we use "files" in package.json instead of npmignore