[robhogan]

Currently, Metro reads "exports" from the package.json closest to the requested subpath, so a nested {"type": "commonjs"} or legacy shim hides the root's "exports". That's different to Node's PACKAGE_RESOLVE, webpack 5 and Vite 8.

This adds resolver.unstable_resolveExportsFromPackageRoot, off by default, which reads "exports" from the root of the package named by a bare specifier, following Node. The subpath is the literal text after the package name, so pkg/./sub and pkg/node_modules/dep/foo aren't exported - we warn and fall back to file-based resolution, as for any other unexported subpath. A package with no package.json at its root has no "exports", so a nested one doesn't apply. Haste packages and extraNodeModules mappings have no Node equivalent, and read the root of the mapped directory too, using the closest package if it has no package.json. "browser" redirections, "imports" and self-references keep using the closest, which is correct for those.

Being off, this can go out in 0.87.x without changing what anyone resolves. We'll enable it by default for 0.88 in a follow-up.

Refs #2153

Changelog:

 - **[Experimental]**: Add `resolver.unstable_resolveExportsFromPackageRoot` to read `"exports"` from the package root, instead of the closest `package.json`

Test plan:
New unit tests.

AI-driven comparison: import graph walks through DependencyGraph of Bluesky (iOS, Android, web) and Mattermost (iOS, Android). With the flag off, no edges, failures or warnings differ from main. With it on, 29 edges change on each Mattermost platform and 2 on Bluesky web, as described in the issue, and no failures or warnings differ.

[github-actions]

Metro review: Looks good

Risk: low · Commit: 972327f · 10 commands run

This adds an off-by-default resolver.unstable_resolveExportsFromPackageRoot, which reads "exports" from the root of the package named by a bare specifier, as Node does. All three earlier findings are fixed, and their new tests fail when each fix is disabled. On a 36-specifier fixture through a real DependencyGraph, flag-off results match base, and flag-on differs from Node only in the documented warn-and-fall-back cases (plus pkg/ treated as pkg), so I have no new findings.

No findings.

Verified

• ✅ yarn jest --no-watchman packages/metro-resolver packages/metro/src/DeltaBundler/__tests__/resolver-test.js packages/metro-config — 14 suites, 522 tests.
• ✅ yarn flow check — No errors. Run before the review's repro tests were added.
• ✅ yarn eslint on resolve.js, PackageExportsResolve.js and package-exports-test.js
• ✅ yarn verify-api-snapshots — 18 snapshots verified.
• ✅ yarn jest --no-watchman packages/metro-resolver/src/__tests__/package-exports-test.js, with the pattern-segment check and nested node_modules check disabled (failed as expected) — 10 of 120 tests fail, covering both fixes. Temporary edits reverted.
• ✅ yarn jest --no-watchman package-exports-test.js resolver-test.js, using the lexical packagePath instead of realPath for the no-root case (failed as expected) — The new symlink test fails on linux and mocked win32. Temporary edit reverted; git status showed only the repro test untracked at that point.
• ✅ yarn jest --no-watchman packages/metro/src/DeltaBundler/__tests__/review-node-diff-test.js (head) — Logs results rather than asserting. 36 specifiers on real fs and DependencyGraph against Node's import.meta.resolve, including scoped, symlinked, no-root and nested node_modules cases.
• ✅ yarn --cwd base-worktree jest --no-watchman packages/metro/src/DeltaBundler/__tests__/review-node-diff-test.js (base) — Flag-off column compared by eye with head: same results and warnings for all 36 specifiers.
• ✅ yarn jest --no-watchman packages/metro/src/DeltaBundler/__tests__/review-real-pkgs-test.js — Real nanoid 3.3.20 and @‍mswjs/interceptors 0.41.9 on ios and android. With the flag, nanoid/async gets a crypto build unless applyBrowserSpecAfterExports is on, and fetch gets lib/node, whose chunks use node:zlib. Matches the docs.
• ✅ node bench/resolve-bench.js <head> <base> — Run without and with nested manifests. No significant change in either.

Benchmarks (base vs this PR)

Benchmark	Base	This PR	Change
resolve() of 4000 bare specifiers, flag off	17.32ms (17.03-17.90)	17.24ms (16.97-17.91)	no significant change
resolve() of 4000 bare specifiers, flag on at head vs base	17.32ms (17.03-17.90)	17.50ms (17.26-18.11)	no significant change

Method

• resolve() of 4000 bare specifiers, flag off: Generated in-memory tree of 2000 packages, half with exports, each with a nested lib/package.json. One Node process loaded both checkouts, 5 warm-up rounds, then 20 alternating rounds per side. Median with range. Script: bench/resolve-bench.js
• resolve() of 4000 bare specifiers, flag on at head vs base: Same run and fixture as the flag-off row, so half the packages have exports and the root is not the closest manifest for their subpaths. Median with range; the ranges overlap. Script: bench/resolve-bench.js

Not run: The Bluesky and Mattermost comparison in the test plan wasn't repeated, because it needs those apps and the PR's harness. Flag-off equivalence rests on the 36-specifier fixture, the existing tests and code tracing. Real Windows wasn't available, so only mocked win32 in resolver-test.js ran. Real-package checks only resolved entry points and searched source files; nothing was bundled. A few compound shell commands were denied by the session's permission check, so I reran the checks as simple commands or read earlier review output instead.

_{Automated review by Claude. Advisory only: it never approves or blocks, and a maintainer makes the call.}

[huntie]

Package exports never ends 😅👏🏻