Read both export styles from a library's react-native.config.js

`defaultReadConfig` returned the module object as required, so an ESM config
that only declares `export default {...}` read as a config with no `spm` block
at all — while the Community CLI, which loads the same file through cosmiconfig,
sees it. A library shipping that shape silently lost its `spm.name`.

Unwrap the default export and let named exports win over its keys, so both
styles resolve. Non-objects (a function-style config) pass through untouched.

Precedence only decides the pathological shape that defines one key twice.
cosmiconfig's ESM loader reads only the default export, so the two tools would
disagree there; the docs say to avoid it.

A config that throws while loading now warns with the path and the reason
instead of being swallowed: it was already ignored, only invisibly.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: chrfalch

packages/react-native/scripts/spm/__docs__/spm-scripts.md

@@ -376,6 +376,21 @@ library's target can import it.
 This is a **library-author** surface, like the podspec dependency it replaces —
 apps don't normally set it.
 
+### Config module format
+
+`react-native.config.js` may be CommonJS or ESM, and both named and default
+exports are read. A key defined twice — as a named export and on the default
+export — resolves to the named one. Avoid that shape: the Community CLI's own
+loader reads only the default export, so the two tools would disagree. For
+maximum compatibility, prefer the one-line CommonJS form:
+
+```js
+module.exports = {dependency: {platforms: {ios: {}}}, spm: {name: 'worklets'}};
+```
+
+If the config fails to load, a warning names the file and the reason — the `spm`
+settings in it are ignored rather than silently applied.
+
 ## Self-managed community packages
 
 A community library that ships its own `Package.swift` is referenced directly by

packages/react-native/scripts/spm/__tests__/expand-spm-dependencies-test.js

@@ -34,10 +34,14 @@
  */
 
 const {
+  defaultReadConfig,
   expandSpmDependencies,
   resolveSwiftName,
 } = require('../expand-spm-dependencies');
 const {toSwiftName} = require('../spm-utils');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
 
