@looop-games/cli 0.1.7 → 0.1.9

package/lib/agent-surface.mjs

@@ -1,15 +1,20 @@
 // The agent surface — skills + the Layer-0 managed block — and how an update
 // reaches a repo that already exists (creator-harness Slice 2, decision Q2).
 //
-// The surface ships INSIDE the versioned engine artifact, not the npm CLI: the
-// CLI's template is only a create-time SEED (the engine is login-gated, so a
-// fresh folder can't download one before its first `dev`). From then on the
-// artifact is the source of truth. Without this, a creator's skills are frozen
-// at the version they created the game with — the exact freeze Q2 exists to end.
+// The surface ships INSIDE the versioned engine artifact, and ONLY there — the
+// npm CLI carries no copy of it. That is what makes the ownership record below
+// trustworthy: `create` places the surface by calling straight into this module
+// (against the artifact it just installed), so the bytes on disk and the hashes
+// we record come from the same place, and a fresh repo's first `update` is a
+// genuine no-op. The CLI used to seed the surface from its own bundled
+// `template/`, stamped with the ENGINE's version — a record that was false the
+// moment npm and the engine registry shipped out of step, and that made the
+// first `update` overwrite (or DELETE, via the orphan prune below) skills on a
+// repo minutes old.
 //
-// **This runs ONLY under `looop update`** (2026-07-11) — never on `dev`
-// or `publish`. It COULD run there safely (it can only ever converge a repo to
-// the engine version already pinned in its package.json, never a newer one),
+// **This runs under `looop update` — and under `looop create`** — never on
+// `dev` or `publish`. It COULD run there safely (it can only ever converge a
+// repo to the engine version already pinned in its package.json, never a newer one),
 // but a creator who ran `dev` and then found files they never wrote sitting in
 // `git status` would be right to feel we'd gone through their pockets. Updates
 // are something you ASK for. So this module writes nothing on its own schedule,
@@ -36,7 +41,7 @@
 // everything outside them (their title, their instructions below the end
 // marker) is theirs and is spliced back untouched.
 import { createHash } from 'node:crypto';
-import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 
 export const SURFACE_DIR = 'agent-surface';
@@ -269,26 +274,3 @@ export function reconcileAgentSurface(projectDir, engineDir, { log = console.log
 
   return result;
 }
-
-// Used by `looop create`: the template seed IS the surface for a brand-new
-// repo, so record it as ours immediately. Without this the first `dev` would
-// treat a two-minute-old scaffold as an unknown pre-existing repo and adopt it.
-export function recordSeededSurface(projectDir, engineVersion) {
-  const placed = {};
-  const add = (rel) => {
-    const abs = join(projectDir, rel);
-    if (existsSync(abs)) placed[rel] = sha(readFileSync(abs));
-  };
-  const walk = (rel) => {
-    const abs = join(projectDir, rel);
-    if (!existsSync(abs)) return;
-    for (const entry of readdirSync(abs)) {
-      const child = join(rel, entry);
-      if (statSync(join(projectDir, child)).isDirectory()) walk(child);
-      else add(child);
-    }
-  };
-  walk(join('.claude', 'skills'));
-  add('AGENTS.md');
-  writeLocal(projectDir, engineVersion ?? null, placed);
-}

