template-kit/lockfile-missing

Your workspace must have a committed package-lock.json. Without one, your submission cannot be installed at all.

Rule

There must be a package-lock.json at the workspace root.

This is checked once per run, not once per template. A workspace has one package.json and one lockfile, however many templates and sections live inside it — so this violation is reported once and fixed once.

A yarn.lock or a pnpm-lock.yaml does not satisfy it. The install is npm ci, and npm ci reads package-lock.json.

Reason

The platform installs your submission with npm ci — the reproducible install, which takes the tree the lockfile pins and does not resolve anything itself. It requires a lockfile, and refuses to run without one.

That is the whole point of the requirement: the tree that is built, bundled, audited, and published is byte-for-byte the tree you tested against. No lockfile, no reproducible tree, no build — and “works on my machine” would otherwise be the only thing standing behind a page a customer is paying for.

Fix

Run npm install and commit the lockfile. If it is being ignored, stop ignoring it — that is the single most common cause of this violation, and the ignore rule is almost always inherited from a template .gitignore that was written for an application, not a package.

Before

.gitignore

node_modules/
dist/
package-lock.json      ← the lockfile never gets committed

npm ci on the checked-out submission: The 'npm ci' command can only install with an existing package-lock.json.

After

.gitignore

node_modules/
dist/

npm install            # regenerates package-lock.json from package.json
git add package-lock.json

See also

• lockfile-stale — the lockfile exists but no longer reproduces the tree package.json asks for.