fix(rivetkit): resolve ESM-only secure-exec package in dynamic isolate runtime

Author: NathanFlurry

rivetkit-typescript/packages/rivetkit/src/dynamic/isolate-runtime.ts

@@ -1,4 +1,5 @@
 import { createRequire } from "node:module";
+import { readFileSync } from "node:fs";
 import { mkdir, readFile, stat } from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -1499,6 +1500,43 @@ async function loadIsolatedVmModule(): Promise<IsolatedVmModule> {
 	return isolatedVmModulePromise;
 }
 
+/**
+ * Resolve an ESM-only package entry by walking up from cwd to find it in
+ * node_modules. This handles packages that have "type": "module" and only
+ * define "import" in exports (no "require"), which createRequire().resolve()
+ * cannot handle.
+ */
+function resolveEsmPackageEntry(packageName: string): string | undefined {
+	let current = process.cwd();
+	while (true) {
+		const pkgJsonPath = path.join(
+			current,
+			"node_modules",
+			packageName,
+			"package.json",
+		);
+		try {
+			const content = readFileSync(pkgJsonPath, "utf-8");
+			const pkgJson = JSON.parse(content) as {
+				main?: string;
+				exports?: Record<string, unknown>;
+			};
+			const entryRelative =
+				(pkgJson.exports?.["."] as { import?: string } | undefined)
+					?.import ?? pkgJson.main;
+			if (entryRelative) {
+				return path.resolve(path.dirname(pkgJsonPath), entryRelative);
+			}
+		} catch {
+			// package.json not found at this level, keep walking up
+		}
+		const parent = path.dirname(current);
+		if (parent === current) break;
+		current = parent;
+	}
+	return undefined;
+}
+
 function resolveSecureExecEntryPath(): string {
 	const explicitSpecifier =
 		process.env.RIVETKIT_DYNAMIC_SECURE_EXEC_SPECIFIER;
@@ -1524,7 +1562,13 @@ function resolveSecureExecEntryPath(): string {
 	for (const packageSpecifier of packageSpecifiers) {
 		try {
 			return resolver.resolve(packageSpecifier);
-		} catch {}
+		} catch {
+			// createRequire().resolve() cannot resolve ESM-only packages (packages
+			// with "type": "module" and only "import" in exports). Fall back to
+			// manually finding the package in node_modules and reading its entry.
+			const resolved = resolveEsmPackageEntry(packageSpecifier);
+			if (resolved) return resolved;
+		}
 	}
 
 	const localDistCandidates = [