fix(npm): package file: versions not relative to the workspace root

.prettierignore

@@ -1,6 +1,7 @@
 **/pnpm-lock.yaml
 docs/*_*.md
 e2e/**/*-docs.md
+e2e/pnpm_lockfiles/cases/*.yaml
 examples/**/*-docs.md
 js/private/coverage/coverage.js
 js/private/node-patches/fs.cjs

e2e/pnpm_lockfiles/MODULE.bazel

@@ -19,6 +19,7 @@ PNPM_LOCK_TEST_CASES = [
     "isaacs-cliui-v90.yaml",
     "docusaurus-direct-peer-v6.yaml",
     "docusaurus-direct-peer-v9.yaml",
+    "vendored-files-v6.yaml",
 ]
 
 bazel_dep(name = "aspect_bazel_lib", version = "2.7.7")
@@ -93,6 +94,10 @@ npm = use_extension(
 [
     npm.npm_translate_lock(
         name = lockfile.replace(".yaml", ""),
+        data = [
+            "//vendored:lodash-4.17.19.tgz",
+            "//vendored:lodash-4.17.21.tgz",
+        ],
         pnpm_lock = "//cases:%s" % lockfile,
         verify_node_modules_ignored = "//:.bazelignore",
     )

e2e/pnpm_lockfiles/WORKSPACE

@@ -18,6 +18,7 @@ PNPM_LOCK_TEST_CASES = [
     "isaacs-cliui-v90.yaml",
     "docusaurus-direct-peer-v6.yaml",
     "docusaurus-direct-peer-v9.yaml",
+    "vendored-files-v6.yaml",
 ]
 
 load("@aspect_rules_js//js:repositories.bzl", "rules_js_dependencies")
@@ -59,6 +60,10 @@ npm_repositories_v90()
 [
     npm_translate_lock(
         name = lockfile.replace(".yaml", ""),
+        data = [
+            "//vendored:lodash-4.17.19.tgz",
+            "//vendored:lodash-4.17.21.tgz",
+        ],
         pnpm_lock = "//cases:%s" % lockfile,
         verify_node_modules_ignored = "//:.bazelignore",
     )
@@ -70,6 +75,7 @@ load("@docusaurus-direct-peer-v9//:repositories.bzl", npm_repositories_direct_wi
 load("@isaacs-cliui-v90//:repositories.bzl", npm_repositories_isaacs_cliui_v90 = "npm_repositories")
 load("@override-with-alias-url-v9//:repositories.bzl", npm_repositories_override_with_alias_v90 = "npm_repositories")
 load("@tarball-no-url-v54//:repositories.bzl", npm_repositories_tarball_no_url_v54 = "npm_repositories")
+load("@vendored-files-v6//:repositories.bzl", npm_repositories_vendored_files_v6 = "npm_repositories")
 
 npm_repositories_tarball_no_url_v54()
 
@@ -80,3 +86,5 @@ npm_repositories_isaacs_cliui_v90()
 npm_repositories_direct_with_peers_v6()
 
 npm_repositories_direct_with_peers_v9()
+
+npm_repositories_vendored_files_v6()

e2e/pnpm_lockfiles/cases/BUILD.bazel

@@ -4,6 +4,7 @@ load("@docusaurus-direct-peer-v9//:defs.bzl", docusaurus_direct_with_peers_v9_li
 load("@isaacs-cliui-v90//:defs.bzl", isaacs_cliui_v90_link_all = "npm_link_all_packages")
 load("@override-with-alias-url-v9//:defs.bzl", override_with_alias_link_all = "npm_link_all_packages")
 load("@tarball-no-url-v54//:defs.bzl", tarball_no_url_link_all = "npm_link_all_packages")
+load("@vendored-files-v6//:defs.bzl", vendored_files_v6_link_all = "npm_link_all_packages")
 
 exports_files(glob(["*.yaml"]))
 
@@ -52,3 +53,16 @@ build_test(
         # ":docusaurus_direct_with_peers_v6-modules/@docusaurus/module-type-aliases",
     ],
 )
+
+vendored_files_v6_link_all(name = "vendored-files-v6-modules")
+
+build_test(
+    name = "vendored-files-v6",
+    targets = [
+        ":vendored-files-v6-modules",
+        ":vendored-files-v6-modules/lodash",
+        ":vendored-files-v6-modules/is-number",
+        ":.aspect_rules_js/vendored-files-v6-modules/lodash@4.17.19",
+        ":.aspect_rules_js/vendored-files-v6-modules/is-number@0.0.0",
+    ],
+)

e2e/pnpm_lockfiles/cases/vendored-files-v6.yaml

@@ -0,0 +1,31 @@
+lockfileVersion: '6.0'
+
+settings:
+  autoInstallPeers: true
+  excludeLinksFromLockfile: false
+
+onlyBuiltDependencies: []
+
+importers:
+
+  .:
+    dependencies:
+      is-number:
+        specifier: file:../vendored/is-number
+        version: file:../vendored/is-number
+      lodash:
+        specifier: file:../vendored/lodash-4.17.19.tgz
+        version: file:../vendored/lodash-4.17.19.tgz
+
+packages:
+
+  file:../vendored/is-number:
+    resolution: {directory: ../vendored/is-number, type: directory}
+    name: is-number
+    dev: false
+
+  file:../vendored/lodash-4.17.19.tgz:
+    resolution: {integrity: sha512-JNvd8XER9GQX0v2qJgsaN/mzFCNA5BRe/j8JN9d+tWyGLSodKQHKFicdwNYzWwI3wjRnaKPsGj1XkBjx/F96DQ==, tarball: file:../vendored/lodash-4.17.19.tgz}
+    name: lodash
+    version: 4.17.19
+    dev: false

e2e/pnpm_lockfiles/vendored/BUILD.bazel

@@ -0,0 +1,4 @@
+exports_files([
+    "lodash-4.17.19.tgz",
+    "lodash-4.17.21.tgz",
+])

npm/private/npm_translate_lock_helpers.bzl

@@ -431,7 +431,9 @@ ERROR: can not apply both `pnpm.patchedDependencies` and `npm_translate_lock(pat
                 else:
                     url = tarball
             elif tarball.startswith("file:"):
-                url = tarball
+                file_path = tarball[5:]
+                file_path = paths.normalize(paths.join(root_package, file_path))
+                url = "file:{}".format(file_path)
             else:
                 if not registry:
                     registry = utils.npm_registry_url(name, registries, default_registry)