- restrict published files via "files" field
- exclude test sources from build output
- ensure clean npm tarball (no src, no tests)
- align packaging with release policy