fix: Handle package with multiple versions, nesting and order

Author: d3xter666

internal/shrinkwrap-extractor/lib/convertPackageLockToShrinkwrap.js

@@ -65,14 +65,17 @@ export default async function convertPackageLockToShrinkwrap(workspaceRootDir, t
 		if (pkg.link) {
 			pkg = packageLockJson.packages[pkg.resolved];
 		}
+
+		const originalLocation = packageLoc;
 		if (pkg.name === targetPackageName) {
 			// Make the target package the root package
 			packageLoc = "";
 			if (extractedPackages[packageLoc]) {
 				throw new Error(`Duplicate root package entry for "${targetPackageName}"`);
 			}
 		} else {
-			packageLoc = normalizePackageLocation(packageLoc, node, targetPackageName, tree.packageName);
+			packageLoc = normalizePackageLocation(packageLoc, node, targetPackageName, tree.packageName,
+				extractedPackages);
 		}
 		if (packageLoc !== "" && !pkg.resolved) {
 			// For all but the root package, ensure that "resolved" and "integrity" fields are present
@@ -82,14 +85,15 @@ export default async function convertPackageLockToShrinkwrap(workspaceRootDir, t
 			pkg.resolved = resolved;
 			pkg.integrity = integrity;
 		}
-		extractedPackages[packageLoc] = pkg;
+
+		extractedPackages[packageLoc] = {pkg, originalLocation};
 	}
 
 	// Sort packages by key to ensure consistent order (just like the npm cli does it)
 	const sortedExtractedPackages = Object.create(null);
 	const sortedKeys = Object.keys(extractedPackages).sort((a, b) => a.localeCompare(b));
 	for (const key of sortedKeys) {
-		sortedExtractedPackages[key] = extractedPackages[key];
+		sortedExtractedPackages[key] = extractedPackages[key].pkg;
 	}
 
 	// Generate npm-shrinkwrap.json
@@ -106,26 +110,57 @@ export default async function convertPackageLockToShrinkwrap(workspaceRootDir, t
 
 /**
  * Normalize package locations from workspace-specific paths to standard npm paths.
+ * Automatically detects and resolves version collisions by checking source locations.
+ *
  * Examples (assuming @ui5/cli is the targetPackageName):
- * 	- packages/cli/node_modules/foo -> node_modules/foo
+ * 	- packages/cli/node_modules/foo -> node_modules/foo (if no collision)
+ * 	- packages/cli/node_modules/foo -> node_modules/@ui5/cli/node_modules/foo (if root has different version)
  * 	- packages/fs/node_modules/bar -> node_modules/@ui5/fs/node_modules/bar
  *
  * @param {string} location - Package location from arborist
  * @param {object} node - Package node from arborist
  * @param {string} targetPackageName - Target package name for shrinkwrap file
  * @param {string} rootPackageName - Root / workspace package name
+ * @param {Object<string, {pkg: object, originalLocation: string}>} extractedPackages - Already extracted packages
  * @returns {string} - Normalized location for npm-shrinkwrap.json
  */
-function normalizePackageLocation(location, node, targetPackageName, rootPackageName) {
+function normalizePackageLocation(
+	location, node, targetPackageName, rootPackageName, extractedPackages
+) {
 	const topPackageName = node.top.packageName;
+	const currentIsFromRoot = !location.startsWith("packages/");
+
 	if (topPackageName === targetPackageName) {
-		// Remove location for packages within target package (e.g. @ui5/cli)
-		return location.substring(node.top.location.length + 1);
+		// Package is within target package (e.g. @ui5/cli)
+		const normalizedPath = location.substring(node.top.location.length + 1);
+		const existing = extractedPackages[normalizedPath];
+
+		if (existing && existing.pkg.version !== node.version) {
+			// Collision detected: Check which should be at root level
+			const existingIsFromRoot = !existing.originalLocation.startsWith("packages/");
+
+			// Root packages always get priority at top level
+			if (existingIsFromRoot && !currentIsFromRoot) {
+				// Existing is from root, current is from workspace -> nest current
+				return `node_modules/${topPackageName}/${normalizedPath}`;
+			} else if (!existingIsFromRoot && currentIsFromRoot) {
+				// Current is from root, existing is from workspace -> shouldn't happen
+				// due to processing order, but handle gracefully
+				const msg = `Unexpected collision: root package processed after workspace ` +
+					`package at ${normalizedPath}`;
+				throw new Error(msg);
+			}
+			// Both from same type of location with different versions -> nest current
+			return `node_modules/${topPackageName}/${normalizedPath}`;
+		}
+
+		return normalizedPath;
 	} else if (topPackageName !== rootPackageName) {
 		// Add package within node_modules of actual package name (e.g. @ui5/fs)
 		return `node_modules/${topPackageName}/${location.substring(node.top.location.length + 1)}`;
 	}
-	// If it's already within the root workspace package, keep as-is
+
+	// Package is within root workspace, keep as-is
 	return location;
 }
 

