Sketch of lockfile generation.

lib/broccoli/fastboot-config.js

@@ -8,6 +8,7 @@ const merge  = require('ember-cli-lodash-subset').merge;
 const md5Hex = require('md5-hex');
 const path   = require('path');
 const Plugin = require('broccoli-plugin');
+const child_process = require('child_process');
 
 const stringify = require('json-stable-stringify');
 
@@ -47,13 +48,18 @@ module.exports = class FastBootConfig extends Plugin {
    * and write it to `package.json`.
    */
   build() {
-    this.buildConfig();
-    this.buildDependencies();
-    this.buildManifest();
-    this.buildHostWhitelist();
-
-    let outputPath = path.join(this.outputPath, 'package.json');
-    this.writeFileIfContentChanged(outputPath, this.toJSONString());
+    return Promise.all([
+      this.buildConfig(),
+      this.buildDependencies(),
+      this.buildManifest(),
+      this.buildHostWhitelist()
+    ]).then(() => {
+      let packageOutputPath = path.join(this.outputPath, 'package.json');
+      this.writeFileIfContentChanged(packageOutputPath, this.toJSONString());
+
+      // let lockfileOutputPath = path.join(this.outputPath, 'package-lock.json');
+      // this.writeFileIfContentChanged(lockfileOutputPath, this.lockileToJSONString());
+    });
   }
 
   writeFileIfContentChanged(outputPath, content) {
@@ -124,10 +130,39 @@ module.exports = class FastBootConfig extends Plugin {
       });
     }
 
-    this.dependencies = dependencies;
-    this.moduleWhitelist = uniq(moduleWhitelist);
+    return this.updateDependencies(dependencies, moduleWhitelist);
+  }
+
+  dependenciesChanged(dependencies) {
+    return stringify(dependencies) !== stringify(this.dependencies);
+  }
+
+  getPackageLock(dependencies) {
+    let packagePath = path.join(this.project.root, 'package.json');
+    let lockfilePath = path.join(this.project.root, 'package-lock.json');
+    let tmpFolder = path.join(this.outputPath, 'package-lock-generator');
+
+    fs.mkdirSync(tmpFolder)
+    fs.symlinkSync(packagePath, path.join(tmpFolder, 'package.json'));
+    fs.symlinkSync(lockfilePath, path.join(tmpFolder, 'package-lock.json'));
+    child_process.execSync('npm install --cache=tmp', { cwd: tmpFolder });
+    fs.unlinkSync(path.join(tmpFolder, 'package.json'));
+    fs.unlinkSync(path.join(tmpFolder, 'package-lock.json'));
+
+    // Run install again, only from cache.
+    fs.writeFileSync(path.join(tmpFolder, 'package.json'), stringify({ dependencies }));
+    child_process.execSync('npm install --cache=tmp --offline', { cwd: tmpFolder });
   }
 
+  updateDependencies(dependencies, moduleWhitelist) {
+    if (this.dependenciesChanged(dependencies)) {
+      this.getPackageLock(dependencies);
+    }
+
+    this.dependencies = dependencies;
+    this.moduleWhitelist = moduleWhitelist;
+}
+
   updateFastBootManifest(manifest) {
     this.project.addons.forEach(addon =>{
       if (addon.updateFastBootManifest) {
@@ -180,6 +215,10 @@ module.exports = class FastBootConfig extends Plugin {
     }, null, 2);
   }
 
+  lockileToJSONString() {
+    return {};
+  }
+
   normalizeHostWhitelist() {
     if (!this.hostWhitelist) {
       return;