package/lib/create.mjs

@@ -2,26 +2,45 @@
 //
 // The create-next-app gesture: one command → a complete folder that is its
 // own repo, where `looop dev` immediately serves a WORKING multiplayer game
-// (the platform is not optional — the template joins a room on line one, no
+// (the platform is not optional — the scaffold joins a room on line one, no
 // "add multiplayer later" tier). The folder name is the slug.
 //
-// The scaffold lives as REAL FILES in ../template/ (creator-harness Slice 1)
-// — edit the template there, not string literals here. `create` copies it
-// with a {{name}} substitution pass. One rename on copy, an npm-pack
-// artifact: `gitignore` → `.gitignore` (npm silently strips .gitignore
-// files from packages). package.json is generated below instead of shipped
-// in the template (nested package.json files confuse npm's packer, and it
-// carries the dynamic cliSpec anyway).
+// ── Where the creator's files come from ─────────────────────────────────────
+//
+// EVERYTHING a creator receives comes from the versioned engine artifact: the
+// starter game (`scaffold/`) and the agent surface (`agent-surface/` — skills
+// plus the Layer-0 managed block). This npm package ships CODE ONLY.
+//
+// It used to ship a `template/` folder, and that was a bug with a long fuse.
+// npm and the engine registry are two independent, immutable release lanes, so
+// the two copies of the surface drifted the moment one shipped without the
+// other — and `create` seeded from the CLI while stamping the ownership record
+// with the ENGINE's version, so that record was a lie the day it was written.
+// The creator paid for it on their first `looop update`: skills they had never
+// touched changed under them, and a skill the CLI shipped but the engine didn't
+// was silently DELETED (agent-surface.mjs prunes files it owns that the
+// artifact no longer lists). On a repo minutes old.
+//
+// One authored copy, one release lane. A skill or scaffold change now ships
+// with an engine release alone; the CLI is released only when the CLI's own
+// code changes.
+//
+// The consequence, and it is deliberate: `create` needs the engine, and the
+// engine download is login-gated — so CREATE SIGNS YOU IN. That gate existed
+// anyway, one command later, at first `dev`. This moves it to where the creator
+// is already waiting and leaves `dev` instant.
 import { execFileSync } from 'node:child_process';
-import { existsSync, mkdirSync, writeFileSync, readdirSync, readFileSync, symlinkSync } from 'node:fs';
+import { existsSync, mkdirSync, writeFileSync, readdirSync, readFileSync, rmSync, symlinkSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { join, relative, dirname } from 'node:path';
 import { getApiBase } from './config.mjs';
 import { DEFAULT_API_BASE } from './llm-shim.mjs';
 import { runNpm } from './npm.mjs';
-import { recordSeededSurface } from './agent-surface.mjs';
+import { ensureEngine } from './engine.mjs';
+import { reconcileAgentSurface } from './agent-surface.mjs';
 
-export const TEMPLATE_DIR = join(import.meta.dirname, '..', 'template');
+// The starter game, inside the installed engine artifact.
+export const SCAFFOLD_DIR = 'scaffold';
 
 const NAME_OK = /^[a-z0-9][a-z0-9-]{0,40}$/;
 
@@ -48,69 +67,37 @@ const ALLOW_SCRIPTS = { esbuild: true, workerd: true, fsevents: true };
 // what create-time provisioning exists to prevent.
 const PLAYWRIGHT_SPEC = '^1.61.1';
 
-// Resolve the engine pin AT CREATE TIME so the initial commit — the
-// milestone-1 revert baseline — already carries `looop.engine`. Without
-// this, first `looop dev` writes the pin AFTER the baseline: the fresh repo
-// starts dirty, and a milestone-1 reject (`git reset --hard`) deletes the
-// pin, so the next dev re-resolves "latest" and can silently change engine
-// versions under a revert. The version LIST endpoint is public (a version
-// number is not a secret); the engine BYTES stay login-gated at first dev.
-async function resolveEnginePin(apiBase, log) {
-  try {
-    const res = await fetch(`${apiBase}/api/creator/engine`);
-    if (!res.ok) throw new Error(`HTTP ${res.status}`);
-    const { latest } = await res.json();
-    if (!latest) throw new Error('no downloadable releases');
-    return latest;
-  } catch (err) {
-    log(`⚠️  Could not resolve the engine version (${err.message}) — the first \`looop dev\` will pin it instead.`);
-    return null;
+// Copy the starter game out of the artifact. One rename: `gitignore` →
+// `.gitignore` (npm pack silently strips .gitignore files from a package, so
+// the artifact stores it dot-less).
+function copyScaffold(engineDir, dir, name, version) {
+  const root = join(engineDir, SCAFFOLD_DIR);
+  if (!existsSync(root)) {
+    // RELEASE ORDER: the engine must ship the scaffold BEFORE a CLI that expects
+    // it. If this CLI ever reaches a creator ahead of that engine, `create`
+    // resolves the latest engine, finds no starter game, and every create on
+    // earth fails — so say exactly what is wrong, and never blame the creator's
+    // setup for our release ordering.
+    throw new Error(
+      `Looop engine ${version} ships no starter game — it predates engine-owned scaffolding. ` +
+        'This is a platform-side issue, not something you did: please report it (`npx looop feedback`) or retry shortly.',
+    );
   }
-}
-
-function copyTemplate(dir, name) {
-  const entries = readdirSync(TEMPLATE_DIR, { withFileTypes: true, recursive: true }).filter((e) => e.isFile());
-  for (const entry of entries) {
-    const rel = relative(TEMPLATE_DIR, join(entry.parentPath, entry.name));
+  for (const entry of readdirSync(root, { withFileTypes: true, recursive: true })) {
+    if (!entry.isFile()) continue;
+    const rel = relative(root, join(entry.parentPath, entry.name));
     const dest = join(dir, rel === 'gitignore' ? '.gitignore' : rel);
     mkdirSync(dirname(dest), { recursive: true });
-    writeFileSync(dest, readFileSync(join(TEMPLATE_DIR, rel), 'utf8').replaceAll('{{name}}', name));
+    writeFileSync(dest, readFileSync(join(root, rel), 'utf8').replaceAll('{{name}}', name));
   }
 }
 
