Files field restricts published contents

Without a files allowlist or .npmignore, running npm publish sends your entire repository — test fixtures, CI configs, editor settings, source TypeScript, internal tooling, and potentially .env.example files — to every consumer who installs your package. ISO 25010 confidentiality is directly impacted: internal implementation details that weren't meant to be public are now permanently embedded in a versioned npm release. SLSA L2 requires artifact provenance; publishing unpredicted files breaks that guarantee. Bloated packages also slow installs for all downstream users.

Add a files allowlist to package.json restricting publication to only built output and essential metadata.

{
  "files": [
    "dist",
    "README.md",
    "LICENSE"
  ]
}

Verify what gets published before releasing: npm pack --dry-run prints every file that would be included. Anything outside dist/, README.md, and LICENSE should raise a question. The files allowlist is safer than .npmignore — new directories are excluded by default rather than accidentally included.