Lockfile support for experimental npm specifiers

[sagea]

Bug:
Lock files aren't supported when using the new experimental npm modules feature.

Why post this?
The release notes below describe the list of specifiers that are supported and those that aren't. Deno cache is not in that list as of writing this ticket.
https://deno.com/blog/v1.25#experimental-npm-support

Repro Steps

1. Create a new folder

mkdir deno-npm-lock-repro

2. cd into folder

cd deno-npm-lock-repro

3. Create a new project

deno init

4. Create an express app in the main.ts file

import express from "npm:express";
const app = express();

app.get("/", function (req, res) {
  res.send("Hello World");
});

app.listen(3000);
console.log("listening on http://localhost:3000/");

5. Create a lock file using the deno cache command

deno cache --reload --lock=lock.json --lock-write --unstable main.ts

EXPECTED:
A file is created named lock.json with a list of modules.

ACTUAL:
A file is created named lock.json but it has an empty object.

[bartlomieju]

Yes, lock file integration with npm: specifiers is currently not supported. This is on the radar for @dsherret and me

[bartlomieju]

Ignore PR linked above, I assigned wrong issue number to close.

[bartlomieju]

Supporting npm packages in lock file requires us to introduce a new lock file format, because the current lockfile has only a top-level mapping between URLs and their checksums. In case of npm specifier, not only do we need to store the checksum, but the resolution result of imports (eg. import chalk from "npm:chalk" resolves to chalk@5.0.1 and import react from "npm:react@17" resolves to react@17.0.1`).

So to achieve this goal I propose following file format:

// This file is automatically generated by Deno, do not edit its contents
// manually.
// This file should be commited to your repository.
{
  "version": "2",
  "dependencies": {
    "remote": {
        "https://deno.land/std@0.160.0/http/server.ts": "asdwetsw44523asdfgfas..",
        "https://deno.land/std@0.160.0/http/file_server.ts": "asdwetsw44523asdfgfas..",
    },
    "npm": {
        "chalk@5.0.0": "sha256-asdf4356tsdfgww345",
        "react@17.0.1": "sha256-sadfwer334563456"
    }
  },
  "resolution": {
    "chalk": {
        "major": 5,
        "minor": 0,
        "patch": 0,
        "pre": [],
        "build": []
    },
    "react@17": {
        "major": 17,
        "minor": 0,
        "patch": 1,
        "pre": [],
        "build": []
    }
  }
}

The file would use jsonc format and I think we should default to deno.lock filename.

It allows us to change the format in the future, while preserving compatibility with previous version (or at least provide an easy upgrade path from one version to the next); store additional required info (if a need arises in the future).

If there's an agreement regarding the format I will open a PR that will first add new format to handle remote dependencies and follow up with support for npm. In addition we'll try to address #11971 in v1.27 release.