-export async function create({
-  name,
-  cwd = process.cwd(),
-  install = true,
-  cliSpec = process.env.LOOOP_CREATE_CLI_SPEC || '^0.1.0',
-  apiBase = getApiBase(DEFAULT_API_BASE),
-  log = console.log,
-} = {}) {
-  if (!name || !NAME_OK.test(name)) {
-    throw new Error(
-      `"${name ?? ''}" won't work as a game name — use lowercase letters, digits, and dashes (it becomes the URL: play.looop.games/g/<name>).`,
-    );
-  }
-  const dir = join(cwd, name);
-  if (existsSync(dir)) throw new Error(`${dir} already exists — pick another name or remove it first.`);
-
-  mkdirSync(dir, { recursive: true });
-  copyTemplate(dir, name);
-  // Non-Claude agent CLIs (Codex, Gemini/Antigravity, Cursor, opencode)
-  // discover project skills at .agents/skills/ — alias it to the same files.
-  // Created here, not shipped in the template: npm pack can't carry symlinks.
-  try {
-    mkdirSync(join(dir, '.agents'), { recursive: true });
-    symlinkSync(join('..', '.claude', 'skills'), join(dir, '.agents', 'skills'), 'dir');
-  } catch {
-    // e.g. Windows without symlink rights — Claude Code (and any tool that
-    // reads .claude/skills/ directly) still works.
-  }
-  // The engine is deliberately NOT a dependency (Q4 revision): it installs
-  // from the platform's login-gated registry on first `looop dev`. The
-  // VERSION is pinned here at create time (public lookup, warn-fallback) so
-  // the initial commit already carries it — see resolveEnginePin above.
-  const enginePin = await resolveEnginePin(apiBase, log);
+async function scaffold({ dir, name, install, cliSpec, apiBase, log, ensure, reconcile }) {
+  // Written FIRST, and without the engine pin: npm needs a package.json to
+  // install into, and `ensureEngine` writes the pin itself once it knows which
+  // version it actually installed. ONE writer for the pin — the old code had
+  // `create` resolve it and `ensureEngine` resolve it again, which is precisely
+  // how they came to disagree.
   writeFileSync(
     join(dir, 'package.json'),
     JSON.stringify(
@@ -121,28 +108,50 @@ export async function create({
         scripts: { dev: 'looop dev', publish: 'looop publish', test: 'looop test' },
         devDependencies: { '@looop-games/cli': cliSpec, playwright: PLAYWRIGHT_SPEC },
         allowScripts: ALLOW_SCRIPTS,
-        ...(enginePin ? { looop: { engine: enginePin } } : {}),
       },
       null,
       2,
     ) + '\n',
   );
 
