{"record":{"id":"50bf739e237b8a61","repo":"nodejs/node","slug":"providerentity-must-be-specified-with-entityk","errorCode":null,"errorMessage":"${providerEntity} must be specified with ${entityKey} option or inferred from the package.json repository field","messagePattern":"(.+?) must be specified with (.+?) option or inferred from the package\\.json repository field","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"deps/npm/lib/trust-cmd.js","lineNumber":299,"sourceCode":"    }\n\n    this.validateFile?.(flags.file)\n\n    if (invalidPkgJsonProviderType) {\n      const message = this.warnString`Repository in package.json is not a ${providerEntity}`\n      if (!flags[entityKey]) {\n        throw new Error(message)\n      } else {\n        warnings.push(message)\n      }\n    } else {\n      if (mismatchPkgJsonRepository) {\n        warnings.push(this.warnString`Repository in package.json (${git.repository}) differs from provided ${providerEntity} (${entity})`)\n      }\n    }\n\n    if (!entity && matchPkg) {\n      throw new Error(`${providerEntity} must be specified with ${entityKey} option or inferred from the package.json repository field`)\n    }\n    if (!entity) {\n      throw new Error(`${providerEntity} must be specified with ${entityKey} option`)\n    }\n\n    this.validateEntity(entity)\n\n    return {\n      values: {\n        package: pkgName,\n        file: flags.file,\n        [entityKey]: entity,\n        ...(flags.environment && { environment: flags.environment }),\n      },\n      fromPackageJson: {\n        [entityKey]: usedRepositoryInPkgJson,\n        package: usedPkgNameFromPkgJson,\n      },","sourceCodeStart":281,"sourceCodeEnd":317,"githubUrl":"https://github.com/nodejs/node/blob/1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e/deps/npm/lib/trust-cmd.js#L281-L317","documentation":"Thrown by TrustCommand.flagsToOptions when no entity was resolved (no flag and no usable package.json repository) AND the positional matches the package.json name (or was omitted), i.e. matchPkg is true. The message tells the user the entity must come from the entityKey flag (e.g. --project) or be inferred from the package.json repository field. This is the 'package.json is the source of truth but has no repository info' branch.","triggerScenarios":"Running `npm trust gitlab --file .gitlab-ci.yml --allow-publish` with a package.json that has a name but no `repository` field (or one hosted-git-info cannot parse), and no `--project`. matchPkg true means this branch fires; if a positional that doesn't match were given, error 77 would fire instead.","commonSituations":"Fresh package without repository metadata; repository field is a bare string that hosted-git-info doesn't recognize; you meant to pass --project but forgot.","solutions":["Pass the entity flag for the provider: `--project group/proj` (gitlab) or `--repo owner/repo` (github).","Add a parseable `repository` field to package.json (URL or `gitlab:group/proj` shorthand) so it can be inferred.","Verify hosted-git-info can parse your repository string; prefer a full HTTPS URL."],"exampleFix":"// before\n// package.json: { \"name\": \"pkg\" }  (no repository)\nnpm trust gitlab --file .gitlab-ci.yml --allow-publish\n// after\nnpm trust gitlab --file .gitlab-ci.yml --project group/proj --allow-publish","handlingStrategy":"validation","validationCode":"const git = gitinfo.fromUrl(pkg.repository?.url || pkg.repository)\nif (!entity && matchPkg) {\n  throw new Error(`No ${providerEntity} resolvable; pass --${entityKey} or set package.json#repository`)\n}","typeGuard":"const hasResolvableEntity = (entity, flags, entityKey) =>\n  Boolean(entity) || Boolean(flags && flags[entityKey])","tryCatchPattern":"try {\n  await createConfigCommand(...)\n} catch (err) {\n  if (/inferred from the package.json repository field/i.test(err.message)) {\n    // set package.json#repository to a parseable URL or pass --project, then retry\n  } else { throw err }\n}","preventionTips":["Set a parseable `repository` field in package.json for inference.","Provide the explicit entity flag to avoid relying on inference.","Use HTTPS repository URLs; avoid bare strings hosted-git-info cannot classify."],"tags":["validation","trust","cli-args","package-json","repository"],"backgroundTag":null,"analyzedSha":"1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e","analyzedAt":"2026-08-13T00:53:24.642Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}