fix: resolve vendor dependencies using node module resolution (#691)

Author: rexxars

packages/@sanity/cli/src/actions/build/buildVendorDependencies.ts

@@ -1,9 +1,9 @@
-import path, {resolve} from 'node:path'
+import path from 'node:path'
 
 import semver from 'semver'
 import {build} from 'vite'
 
-import {getLocalPackageVersion} from '../../util/getLocalPackageVersion.js'
+import {getLocalPackageDir, getLocalPackageVersion} from '../../util/getLocalPackageVersion.js'
 import {createExternalFromImportMap} from './createExternalFromImportMap.js'
 
 // Directory where vendor packages will be stored
@@ -152,6 +152,10 @@ export async function buildVendorDependencies({
 
     const subpaths = ranges[matchedRange]
 
+    // Resolve the actual package directory using Node module resolution,
+    // so that hoisted packages in monorepos/workspaces are found correctly
+    const packageDir = getLocalPackageDir(packageName, cwd)
+
     // Iterate over each subpath and its corresponding entry point
     for (const [subpath, relativeEntryPoint] of Object.entries(subpaths)) {
       const specifier = path.posix.join(packageName, subpath)
@@ -160,7 +164,7 @@ export async function buildVendorDependencies({
         path.relative(packageName, specifier) || 'index',
       )
 
-      entry[chunkName] = resolve(`node_modules/${packageName}/${relativeEntryPoint}`)
+      entry[chunkName] = path.join(packageDir, relativeEntryPoint)
       imports[specifier] = path.posix.join('/', basePath, VENDOR_DIR, `${chunkName}.mjs`)
     }
   }

packages/@sanity/cli/src/actions/schema/getExtractOptions.ts

@@ -31,11 +31,8 @@ export function getExtractOptions({
     const resolved = resolve(join(projectRoot.directory, pathFlag))
     const isExistingDirectory = existsSync(resolved) && statSync(resolved).isDirectory()
 
-    if (isExistingDirectory || !extname(resolved)) {
-      outputPath = join(resolved, 'schema.json')
-    } else {
-      outputPath = resolved
-    }
+    outputPath =
+      isExistingDirectory || !extname(resolved) ? join(resolved, 'schema.json') : resolved
   } else {
     outputPath = resolve(join(projectRoot.directory, 'schema.json'))
   }

packages/@sanity/cli/src/util/__tests__/getLocalPackageVersion.test.ts

@@ -5,7 +5,7 @@ import {type PackageJson} from '@sanity/cli-core'
 import {moduleResolve} from 'import-meta-resolve'
 import {afterEach, describe, expect, test, vi} from 'vitest'
 
-import {getLocalPackageVersion} from '../getLocalPackageVersion.js'
+import {getLocalPackageDir, getLocalPackageVersion} from '../getLocalPackageVersion.js'
 
 const mockReadPackageJson = vi.hoisted(() => vi.fn())
 
@@ -39,6 +39,7 @@ describe('getLocalPackageVersion', () => {
     const mockPackageUrl = pathToFileURL(
       resolve(mockWorkDir, 'node_modules', mockModuleId, 'package.json'),
     )
+    const expectedPackageDir = resolve(mockWorkDir, 'node_modules', mockModuleId)
     const mockVersion = '1.0.0'
 
     mockedModuleResolve.mockReturnValueOnce(mockPackageUrl)
@@ -53,31 +54,30 @@ describe('getLocalPackageVersion', () => {
       `${mockModuleId}/package.json`,
       pathToFileURL(resolve(mockWorkDir, 'noop.js')),
     )
-    expect(mockReadPackageJson).toHaveBeenCalledWith(mockPackageUrl)
+    expect(mockReadPackageJson).toHaveBeenCalledWith(join(expectedPackageDir, 'package.json'))
     expect(result).toBe(mockVersion)
   })
 
   test('returns null when readPackageJson throws', async () => {
     const mockPackageUrl = pathToFileURL(
       resolve(mockWorkDir, 'node_modules', mockModuleId, 'package.json'),
     )
+    const expectedPackageDir = resolve(mockWorkDir, 'node_modules', mockModuleId)
 
