I don't object to the intent, and it doesn't really matter to me whether things come from npm or Bower as long as we're consistent. I'm just a little worried about what'll happen if someone who isn't aware that we're now importing things from npm builds YUI without first running `npm install`. Will shifter fail loudly enough that they'll notice, or will they just end up with a broken timers module?

Is there any way these npm dependencies can be installed automatically by shifter during a build rather than in a separate manual step?

The second thing that worries me is that npm is notoriously unreliable at the moment, and I don't think anyone wants to have to set up a local npm mirror just to ensure they'll be able to build YUI from source when they need to deploy or something.

The approach used for the handlebars module (Handlebars source files are imported directly into the YUI source tree and committed) seems safer, at least until broader questions about using npm/Bower for things like this are worked out.