Tarball support missing about synp

[DeTeam]

npm i seem to put actual URL into the "version" field in the lockfile, whilst synp uses version directly from npmtree. Not sure what'd be the best way to solve it.

UPD: the same applies to requires part, npm i would use a tarball url as a version, not the actual version which is fetched.

[DeTeam]

https://npm.community/t/npm-audit-returns-400-from-registry-when-non-registry-packages-satisfy-specs-that-exist-in-the-registry/462 — can be somewhat related 🤷‍♂️

[imsnif]

Hey @DeTeam - thanks very much for the detailed report and reproduction!
I'm sorry it took me a short while to get to it.

Looks like you're right - I'm actually not sure if this was a change in npm or if this was wrong all along. It's something that is fixed by npm install without changing the version, but is definitely not a good experience.

I think the solution is to change this function in order to accommodate the situation (reach the same result as when npm creates the file): https://github.com/imsnif/synp/blob/master/lib/entry.js#L9-L19

Do you feel like making a PR for this?

[DeTeam]

On it with #28