{"record":{"id":"5190babb7626f010","repo":"microsoft/typescript-go","slug":"package-lock-json-entry-for-npmpackagename-ve","errorCode":null,"errorMessage":"package-lock.json entry for ${npmPackageName}@${version} does not contain a tarball URL.","messagePattern":"package-lock\\.json entry for (.+?)@(.+?) does not contain a tarball URL\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"Herebyfile.mjs","lineNumber":2280,"sourceCode":"    await fs.promises.mkdir(dest, { recursive: true });\r\n\r\n    const tarballDestination = path.join(builtPublishedPlatformPackages, \"tarballs\");\r\n    await fs.promises.mkdir(tarballDestination, { recursive: true });\r\n\r\n    const version = getPublishedTypeScriptPackageJson().optionalDependencies[npmPackageName];\r\n    if (!version || typeof version !== \"string\") {\r\n        throw new Error(`${publishedTypeScriptAliasPackageName} does not depend on ${npmPackageName}.`);\r\n    }\r\n\r\n    const lockEntry = getPackageLock().packages[`node_modules/${npmPackageName}`];\r\n    if (!lockEntry) {\r\n        throw new Error(`package-lock.json does not contain ${npmPackageName}; run npm install.`);\r\n    }\r\n    if (lockEntry.version !== version) {\r\n        throw new Error(`package-lock.json has ${npmPackageName}@${lockEntry.version}, but ${publishedTypeScriptAliasPackageName} depends on ${version}.`);\r\n    }\r\n    if (!lockEntry.resolved || typeof lockEntry.resolved !== \"string\") {\r\n        throw new Error(`package-lock.json entry for ${npmPackageName}@${version} does not contain a tarball URL.`);\r\n    }\r\n\r\n    console.log(`Fetching ${npmPackageName}@${version} with npm.`);\r\n    const { stdout } = await $pipe({ cwd: tarballDestination, env: releasePackageEnv })`npm pack --json ${npmPackageName}@${version}`;\r\n    const [packed] = JSON.parse(stdout);\r\n    if (!packed.filename || typeof packed.filename !== \"string\") {\r\n        throw new Error(`npm pack ${npmPackageName}@${version} did not return a filename.`);\r\n    }\r\n    await tar.x({ file: path.join(tarballDestination, packed.filename), cwd: dest, strip: 1 });\r\n\r\n    if (!fs.existsSync(lib)) {\r\n        throw new Error(`Published platform package ${npmPackageName}@${version} did not contain a lib directory.`);\r\n    }\r\n\r\n    return lib;\r\n}\r\n\r\nasync function runPackVsixExtensions() {\r","sourceCodeStart":2262,"sourceCodeEnd":2298,"githubUrl":"https://github.com/microsoft/typescript-go/blob/1bcfa18d79a3be41772223d5c05dfe4480e614ff/Herebyfile.mjs#L2262-L2298","documentation":"The third lockfile validation in getPublishedPlatformPackageLibDir: the `node_modules/<npmPackageName>` entry in package-lock.json must contain a string `resolved` URL. That URL is what identifies the tarball source for the fetch; entries without it (file: deps, some offline/local registry flows, hand-edited locks) cannot be fetched reproducibly, so the build refuses.","triggerScenarios":"package-lock.json was edited by hand or produced against an offline/local registry that omits `resolved` (or replaces it with a non-string), and a VSIX build with published platform packages then tries to fetch that platform tarball.","commonSituations":"Using an internal registry mirror or Verdaccio that strips resolved URLs; lockfile conflicts resolved by deleting fields; npm version differences in lock output.","solutions":["Regenerate the lockfile: delete the stale entry (or the lock) and `npm install` against the real registry so `resolved` is populated","Check .npmrc / registry config so the lock records real tarball URLs","Verify with `node -p \"require('./package-lock.json').packages['node_modules/<name>'].resolved\"` before retrying"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"const entry = require(\"./package-lock.json\").packages[`node_modules/${npmPackageName}`];\nif (!entry || typeof entry.resolved !== \"string\" || !entry.resolved.startsWith(\"http\")) {\n  throw new Error(`Lock entry for ${npmPackageName} has no tarball URL — regenerate the lock against a real registry`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never hand-edit package-lock.json fields away","Configure .npmrc against a registry that records resolved URLs, and regenerate the lock if mirrors change"],"tags":["npm","package-lock","registry","build"],"backgroundTag":null,"analyzedSha":"1bcfa18d79a3be41772223d5c05dfe4480e614ff","analyzedAt":"2026-08-16T02:12:00.115Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}