title: npm pack and missing package-lock.json
body: <p>from <a href="https://docs.npmjs.com/using-npm/developers.html#keeping-files-out-of-your-package" rel="nofollow noreferrer">npm documentation</a>:</p>
  
  <blockquote>
    <p>By default, the following paths and files are ignored, so there’s no
    need to add them to .npmignore explicitly:</p>
  
  <pre><code>.*.swp
  ._*
  .DS_Store
  .git
  .hg
  .npmrc
  .lock-wscript
  .svn
  .wafpickle-*
  config.gypi
  CVS
  npm-debug.log
  </code></pre>
    
    <p>Additionally, everything in node_modules is ignored, except for bundled dependencies. npm automatically handles this for you, so don’t bother adding node_modules to .npmignore.</p>
  </blockquote>
  
  <p>when <code>npm pack</code> is executed, <a href="https://docs.npmjs.com/configuring-npm/package-lock-json.html" rel="nofollow noreferrer"><code>package-lock.json</code></a> is not included in the archive.</p>
  
  <p>is it a bug or is it expected and undocumented behavior?</p>