Find a published npm package's source by comparing branches

A package's registry version may not come from main, and the repo's version field may disagree with npm. Run npm pack pkg@version, extract it, and diff the entry file against candidate refs with git show "${ref}:path" | diff - extracted/file, including every remote branch. In this session a release branch matched with 0 differing lines and carried one commit that main lacked, while main had features that were never published. Check this before bumping and publishing, or you can silently revert a hotfix made only on the release branch. Exact blob matching with git hash-object also works, but it failed here only because the search loop's $c:cli/... expansion was mangled by zsh.