Merge pull request #218 from twada/package.files

use `files` field in package.json for npm whitelist