Use "file" whitelist in package.json

In lieu of the .npmignore blacklist