     mockedModuleResolve.mockReturnValueOnce(mockPackageUrl)
     mockReadPackageJson.mockRejectedValueOnce(new Error('Failed to read package.json'))
 
     const result = await getLocalPackageVersion(mockModuleId, mockWorkDir)
 
     expect(mockedModuleResolve).toHaveBeenCalledOnce()
-    expect(mockReadPackageJson).toHaveBeenCalledWith(mockPackageUrl)
+    expect(mockReadPackageJson).toHaveBeenCalledWith(join(expectedPackageDir, 'package.json'))
     expect(result).toBeNull()
   })
 
   test('returns version via fallback when package has strict exports', async () => {
     const mainEntryPath = resolve(mockWorkDir, 'node_modules', mockModuleId, 'dist', 'index.js')
     const mainEntryUrl = pathToFileURL(mainEntryPath)
-    const expectedPackageJsonUrl = pathToFileURL(
-      join(resolve(mockWorkDir, 'node_modules', mockModuleId), 'package.json'),
-    )
+    const expectedPackageDir = resolve(mockWorkDir, 'node_modules', mockModuleId)
     const mockVersion = '2.0.0'
     const dirUrl = pathToFileURL(resolve(mockWorkDir, 'noop.js'))
 
@@ -97,7 +97,7 @@ describe('getLocalPackageVersion', () => {
     expect(mockedModuleResolve).toHaveBeenCalledTimes(2)
     expect(mockedModuleResolve).toHaveBeenNthCalledWith(1, `${mockModuleId}/package.json`, dirUrl)
     expect(mockedModuleResolve).toHaveBeenNthCalledWith(2, mockModuleId, dirUrl)
-    expect(mockReadPackageJson).toHaveBeenCalledWith(expectedPackageJsonUrl)
+    expect(mockReadPackageJson).toHaveBeenCalledWith(join(expectedPackageDir, 'package.json'))
     expect(result).toBe(mockVersion)
   })
 
@@ -173,3 +173,79 @@ describe('getLocalPackageVersion', () => {
     expect(result).toBeNull()
   })
 })
+
+describe('getLocalPackageDir', () => {
+  const mockWorkDir = '/mock/work/dir'
+  const mockModuleId = '@sanity/test'
+
+  afterEach(() => {
+    vi.clearAllMocks()
+  })
+
+  test('returns package directory when package.json is resolved', () => {
+    const mockPackageUrl = pathToFileURL(
+      resolve(mockWorkDir, 'node_modules', mockModuleId, 'package.json'),
+    )
+
+    mockedModuleResolve.mockReturnValueOnce(mockPackageUrl)
+
+    const result = getLocalPackageDir(mockModuleId, mockWorkDir)
+
+    expect(result).toBe(resolve(mockWorkDir, 'node_modules', mockModuleId))
+    expect(mockedModuleResolve).toHaveBeenCalledWith(
+      `${mockModuleId}/package.json`,
+      pathToFileURL(resolve(mockWorkDir, 'noop.js')),
+    )
+  })
+
+  test('resolves hoisted packages in monorepo root node_modules', () => {
+    // Simulate a monorepo where react is hoisted to root
+    const monorepoRoot = '/project'
+    const workspaceDir = '/project/packages/frontend'
+    const hoistedPackageUrl = pathToFileURL(
+      resolve(monorepoRoot, 'node_modules', 'react', 'package.json'),
+    )
+
+    mockedModuleResolve.mockReturnValueOnce(hoistedPackageUrl)
+
+    const result = getLocalPackageDir('react', workspaceDir)
+
+    expect(result).toBe(resolve(monorepoRoot, 'node_modules', 'react'))
+  })
+
+  test('falls back to main entry point when package.json is not exported', () => {
+    const mainEntryPath = resolve(mockWorkDir, 'node_modules', mockModuleId, 'dist', 'index.js')
+    const mainEntryUrl = pathToFileURL(mainEntryPath)
+
+    mockedModuleResolve
+      .mockImplementationOnce(() => {
+        throw createNodeError('ERR_PACKAGE_PATH_NOT_EXPORTED', 'Package path not exported')
+      })
+      .mockReturnValueOnce(mainEntryUrl)
+
+    const result = getLocalPackageDir(mockModuleId, mockWorkDir)
+
+    expect(result).toBe(resolve(mockWorkDir, 'node_modules', mockModuleId))
+    expect(mockedModuleResolve).toHaveBeenCalledTimes(2)
+  })
+
+  test('throws when moduleResolve throws a non-fallback error', () => {
+    mockedModuleResolve.mockImplementationOnce(() => {
+      throw createNodeError('ERR_MODULE_NOT_FOUND', 'Module not found')
+    })
+
+    expect(() => getLocalPackageDir(mockModuleId, mockWorkDir)).toThrow('Module not found')
+  })
+
+  test('throws when both resolution strategies fail', () => {
+    mockedModuleResolve
+      .mockImplementationOnce(() => {
+        throw createNodeError('ERR_PACKAGE_PATH_NOT_EXPORTED', 'Package path not exported')
+      })
+      .mockImplementationOnce(() => {
+        throw createNodeError('ERR_MODULE_NOT_FOUND', 'Module not found')
+      })
+
+    expect(() => getLocalPackageDir(mockModuleId, mockWorkDir)).toThrow('Module not found')
+  })
+})

