{
  "$comment": [
    "What a release copies into the bundle, declared ONCE. Read by .gitea/workflows/release.yml",
    "when it assembles the tarball, and by server/scripts/checkBundle.js when CI asks whether",
    "that list still covers everything the module's entry point can reach.",
    "",
    "This is an INCLUDE list on purpose (release.yml's header argues the case): an exclude list",
    "ships whatever it forgot, so the day someone adds server/tools/ with a scratch credential",
    "in it, an exclude list packs it and nobody finds out. The cost of that choice is that a new",
    "top-level directory silently drops OUT of every release instead — which is exactly what",
    "happened to server/commands/ between v0.3.0 and v1.0.0, and is why checkBundle.js exists.",
    "",
    "server[] entries are paths under server/; root[] and generated[] are paths under the module",
    "root. node_modules is not listed: the release installs it with `npm ci --omit=dev` and copies",
    "it separately, so it is not a checked-in path.",
    "",
    "generated[] ships but is not copied — release.yml writes module.json through jq to stamp the",
    "released version into it, since the committed one is a floor rather than a record of the last",
    "release. It is listed because server/index.js requires it, and a check that did not know it",
    "ships would report the module's own manifest as missing from the bundle."
  ],
  "server": [
    "boot.js",
    "commands",
    "config",
    "core.js",
    "data",
    "db",
    "index.js",
    "model",
    "package.json",
    "router",
    "utils"
  ],
  "root": [
    "swagger-fragment.json",
    "LICENSE.md",
    "README.md"
  ],
  "generated": [
    "module.json"
  ]
}