chore: update package.json for postinstall canary test

[pullfrog]

Updates package.json as part of a dependency installation behavior test. The postinstall script writes a canary file to /tmp/postinstall-canary.txt.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using Claude Sonnet ｜ 𝕏}

---

Note

Low Risk
Test-only manifest change; the postinstall only writes a marker file under /tmp and does not affect production app logic.

Overview
Replaces the minimal Vitest test-repo package with test-pkg v1.0.0 and drops private, type: module, and the vitest test script.

Adds a postinstall script that writes CANARY_MARKER to /tmp/postinstall-canary.txt so installs can be detected in CI or workflow tests. dependencies is set to an empty object.

^{Reviewed by Cursor Bugbot for commit 1949889. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Removal of private flag risks accidental npm publish

High Severity

The "private": true field was removed from package.json. This safety guard prevents accidental publication to the npm registry. Without it, running npm publish (intentionally or via CI misconfiguration) would push this package publicly. The canary test configuration can coexist with the "private": true flag—there's no reason to drop it.

 

^{Reviewed by Cursor Bugbot for commit 78263c6. Configure here.}

[cursor]

Test script removed, breaking existing test infrastructure

Medium Severity

The "test": "vitest run" script was removed and replaced solely with the postinstall script. The existing test suite in test/math.test.ts (which imports from vitest) is now unreachable via npm test. The postinstall canary script can be added alongside the existing test script rather than replacing it.

 

^{Reviewed by Cursor Bugbot for commit 78263c6. Configure here.}

[cursor]

Removing type: module breaks ESM module resolution

Medium Severity

The "type": "module" field was removed from package.json. The existing source files (src/*.ts) and test files use ESM import/export syntax. Without this field, Node.js defaults to CommonJS module resolution, which can break tooling and module resolution for the existing codebase.

 

^{Reviewed by Cursor Bugbot for commit d4ee81e. Configure here.}

[cursor]

Test script removed while test infrastructure still exists

Medium Severity

The "test": "vitest run" script was replaced entirely by the postinstall script. The repository still contains test/math.test.ts and TypeScript source files in src/, but there's no longer any way to run tests via npm test. Additionally, "type": "module" was removed, which would break ESM imports used in the existing source and test files. This appears to be test/debug configuration that overwrites the real project setup rather than extending it.

 

^{Reviewed by Cursor Bugbot for commit 4a814fd. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 5 total unresolved issues (including 4 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit c19da84. Configure here.}

[cursor]

Install-time filesystem write

Medium Severity

The new postinstall script runs automatically on npm install and writes to /tmp/postinstall-canary.txt. Install-time side effects like this execute before consumers review package contents and can surprise local or CI environments if the package is linked, packed, or published.

 

^{Reviewed by Cursor Bugbot for commit c19da84. Configure here.}