pkg.lock.json

[justinmk]

need some sort of "lockfile" concept, probably. ugh.

ref savq/paq-nvim#149 (comment)

[brianhuster]

In paq-nvim, the lockfile is just used to check if an installed package has version/URL mismatch with what users specify in their config. So their lockfile is just a JSON-ized version of their Packages object

{
    "package-1": {
       "name": "package-1",
       "url": "https://.../package-1.git"
       "hash": "..."
       // Other field of Package that can be serialized
   },
    "pack2": {
        "name": "pack2",
        "url":  ""
        "hash": "..."
        // etc
    }
}

Also since pkg.json's lockfile is called pkg.lock.json instead of pkg-lock.json, does that mean it doesn't have to be a subset of npm's package-lock.json?