further flush out package.json; validated against package-json-validator.com