Extension first, package.json second: a file's own suffix outranks the folder's default.

Node picks a module system for each file separately. A .mjs or .cjs suffix settles it on the spot. Only for plain .js files does Node walk up to the nearest package.json and read its type field, so that setting is a default for .js, not an order that overrides explicit suffixes.

Read it once, then a question tests whether the trick stuck.