Summary

Eliminate package.json + package-lock.json from panll. All build orchestration now flows through deno.json tasks using npm: specifiers cached by deno install.

This supersedes the band-aid in panll#62 (workflow switched npm ci -> npm install --no-audit --no-fund to work around lockfile drift). With package.json removed, the drift class disappears entirely. Lockfile-drift root cause traced to session_2026_05_30_snifs_build_mode_arc.

Implements one step of the estate npm->Deno umbrella (hyperpolymath/standards#253).

Changes

• deno.json: add nodeModulesDir: "auto"; tailwindcss + rescript + @rescript/core + @rescript/runtime promoted to deno imports; tasks invoke them via deno run -A --allow-scripts=npm:<pkg> npm:<pkg>@VER. Pinned-version trailing-slash forms npm:/pkg@VER/ keep the .res.js subpath imports URL-resolvable.
• .github/workflows/build-validation.yml: drop actions/setup-node; npm ci + npm run res:build replaced with deno install + deno task res:build; drop stale src-tauri/ manifest-paths (Gossamer migration completed previously — src-tauri/ does not exist on main); rust gate now cargo check + cargo test --lib at workspace root. Linux deps step renamed Tauri -> Gossamer.
• .github/workflows/e2e.yml: replace npx rescript build with deno task res:build across all 3 jobs.
• Delete package.json + package-lock.json (no .npmrc was present).
• deno.lock auto-tidies: packageJson block removed; workspace.dependencies absorbs the four formerly-package.json deps.

Tailwind decision (transitional)

Kept tailwindcss via npm:tailwindcss@^3.4.19 specifier as the transitional choice. No fully deno-native drop-in is worth the semantic swap right now (windicss/unocss diverge from existing class semantics). Recommend filing a follow-up issue under standards#253 for a future tailwind -> deno-native swap.

Test plan

Verified locally on this branch (Linux x86_64, deno 2.7.14):

• deno install — OK (77 npm packages resolved)
• deno task res:build — OK (.res.js outputs produced, warnings only)
• deno task bundle — OK (public/app.bundle.js 5.6 MB)
• deno task css:build — OK (public/styles.css 81 KB)
• deno task test — 2545 passed / 21 failed — IDENTICAL to main (the 21 failures are pre-existing and unrelated; confirmed by running the same suite on main and getting the same counts)
• cargo check --lib — OK
• deno cache scripts/bundle.ts — OK

just dev (Gossamer GTK window) not runnable in this sandbox — CI build-validation job covers the rust gate after this PR.

Refs

• [campaign] npm → Deno estate migration (UMBRELLA) standards#253 (estate npm->Deno umbrella)
• fix(ci): replace npm ci with npm install — lockfile drift unblocks validate #62 (band-aid: npm install --no-audit --no-fund — superseded; flag for owner to confirm removal of any open follow-up referencing it)
• session_2026_05_30_snifs_build_mode_arc (lockfile drift origin)

Adjacent gaps noticed (not fixed here)

While in the repo, the meander surfaced:

• scripts/bundle.ts line 19: stale // Tauri JS APIs ... comment (Gossamer migrated). Source comment only; not load-bearing — owner may want to clean in a separate doc-sweep PR.
• README.adoc, src/model/README.md, docs/guides/llm-warmup-user.md, AGENTS.md, GEMINI.md, .junie/guidelines.md, CONTRIBUTING.md, CHANGELOG.md, TOPOLOGY.md: contain npx rescript build / "npm only for ReScript" / "Tauri" references that will be stale post-merge. Suggest a docs-sweep follow-up PR.
• docs/archive/NPM-TO-DENO-MIGRATION.md: archived migration plan now satisfied — can be marked CLOSED.
• Justfile, contractile.just: no direct npm/npx calls — clean.
• tests/cross_panel_integration_test.js:242 references "package.json" as a string (likely a path probe / topology check). May need a small follow-up if the test relies on the file's existence.

Robot generated with Claude Code