Why this is core

Two market-facing gaps in one PR:

1. Zero CI. The repo advertises engines: >=18.17 and a npm test flow, but nothing verifies either — there is no pipeline, no green-badge trust signal, and a regression can land silently. (The Node 18 leg matters: until now npm test silently broke on Node 18 because node --test glob expansion is a Node 21+ feature — verified on a real Node 18.20.8 install. This PR stacks on the CLI-contract fix that replaces the glob with a cross-version runner.)

2. The published package ships test source. Without a files whitelist, npm publish packs src/, tests/, scripts/, .github/ and dist/tests/ — and the package has no exports map, no repository metadata, no keywords, and declares MIT with no LICENSE file.

Changes

CI (.github/workflows/ci.yml)

• Matrix: Node 18 / 20 / 22 / 24 × ubuntu / windows / macos — the exact engine floor from engines plus current LTS lines, on every OS the CLI targets.
• Runs npm ci, npm test, plus offline-demo and --version smoke checks.
• Separate package hygiene job: npm pack --dry-run prints the tarball contents so a wrong files whitelist fails loudly.
• fail-fast: false so one platform's failure doesn't mask the others.

Publish hygiene (package.json)

• files: ["dist/src", "README.md", "LICENSE"] — the tarball drops from ~everything to 60 files / 49 kB (verified via npm pack --dry-run): compiled JS + d.ts + maps only, no tests or sources.
• exports map (types / import / default) so TS consumers and bundlers resolve the package deterministically.
• keywords, repository, bugs, homepage, sideEffects: false, and prepublishOnly: npm run build so a stale dist can never be published.

LICENSE

• Adds the MIT text that package.json already declares but never shipped. Copyright line uses the repo owner handle (nullcache) — adjust the holder name if you prefer a legal name.

Verification

• npm test: 26/26 pass on Node 24 and on Node 18.20.8 (the engines floor).
• npm pack --dry-run: tarball = LICENSE + README + dist/src + package.json only.
• Workflow YAML validated.

Note: this PR stacks on the CLI-contract PR (it replaces the Node 21+ glob in npm test with a cross-version runner, which is why Node 18 can be in the CI matrix here). Merge order: CLI-contract first, or both together — the commit history is clean either way.