fix: Normalize workspace paths in npm-shrinkwrap.json (#1231)

The published `@ui5/cli` package contained an `npm-shrinkwrap.json` with
monorepo workspace paths like:
```json
{
  "packages": {
    "packages/cli/node_modules/open": {...},
    "packages/fs/node_modules/globby": {...}
  }
}
```

Enahnce the shrinkwrap-extractor to normalize workspace-specific paths
to standard npm format:
- `packages/cli/node_modules/open` → `node_modules/open`
- `packages/fs/node_modules/globby` → `node_modules/globby`

Fixes #1227

---------

Co-authored-by: Matthias Osswald <[email protected]>

Author: d3xter666

internal/shrinkwrap-extractor/lib/convertPackageLockToShrinkwrap.js

@@ -48,7 +48,8 @@ export default async function convertPackageLockToShrinkwrap(workspaceRootDir, t
 		path: workspaceRootDir,
 	});
 	const tree = await arb.loadVirtual();
-	const cliNode = Array.from(tree.tops).find((node) => node.packageName === targetPackageName);
+	const tops = Array.from(tree.tops.values());
+	const cliNode = tops.find((node) => node.packageName === targetPackageName);
 	if (!cliNode) {
 		throw new Error(`Target package "${targetPackageName}" not found in workspace`);
 	}
@@ -70,7 +71,10 @@ export default async function convertPackageLockToShrinkwrap(workspaceRootDir, t
 			if (extractedPackages[packageLoc]) {
 				throw new Error(`Duplicate root package entry for "${targetPackageName}"`);
 			}
-		} else if (!pkg.resolved) {
+		} else {
+			packageLoc = normalizePackageLocation(packageLoc, node, targetPackageName, tree.packageName);
+		}
+		if (packageLoc !== "" && !pkg.resolved) {
 			// For all but the root package, ensure that "resolved" and "integrity" fields are present
 			// These are always missing for locally linked packages, but sometimes also for others (e.g. if installed
 			// from local cache)
@@ -100,6 +104,31 @@ export default async function convertPackageLockToShrinkwrap(workspaceRootDir, t
 	return shrinkwrap;
 }
 
+/**
+ * Normalize package locations from workspace-specific paths to standard npm paths.
+ * Examples (assuming @ui5/cli is the targetPackageName):
+ * 	- packages/cli/node_modules/foo -> node_modules/foo
+ * 	- packages/fs/node_modules/bar -> node_modules/@ui5/fs/node_modules/bar
+ *
+ * @param {string} location - Package location from arborist
+ * @param {object} node - Package node from arborist
+ * @param {string} targetPackageName - Target package name for shrinkwrap file
+ * @param {string} rootPackageName - Root / workspace package name
+ * @returns {string} - Normalized location for npm-shrinkwrap.json
+ */
+function normalizePackageLocation(location, node, targetPackageName, rootPackageName) {
+	const topPackageName = node.top.packageName;
+	if (topPackageName === targetPackageName) {
+		// Remove location for packages within target package (e.g. @ui5/cli)
+		return location.substring(node.top.location.length + 1);
+	} else if (topPackageName !== rootPackageName) {
+		// Add package within node_modules of actual package name (e.g. @ui5/fs)
+		return `node_modules/${topPackageName}/${location.substring(node.top.location.length + 1)}`;
+	}
+	// If it's already within the root workspace package, keep as-is
+	return location;
+}
+
 function collectDependencies(node, relevantPackageLocations) {
 	if (relevantPackageLocations.has(node.location)) {
 		// Already processed