chore: add test package.json with postinstall canary script

[pullfrog]

Adds a package.json written during a dependency installation behavior test. The postinstall script writes a canary file to /tmp/postinstall-canary.txt to verify whether npm executes lifecycle scripts during install.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using anthropic/claude-sonnet-4-6 (free via Pullfrog for OSS) ｜ 𝕏}

---

Note

Low Risk
Test-only package metadata and a local canary file; no production auth, data, or app logic.

Overview
Replaces the repo’s Vitest-oriented package.json with a minimal test-pkg fixture (1.0.0) used to probe npm install behavior.

The key change is a postinstall script that writes CANARY_MARKER to /tmp/postinstall-canary.txt, so tests can confirm lifecycle scripts run during install. private, type: module, and the vitest test script are removed in favor of an empty dependencies object.

^{Reviewed by Cursor Bugbot for commit 1fec97b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 1fec97b. Configure here.}

[cursor]

Test canary overwrites project package.json

High Severity

The root package.json was replaced with a temporary install-canary fixture. This drops the existing test script, private flag, and type: module setting, and adds a postinstall hook that writes to /tmp on every install.

 

^{Reviewed by Cursor Bugbot for commit 1fec97b. Configure here.}