chore(pkg): publish runtime only; relocate tests; add publint + verifier

The published package was shipping 25 test files and 5 dev scripts: the
`files` allowlist listed `src/` and `scripts/` wholesale, and with a
`files` field present npm ignores `.npmignore` entirely — so its test/dev
excludes silently did nothing.

Packaging (industry-standard allowlist, no .npmignore):
- Relocate tests src/tests/ -> top-level test/ so the `src` allowlist entry
  no longer pulls them in. Rewrite their `../` imports to `../src/` and fix
  bug-fixes.test.js path anchors (srcDir/projectDir) for the new depth.
- Tighten `files` to a precise allowlist (src, mcp.json, .env.example,
  README, LICENSE, CLAUDE.md, AGENTS.md) and delete the dead `.npmignore`.
  Tarball: 61 -> 31 files, 0 tests, 0 dev scripts.
- Add publint (npm run lint:package) and a prepublishOnly gate that runs
  the offline suites + publint before publish (omits the live integration
  test so publishing never hits a real site).

Dev tooling:
- Add scripts/verify-tool-names.mjs: cross-checks every gf_/gv_ name in the
  server instructions, docs and demo against the tools the server actually
  registers (gv_* are generated from the live abilities catalog and can
  drift). Run via npm run verify:tool-names against a live site.
- Document packaging and the verifier in AGENTS.md.

Verified: full test:all incl. live integration green; npm pack --dry-run
clean (31 files); publint passes; verify:tool-names passes.

Author: zackkatz

.npmignore

@@ -38,36 +38,25 @@ MCP/
 │   │   ├── validators.js     # Domain-specific validators (forms, entries, feeds, etc.)
 │   │   ├── field-validation.js  # FieldAwareValidator for field-specific rules
 │   │   └── test-config.js    # Dual test/live environment config, TestFormManager
-│   ├── utils/
-│   │   ├── compact.js        # stripEmpty() — recursive null/empty/false stripping for token optimization
-│   │   ├── logger.js         # MCP-safe logger (stderr in MCP mode, console in test)
-│   │   └── sanitize.js       # Credential masking for safe logging
-│   └── tests/
-│       ├── run.js            # Test runner
-│       ├── helpers.js        # Mock data generators, test utilities
-│       ├── integration.test.js          # Live API integration tests
-│       ├── server-tools.test.js         # Tool registration validation
-│       ├── forms.test.js                # Forms endpoint tests
-│       ├── entries.test.js              # Entries endpoint tests
-│       ├── feeds.test.js                # Feeds endpoint tests
-│       ├── submissions.test.js          # Submission pipeline tests
-│       ├── authentication.test.js       # Auth method tests
-│       ├── validation.test.js           # Input validation tests
-│       ├── field-validation.test.js     # Field-specific validation
-│       ├── field-manager.test.js        # FieldManager unit tests
-│       ├── field-dependencies.test.js   # DependencyTracker tests
-│       ├── field-positioner.test.js     # PositionEngine tests
-│       ├── field-registry.test.js       # Field registry tests
-│       ├── field-operations-e2e.test.js # Field operations E2E
-│       ├── field-operations-integration.test.js # Field ops integration
-│       ├── compact.test.js             # stripEmpty compact utility tests
-│       └── sanitize.test.js            # Sanitization tests
+│   └── utils/
+│       ├── compact.js        # stripEmpty() — recursive null/empty/false stripping for token optimization
+│       ├── logger.js         # MCP-safe logger (stderr in MCP mode, console in test)
+│       └── sanitize.js       # Credential masking for safe logging
+├── test/                     # Test suites — top-level, NOT published (see Packaging)
+│   ├── run.js                # Custom test runner (npm run test:unit)
+│   ├── helpers.js            # Mock data generators, test utilities
+│   ├── integration.test.js   # Live API integration tests (npm test)
+│   ├── views.test.js, views-stress.test.js   # GravityView inspector + abilities coverage
+│   ├── abilities-loader.test.js              # Abilities catalog → gv_* tool generation
+│   └── *.test.js             # forms, entries, feeds, fields, validation, submissions, compact, sanitize, …
 ├── scripts/
 │   ├── check-env.js          # Environment validation script
 │   ├── setup-test-data.js    # Test data seeding
 │   ├── test-field-ops.js     # Field operations smoke test
 │   ├── test-server-output.js # Server output verification
-│   └── verify-field-tools.js # Field tool registration check
+│   ├── verify-field-tools.js # Field tool registration check
+│   ├── verify-tool-names.mjs # Cross-check doc/instruction tool names vs registered tools (dev-only, not published)
+│   └── stress-abilities.mjs  # Synthetic abilities-loader stress/contract test
 └── .github/workflows/
     ├── publish.yml           # npm publish workflow
     ├── security.yml          # Security scanning
@@ -245,7 +234,7 @@ All delete operations (`deleteForm`, `deleteEntry`, `deleteFeed`) check `this.al
      return wrapHandler(() => gravityFormsClient.newToolMethod(params))();
    ```
 
