microsoft/typescript-go · error · Error

package-lock.json entry for ${npmPackageName}@${version} doe

Error message

package-lock.json entry for ${npmPackageName}@${version} does not contain a tarball URL.

What it means

The third lockfile validation in getPublishedPlatformPackageLibDir: the `node_modules/<npmPackageName>` entry in package-lock.json must contain a string `resolved` URL. That URL is what identifies the tarball source for the fetch; entries without it (file: deps, some offline/local registry flows, hand-edited locks) cannot be fetched reproducibly, so the build refuses.

Source

Thrown at Herebyfile.mjs:2280

    await fs.promises.mkdir(dest, { recursive: true });

    const tarballDestination = path.join(builtPublishedPlatformPackages, "tarballs");
    await fs.promises.mkdir(tarballDestination, { recursive: true });

    const version = getPublishedTypeScriptPackageJson().optionalDependencies[npmPackageName];
    if (!version || typeof version !== "string") {
        throw new Error(`${publishedTypeScriptAliasPackageName} does not depend on ${npmPackageName}.`);
    }

    const lockEntry = getPackageLock().packages[`node_modules/${npmPackageName}`];
    if (!lockEntry) {
        throw new Error(`package-lock.json does not contain ${npmPackageName}; run npm install.`);
    }
    if (lockEntry.version !== version) {
        throw new Error(`package-lock.json has ${npmPackageName}@${lockEntry.version}, but ${publishedTypeScriptAliasPackageName} depends on ${version}.`);
    }
    if (!lockEntry.resolved || typeof lockEntry.resolved !== "string") {
        throw new Error(`package-lock.json entry for ${npmPackageName}@${version} does not contain a tarball URL.`);
    }

    console.log(`Fetching ${npmPackageName}@${version} with npm.`);
    const { stdout } = await $pipe({ cwd: tarballDestination, env: releasePackageEnv })`npm pack --json ${npmPackageName}@${version}`;
    const [packed] = JSON.parse(stdout);
    if (!packed.filename || typeof packed.filename !== "string") {
        throw new Error(`npm pack ${npmPackageName}@${version} did not return a filename.`);
    }
    await tar.x({ file: path.join(tarballDestination, packed.filename), cwd: dest, strip: 1 });

    if (!fs.existsSync(lib)) {
        throw new Error(`Published platform package ${npmPackageName}@${version} did not contain a lib directory.`);
    }

    return lib;
}

async function runPackVsixExtensions() {

View on GitHub (pinned to 1bcfa18d79)

Solutions

1. Regenerate the lockfile: delete the stale entry (or the lock) and `npm install` against the real registry so `resolved` is populated
2. Check .npmrc / registry config so the lock records real tarball URLs
3. Verify with `node -p "require('./package-lock.json').packages['node_modules/<name>'].resolved"` before retrying

const entry = require("./package-lock.json").packages[`node_modules/${npmPackageName}`];
if (!entry || typeof entry.resolved !== "string" || !entry.resolved.startsWith("http")) {
  throw new Error(`Lock entry for ${npmPackageName} has no tarball URL — regenerate the lock against a real registry`);
}

When it happens

Trigger: package-lock.json was edited by hand or produced against an offline/local registry that omits `resolved` (or replaces it with a non-string), and a VSIX build with published platform packages then tries to fetch that platform tarball.

Common situations: Using an internal registry mirror or Verdaccio that strips resolved URLs; lockfile conflicts resolved by deleting fields; npm version differences in lock output.

Related errors

• package-lock.json does not contain ${npmPackageName}; run np
• Found external imports in .d.ts files:\n${importErrors.map(e
• ${publishedTypeScriptAliasPackageName} should alias the type
• Could not find ${publishedTypeScriptAliasPackageName}; run n
• package-lock.json has ${npmPackageName}@${lockEntry.version}

AI-assisted analysis of microsoft/typescript-go@1bcfa18d79 (2026-08-16). Data as JSON: /api/errors/5190babb7626f010. Report an issue: GitHub.