diff --git a/.gitignore b/.gitignore
index 2c6b6fd..2014d8e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,7 +18,6 @@ venv/
 node_modules/
 npm/lib/
 /tools/sigil-vscode/out/
-/tools/sigil-vscode/package-lock.json
 
 # Paperclip agents (not part of product)
 agents/
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..06f2f9a
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,4 @@
+ignore-scripts=true
+save-exact=true
+audit=true
+fund=false
diff --git a/npm/package.json b/npm/package.json
index cdfd9da..729c86e 100644
--- a/npm/package.json
+++ b/npm/package.json
@@ -29,7 +29,7 @@
     "url": "https://github.com/fielding/sigil/issues"
   },
   "scripts": {
-    "prepublishOnly": "bash prepare.sh"
+    "prepublishOnly": "node prepare.mjs"
   },
   "engines": {
     "node": ">=18"
diff --git a/npm/prepare.mjs b/npm/prepare.mjs
new file mode 100644
index 0000000..781c854
--- /dev/null
+++ b/npm/prepare.mjs
@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+import { copyFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(scriptDir, "..");
+const libDir = join(scriptDir, "lib");
+
+function copyRequired(source, destination, label) {
+  if (!existsSync(source)) {
+    throw new Error(`${label} missing: ${source}`);
+  }
+  mkdirSync(dirname(destination), { recursive: true });
+  copyFileSync(source, destination);
+  console.log(`Copied ${label} to ${destination}`);
+}
+
+mkdirSync(libDir, { recursive: true });
+copyRequired(
+  join(repoRoot, "tools", "intent", "sigil.py"),
+  join(libDir, "sigil.py"),
+  "sigil.py",
+);
+copyRequired(
+  join(repoRoot, "tools", "intent_viewer", "index.html"),
+  join(libDir, "sigil_viewer.html"),
+  "intent_viewer",
+);
+
+const demoSourceDir = join(repoRoot, "examples", "demo-app", ".intent", "index");
+const demoDestDir = join(libDir, "demo_index");
+rmSync(demoDestDir, { recursive: true, force: true });
+mkdirSync(demoDestDir, { recursive: true });
+
+if (!existsSync(demoSourceDir)) {
+  console.warn(`Demo intent index not present at ${demoSourceDir}; packaged CLI will omit demo_index fixtures.`);
+} else {
+  const copied = readdirSync(demoSourceDir)
+    .filter((name) => name.endsWith(".json"))
+    .sort();
+  for (const name of copied) {
+    copyFileSync(join(demoSourceDir, name), join(demoDestDir, name));
+  }
+  console.log(`Copied ${copied.length} demo index JSON files to ${demoDestDir}`);
+}
diff --git a/npm/prepare.sh b/npm/prepare.sh
index bac959e..5f51e28 100755
--- a/npm/prepare.sh
+++ b/npm/prepare.sh
@@ -1,16 +1,5 @@
 #!/usr/bin/env bash
-# Copy sigil.py into the npm package for distribution
+# Compatibility wrapper for humans who still run npm/prepare.sh directly.
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-
-mkdir -p "$SCRIPT_DIR/lib"
-cp "$REPO_ROOT/tools/intent/sigil.py" "$SCRIPT_DIR/lib/sigil.py"
-echo "Copied sigil.py to npm/lib/"
-
-cp "$REPO_ROOT/tools/intent_viewer/index.html" "$SCRIPT_DIR/lib/sigil_viewer.html"
-echo "Copied intent_viewer to npm/lib/sigil_viewer.html"
-
-mkdir -p "$SCRIPT_DIR/lib/demo_index"
-cp "$REPO_ROOT/examples/demo-app/.intent/index/"*.json "$SCRIPT_DIR/lib/demo_index/"
-echo "Copied demo index to npm/lib/demo_index/"
+exec node "$SCRIPT_DIR/prepare.mjs"
diff --git a/tools/sigil-vscode/package-lock.json b/tools/sigil-vscode/package-lock.json
new file mode 100644
index 0000000..90ab68a
--- /dev/null
+++ b/tools/sigil-vscode/package-lock.json
@@ -0,0 +1,59 @@
+{
+  "name": "sigil-intent",
+  "version": "0.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "sigil-intent",
+      "version": "0.1.0",
+      "license": "MIT",
+      "devDependencies": {
+        "@types/node": "^20.0.0",
+        "@types/vscode": "^1.85.0",
+        "typescript": "^5.3.0"
+      },
+      "engines": {
+        "vscode": "^1.85.0"
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "20.19.41",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.19.41.tgz",
+      "integrity": "sha512-ECymXOukMnOoVkC2bb1Vc/w/836DXncOg5m8Xj1RH7xSHZJWNYY6Zh7EH477vcnD5egKNNfy2RpNOmuChhFPgQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.21.0"
+      }
+    },
+    "node_modules/@types/vscode": {
+      "version": "1.120.0",
+      "resolved": "https://registry.npmjs.org/@types/vscode/-/vscode-1.120.0.tgz",
+      "integrity": "sha512-feaT4Rst+FkTch5zz/ZbNCxoIvo55YU80Be2kiL7OJcod4+CUYf2lUBPdIJzozNnSEMq1VRTGrWEcCGFB3fBmA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/typescript": {
+      "version": "5.9.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "6.21.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "dev": true,
+      "license": "MIT"
+    }
+  }
+}