-  // The template we just copied IS this repo's agent surface, so record it as
-  // ours now (Slice 2 / Q2). Without this, the first `looop dev` would meet a
-  // two-minute-old scaffold with no ownership record, treat it as a legacy
-  // pre-Slice-2 repo, and noisily "adopt" it. From here the artifact drives it.
-  recordSeededSurface(dir, enginePin);
-
   if (install) {
     log(`Installing the CLI (npm install in ${name}/)…`);
     runNpm(['install', '--no-audit', '--no-fund'], { cwd: dir, stdio: 'pipe' });
+  }
+
+  // The engine — and with it the starter game and the agent skills. Signs the
+  // creator in via the device flow if this machine has no token yet, and writes
+  // the `looop.engine` pin.
+  const engine = await ensure(dir, { apiBase, log });
+
+  copyScaffold(engine.dir, dir, name, engine.version);
+
+  // The agent surface is PLATFORM-owned and reconciled on every `looop update`,
+  // so it is placed here by the very code that will later update it — reading
+  // the artifact, recording the real hash of what landed. That identity is the
+  // whole point: a fresh repo's first `update` is now a genuine no-op, because
+  // the bytes on disk and the bytes in the ownership record came from the same
+  // artifact.
+  reconcile(dir, engine.dir, { log });
+
+  // Non-Claude agent CLIs (Codex, Gemini/Antigravity, Cursor, opencode)
+  // discover project skills at .agents/skills/ — alias it to the same files.
+  // After reconcile, so the link is never dangling.
+  try {
+    mkdirSync(join(dir, '.agents'), { recursive: true });
+    symlinkSync(join('..', '.claude', 'skills'), join(dir, '.agents', 'skills'), 'dir');
+  } catch {
+    // e.g. Windows without symlink rights — Claude Code (and any tool that
+    // reads .claude/skills/ directly) still works.
+  }
+
+  if (install) {
     // Fetch the smoke-test browser NOW (cached machine-wide per version) so
     // the first `looop test` never stalls on a surprise download mid-build.
     // Resolved + run via node directly — NEVER a nested `npx`: when create
-    // itself runs under `npm exec --package=<tarball>` (the stranger
-    // gesture), the inherited npm_config_* env makes an inner npx try to
-    // re-install the tarball and cancel (caught live, 2026-07-10).
+    // itself runs under `npm exec --package=<tarball>` (the stranger gesture),
+    // the inherited npm_config_* env makes an inner npx try to re-install the
+    // tarball and cancel (caught live, 2026-07-10).
     try {
       log('Fetching the test browser (Chromium — one-time download, cached for every game)…');
       const req = createRequire(join(dir, 'package.json'));
@@ -152,12 +161,14 @@ export async function create({
       log('⚠️  Could not fetch Chromium (offline?) — `looop test` will fetch it when first needed.');
     }
   }
+
   try {
     execFileSync('git', ['init', '-q'], { cwd: dir, stdio: 'pipe' });
-    // Commit the scaffold: the initial commit is the first revert baseline
-    // (rejecting milestone 1 resets to it) and what lets `git worktree add`
-    // work — on a never-committed repo it silently creates an empty orphan
-    // lane instead.
+    // The initial commit is the first revert baseline (rejecting milestone 1
+    // resets to it) and what lets `git worktree add` work — on a never-committed
+    // repo it silently creates an empty orphan lane instead. It carries the
+    // engine pin AND the true agent surface, so a reset to baseline cannot
+    // silently change either.
     execFileSync('git', ['add', '-A'], { cwd: dir, stdio: 'pipe' });
     const msg = ['commit', '-q', '-m', 'initial scaffold (looop create)'];
     try {
@@ -175,8 +186,43 @@ export async function create({
   }
 
