[BUG] .npmignore within subdirectories are ignored when "files" array is used

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

The docs state that when using "files" in package.json, .npmignore files in subdirectories will override the files inclusions for packaging:

You can also provide a .npmignore file in the root of your package or in subdirectories, which will keep files from being included. At the root of your package it will not override the "files" field, but in subdirectories it will.

https://docs.npmjs.com/cli/v8/configuring-npm/package-json#files

Whatever syntax I try with the subdirectory .npmignore, the files I expect to be excluded are still listed in the package (testing with npm pack --dry-run).

Expected Behavior

Following the proof of concept below, I would expect the following contents:

npm notice === Tarball Contents === 
npm notice 243B package.json
npm notice 0B   src/yes.js  
npm notice === Tarball Details ===

Either that, or the docs are wrong or out-of-date.

Have been able to work around by adding a negation pattern to "files" which isn't explicitly documented but seems to work.

Steps To Reproduce

Tested with nodejs 16.10.0 and npm 8.1.4 (MacOS)

mkdir proof-of-concept
cd proof-of-concept
npm init -y
mkdir src
touch src/yes.js src/no.js
echo "no.js" > src/.npmignore

Edit the package.json to include:

"files": ["src/"]

then no.js is still included, despite the .npmignore in the subdirectory:

$ npm pack --dry-run

npm notice 
npm notice 📦  proof-of-concept@1.0.0
npm notice === Tarball Contents === 
npm notice 243B package.json
npm notice 0B   src/no.js   
npm notice 0B   src/yes.js  
npm notice === Tarball Details === 
...

Environment

• npm: 8.1.4
• Node: 16.10.0
• OS: MacOS
• platform: it's just on a desk
• npm config:

; "user" config from (omitted) 

//registry.npmjs.org/:_authToken = (omitted) 

; "env" config from environment

prefix = (omitted)

; node bin location = (omitted) 
; cwd = (omitted) 
; HOME = (omitted) 

Reproduce the issue with package.json, src/.npmignore, src/yes.js, and src/no.js using npm pack --dry-run. Compare the resulting tarball contents with the expected output, then determine whether subdirectory .npmignore behavior should be corrected or the package.json documentation updated.