npm pack, bundleDependencies and dedupe + shrinkwrap

[banderror]

npm pack ignores flattened dependency tree fixed in npm-shrinkwrap.json, if these deps are bundleDependencies, and produces package with non-flattened node_modules inside.

So, having the following package.json

{
  "name": "...",
  "version": "...",
  "private": true,
  "main": "server.js",
  "dependencies": {
    "URIjs": "^1.15.1",
    "async": "^1.0.0",
    "body-parser": "^1.12.4",
    "compression": "^1.4.4",
    "connect-flash": "^0.1.1",
    "cookie-parser": "^1.3.5",
    "debug": "^2.2.0",
    "elasticsearch": "^4.1.0",
    "express": "^4.12.4",
    "express-session": "^1.11.2",
    "jade": "^1.10.0",
    "moment": "^2.10.3",
    "morgan": "^1.5.3",
    "request": "^2.55.0",
    "serve-favicon": "^2.2.1",
    "string-format": "^0.5.0",
    "underscore.string": "^3.0.3"
  },
  "bundleDependencies": [
    "URIjs",
    "async",
    "body-parser",
    "compression",
    "connect-flash",
    "cookie-parser",
    "debug",
    "elasticsearch",
    "express",
    "express-session",
    "jade",
    "moment",
    "morgan",
    "request",
    "serve-favicon",
    "string-format",
    "underscore.string"
  ],
  "devDependencies": {
    "bower": "^1.4.1",
    "pm2": "^0.12.15"
  }
}

I'm trying to pack my app such a way that dependency tree is bundled inside the package AND is flattened the same time. So I do:

$ npm install
$ npm dedupe
$ npm shrinkwrap

After that I got in my working directory's node_modules:

$ ls

URIjs
accepts
async
bluebird
body-parser
chalk
compression
connect-flash
content-type
cookie-parser
cookie-signature
crc
debug
depd
elasticsearch
etag
express
express-session
forever-agent
fresh
jade
mime-db
mime-types
moment
morgan
ms
on-finished
on-headers
parseurl
qs
request
serve-favicon
string-format
type-is
underscore.string
utils-merge
vary

But, if I pack my application into a npm package, then inside there's the following package's node_modules

$ npm pack
...
$ ls

URIjs
async
body-parser
compression
connect-flash
cookie-parser
debug
elasticsearch
express
express-session
jade
moment
morgan
request
serve-favicon
string-format
underscore.string

Like it was before npm dedupe.

$ node -v
v0.12.4

$ npm -v
2.11.0

[othiym23]

With npm@2, you'll need to ensure that all of the modules that are hoisted by dedupe are included in bundledDependencies, because the bundling mechanism is semi-detached from the bits of the installer and deduper that create the flattened tree. Because npm@3 (what is currently the multi-stage branch) installs flatter trees by default, it should handle this case better, and will include the hoisted modules by default.

[banderror]

Thank you, workaround solves the problem.