 function makeReadConfig(configs /*: {[string]: ?Object} */) {
   return (root /*: string */) =>
@@ -391,3 +395,116 @@ describe('expandSpmDependencies', () => {
     );
   });
 });
+
+// ---------------------------------------------------------------------------
+// defaultReadConfig
+//
+// The community CLI reads the same react-native.config.js through cosmiconfig,
+// which prefers the default export — so an ESM config that only sets
+// `export default` must not be invisible to us.
+// ---------------------------------------------------------------------------
+
+describe('defaultReadConfig', () => {
+  let tmpRoot;
+
+  beforeAll(() => {
+    tmpRoot = fs.mkdtempSync(
+      path.join(fs.realpathSync(os.tmpdir()), 'spm-read-config-'),
+    );
+  });
+
+  afterAll(() => {
+    fs.rmSync(tmpRoot, {recursive: true, force: true});
+  });
+
+  function writeConfig(name, source, esm = false) {
+    const root = path.join(tmpRoot, name);
+    fs.mkdirSync(root, {recursive: true});
+    fs.writeFileSync(
+      path.join(root, 'package.json'),
+      JSON.stringify(esm ? {name, type: 'module'} : {name}),
+    );
+    fs.writeFileSync(path.join(root, 'react-native.config.js'), source);
+    return root;
+  }
+
+  it('returns null when the library ships no config', () => {
+    const root = path.join(tmpRoot, 'no-config');
+    fs.mkdirSync(root, {recursive: true});
+    expect(defaultReadConfig(root)).toBeNull();
+  });
+
+  it('reads a CommonJS config', () => {
+    const root = writeConfig('cjs', "module.exports = {spm: {name: 'Cjs'}};\n");
+    expect(defaultReadConfig(root).spm.name).toBe('Cjs');
+  });
+
+  it('unwraps an ESM config that only has a default export', () => {
+    const root = writeConfig(
+      'esm-default',
+      "export default {spm: {name: 'EsmDefault'}};\n",
+      true,
+    );
+    expect(defaultReadConfig(root).spm.name).toBe('EsmDefault');
+  });
+
+  it('reads an ESM config that only has named exports', () => {
+    const root = writeConfig(
+      'esm-named',
+      "export const spm = {name: 'EsmNamed'};\n",
+      true,
+    );
+    expect(defaultReadConfig(root).spm.name).toBe('EsmNamed');
+  });
+
+  it('prefers the named export when a config ships both (the PowerSync shape)', () => {
+    const root = writeConfig(
+      'esm-both',
+      "export const spm = {name: 'Named'};\n" +
+        "export default {spm: {name: 'Default'}, dependency: {platforms: {ios: {}}}};\n",
+      true,
+    );
+    const config = defaultReadConfig(root);
+    expect(config.spm.name).toBe('Named');
+    // Only the merge satisfies this: `dependency` exists on the default export
+    // alone, so reading the module raw would miss it.
+    expect(config.dependency.platforms.ios).toEqual({});
+  });
+
+  it('keeps sibling keys of the default export (dependency.platforms.ios)', () => {
+    const root = writeConfig(
+      'esm-siblings',
+      "export default {dependency: {platforms: {ios: {}}}, spm: {name: 'Siblings'}};\n",
+      true,
+    );
+    const config = defaultReadConfig(root);
+    expect(config.dependency.platforms.ios).toEqual({});
+    expect(config.spm.name).toBe('Siblings');
+  });
+
+  it('passes a function-style config through unchanged (module.exports = () => ({...}))', () => {
+    const root = writeConfig(
+      'fn-style',
+      "module.exports = () => ({spm: {name: 'FnStyle'}});\n",
+    );
+    const config = defaultReadConfig(root);
+    expect(typeof config).toBe('function');
+    expect(config().spm.name).toBe('FnStyle');
+  });
+
+  it('warns with the config path and the reason when the config fails to load, and returns null', () => {
+    const root = writeConfig(
+      'broken',
+      "require('a-dev-dependency-that-is-not-installed');\n",
+    );
+    const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {});
+    try {
+      expect(defaultReadConfig(root)).toBeNull();
+      const message = warnSpy.mock.calls.map(call => call.join(' ')).join('\n');
+      expect(message).toContain(path.join(root, 'react-native.config.js'));
+      expect(message).toContain('a-dev-dependency-that-is-not-installed');
+    } finally {
+      warnSpy.mockRestore();
+    }
+  });
+});

packages/react-native/scripts/spm/expand-spm-dependencies.js

@@ -10,10 +10,12 @@
 
 'use strict';
 
-const {toSwiftName} = require('./spm-utils');
+const {makeLogger, toSwiftName} = require('./spm-utils');
 const fs = require('node:fs');
 const path = require('node:path');
 
+const {warn} = makeLogger('expand-spm-dependencies');
+
 /**
  * expand-spm-dependencies.js — Resolves transitive native deps declared via
  * `spm.dependencies` in a library's react-native.config.js.
@@ -188,8 +190,32 @@ function defaultReadConfig(root /*: string */) /*: ?RnConfig */ {
   }
   try {
     // $FlowFixMe[unsupported-syntax]
-    return require(configPath);
-  } catch {
+    const mod = require(configPath);
+    // The community CLI reads this same file through cosmiconfig, which
+    // prefers the default export — so an ESM config declaring only
+    // `export default` must not read as empty here. Named exports win over
+    // the default object's keys, and every sibling key is preserved
+    // (`dependency.platforms.ios` is read from this result too).
+    // A function-style config (`module.exports = () => ({...})`) and other
+    // non-objects pass through untouched — there is no default export to
+    // unwrap, and nulling them would hide a config that used to be read.
+    if (mod == null || typeof mod !== 'object') {
+      return mod;
+    }
+    const dflt = mod.default;
+    if (dflt == null || typeof dflt !== 'object') {
+      return mod;
+    }
+    const {default: _unused, ...named} = mod;
+    return {...dflt, ...named};
+  } catch (e) {
+    // A config can fail to load for reasons unrelated to SPM (it may import a
+    // devDependency absent in a consumer install), so this stays a warning —
+    // but a silent null turns a dropped `spm` block into a link error much
+    // later.
+    warn(
+      `Failed to load ${configPath}: ${e.message}. Any 'spm' settings in it are ignored.`,
+    );
     return null;
   }
 }