chore: update package.json for postinstall canary test

[pullfrog]

Updates package.json as part of a dependency installation behavior test. The postinstall script writes a canary file to /tmp/postinstall-canary.txt.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using Claude Sonnet ｜ 𝕏}

---

Note

Medium Risk
The postinstall hook runs shell on every install and writes to /tmp, which is intentional for testing but would be unsafe if copied into a real package without review.

Overview
package.json is reshaped for an install-behavior canary instead of a normal dev/test package: the name becomes test-pkg, version 1.0.0 is added, private / type: "module" are dropped, and the vitest run test script is removed.

A postinstall script is added that runs echo CANARY_MARKER > /tmp/postinstall-canary.txt so dependency installation can be verified via that file. An empty dependencies object is included.

^{Reviewed by Cursor Bugbot for commit 8a91227. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Removal of private flag risks accidental npm publish

High Severity

The "private": true field was removed from package.json. This safety guard prevents accidental publication to the npm registry. Without it, running npm publish (intentionally or via CI misconfiguration) would push this package publicly. The canary test configuration can coexist with the "private": true flag—there's no reason to drop it.

 

^{Reviewed by Cursor Bugbot for commit 78263c6. Configure here.}

[cursor]

Test script removed, breaking existing test infrastructure

Medium Severity

The "test": "vitest run" script was removed and replaced solely with the postinstall script. The existing test suite in test/math.test.ts (which imports from vitest) is now unreachable via npm test. The postinstall canary script can be added alongside the existing test script rather than replacing it.

 

^{Reviewed by Cursor Bugbot for commit 78263c6. Configure here.}

[cursor]

Removing type: module breaks ESM module resolution

Medium Severity

The "type": "module" field was removed from package.json. The existing source files (src/*.ts) and test files use ESM import/export syntax. Without this field, Node.js defaults to CommonJS module resolution, which can break tooling and module resolution for the existing codebase.

 

^{Reviewed by Cursor Bugbot for commit d4ee81e. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 4 total unresolved issues (including 3 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4a814fd. Configure here.}

[cursor]

Test script removed while test infrastructure still exists

Medium Severity

The "test": "vitest run" script was replaced entirely by the postinstall script. The repository still contains test/math.test.ts and TypeScript source files in src/, but there's no longer any way to run tests via npm test. Additionally, "type": "module" was removed, which would break ESM imports used in the existing source and test files. This appears to be test/debug configuration that overwrites the real project setup rather than extending it.

 

^{Reviewed by Cursor Bugbot for commit 4a814fd. Configure here.}