#3630 extension push (package.json mode): audit dependencies resolved through package.json, and leave the author's node_modules/ unchanged (merges #3632)

Merged 2026-10-22 (Seth): this issue now also covers swamp-club#3632, which is closed as a duplicate. Both are package.json-mode problems in the same code (resolve_extension_files.ts, bundle.ts and the dependency extractor), and #3612 has shipped, so the resolver they build on is settled.

1. Bare imports resolved through package.json are never audited (original #3630)

When an extension has no deno.json but has a package.json (package.json mode), push bundles bare imports resolved through the package.json dependencies. The dependency trust audit (src/domain/extensions/extension_dependency_extractor.ts) only audits npm: and jsr: specifiers written in source and, since swamp-club#3611 and #3612, bare imports the project's Deno config resolves. A bare import resolved through package.json gets no OSV, deprecation, license or loose-specifier check. It prints "No npm/jsr dependencies to audit" and earns 2/2, even for a deprecated left-pad@1.3.0, as the #3682 docs capture found.

Expected: in package.json mode, the audit maps each bare import the source uses to its package.json dependency entry, checking dependencies and then devDependencies as the bundler resolves them. It audits that npm package at the version that ships, and honours the deno.lock beside package.json as it does today. If #3612 moved resolution to the deno info module graph, use the version that graph resolves.

The swamp-extensions corpus has no package.json-only extension today, so this affects third-party authors rather than the corpus. Found while planning swamp-club#3611.

2. Push and quality write node_modules/.deno/ into the author's project (was #3632)

In a package.json-mode extension, push and extension quality require node_modules/ to exist (requireNodeModules in src/cli/resolve_extension_files.ts). They then bundle with --node-modules-dir=auto and the working directory set to the package.json directory (denoProjectArgs in src/domain/models/bundle.ts). The deno info module graph reader uses the same flags. When npm installed node_modules/, deno adds its own node_modules/.deno/ tree to it, so push and quality write into the author's working tree.

Reproduced with deno 2.9.7: npm install of ms ^2.1.0 left 7 entries under node_modules/. One deno bundle --no-lock --node-modules-dir=auto added node_modules/.deno/, with 16 entries. Found while fixing swamp-club#3613, which makes push and quality treat the author's deno.lock as read-only; node_modules/ was out of that scope.

Expected: push, quality and fmt leave the author's tree unchanged. One option is to resolve from the existing node_modules/ without letting deno manage it (--node-modules-dir=manual), if that still resolves npm-installed trees.

Acceptance

• Unit tests for both parts.
• One UAT item that covers both:
  • A package.json-mode extension with a deprecated or vulnerable dependency gets dependency findings and loses the points.
  • After push, quality and fmt, the author's node_modules/ is byte-for-byte unchanged.
• Docs: collected for the single dependency-trust docs update, done after this issue and #3662.