So I've overseen a GSoC project in Guix that tried to do the same thing, and at this point I and most of the Guix team are convinced that it just can't be done. The package structures just go far, far too deep, and are very frequently circular; the kinds of problems you have with bootstrapping a compiler to be reasonably reproducible apply here just as badly, but for everyday packages, since packages often depend on prior versions of themselves to build and the package authors are frequently not even aware of this.

Sadly, I think npm broke the hope of a free web using its system, and most of javascript uses it. I spent a long time hoping we could integrate it, and many I know have spent plenty of effort, but I'm afraid that npm, in its current design, is incompatible with a safely reproducible system.

Sadly that screws over most free software web applications. At this point our best bet, I think, is to put our hopes on languages which aren't Javascript but compile to either Javascript or the browser, and in the meanwhile to write vanilla javascript that doesn't have these constraints.

I don't like that this is my conclusion. It's holding back some of my own work.