pnpm 12 pack keeps only the main/bin file of a gitignored directory and ignores browser (npm and pnpm 11 pack the whole directory) #16908

Verify latest release

• I verified that the issue exists in the latest pnpm release (12.12.1; also checked 12.0.0)

pnpm version

12.0.0 through 12.12.1. pnpm 11.28.5 matches npm.

Which area(s) of pnpm are affected? (leave empty if unsure)

CLI (pnpm pack / pnpm publish)

Reproduction steps

mkdir -p repro-pkg/dist/lib repro-pkg/out repro-pkg/src && cd repro-pkg
echo x > dist/lib/app.js; echo y > dist/lib/other.js
echo b > out/browser.js; echo c > out/chunk.js; echo s > src/a.ts
printf 'node_modules\ndist/\nout/\n' > .gitignore
echo '{"name":"repro-pkg","version":"1.0.0","main":"dist/lib/app.js","browser":"out/browser.js"}' > package.json
pnx npm@latest pack --dry-run      # all of dist/ and out/
pnx pnpm@11 pack --dry-run         # all of dist/ and out/
pnx pnpm@12.12.1 pack --dry-run    # only dist/lib/app.js, nothing from out/

There is no files field and no .npmignore, so .gitignore applies.

Describe the Bug

pnpm 12 packs only the exact main file from the gitignored dist/, and nothing from the gitignored out/ that browser points into:

pnpm 12.12.1 output:

package: repro-pkg@1.0.0
Tarball Contents
dist/lib/app.js
package.json
src/a.ts
Tarball Details
repro-pkg-1.0.0.tgz

Packages that build into a gitignored dist/ and point main into it publish one file instead of their build output; types, chunks and assets are missing. Nothing warns. We hit this in several packages when upgrading from pnpm 11 to 12 (one went from 37 files under dist/ to 1).

Expected Behavior

Match npm-packlist (and pnpm 11): dist/lib/app.js, dist/lib/other.js, out/browser.js, out/chunk.js, package.json, src/a.ts.

npm-packlist turns main, bin and browser into re-include rules for their paths and parent directories (for example !/dist/lib/app.js, !/dist/lib, !/dist), which un-ignores the gitignored directory, so the whole directory is packed when there is no files field. npm docs: https://docs.npmjs.com/cli/v11/configuring-npm/package-json#files, npm-packlist: https://github.com/npm/npm-packlist

Root cause pointer: pnpm 12's fs-packlist skips the ignored directory and then re-adds only the exact main/bin file (force_include_main_and_bin). It does not handle browser at all. Related, already fixed fs-packlist divergences: #15738, #16213.

Which Node.js version are you using?

v26.10.0

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

AL2023, Ubuntu, x86_64