chore: update package.json for postinstall canary test

[pullfrog]

Updates package.json as part of a dependency installation behavior test. The postinstall script writes a canary file to /tmp/postinstall-canary.txt.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using Claude Sonnet ｜ 𝕏}

---

Note

Medium Risk
A postinstall script runs on every npm install and writes to /tmp, which is unexpected in normal packages and could surprise CI or local installs; removing the vitest script also means npm test no longer runs tests from this manifest.

Overview
Reconfigures package.json for a postinstall canary test instead of the previous vitest-based setup.

The package is renamed from test-repo to test-pkg, version 1.0.0 is added, and private / type: module are removed. The test script (vitest run) is replaced by a postinstall script that runs echo CANARY_MARKER > /tmp/postinstall-canary.txt so installs can be verified via that file. An empty dependencies object is added.

^{Reviewed by Cursor Bugbot for commit 3023dfd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Removal of private flag risks accidental npm publish

High Severity

The "private": true field was removed from package.json. This safety guard prevents accidental publication to the npm registry. Without it, running npm publish (intentionally or via CI misconfiguration) would push this package publicly. The canary test configuration can coexist with the "private": true flag—there's no reason to drop it.

 

^{Reviewed by Cursor Bugbot for commit 78263c6. Configure here.}

[cursor]

Test script removed, breaking existing test infrastructure

Medium Severity

The "test": "vitest run" script was removed and replaced solely with the postinstall script. The existing test suite in test/math.test.ts (which imports from vitest) is now unreachable via npm test. The postinstall canary script can be added alongside the existing test script rather than replacing it.

 

^{Reviewed by Cursor Bugbot for commit 78263c6. Configure here.}

[cursor]

Removing type: module breaks ESM module resolution

Medium Severity

The "type": "module" field was removed from package.json. The existing source files (src/*.ts) and test files use ESM import/export syntax. Without this field, Node.js defaults to CommonJS module resolution, which can break tooling and module resolution for the existing codebase.

 

^{Reviewed by Cursor Bugbot for commit d4ee81e. Configure here.}

[cursor]

Test script removed while test infrastructure still exists

Medium Severity

The "test": "vitest run" script was replaced entirely by the postinstall script. The repository still contains test/math.test.ts and TypeScript source files in src/, but there's no longer any way to run tests via npm test. Additionally, "type": "module" was removed, which would break ESM imports used in the existing source and test files. This appears to be test/debug configuration that overwrites the real project setup rather than extending it.

 

^{Reviewed by Cursor Bugbot for commit 4a814fd. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 5 total unresolved issues (including 4 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit c19da84. Configure here.}

[cursor]

Install-time filesystem write

Medium Severity

The new postinstall script runs automatically on npm install and writes to /tmp/postinstall-canary.txt. Install-time side effects like this execute before consumers review package contents and can surprise local or CI environments if the package is linked, packed, or published.

 

^{Reviewed by Cursor Bugbot for commit c19da84. Configure here.}