Mark the package private and declare engines and exports (closes #6)

quak is not published, so package.json is marked private and loses its
files field. engines.node is >=22, the major version script/bootstrap
and the Dockerfile use. The exports map makes "." and "./package.json"
the only importable paths, so the CLI-only modules stay internal.

Model: opus-5-5

TODO.md

@@ -23,6 +23,13 @@ declares one.
 
 # Completed Steps
 
+- 2026-09-23: Settled the package metadata (issue 6). quak is not published, so
+  `package.json` is marked `"private": true` and the `files` field is gone.
+  `engines.node` is `>=22`, the major version `script/bootstrap` and the
+  `Dockerfile` use. An `exports` map makes `.` and `./package.json` the only
+  importable paths; `runMetadataBackup`, the thumbnail helpers and their types
+  stay internal to the CLI.
+
 - 2026-09-23: Brought the README and this file in line with the tree (issue
   111). The layout lists `src/library/` and the other source files, the backup
   layout names `failures.json` and the optional `thumbnails/`, "Opening a

package.json

@@ -9,17 +9,23 @@
         "type": "git",
         "url": "https://git.eeqj.de/sneak/quak.git"
     },
+    "private": true,
     "type": "module",
+    "engines": {
+        "node": ">=22"
+    },
     "main": "./dist/src/index.js",
     "types": "./dist/src/index.d.ts",
+    "exports": {
+        ".": {
+            "types": "./dist/src/index.d.ts",
+            "import": "./dist/src/index.js"
+        },
+        "./package.json": "./package.json"
+    },
     "bin": {
         "quak": "./dist/bin/quak.js"
     },
-    "files": [
-        "dist/",
-        "README.md",
-        "LICENSE"
-    ],
     "scripts": {
         "build": "script/build",
         "quak": "node ./dist/bin/quak.js",