internal/shrinkwrap-extractor/test/expected/package.b/npm-shrinkwrap.json

@@ -86,37 +86,51 @@ test("Convert package-lock.json to shrinkwrap", async (t) => {
 
 test("Workspace paths should be normalized to node_modules format", async (t) => {
 	const __dirname = import.meta.dirname;
-
 	const cwd = path.join(__dirname, "..", "fixture", "project.a");
 	const symlinkPath = await setupFixtureSymlink(cwd);
 	t.after(async () => await unlink(symlinkPath).catch(() => {}));
 
-	const targetPackageName = "@ui5/cli";
-	const shrinkwrapJson = await convertPackageLockToShrinkwrap(cwd, targetPackageName);
-
-	// Verify that no package paths contain workspace prefixes like "packages/cli/node_modules/..."
-	const packagePaths = Object.keys(shrinkwrapJson.packages);
+	const shrinkwrapJson = await convertPackageLockToShrinkwrap(cwd, "@ui5/cli");
+	const packagePaths = Object.keys(shrinkwrapJson.packages).filter((p) => p !== "");
 
+	// All paths must start with node_modules/, never with packages/
 	for (const packagePath of packagePaths) {
-		// Skip root package (empty string)
-		if (packagePath === "") continue;
-
-		// Assert that no path starts with "packages/"
 		assert.ok(!packagePath.startsWith("packages/"),
-			`Package path "${packagePath}" should not start with "packages/" prefix`);
-
-		// Assert that non-root paths start with "node_modules/"
+			`Path "${packagePath}" should not contain workspace prefix`);
 		assert.ok(packagePath.startsWith("node_modules/"),
-			`Package path "${packagePath}" should start with "node_modules/" prefix`);
+			`Path "${packagePath}" should start with node_modules/`);
 	}
 
-	// Specifically check a package that would have been under packages/cli/node_modules in the monorepo
-	// The "@npmcli/config" package is a direct dependency that exists in the CLI's node_modules
-	const npmCliConfigPackage = shrinkwrapJson.packages["node_modules/@npmcli/config"];
-	assert.ok(npmCliConfigPackage, "The '@npmcli/config' package should be present at normalized path");
-	assert.equal(npmCliConfigPackage.version, "9.0.0", "@npmcli/config package should have correct version");
+	// Verify a CLI dependency was normalized correctly
+	const npmCliConfig = shrinkwrapJson.packages["node_modules/@npmcli/config"];
+	assert.ok(npmCliConfig, "@npmcli/config should be at normalized path");
+	assert.equal(npmCliConfig.version, "9.0.0");
+
+	console.log(`✓ All ${packagePaths.length} package paths correctly normalized`);
+});
+
+test("Version collisions: root packages get priority at top level", async (t) => {
+	const __dirname = import.meta.dirname;
+	const cwd = path.join(__dirname, "..", "fixture", "project.b");
+	const symlinkPath = await setupFixtureSymlink(cwd);
+	t.after(async () => await unlink(symlinkPath).catch(() => {}));
+
+	const shrinkwrapJson = await convertPackageLockToShrinkwrap(cwd, "@ui5/cli");
+
+	// ansi-regex: root has v6.2.2, CLI workspace has v5.0.1
+	// Root version should be at top level, workspace version nested
+	const rootAnsiRegex = shrinkwrapJson.packages["node_modules/ansi-regex"];
+	assert.equal(rootAnsiRegex?.version, "6.2.2", "Root ansi-regex at top level");
+
+	const cliAnsiRegex = shrinkwrapJson.packages["node_modules/@ui5/cli/node_modules/ansi-regex"];
+	assert.equal(cliAnsiRegex?.version, "5.0.1", "Workspace ansi-regex nested under @ui5/cli");
+
+	// Verify root version satisfies dependents
+	const stripAnsi = shrinkwrapJson.packages["node_modules/strip-ansi"];
+	assert.equal(stripAnsi.dependencies["ansi-regex"], "^6.0.1");
+	assert.ok(rootAnsiRegex.version.startsWith("6."), "Root v6.2.2 satisfies ^6.0.1");
 
-	console.log(`✓ All ${packagePaths.length - 1} package paths correctly normalized`);
+	console.log("✓ Root package prioritized at top level, workspace version nested");
 });
 
 test("Compare generated shrinkwrap with expected result: package.a", async (t) => {