npm publish --ignore-scripts` 发布，避免在发布动作内重复执行完整门禁
+9. **不会**运行 `npm run verify:release`（后者依赖私有真实环境，属于操作者显式 opt-in 的补充复核）
 
 ## 为什么不是直接 publish
 
@@ -38,4 +39,4 @@ git tag vX.Y.Z
 npm run release:publish
 ```
 
-> 若走仓库自动化路径，可先手动运行 GitHub Actions 的 `Release Preflight`，确认通过后再执行 tag / publish。
+> 若走仓库自动化路径，可先手动运行 GitHub Actions 的 `Release Preflight`，确认通过后再推送 `v*` tag 或手动运行 `Publish to npm` workflow。真实 publish step 已跳过重复 lifecycle scripts，因为同一 job 前置步骤已经完成 `release:preflight`。

package.json

@@ -15,7 +15,9 @@
     "./package.json": "./package.json"
   },
   "files": [
-    "dist/",
+    "dist/**/*.cjs",
+    "dist/**/*.mjs",
+    "dist/**/*.d.ts",
     "changelogs/v2.0.0.md",
     "README.md",
     "LICENSE",
@@ -80,7 +82,7 @@
     "verify": "npm run verify:full",
     "release:preflight": "node scripts/release-preflight.cjs",
     "prepublishOnly": "npm run release:preflight",
-    "release:publish": "npm publish",
+    "release:publish": "npm run release:preflight && npm publish --ignore-scripts",
     "postpublish": "echo '✅ 发布成功！请创建 GitHub Release: https://github.com/vextjs/monSQLize/releases/new?tag=v'$npm_package_version"
   },
   "peerDependenciesMeta": {

scripts/build-p1.cjs

@@ -1,6 +1,8 @@
 const { cpSync, mkdirSync, rmSync } = require('node:fs');
 const { build } = require('esbuild');
 
+const emitSourceMaps = process.env.MONSQLIZE_BUILD_SOURCEMAPS === '1';
+
 async function main() {
     rmSync('lib', { recursive: true, force: true });
     rmSync('dist', { recursive: true, force: true });
@@ -17,7 +19,7 @@ async function main() {
         platform: 'node',
         format: 'cjs',
         target: 'node18',
-        sourcemap: true,
+        sourcemap: emitSourceMaps,
         logLevel: 'info',
     });
 
@@ -29,7 +31,7 @@ async function main() {
         platform: 'node',
         format: 'esm',
         target: 'node18',
-        sourcemap: true,
+        sourcemap: emitSourceMaps,
         logLevel: 'info',
     });
 
@@ -49,7 +51,7 @@ async function main() {
             platform: 'node',
             format: 'cjs',
             target: 'node18',
-            sourcemap: true,
+            sourcemap: emitSourceMaps,
             logLevel: 'info',
         });
     }