Package build must refuse bin entries that are absent from the packed tarball

[ScriptedAlchemy]

Failure

cargo-hauler@0.6.10 published this package.json bin map:

{
  "cargo-hauler": "./dist/bin/cargo-hauler.js",
  "cargo-hauler-install": "./dist/bin/cargo-hauler-install.js",
  "hauler": "./dist/bin/hauler.js"
}

The npm tarball shipped only dist/bin/hauler.js, dist/bin/cargo-hauler.mjs, and dist/bin/cargo-hauler-flight.mjs. cargo-hauler-install was gone (mise: "not a valid shim"; node …/cargo-hauler-install.js → MODULE_NOT_FOUND) and cargo-hauler pointed at a .js that does not exist. Consumers could not install the plugin into any host.

npm pack of the prior releases:

version	declared bin.cargo-hauler / bin.cargo-hauler-install	files present under dist/bin/
0.6.8	./dist/bin/cargo-hauler.js, ./dist/bin/cargo-hauler-install.js	those two, plus hauler.js, cargo-hauler-flight.mjs
0.6.9	same	same
0.6.10	same	hauler.js, cargo-hauler.mjs, cargo-hauler-flight.mjs only

The break landed when cargo-hauler #140 pinned agent-bundle to 9197015b9ae5088eee75c7d2d11a40890b37b367 (then-main, which includes the npm-root package build from #656 / 45beb54792). That build copies the artifact into dist/, compiles only authored bin entries, and does not generate cargo-hauler-install. cargo-hauler still publishes the repo-root package.json (files: [dist, artifact, …]) with the pre-#656 .js bin map.

AB7012 already rejects a staged npm-root package.json whose bins name omitted files (pack-inventory.ts). It never sees the repo-root manifest npm actually packs, so agent-bundle prepack and pnpm check were green while the published tarball was uninstallable.

The owner's #639 review already required this: reject unsupported references with an actionable diagnostic. #639 itself was closed in favor of #656; the diagnostic still only covers the generated root.

Follow-on (same family)

cargo-hauler@0.6.11 fixed the bin map and staged cargo-hauler-install, but cargo-hauler-install install <host> still failed on a real npm-installed tree:

AB7001: --from root does not match its manifest: bin/cargo-hauler.mjs differs from its files[] row in bytes, mode, or digest.

SHA-256 matched. npm pack/extract rewrote the mode: artifact/bin/cargo-hauler.mjs was 0o664 vs manifest 493 (0o755); dist/bin/cargo-hauler.mjs was 0o775. A freshly built worktree (packed-install) writes the correct bits, so the suite never saw this. cargo-hauler@0.6.12 works around it by preferring sibling artifact/ and chmod'ing files[] rows to the manifest mode before installBundle.

Ask

1. Refuse to emit or publish a package.json whose bin entries point at files absent from the packed package — the tarball npm will actually install, not only the generated npm-root. Actionable diagnostic (the feat(build): package the canonical npm root #639 bar). AB7012 is the right code if it is applied to the published manifest.
2. Packed pool: npm pack, install the tarball into a clean prefix, and run every declared bin (not only the artifact CLI). 0.6.10 would have failed on cargo-hauler and cargo-hauler-install.
3. The same packed install should exercise install <host> (or installBundle) against the extracted tree so npm-rewritten modes fail in CI instead of on the consumer (AB7001).

Consumer workaround is already published: cargo-hauler@0.6.12 (ScriptedAlchemy/cargo-hauler#143, #145).