Reported by @anurse :
Given a project that doesn't have any dependency, user should be able to run it without kpm restore. So the project may not have lockfile. In this case, kpm bundle --no-source should generate lockfile in the output.