How does NPM manage node_modules Transitive Dependencies?

Let’s say I create an app called MyApp and it depends on package A (version 1.0) and package B which depends on package C which in turn depends on package A (version 2.0):

MyApp
- A @ 1.0
- B

A
- (no dependencies in whichever version)

B
- C

C
- A @ 2.0

My question is.

Q1 - Which version of the package A will be installed? Will package A get installed or MyApp’s node_modules, B’s node_modules or C’s node_modules?

Q2 - My thinking is, NPM will install A (1.0) in MyApp's node_modules folder and install A (2.0) on package C's node_modules.

Q3 - But if I just want one copy of A (2.0) to be installed globally, what should I do to make NPM do in this way?

Considering solely documentation at https://docs.npmjs.com/cli/v6/configuring-npm/folders#cycles-conflicts-and-folder-parsimony, your Q2 assumptions are right, what also answers Q1.

> […] at every stage, if a package is already installed in an ancestor node_modules folder, then it is not installed at the current location.

For illustration, let's modify your example and add A (1.0) also as a dependency of B:

MyApp
- A @ 1.0
- B

A
- (no dependencies in whichever version)

B
- A @ 1.0 (added for illustration)
- C

C
- A @ 2.0

Resulting directory tree with respective versions (that are NOT part of the folder names) should then look like this:

MyApp/node_modules/A (@ 1.0)
MyApp/node_modules/B
MyApp/node_modules/B/node_modules/C
MyApp/node_modules/B/node_modules/C/node_modules/A (@ 2.0)

NB: there is NO

MyApp/node_modules/B/node_modules/A (@ 1.0)

present there, since it is already present higher, under MyApp.

(Side note: in case B would not depend on A (1.0), from the docs I am not completely sure, whether the A (@ 2.0) wouldn't appear one level higher (under B) instead, as B would be the first top-most ancestor without version mismatch, even though it was not B's dependency at all in this hypothetical case. This would allow all "siblings" share same module without colliding with root level dependency.)

As for Q3 the answer is simple (I guess by "global" you mean MyApp (root) module, not system-wide modules): since you dictate MyApp's dependencies, if the app can work with A (2.0), just bump up that dependency version from 1.0 and do the update. After that there should only be

MyApp/node_modules/A (@ 2.0)

instead of .. (@ 1.0) and the former

MyApp/node_modules/B/node_modules/C/node_modules/A (@ 2.0)

should be gone.

If it was other way round (C would depend on older A (1.0) instead of newer 2.0) then I don't have a clear answer, besides you would just have to make C author unlock or bump-up dependency to A (2.0), i.e. I don't think it is possible without altering those modules.