diff --git a/TODO.md b/TODO.md
index 87bc2c7..35b9e6f 100644
--- a/TODO.md
+++ b/TODO.md
@@ -23,6 +23,13 @@ declares one.
 
 # Completed Steps
 
+- 2026-09-23: Settled the package metadata (issue 6). quak is not published, so
+  `package.json` is marked `"private": true` and the `files` field is gone.
+  `engines.node` is `>=22`, the major version `script/bootstrap` and the
+  `Dockerfile` use. An `exports` map makes `.` and `./package.json` the only
+  importable paths; `runMetadataBackup`, the thumbnail helpers and their types
+  stay internal to the CLI.
+
 - 2026-09-23: Brought the README and this file in line with the tree (issue
   111). The layout lists `src/library/` and the other source files, the backup
   layout names `failures.json` and the optional `thumbnails/`, "Opening a
diff --git a/package.json b/package.json
index 7376620..f1a1d6f 100644
--- a/package.json
+++ b/package.json
@@ -9,17 +9,23 @@
         "type": "git",
         "url": "https://git.eeqj.de/sneak/quak.git"
     },
+    "private": true,
     "type": "module",
+    "engines": {
+        "node": ">=22"
+    },
     "main": "./dist/src/index.js",
     "types": "./dist/src/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/src/index.d.ts",
+            "import": "./dist/src/index.js"
+        },
+        "./package.json": "./package.json"
+    },
     "bin": {
         "quak": "./dist/bin/quak.js"
     },
-    "files": [
-        "dist/",
-        "README.md",
-        "LICENSE"
-    ],
     "scripts": {
         "build": "script/build",
         "quak": "node ./dist/bin/quak.js",