-5. **Add tests** — create test in `src/tests/` following existing patterns (see `forms.test.js` for reference).
+5. **Add tests** — create test in `test/` following existing patterns (see `forms.test.js` for reference). Import source under test as `../src/…`.
 
 ### Adding a New Field Type to the Registry
 
@@ -340,7 +329,7 @@ npm run test:all       # Run everything sequentially
 npm test               # Integration tests (requires live API)
 ```
 
-Tests use a custom runner (`src/tests/run.js`), not Jest/Mocha. Test helpers in `src/tests/helpers.js` provide mock data generators (`generateMockForm`, `generateMockEntry`, `generateMockFeed`).
+Tests use a custom runner (`test/run.js`), not Jest/Mocha. Test helpers in `test/helpers.js` provide mock data generators (`generateMockForm`, `generateMockEntry`, `generateMockFeed`).
 
 For integration tests, set `GRAVITY_FORMS_TEST_*` env vars pointing to a test WordPress site. Test forms are prefixed with `TEST_` and auto-cleaned via `TestFormManager`.
 
@@ -374,6 +363,15 @@ No build step — pure ESM JavaScript, runs directly with `node src/index.js`. R
 
 12. **Test mode resolves env vars at client construction.** When `GRAVITYKIT_MCP_TEST_MODE=true` (or legacy `GRAVITYMCP_TEST_MODE=true`), `testConfig.resolveEnv()` remaps `GRAVITY_FORMS_TEST_BASE_URL` → `GRAVITY_FORMS_BASE_URL` (and consumer key/secret). The rest of the client and AuthManager work unchanged. — `config/test-config.js:60-95`, `gravity-forms-client.js:16`
 
+## Packaging
+
+What ships to npm is governed solely by the **`files` allowlist** in `package.json` — there is intentionally **no `.npmignore`** (with a `files` field present npm ignores it, so keeping one is misleading). Allowlist, not denylist: a new file ships only if it matches `files`.
+
+- **Ships:** `src/` (runtime), `mcp.json`, `.env.example`, `README.md`, `LICENSE`, `CLAUDE.md`, `AGENTS.md`.
+- **Excluded by omission:** `test/` (tests are top-level, not under `src/`), `scripts/` (dev tooling), `.github/`, `package-lock.json`.
+- **`npm run lint:package`** runs [publint](https://publint.dev) to validate package correctness; **`prepublishOnly`** runs the offline test suites + publint, so a broken or mis-packaged build can't be published. It deliberately omits the live integration test (`npm test`) to avoid hitting a real site during publish.
+- **Verify before publishing:** `npm pack --dry-run` lists exactly what will ship.
+
 ## Releasing
 
 **Every version tag MUST include a CHANGELOG.md update.** Follow this checklist:
@@ -388,6 +386,8 @@ No build step — pure ESM JavaScript, runs directly with `node src/index.js`. R
 
 Skipping any step (especially CHANGELOG) will leave the release history incomplete for future developers and AI agents.
 
+**Before tagging, run `npm run verify:tool-names` against a live site.** The `gv_*` tools are generated from the installed GravityView/Foundation Abilities catalog, so a catalog rename can silently leave the server `instructions` string, README, or the demo referencing tools that no longer exist. The script cross-checks every `gf_`/`gv_` name in prose against what the server actually registers and exits non-zero on a mismatch. Requires WordPress credentials in the environment (see Required Environment). Dev-only — not shipped in the npm package.
