restrict files published to npm.