add package.json with postinstall canary script

[pullfrog]

Adds package.json written during the dependency installation behavior test. The postinstall script writes a canary marker to /tmp/postinstall-canary.txt.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using Claude Sonnet ｜ 𝕏}

---

Note

Low Risk
Test-only fixture with a trivial postinstall side effect; no production app or auth/data paths are touched.

Overview
Replaces the prior minimal package.json with a test-pkg fixture used to assert that npm install runs lifecycle scripts.

The manifest now defines a postinstall script that writes CANARY_MARKER to /tmp/postinstall-canary.txt, so tests can detect whether install-time hooks executed. The old vitest script, private, and type: module fields are removed in favor of this focused canary setup.

^{Reviewed by Cursor Bugbot for commit 009fdb0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Test fixture overwrites project's real package.json configuration

High Severity

This change replaces the repository's real package.json (which had "private": true, "type": "module", and a "test": "vitest run" script) with a postinstall canary test fixture. The existing test/math.test.ts still imports from vitest, so tests can no longer run. Removing "type": "module" breaks ESM resolution for the TypeScript sources, and removing "private": true risks accidental npm publication. This looks like test fixture content that belongs in a subdirectory rather than at the project root.

 

^{Reviewed by Cursor Bugbot for commit 0ddf13a. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 009fdb0. Configure here.}

[cursor]

Non-portable canary path

Medium Severity

The postinstall canary writes to /tmp/postinstall-canary.txt, which is not available on Windows and some hardened environments. A failed redirect makes the lifecycle script exit non-zero, so npm install fails instead of producing the marker.

 

^{Reviewed by Cursor Bugbot for commit 009fdb0. Configure here.}