chore: use prepack/postpack to swap npm README during pack/publish

[devin-ai-integration]

Summary

Adds prepack/postpack lifecycle scripts so the npm tarball includes npm.readme.md as the package README on npmjs.com, while preserving the GitHub README in the repo.

• prepack: backs up README.md to /tmp/.exa-mcp-readme-backup, then copies npm.readme.md → README.md
• postpack: restores original README.md from backup and cleans up

Uses prepack/postpack (not prepublishOnly/postpublish) because these fire on both npm pack and npm publish, enabling dry-run verification via npm pack.

Review & Testing Checklist for Human

• Dry-run the swap: Run npm pack, extract the tarball (tar -xzf exa-mcp-server-*.tgz), and verify package/README.md starts with the npm-specific content (npm badge, npx instructions) — not the GitHub README (Cursor/VS Code install badges)
• Verify restore: After npm pack completes, confirm README.md in the working directory is the original GitHub version (check for "Install in Cursor" badge)
• Verify no side effects: Run npm install and npm run build — confirm neither triggers the README swap (prepack/postpack should only fire during pack/publish)
• Failure recovery: If pack is interrupted between prepack and postpack, README.md will contain npm content. Recovery: git checkout README.md. The /tmp backup also persists. Assess if this risk level is acceptable without a trap-based script.

Notes

• The backup goes to /tmp/.exa-mcp-readme-backup (outside project root) to prevent npm from auto-including README.github.md or similar backup files in the tarball
• npm.readme.md must exist in the repo root or prepack will fail, which is a reasonable guard rail
• prepublishOnly is unchanged — it still only runs build:stdio

Link to Devin session: https://app.devin.ai/sessions/1e3db21a1dca402fa07fabff5faa4959

[devin-ai-integration]

Prompt hidden (unlisted session)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
exa-mcp-server	Ready	Preview, Comment	Apr 9, 2026 1:57am