lockfile-missing

Venue: check — The workspace has no package-lock.json.

Rule

There must be a package-lock.json at the workspace root.

This is checked once per run, not once per template. A workspace has one package.json and one lockfile, however many templates and sections live inside it — so it is reported once and fixed once.

A yarn.lock or a pnpm-lock.yaml does not satisfy it. The install is npm ci, and npm ci reads package-lock.json.

This one is reported as not measured, not as a violation. Every other dependency gate — lockfile-stale, single-react, audit-severity — reads the tree npm ci builds from the lockfile, so without one there is nothing for any of them to grade. check says so and leaves the exit code alone:

⚠ workspace — 3 gate(s) not measured
    [template-kit/lockfile-missing] no package-lock.json at the workspace root, so there is no npm-resolved tree to grade.
    not measured: lockfile-stale, single-react, audit-severity

Read that as a hole in your coverage, not as a pass. Nothing about your dependencies has been cleared — and template-kit pack refuses to build a submission with no lockfile, so this is a problem you fix now or at the pack step.

Reason

The platform installs your submission with npm ci — the reproducible install, which takes the tree the lockfile pins and does not resolve anything itself. It requires a lockfile, and refuses to run without one.

That is the whole point of the requirement: the tree that is built, bundled, audited, and published is byte-for-byte the tree you tested against. No lockfile, no reproducible tree, no build — and “works on my machine” would otherwise be the only thing standing behind a page a customer is paying for.

Fix

Run npm install and commit the lockfile. If it is being ignored, stop ignoring it — that is the single most common cause, and the ignore rule is almost always inherited from a template .gitignore that was written for an application, not a package.

Before

.gitignore

node_modules/
dist/
package-lock.json      ← the lockfile never gets committed

npm ci on the checked-out submission: The 'npm ci' command can only install with an existing package-lock.json.

After

.gitignore

node_modules/
dist/

npm install            # regenerates package-lock.json from package.json
git add package-lock.json

See also

• lockfile-stale — the lockfile exists but no longer reproduces the tree package.json asks for.