hit it hit it hit it get it get it get it
TL;DR
standalone "install" and "update". you can force versions by removing the ^ prefix on the project.json. keep in mind the package.lock isn't ready yet, so updating resources may cause duplicated resource binaries, which will be fixed this week.