diff --git a/README.md b/README.md
index e85170c..741e73d 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,7 @@
 # @atomichub/atomicassets
 
 [![npm version](https://img.shields.io/npm/v/@atomichub/atomicassets.svg)](https://www.npmjs.com/package/@atomichub/atomicassets)
+[![CI](https://github.com/atomicassets/atomicassets-sdk/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/atomicassets/atomicassets-sdk/actions/workflows/ci.yml)
 [![license](https://img.shields.io/npm/l/@atomichub/atomicassets.svg)](https://github.com/atomicassets/atomicassets-sdk/blob/main/LICENSE)
 
 Read and write [AtomicAssets](https://github.com/atomicassets/atomicassets-contract) NFTs from JavaScript or TypeScript.
diff --git a/RELEASING.md b/RELEASING.md
index 8693a49..5475772 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -6,7 +6,7 @@ How a version of this package reaches npm and GitHub. A release ends at a render
 
 1. The feature PR carries the README `## What's new in X.Y.Z` entry for the version, and squash-merges so its subject ends with `(#N)`.
 
-2. Land a `chore(release): X.Y.Z` commit on `main` that touches `package.json` alone.
+2. Land a `chore(release): X.Y.Z` commit on `main` that touches `package.json` alone. CI's `test/packaging.test.ts` on that commit proves the tarball ships only the files the package metadata section expects.
 
 3. Tag that commit and push the tag:
 
@@ -98,6 +98,26 @@ A release with neither leaves both out, which is the normal case here.
 
 The script needs bash, git, awk and sed. It reads the README at the tag, not from the working tree, so the body describes what the tag ships. A prerelease tag reads the entry for its base version, so `vX.Y.Z-rc.1` reads `## What's new in X.Y.Z` as that entry stands at the candidate tag. It exits non-zero and names what is missing when the tag does not exist, when the README at the tag has no entry for the version, or when no earlier tag exists.
 
+## Package metadata
+
+`package.json` carries the fields the npm page and a consumer read, and a release does not change them by accident:
+
+- `name` and `version`.
+- `description`: one sentence on what the package does and for whom.
+- `license`, with the `LICENSE` file shipped.
+- `homepage`.
+- `repository`: an object with `type: git` and the `git+https` URL of this repository.
+- `bugs`: an object with the issues URL.
+- `author`: an object with `name` and `url`.
+- `keywords`.
+- `engines`.
+- `main`, `module`, `types` and the `exports` map.
+- `files`: the build output and the notices that must ship.
+- `sideEffects`.
+- `publishConfig` with `access: public` and `provenance: true`, so a publish outside `publish.yml` either carries the same access and provenance or fails, instead of publishing without them.
+
+The README opens with the package name, the npm version, CI and license badges, a short introduction on what the package is for, and an install line, because that README is the npm page. `npm pack --dry-run` lists what the tarball ships; the build output, its type declarations and source maps, the README, the license and the notices are expected, anything else is a `files` mistake. `test/packaging.test.ts` runs that check in CI, so the tarball is proven before the tag.
+
 ## Tag ranges, prereleases, and older releases
 
 - `PREV` for a stable tag is the nearest earlier stable `v*` tag reachable from `TAG^`, which is what `git describe --tags --abbrev=0 --match 'v*' --exclude 'v*-*' vX.Y.Z^` returns, so a stable release lists every commit since the last stable release. For a prerelease tag `PREV` is the nearest earlier tag of any kind, so each candidate lists what it adds to the tag before it. A stable tag whose only earlier tags are prereleases takes the nearest of them. Tags from older release lines count.
diff --git a/package.json b/package.json
index 911eda5..c162fcd 100644
--- a/package.json
+++ b/package.json
@@ -12,7 +12,10 @@
     "blockchain",
     "sdk"
   ],
-  "author": "AtomicHub",
+  "author": {
+    "name": "AtomicHub",
+    "url": "https://atomichub.io"
+  },
   "homepage": "https://github.com/atomicassets/atomicassets-sdk",
   "bugs": {
     "url": "https://github.com/atomicassets/atomicassets-sdk/issues"
@@ -22,6 +25,10 @@
     "url": "git+https://github.com/atomicassets/atomicassets-sdk.git"
   },
   "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "sideEffects": false,
   "version": "2.1.0",
   "engines": {