Wheel ships subpackages as package data, sweeping in stale __pycache__ and working-tree junk

[vahid-ahmadi]

Only the top-level package is declared. Every subpackage reaches the wheel as package data, swept in by a **/* glob, which makes wheel contents a function of whatever happens to be in the working tree at build time.

# pyproject.toml:66-70
packages = ["microimpute"]
include-package-data = true

[tool.setuptools.package-data]
"microimpute" = ["**/*"]

microimpute.models, .comparisons, .utils, .evaluations and .visualizations are not declared as packages. They currently import correctly from an installed wheel, but by accident of file layout rather than by declaration.

Evidence

Two wheels built from git archive HEAD copies:

• clean copy → 31 files, 0 __pycache__ entries
• same copy after compileall → 27 __pycache__/*.pyc entries, 501,678 bytes of build-host bytecode in the wheel

Anything matching **/* is swept in the same way — .pyc, the microimpute_models/ MDN cache directory, stray CSVs. The wheel is not reproducible, and whatever a maintainer happened to have locally ships to PyPI.

Fix

[tool.setuptools.packages.find]
include = ["microimpute*"]

and drop the blanket package-data, replacing it with the specific non-Python data files if there are any.

Metadata gaps in the same file

• pyproject.toml:8-11 lists two authors, María Juaristi and Nikhil Woodruff. paper.md and CITATION.cff both list four — Vahid Ahmadi (corresponding), Max Ghenis, María Juaristi, Nikhil Woodruff. The PyPI metadata omits the paper's corresponding author, and JOSS reviewers cross-check this.
• No license, no classifiers, no [project.urls], so the PyPI page carries no repository link. (The absent LICENSE file itself is microimpute has no licence, so all rights are reserved #197.)
• No py.typed, despite the codebase being densely annotated and mypy being in the dev extra — the type hints are invisible to downstream consumers. Worth adding in the same change, since it needs the packaging fix to ship correctly.

Found during a pre-JOSS-submission audit (#201), reproduced independently by a second reviewer building wheels from clean and dirty copies.