chore: harden npm install defaults

.gitignore

@@ -18,7 +18,6 @@ venv/
 node_modules/
 npm/lib/
 /tools/sigil-vscode/out/
-/tools/sigil-vscode/package-lock.json
 
 # Paperclip agents (not part of product)
 agents/

.npmrc

@@ -0,0 +1,4 @@
+ignore-scripts=true
+save-exact=true
+audit=true
+fund=false

npm/package.json

@@ -29,7 +29,7 @@
     "url": "https://github.com/fielding/sigil/issues"
   },
   "scripts": {
-    "prepublishOnly": "bash prepare.sh"
+    "prepublishOnly": "node prepare.mjs"
   },
   "engines": {
     "node": ">=18"

npm/prepare.mjs

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+import { copyFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(scriptDir, "..");
+const libDir = join(scriptDir, "lib");
+
+function copyRequired(source, destination, label) {
+  if (!existsSync(source)) {
+    throw new Error(`${label} missing: ${source}`);
+  }
+  mkdirSync(dirname(destination), { recursive: true });
+  copyFileSync(source, destination);
+  console.log(`Copied ${label} to ${destination}`);
+}
+
+mkdirSync(libDir, { recursive: true });
+copyRequired(
+  join(repoRoot, "tools", "intent", "sigil.py"),
+  join(libDir, "sigil.py"),
+  "sigil.py",
+);
+copyRequired(
+  join(repoRoot, "tools", "intent_viewer", "index.html"),
+  join(libDir, "sigil_viewer.html"),
+  "intent_viewer",
+);
+
+const demoSourceDir = join(repoRoot, "examples", "demo-app", ".intent", "index");
+const demoDestDir = join(libDir, "demo_index");
+rmSync(demoDestDir, { recursive: true, force: true });
+mkdirSync(demoDestDir, { recursive: true });
+
+if (!existsSync(demoSourceDir)) {
+  console.warn(`Demo intent index not present at ${demoSourceDir}; packaged CLI will omit demo_index fixtures.`);
+} else {
+  const copied = readdirSync(demoSourceDir)
+    .filter((name) => name.endsWith(".json"))
+    .sort();
+  for (const name of copied) {
+    copyFileSync(join(demoSourceDir, name), join(demoDestDir, name));
+  }
+  console.log(`Copied ${copied.length} demo index JSON files to ${demoDestDir}`);
+}

npm/prepare.sh

@@ -1,16 +1,5 @@
 #!/usr/bin/env bash
-# Copy sigil.py into the npm package for distribution
+# Compatibility wrapper for humans who still run npm/prepare.sh directly.
 set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
-
-mkdir -p "$SCRIPT_DIR/lib"
-cp "$REPO_ROOT/tools/intent/sigil.py" "$SCRIPT_DIR/lib/sigil.py"
-echo "Copied sigil.py to npm/lib/"
-
-cp "$REPO_ROOT/tools/intent_viewer/index.html" "$SCRIPT_DIR/lib/sigil_viewer.html"
-echo "Copied intent_viewer to npm/lib/sigil_viewer.html"
-
-mkdir -p "$SCRIPT_DIR/lib/demo_index"
-cp "$REPO_ROOT/examples/demo-app/.intent/index/"*.json "$SCRIPT_DIR/lib/demo_index/"
-echo "Copied demo index to npm/lib/demo_index/"
+exec node "$SCRIPT_DIR/prepare.mjs"