The package is still publishable to npm, and bin points at the entry that crashes without node_modules

[MongLong0214]

Audit result. Owner instruction: this must have nothing to do with npm.

What is already clean

No document tells a user to run npm install, npm i, or npx commitlore. All four READMEs say the opposite — the committed bundle runs without node_modules. ADR-0011 replaced the registry channel with git distribution and ADR-0012 removed the last native dependency.

What is not

"private":        absent          ← npm publish would succeed
"files":          ["dist", "spec"]
"bin":            { "commitlore": "dist/cli.js" }
"dependencies":   5 runtime packages

1. It is publishable. ADR-0011 decided there is no registry package. The package does not enforce that decision — anyone with credentials, or a mis-triggered workflow, publishes it. A decision the code permits violating is a decision only until someone makes a mistake. "private": true makes it structural.

2. bin points at dist/cli.js. That is the entry point that dies with ERR_MODULE_NOT_FOUND: commander on a fresh clone — I reproduced it on 2026-07-27. The working entry is dist/commitlore.mjs. So the field that exists only to serve a package-manager install names the one file that cannot work when installed that way. It should be removed with private, not repointed.

3. files and runtime dependencies describe a package nobody ships. The bundle inlines everything (--external:better-sqlite3 is gone with ADR-0012). Whether the five entries should move to devDependencies is worth checking — if the bundle inlines them, they are build-time inputs, and listing them as runtime dependencies advertises a runtime that does not exist.

Explicitly NOT in scope

• npm as the development toolchain stays. npm run build, npm test, devDependencies — that is how the project is built, and no owner instruction touched it. "Nothing to do with npm" is about what a user needs, and a user needs nothing today.
• ADR-0002's and ADR-0011's npm text stays. Those record the decision to reject npm. Deleting them erases why, which is the mistake T-502 · secret guard (pre-commit scan) #19 exists to prevent.

After #39

The static binary removes even the Node requirement. At that point bin, files and runtime dependencies describe a distribution mode the project has no path to — worth a single cleanup once #39 lands rather than twice.