chore: reduce npm package size by ~78%

[margaretjgu]

Closes #250.

Summary

Two targeted changes to cut the published package from 25.8 MB → 5.7 MB unpacked (2.3 MB → 0.9 MB tarball):

1. Remove src/ from files[]

The source tree was never needed at runtime — only dist/ is consumed. Removes 3.3 MB from the published package with no functional impact.

2. postbuild script: strip schema declaration artefacts

dist/es/apis/schemas/ contains 48 per-namespace files compiled into *.d.ts, *.d.ts.map, and *.js.map (~8.3 MB combined). Consumers cannot meaningfully introspect these types (they reference internal Zod generics and large transitive type closures). Stripping them has no public-API impact.

The *.js runtime files are preserved — they are imported lazily by the CLI at command execution time.

Measurements

Metric	Before	After	Reduction
dist/ total	33 MB	15 MB	−55%
npm tarball	2.3 MB	0.9 MB	−61%
npm unpacked	25.8 MB	5.7 MB	−78%
total files	3,710	2,884	−826 files

Implementation

The postbuild script runs automatically after every npm run build via npm's lifecycle hooks:

"postbuild": "node -e \"..strip dist/es/apis/schemas/*.d.ts *.d.ts.map *.js.map..\""

This uses only Node.js built-ins (fs, path) — no extra dev dependencies needed.

Checklist

• Remove src/ from files[]
• Add postbuild step to strip dist/es/apis/schemas/*.d.ts, *.d.ts.map, *.js.map
• npm pack --dry-run shows expected tarball size (0.9 MB)
• All tests pass

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	4.81s
✅ REPOSITORY	gitleaks	yes		no	no	69.18s
✅ REPOSITORY	git_diff	yes		no	no	0.46s
✅ REPOSITORY	secretlint	yes		no	no	13.42s
✅ REPOSITORY	trivy	yes		no	no	18.24s

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

[MattDevy]

LGTM