# The published package is defined by the explicit `files` allowlist in
# package.json (the JS launchers + install.js + README). This .npmignore is a
# defense-in-depth net so install-time artifacts never ship even if `files` is
# later broadened back to "bin":
#   - bin/vendor/  — native binaries downloaded by postinstall (install.js)
#   - completions/ — shell completions generated by postinstall
bin/vendor/
completions/
