WIP: split npm functionality out of bundler
hopefully, reads like prose