npm decides what goes into a tarball with one of two mechanisms, not both. If package.json has a files array, it is the allowlist and .npmignore is ignored for the paths it names. If there is no files array, npm falls back to .npmignore, and if that is missing too, to .gitignore.
Several files are included no matter what: package.json, README, LICENSE or LICENCE, and the file named by main. Several are always excluded regardless of the allowlist: node_modules, .git, .npmrc, package-lock.json, and .DS_Store. That last set is why a stray .npmrc cannot be published by accident, and why shipping a lockfile inside a library tarball does not work.
Always verify before publishing with npm pack --dry-run, which prints the exact file list and the unpacked size. Doing this catches the two common failures at once: forgetting to include the dist directory, and accidentally shipping the entire source tree plus test fixtures.