René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Package map entry whose url resolves to a directory-form URL never matches its files","articleBody":"### Version\n\nv26.8.1\n\n### Platform\n\nWindows 11 x64 (the mechanism is platform independent; see analysis)\n\n### Subsystem\n\nmodule, package maps\n\n### What steps will reproduce the bug?\n\nA package entry whose `url` resolves to a *directory-form* URL (one ending in `/`) never matches any file inside it. The natural relative spellings for \"the directory above the map file\" — `\"..\"`, `\"../\"`, `\".\"`, `\"./\"` — all produce such a URL.\n\n```\nproject/\n  package.json          {\"private\":true}\n  index.cjs             console.log(require(\"dep\"));\n  node_modules/\n    .package-map.json\n    dep/package.json    {\"name\":\"dep\",\"main\":\"index.cjs\"}\n    dep/index.cjs       module.exports=\"ok\";\n```\n\n`node_modules/.package-map.json`:\n\n```json\n{\n  \"packages\": {\n    \"root\": { \"url\": \"..\", \"dependencies\": { \"dep\": \"dep\" } },\n    \"dep\": { \"url\": \"./dep\", \"dependencies\": {} }\n  }\n}\n```\n\n```console\n$ node --experimental-package-map=node_modules/.package-map.json index.cjs\n```\n\n### How often does it reproduce? Is there a required condition?\n\nAlways. The condition is that the entry's `url` resolves to a URL ending in `/`.\n\nResults for the same map with only the root `url` changed:\n\n| root `url` | result |\n| --- | --- |\n| `\"..\"` | `ERR_PACKAGE_MAP_EXTERNAL_FILE` |\n| `\"../\"` | `ERR_PACKAGE_MAP_EXTERNAL_FILE` |\n| `\".\"` | `ERR_PACKAGE_MAP_EXTERNAL_FILE` |\n| `\"./\"` | `ERR_PACKAGE_MAP_EXTERNAL_FILE` |\n| absolute `file:` URL without a trailing slash | `ok` |\n\n### What is the expected behavior? Why is that the expected behavior?\n\n`require(\"dep\")` from `index.cjs` should print `ok`. The documentation says `url` is \"An absolute or relative URL ... parsed using the WHATWG `URL` API, using the configuration file URL as base\", and puts no restriction on directory-form URLs. `\".\"` and `\"..\"` are ordinary relative URLs that denote directories, which is what a package entry points at.\n\n### What do you see instead?\n\n```\nError [ERR_PACKAGE_MAP_EXTERNAL_FILE]: Cannot resolve \"dep\" from \".../nodemap/index.cjs\": file is not within any package defined in .../nodemap/node_modules/.package-map.json\n    at PackageMap.resolve (node:internal/modules/package_map:179:13)\n    at packageMapResolve (node:internal/modules/package_map:305:14)\n    at tryPackageMapResolveCJS (node:internal/modules/cjs/loader:697:18)\n  code: 'ERR_PACKAGE_MAP_EXTERNAL_FILE'\n```\n\n### Additional information\n\nCause, in `lib/internal/modules/package_map.js` (v26.8.1):\n\n* `#parse` stores the package path unnormalized: `absolutePath = fileURLToPath(packageURL)` followed by `this.#pathToKey.set(absolutePath, key)`. For a directory-form URL this keeps the trailing separator, for example `/home/u/proj/`.\n* `#getKeyForPath` does `filePath = pathResolve(filePath)` and then walks up with `dirname`, comparing by exact string. `pathResolve` and `dirname` never yield a trailing separator except at a filesystem root, so the stored key is unreachable and `resolve()` throws `ERR_PACKAGE_MAP_EXTERNAL_FILE`.\n\nThe same reasoning applies on POSIX: `fileURLToPath` keeps the trailing `/`, and `path.posix.dirname(\"/home/u/proj/index.cjs\")` is `/home/u/proj`.\n\nSuggested fix: normalize when storing, that is `absolutePath = pathResolve(fileURLToPath(packageURL))` in `#parse`, so stored paths, duplicate detection and lookup all use the same spelling. Normalizing only in `#getKeyForPath` would leave the stored identity inconsistent.\n\nTest coverage: the fixtures in `test/fixtures/package-map/` use only `\"./name\"` style URLs, so no test exercises a directory-form URL. A regression test could add an entry with `url: \"..\"` and require a dependency from a file in that directory.\n\nThis is not the same as #65501 / #65502, which concern subpaths escaping the target package directory.\n\nFound via pnpm, which writes `\"url\": \"..\"` for the workspace root importer in `node_modules/.package-map.json`, so no file at a project root can resolve a bare specifier.\n","author":{"url":"https://github.com/christopher-buss","@type":"Person","name":"christopher-buss"},"datePublished":"2026-09-15T23:50:34Z","url":"https://github.com/nodejs/node/issues/66043"}