packages/@sanity/cli/src/util/getLocalPackageVersion.ts

@@ -17,31 +17,46 @@ export async function getLocalPackageVersion(
   workDir: string,
 ): Promise<string | null> {
   try {
-    // Handle import.meta.url being passed instead of a directory path
-    const dir = workDir.startsWith('file://') ? dirname(fileURLToPath(workDir)) : workDir
-    const dirUrl = pathToFileURL(resolve(dir, 'noop.js'))
+    const packageDir = getLocalPackageDir(moduleName, workDir)
+    return (await readPackageJson(join(packageDir, 'package.json'))).version
+  } catch {
+    return null
+  }
+}
 
-    let packageJsonUrl: URL
-    try {
-      packageJsonUrl = moduleResolve(`${moduleName}/package.json`, dirUrl)
-    } catch (err: unknown) {
-      if (isErrPackagePathNotExported(err)) {
-        // Fallback: resolve main entry point and derive package root
-        const mainUrl = moduleResolve(moduleName, dirUrl)
-        const mainPath = fileURLToPath(mainUrl)
-        const normalizedName = normalize(moduleName)
-        const idx = mainPath.lastIndexOf(normalizedName)
-        const moduleRoot = mainPath.slice(0, idx + normalizedName.length)
-        packageJsonUrl = pathToFileURL(join(moduleRoot, 'package.json'))
-      } else {
-        throw err
-      }
+/**
+ * Resolve the filesystem directory of a locally installed package using Node
+ * module resolution. Works correctly with hoisted packages in monorepos/workspaces,
+ * pnpm symlinks, and other non-standard node_modules layouts.
+ *
+ * @param moduleName - The name of the package in npm.
+ * @param workDir - The working directory to resolve the module from. (aka project root)
+ * @returns The absolute path to the package directory.
+ * @internal
+ */
+export function getLocalPackageDir(moduleName: string, workDir: string): string {
+  // Handle import.meta.url being passed instead of a directory path
+  const dir = workDir.startsWith('file://') ? dirname(fileURLToPath(workDir)) : workDir
+  const dirUrl = pathToFileURL(resolve(dir, 'noop.js'))
+
+  try {
+    const packageJsonUrl = moduleResolve(`${moduleName}/package.json`, dirUrl)
+    return dirname(fileURLToPath(packageJsonUrl))
+  } catch (err: unknown) {
+    if (!isErrPackagePathNotExported(err)) {
+      throw err
     }
+  }
 
-    return (await readPackageJson(packageJsonUrl)).version
-  } catch {
-    return null
+  // Fallback: resolve main entry point and derive package root
+  const mainUrl = moduleResolve(moduleName, dirUrl)
+  const mainPath = fileURLToPath(mainUrl)
+  const normalizedName = normalize(moduleName)
+  const idx = mainPath.lastIndexOf(normalizedName)
+  if (idx === -1) {
+    throw new Error(`Could not determine package directory for '${moduleName}'`)
   }
+  return mainPath.slice(0, idx + normalizedName.length)
 }
 
 function isErrPackagePathNotExported(err: unknown): boolean {