uber/npm-shrinkwrap — pull request #3 by Raynos (2014-04-18 22:16:56+00:00)
Title: WIP: Initial implementation

Algorithm is now:

- run shrinkwrap, shrinkwrapping your current node_modules tree
- run setResolved. This sets `resolved` values on shrinkwrap that are not set by `npm shrinkwrap` due to an inconsistency between `npm install` and `npm cache clear; npm install`.
- run trimFrom. This trims the `from` field which is known to change a lot and cause git diff noise. The `from` field adds little / no value and we only delete it if its statically safe to do so.
- run verify git. Because we do not do `rm -rf node_modules; npm install` we introduce a new type of bug. The bug is a user edits `package.json` but forgets to run `npm install` thus `package.json` & `npm-shrinkwrap` are out of data. Luckily npm handles this quite well with the `npm ls` output bitching about removed deps, added deps & changed versions. HOWEVER npm cannot statically verify whether your git dependencies are correctly installed. verify git adds static verification for this based on version tags.

### Todo

- [ ] write cli
- [ ] document cli
- [ ] test cli in our applications

cc @sh1mmer @squamos @jcorbin