+
 ## Related Resources
 
 - **CLAUDE.md** — Concise project identity and critical rules

AGENTS.md

@@ -13,21 +13,24 @@
     "inspect": "npx @modelcontextprotocol/inspector node src/index.js",
     "check-env": "node scripts/check-env.js",
     "setup-test-data": "node scripts/setup-test-data.js",
-    "test": "node src/tests/integration.test.js",
-    "test:unit": "node src/tests/run.js",
-    "test:field-ops": "node --test src/tests/field-manager.test.js src/tests/field-registry.test.js src/tests/field-dependencies.test.js src/tests/field-positioner.test.js",
-    "test:auth": "node src/tests/authentication.test.js",
-    "test:forms": "node src/tests/forms.test.js",
-    "test:entries": "node src/tests/entries.test.js",
-    "test:feeds": "node src/tests/feeds.test.js",
-    "test:submissions": "node src/tests/submissions.test.js",
-    "test:validation": "node src/tests/validation.test.js",
-    "test:field-validation": "node src/tests/field-validation.test.js",
-    "test:tools": "node src/tests/server-tools.test.js",
-    "test:compact": "node src/tests/compact.test.js",
-    "test:views": "node src/tests/views.test.js",
+    "verify:tool-names": "node scripts/verify-tool-names.mjs",
+    "test": "node test/integration.test.js",
+    "test:unit": "node test/run.js",
+    "test:field-ops": "node --test test/field-manager.test.js test/field-registry.test.js test/field-dependencies.test.js test/field-positioner.test.js",
+    "test:auth": "node test/authentication.test.js",
+    "test:forms": "node test/forms.test.js",
+    "test:entries": "node test/entries.test.js",
+    "test:feeds": "node test/feeds.test.js",
+    "test:submissions": "node test/submissions.test.js",
+    "test:validation": "node test/validation.test.js",
+    "test:field-validation": "node test/field-validation.test.js",
+    "test:tools": "node test/server-tools.test.js",
+    "test:compact": "node test/compact.test.js",
+    "test:views": "node test/views.test.js",
     "test:all": "npm run test:unit && npm run test:field-ops && npm run test:auth && npm run test:forms && npm run test:entries && npm run test:feeds && npm run test:submissions && npm run test:validation && npm run test:field-validation && npm run test:tools && npm run test:views && npm test",
-    "test:coverage": "echo 'Running all tests with coverage analysis' && npm run test:all"
+    "test:coverage": "echo 'Running all tests with coverage analysis' && npm run test:all",
+    "lint:package": "publint",
+    "prepublishOnly": "npm run test:unit && npm run test:field-ops && npm run test:field-validation && npm run test:views && publint"
   },
   "keywords": [
     "mcp",
@@ -51,12 +54,12 @@
   },
   "files": [
     "src/",
-    "scripts/",
-    "LICENSE",
-    "README.md",
-    ".env.example",
     "mcp.json",
-    "CLAUDE.md"
+    ".env.example",
+    "README.md",
+    "LICENSE",
+    "CLAUDE.md",
+    "AGENTS.md"
   ],
   "repository": {
     "type": "git",
@@ -95,5 +98,8 @@
       "Integration testing",
       "Security validation"
     ]
+  },
+  "devDependencies": {
+    "publint": "^0.3.21"
   }
 }