Feature Production Lockfile on NPM

[Malix-Labs]

Feature Description

I just packaged command code for nixpkgs : NixOS/nixpkgs#548781

However, there is only a package.json without any full production lockfile package.lock in the NPM registry : https://www.npmjs.com/package/command-code?activeTab=code

It is needed to ensure reproducible builds, and without the full production lockfile (matching the published package.json, containing only dependencies available from the npm registry), it is needed to replicate it using immediate pinning, which might differ from the one you tested the software with

Would it be possible to include the full production lockfile as well on NPM?

Thanks!

Use Case

Reproducible Packaging

Additional Context

Would be fixed by #618

How important is this to you?

Important for my workflow

[ahmadawais]

What are you trying to accomplish?

[Malix-Labs]

@ahmadawais

Packaging command-code in nixpkgs without having to generate a (suboptimal) lockfile from scratch, nor having to duplicate the package.json file just to strip unreleased dependencies (dev dependencies in this instance)

This is what I had to do in NixOS/nixpkgs#548781