Yes, lock file integration with npm: specifiers is currently not supported. This is on the radar for @dsherret and me

Ignore PR linked above, I assigned wrong issue number to close.

Supporting npm packages in lock file requires us to introduce a new lock file format, because the current lockfile has only a top-level mapping between URLs and their checksums. In case of npm specifier, not only do we need to store the checksum, but the resolution result of imports (eg. import chalk from "npm:chalk" resolves to chalk@5.0.1 and import react from "npm:react@17" resolves to react@17.0.1`).

So to achieve this goal I propose following file format:

// This file is automatically generated by Deno, do not edit its contents
// manually.
// This file should be commited to your repository.
{
  "version": "2",
  "dependencies": {
    "remote": {
        "https://deno.land/std@0.160.0/http/server.ts": "asdwetsw44523asdfgfas..",
        "https://deno.land/std@0.160.0/http/file_server.ts": "asdwetsw44523asdfgfas..",
    },
    "npm": {
        "chalk@5.0.0": "sha256-asdf4356tsdfgww345",
        "react@17.0.1": "sha256-sadfwer334563456"
    }
  },
  "resolution": {
    "chalk": {
        "major": 5,
        "minor": 0,
        "patch": 0,
        "pre": [],
        "build": []
    },
    "react@17": {
        "major": 17,
        "minor": 0,
        "patch": 1,
        "pre": [],
        "build": []
    }
  }
}

The file would use jsonc format and I think we should default to deno.lock filename.

It allows us to change the format in the future, while preserving compatibility with previous version (or at least provide an easy upgrade path from one version to the next); store additional required info (if a need arises in the future).

If there's an agreement regarding the format I will open a PR that will first add new format to handle remote dependencies and follow up with support for npm. In addition we'll try to address #11971 in v1.27 release.