[ENHANCEMENT] Warn on unmatched globs

[danpere]

Is there an existing issue for this?

• [X] I have searched the existing issues

This issue exists in the latest npm version

• [X] I am using the latest npm

Current Behavior

If the file list in package.json includes a filename/glob that does not match any files, npm pack silently ignores it, even if I provide the --ddd option for maximum verbosity.

Expected Behavior

I expected some indication that npm was unable to include the file I requested in the package, preferably with a way to make that be treated as an error (i.e. make npm pack return a non-zero error code and not actually generate a .tgz file).

Steps To Reproduce

1. touch typoable_filename so the file exists.
2. Create package.json:

{
    "name": "test",
    "version": "1.0.0",
    "files": [
		"typeable_filename"
    ]
}

(Note typeable_filename not typoable_filename.) 3. Run npm pack --ddd. 4. See no mention of typeable_filename not being found.

Environment

• npm: 10.2.5
• Node.js: 20.10.0
• OS Name: Windows 11 Enterprise Version 10.0.22631 Build 22631
• System Model Name: Surface Book 2
• npm config:

; "builtin" config from C:\Users\danpere\AppData\Roaming\npm\node_modules\npm\npmrc

prefix = "C:\\Users\\danpere\\AppData\\Roaming\\npm"

; "user" config from C:\Users\danpere\.npmrc

; "project" config from C:\prose\.npmrc

always-auth = true
registry = "[omitted URL]"

; node bin location = C:\Program Files\nodejs\node.exe
; node version = v20.10.0
; npm local prefix = C:\prose
; npm version = 10.2.5
; cwd = C:\prose
; HOME = C:\Users\danpere
; Run `npm config ls -l` to show all defaults.

[kellyselden]

This just came up for me. CI was misconfigured, and the packages weren't getting built first before publish, and dist in the files array wasn't matching anything. An error would have been nice compared to debugging after the fact.

[DarioSoller]

Stumbled over the same. Because of that I now have a published NPM package version of my library, which does not have all the necessary files in it, because the CI/CD pipeline went through and published the incomplete package.

I am willing to contribute with a PR, if someone points me to the right place in the code base? First guess is, that it might be somewhere here: https://github.com/npm/cli/blob/06510a8720fa180e9ef9093d9caee2e85bbc5165/workspaces/libnpmpack/lib/index.js