Package map entry whose url resolves to a directory-form URL never matches its files

Version

v26.8.1

Platform

Windows 11 x64 (the mechanism is platform independent; see analysis)

Subsystem

module, package maps

What steps will reproduce the bug?

A package entry whose url resolves to a directory-form URL (one ending in /) never matches any file inside it. The natural relative spellings for "the directory above the map file" — "..", "../", ".", "./" — all produce such a URL.

project/
  package.json          {"private":true}
  index.cjs             console.log(require("dep"));
  node_modules/
    .package-map.json
    dep/package.json    {"name":"dep","main":"index.cjs"}
    dep/index.cjs       module.exports="ok";

node_modules/.package-map.json:

{
  "packages": {
    "root": { "url": "..", "dependencies": { "dep": "dep" } },
    "dep": { "url": "./dep", "dependencies": {} }
  }
}

$ node --experimental-package-map=node_modules/.package-map.json index.cjs

How often does it reproduce? Is there a required condition?

Always. The condition is that the entry's url resolves to a URL ending in /.

Results for the same map with only the root url changed:

root url	result
".."	ERR_PACKAGE_MAP_EXTERNAL_FILE
"../"	ERR_PACKAGE_MAP_EXTERNAL_FILE
"."	ERR_PACKAGE_MAP_EXTERNAL_FILE
"./"	ERR_PACKAGE_MAP_EXTERNAL_FILE
absolute file: URL without a trailing slash	ok

What is the expected behavior? Why is that the expected behavior?

require("dep") from index.cjs should print ok. The documentation says url is "An absolute or relative URL ... parsed using the WHATWG URL API, using the configuration file URL as base", and puts no restriction on directory-form URLs. "." and ".." are ordinary relative URLs that denote directories, which is what a package entry points at.

What do you see instead?

Error [ERR_PACKAGE_MAP_EXTERNAL_FILE]: Cannot resolve "dep" from ".../nodemap/index.cjs": file is not within any package defined in .../nodemap/node_modules/.package-map.json
    at PackageMap.resolve (node:internal/modules/package_map:179:13)
    at packageMapResolve (node:internal/modules/package_map:305:14)
    at tryPackageMapResolveCJS (node:internal/modules/cjs/loader:697:18)
  code: 'ERR_PACKAGE_MAP_EXTERNAL_FILE'

Additional information

Cause, in lib/internal/modules/package_map.js (v26.8.1):

• #parse stores the package path unnormalized: absolutePath = fileURLToPath(packageURL) followed by this.#pathToKey.set(absolutePath, key). For a directory-form URL this keeps the trailing separator, for example /home/u/proj/.
• #getKeyForPath does filePath = pathResolve(filePath) and then walks up with dirname, comparing by exact string. pathResolve and dirname never yield a trailing separator except at a filesystem root, so the stored key is unreachable and resolve() throws ERR_PACKAGE_MAP_EXTERNAL_FILE.

The same reasoning applies on POSIX: fileURLToPath keeps the trailing /, and path.posix.dirname("/home/u/proj/index.cjs") is /home/u/proj.

Suggested fix: normalize when storing, that is absolutePath = pathResolve(fileURLToPath(packageURL)) in #parse, so stored paths, duplicate detection and lookup all use the same spelling. Normalizing only in #getKeyForPath would leave the stored identity inconsistent.

Test coverage: the fixtures in test/fixtures/package-map/ use only "./name" style URLs, so no test exercises a directory-form URL. A regression test could add an entry with url: ".." and require a dependency from a file in that directory.

This is not the same as #65501 / #65502, which concern subpaths escaping the target package directory.

Found via pnpm, which writes "url": ".." for the workspace root importer in node_modules/.package-map.json, so no file at a project root can resolve a bare specifier.

阅读 lib/internal/modules/package_map.js，尤其是 #parse 和 #getKeyForPath，然后检查 test/fixtures/package-map/ 下的 fixtures。添加一个使用类似 ".." 的目录形式 URL 的回归用例，并验证 require 该依赖时能够成功解析，而不是引发 ERR_PACKAGE_MAP_EXTERNAL_FILE。