   log('');
-  log(`✅ ${name} is ready.`);
-  log(`   cd ${dir} && npx looop dev`);
-  log('   (first run downloads the Looop engine — it will ask you to sign in)');
-  return { dir };
+  log(`✅ ${name} is ready (Looop engine ${engine.version}).`);
+  log(`   cd ${name} && npx looop dev`);
+  return { dir, engineVersion: engine.version };
+}
+
+export async function create({
+  name,
+  cwd = process.cwd(),
+  install = true,
+  cliSpec = process.env.LOOOP_CREATE_CLI_SPEC || '^0.1.0',
+  apiBase = getApiBase(DEFAULT_API_BASE),
+  log = console.log,
+  // Seams, mirroring `looop update` — the tests drive a real artifact on disk
+  // through the real reconciler, with no network and no account.
+  ensure = ensureEngine,
+  reconcile = reconcileAgentSurface,
+} = {}) {
+  if (!name || !NAME_OK.test(name)) {
+    throw new Error(
+      `"${name ?? ''}" won't work as a game name — use lowercase letters, digits, and dashes (it becomes the URL: play.looop.games/g/<name>).`,
+    );
+  }
+  const dir = join(cwd, name);
+  if (existsSync(dir)) throw new Error(`${dir} already exists — pick another name or remove it first.`);
+
+  mkdirSync(dir, { recursive: true });
+  try {
+    return await scaffold({ dir, name, install, cliSpec, apiBase, log, ensure, reconcile });
+  } catch (err) {
+    // ATOMIC. Everything a creator receives now arrives over the network behind
+    // a login, so a failure anywhere leaves a folder with no game, no skills and
+    // no initial commit — one that `looop dev` cannot run, and that `create`
+    // would refuse to retry into ("already exists"). A folder that looks like a
+    // game and isn't one is worse than no folder at all: it fails later,
+    // somewhere more confusing. Take it back, and say so.
+    rmSync(dir, { recursive: true, force: true });
+    log(`\n⚠️  Could not finish creating ${name} — removed the incomplete folder so you can retry cleanly.`);
+    throw err;
+  }
 }

package/lib/feedback.mjs

@@ -8,18 +8,117 @@
 // looop.engine pin, and this CLI's version. A delivered file is stamped
 // `sent:` + `id:` in its frontmatter so it never ships twice; a failed send
 // leaves the file unstamped and is retried on the next run.
-import { readdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
-import { basename, join } from 'node:path';
+import { readdirSync, readFileSync, writeFileSync, existsSync, statSync, realpathSync } from 'node:fs';
+import { basename, join, resolve, relative, isAbsolute, sep } from 'node:path';
 import { findProject } from './project.mjs';
 import { getToken, getApiBase } from './config.mjs';
 import { DEFAULT_API_BASE } from './llm-shim.mjs';
 
