This cheatsheet would have you publish dist/*.{js,d.ts}. Presumably you would use "files":["dist"] in package.json to exclude sources from being published.

The OP recommends to additionally package src/*.ts along with sourceMaps and declarationMaps.

What's actually the best practice here?

I poke around in node_modules with some regularity (often in combination with the debugger) and it’s always nice to find actual source files, not just source maps.