Hack in a package.yaml instead of package.json

json is just incredibly tedious to use for this, especially because of
lack of comments.

Upstream has been informed of this many times apparently, npm won't
change it. Just hack it downstream.

npm will never get better, will it...

nix/utilities/default.nix

@@ -0,0 +1,20 @@
+{pkgs}: let
+  inherit (builtins) readFile;
+
+  update-lockfile = pkgs.writeShellApplication {
+    name = "update-lockfile";
+    runtimeInputs = with pkgs; [
+      git
+      yj
+      nodejs-14_x
+      direnv
+      nodePackages.npm-check-updates
+    ];
+    text = readFile ./update-lockfile;
+  };
+in {
+  update-lockfile = {
+    type = "app";
+    program = "${update-lockfile}/bin/update-lockfile";
+  };
+}

nix/utilities/update-lockfile

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+set -eu
+
+cd "$(git rev-parse --show-toplevel)"
+
+if [ -L node_modules ]; then
+    unlink node_modules
+fi
+
+if [ -L package.json ]; then
+    unlink package.json
+fi
+
+yj < package.yaml > package.json
+
+if [ "${1}" == "--ignore-semver" ]; then
+   npm-check-updates -u
+fi
+
+npm install --package-lock-only
+rm -rf node_modules
+rm package.json
+
+direnv reload