 const CLI_VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
 
+// Attachment caps. The riven report cited game.js:56 and riven-render.js:302 —
+// source files, not screenshots — so attachments are TEXT. Kept well under the
+// intake's own ceiling so an oversized set is caught HERE, with a readable
+// message: Cloudflare replaces a Pages Function's 5xx body with its own HTML
+// page, which would reach the creator as an unreadable wall.
+export const MAX_ATTACHMENTS = 20;
+export const MAX_ATTACHMENT_BYTES = 256 * 1024; // per file
+export const MAX_ATTACHMENTS_BYTES = 1024 * 1024; // all of them together
+
+const frontmatter = (text) => /^---\n([\s\S]*?)\n---/.exec(text)?.[1] ?? '';
+
 // A report is "sent" when its frontmatter carries a `sent:` stamp.
 function isSent(text) {
-  const fm = /^---\n([\s\S]*?)\n---/.exec(text);
-  return fm ? /^sent:\s*\S/m.test(fm[1]) : false;
+  return /^sent:\s*\S/m.test(frontmatter(text));
+}
+
+// `attachments:` in the report's frontmatter, in either YAML shape agents write:
+//
+//   attachments:          attachments: [game.js, src/render.js]
+//     - game.js
+//     - src/render.js
+export function parseAttachments(text) {
+  const fm = frontmatter(text);
+  const inline = /^attachments:\s*\[(.*)\]\s*$/m.exec(fm);
+  if (inline) {
+    return inline[1]
+      .split(',')
+      .map((s) => s.trim().replace(/^['"]|['"]$/g, ''))
+      .filter(Boolean);
+  }
+  const block = /^attachments:\s*$/m.exec(fm);
+  if (!block) return [];
+  const out = [];
+  for (const line of fm.slice(block.index).split('\n').slice(1)) {
+    const item = /^\s*-\s*(.+?)\s*$/.exec(line);
+    if (!item) break; // the list ends at the first non-item line
+    out.push(item[1].replace(/^['"]|['"]$/g, ''));
+  }
+  return out;
+}
+
+// The agent chooses this list, so it is arbitrary filesystem read access over a
+// network. Every path must land inside the game folder — resolved, not merely
+// inspected, because a symlink's string looks innocent. An escape is a hard
+// error, never a skipped file.
+function readAttachments(projectDir, paths, reportName) {
+  if (paths.length > MAX_ATTACHMENTS) {
+    throw new Error(
+      `${reportName} lists ${paths.length} attachments (max ${MAX_ATTACHMENTS}) — attach only the files the diagnosis rests on.`,
+    );
+  }
+
+  const root = realpathSync(projectDir);
+  const inside = (candidate) => candidate === root || candidate.startsWith(root + sep);
+  const escaped = (p, resolved) => {
+    throw new Error(
+      `${reportName} attaches "${p}", which resolves outside the game folder (${resolved}). ` +
+        `Feedback may only attach files from this game.`,
+    );
+  };
+
+  const files = [];
+  let total = 0;
+
+  for (const p of paths) {
+    // Containment is checked BEFORE existence, and on the lexical path first:
+    // "../../.ssh/id_rsa" is refused for what it asks for, not for whether it
+    // happens to be there. Then again after realpath — a symlink's string looks
+    // perfectly innocent.
+    const full = resolve(root, p);
+    if (isAbsolute(p) || !inside(full)) escaped(p, full);
+
+    let real;
+    try {
+      real = realpathSync(full);
+    } catch {
+      throw new Error(`${reportName} attaches "${p}", which does not exist in the game folder.`);
+    }
+    if (!inside(real)) escaped(p, real);
+    if (!statSync(real).isFile()) throw new Error(`${reportName} attaches "${p}", which is not a file.`);
+
+    const bytes = statSync(real).size;
+    if (bytes > MAX_ATTACHMENT_BYTES) {
+      throw new Error(
+        `${reportName} attaches "${p}" (${Math.round(bytes / 1024)} KiB) — too large, the per-file cap is ${MAX_ATTACHMENT_BYTES / 1024} KiB.`,
+      );
+    }
+    total += bytes;
+    if (total > MAX_ATTACHMENTS_BYTES) {
+      throw new Error(
+        `${reportName}'s attachments are too large together (over ${MAX_ATTACHMENTS_BYTES / 1024} KiB) — attach fewer files.`,
+      );
+    }
+
+    const content = readFileSync(real, 'utf8');
+    if (content.includes('\0')) {
+      throw new Error(`${reportName} attaches "${p}", which is not a text file. Attach source, logs, or config.`);
+    }
+    // Report the path the creator wrote (project-relative), not the real one —
+    // it is what the report's prose cites.
+    files.push({ path: relative(root, real).split(sep).join('/'), content });
+  }
+  return files;
 }
 
 function titleOf(text, path) {
@@ -61,12 +160,16 @@ export async function sendFeedback({
   const sent = [];
   for (const path of unsent) {
     const body = readFileSync(path, 'utf8');
+    // Read + guard the attachments BEFORE the request: a bad path must fail the
+    // send outright, leaving the report unstamped and retryable.
+    const files = readAttachments(project.dir, parseAttachments(body), basename(path));
     const report = {
       title: titleOf(body, path),
       body,
       slug: project.slug,
       engine: project.pkg?.looop?.engine,
       cli: CLI_VERSION,
+      ...(files.length ? { files } : {}),
     };
     const res = await fetch(`${apiBase}/api/creator/feedback`, {
       method: 'POST',
@@ -79,8 +182,9 @@ export async function sendFeedback({
     }
     const { id } = await res.json();
     writeFileSync(path, stamp(body, id));
-    log(`✅ Sent ${basename(path)} → ${id}`);
-    sent.push({ file: path, id });
+    const withFiles = files.length ? ` (+${files.length} file${files.length === 1 ? '' : 's'})` : '';
+    log(`✅ Sent ${basename(path)}${withFiles} → ${id}`);
+    sent.push({ file: path, id, files: files.map((f) => f.path) });
   }
   log(`${sent.length} report${sent.length === 1 ? '' : 's'} delivered to the Looop team.`);
   return { sent };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@looop-games/cli",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Looop game development CLI — dev server, login, and publishing for standalone Looop games.",
   "type": "module",
   "license": "Apache-2.0",
@@ -10,7 +10,6 @@
   "files": [
     "bin",
     "lib",
-    "template",
     "!lib/**/*.test.mjs"
   ],
   "engines": {