fix(npm): package file: versions not relative to the workspace root

e2e/pnpm_workspace_rerooted/.aspect/rules/external_repository_action_cache/npm_translate_lock_LTE1MzU4OTk=

@@ -10,8 +10,9 @@ lib/a/package.json=1162557353
 lib/b/package.json=1612905941
 lib/c/package.json=1015268365
 lib/d/package.json=476969669
-package.json=-716078204
-root/pnpm-lock.yaml=1120945581
+package.json=-1094473262
+root/pnpm-lock.yaml=294643168
 root/pnpm-workspace.yaml=1861018878
 vendored/a/package.json=-174142441
 vendored/b/package.json=536664170
+vendored/lodash-4.17.19.tgz=-869163378

e2e/pnpm_workspace_rerooted/BUILD.bazel

@@ -27,3 +27,10 @@ build_test(
         "//lib/d:node_modules/alias-2",
     ],
 )
+
+build_test(
+    name = "vendored",
+    targets = [
+        "//:node_modules/lodash",
+    ],
+)

e2e/pnpm_workspace_rerooted/MODULE.bazel

@@ -45,6 +45,7 @@ npm.npm_translate_lock(
         "//lib/c:package.json",
         "//lib/d:package.json",
         "//root:pnpm-workspace.yaml",
+        "//vendored:lodash-4.17.19.tgz",
         "//vendored/a:package.json",
         "//vendored/b:package.json",
     ],

e2e/pnpm_workspace_rerooted/WORKSPACE

@@ -34,6 +34,7 @@ npm_translate_lock(
         "//lib/c:package.json",
         "//lib/d:package.json",
         "//root:pnpm-workspace.yaml",
+        "//vendored:lodash-4.17.19.tgz",
         "//vendored/a:package.json",
         "//vendored/b:package.json",
     ],

e2e/pnpm_workspace_rerooted/app/a/BUILD.bazel

@@ -13,6 +13,7 @@ js_binary(
         ":node_modules/@aspect-test",
         ":node_modules/@lib",
         "//:node_modules/@aspect-test",
+        "//:node_modules/lodash",
     ],
     entry_point = "main.js",
 )
@@ -23,6 +24,7 @@ js_test(
     data = [
         ":node_modules",
         "//:node_modules/@aspect-test",
+        "//:node_modules/lodash",
     ],
     entry_point = "main.js",
     log_level = "info",

e2e/pnpm_workspace_rerooted/app/a/main.js

@@ -7,3 +7,4 @@ console.log('--@aspect-test/c--', require('@aspect-test/c').id())
 console.log('--@aspect-test/g--', require('@aspect-test/g').id())
 console.log('--@lib/a--', require('@lib/a').id())
 console.log('--@lib/a--', require('@lib/a').test())
+console.log('--lodash--', require('lodash'))

e2e/pnpm_workspace_rerooted/lib/a/BUILD.bazel

@@ -1,6 +1,7 @@
 # NOTE: keep in sync with e2e/pnpm_workspace(_rerooted)
 
 load("@aspect_rules_js//npm:defs.bzl", "npm_package")
+load("@bazel_skylib//rules:build_test.bzl", "build_test")
 load("@npm//:defs.bzl", "npm_link_all_packages")
 
 npm_link_all_packages(name = "node_modules")
@@ -14,3 +15,11 @@ npm_package(
     out = "pkg",
     visibility = ["//visibility:public"],
 )
+
+build_test(
+    name = "vendored",
+    targets = [
+        ":node_modules/vendored-a",
+        ":node_modules/vendored-b",
+    ],
+)

e2e/pnpm_workspace_rerooted/package.json

@@ -2,7 +2,8 @@
     "private": true,
     "dependencies": {
         "typescript": "4.9.5",
-        "@aspect-test/a": "5.0.2"
+        "@aspect-test/a": "5.0.2",
+        "lodash": "file:vendored/lodash-4.17.19.tgz"
     },
     "devDependencies": {
         "@aspect-test/b": "5.0.2"

e2e/pnpm_workspace_rerooted/vendored/BUILD.bazel

@@ -0,0 +1 @@
+exports_files(["lodash-4.17.19.tgz"])

npm/private/npm_translate_lock_helpers.bzl

@@ -427,7 +427,9 @@ ERROR: can not apply both `pnpm.patchedDependencies` and `npm_translate_lock(pat
                 else:
                     url = tarball
             elif tarball.startswith("file:"):
-                url = tarball
+                file_path = tarball[5:]
+                file_path = paths.normalize(paths.join(root_package, file_path))
+                url = "file:{}".format(file_path)
             else:
                 if not registry:
                     registry = utils.npm_registry_url(name, registries, default_registry)