use `files` field in package.json for npm whitelist

use whitelist instead of blacklist (.npmignore)
fixes #217