In Node 24, what primarily determines whether app.js is ESM or CommonJS?

In Node 24, what primarily determines whether app.js is ESM or CommonJS?

1. The type field in the nearest parent package.json
2. Whether the file contains an import declaration
3. Whether package-lock.json exists
4. The current working directory name