AuthKitProvider /client entry pulls @workos-inc/node into the dev browser bundle, breaking Vite dev server

[rgcottrell]

Summary

After upgrading @workos/authkit-tanstack-react-start from 0.5.0 → 0.7.0, the Vite dev server and @vitest/browser throw an uncaught SyntaxError for eventemitter3
whenever a page imports AuthKitProvider from @workos/authkit-tanstack-react-start/client:

Uncaught (in promise) SyntaxError: The requested module
'/@fs/.../node_modules/.pnpm/eventemitter3@5.0.4/node_modules/eventemitter3/index.js?v=...'
does not provide an export named 'default'

Production builds (Rollup) are unaffected — Rollup picks the .mjs entry via the import condition and tree-shakes server code out. Only Vite's dev server, which
serves modules unbundled, is broken.

Versions

• @workos/authkit-tanstack-react-start@0.7.0
• @workos/authkit-session@0.5.1 (transitive)
• @workos-inc/node@8.13.0 (resolved from ^8.0.0)
• eventemitter3@5.0.4 (runtime dep of @workos-inc/node@8.13+)
• vite@7.3.2, @tanstack/react-start@1.167.49, React 19.2, pnpm 10.20

Reproduction

1. TanStack Start app with @workos/authkit-tanstack-react-start@0.7.0 and @workos-inc/node@8.13.0 installed (pnpm).
2. Any route that mounts the provider from the /client subpath:

import { AuthKitProvider } from "@workos/authkit-tanstack-react-start/client";
3. Run vite dev and load the route in a browser.
4. The error appears in the browser console.

Root cause

dist/client/AuthKitProvider.js and dist/client/index.js statically import server-only modules:

// dist/client/AuthKitProvider.js
import {
checkSessionAction,
getAuthAction,
refreshAuthAction,
switchToOrganizationAction,
} from "../server/actions.js";
import { getSignOutUrl } from "../server/server-functions.js";

// dist/client/index.js
export { getAuthAction } from "../server/actions.js";

That walks into dist/server/authkit-loader.js → @workos/authkit-session → @workos-inc/node. From @workos/authkit-session@0.5.1, the dep on @workos-inc/node is
^8.0.0 (where 0.3.4 pinned exactly 8.0.0), so pnpm hoists whatever is already installed — for many apps that's 8.13.0, which added eventemitter3 as a runtime
dep:

// node_modules/@workos-inc/node/lib/factory-*.mjs
import { EventEmitter } from "eventemitter3";

Vite's dev server reaches eventemitter3 only through this deeply nested transitive chain, so it doesn't auto-include it for pre-bundling. It serves
eventemitter3@5.0.4/index.mjs directly, whose first line is:

import EventEmitter from "./index.js";

The CJS ./index.js does module.exports = EventEmitter. Vite's dev server doesn't ESM-shim files served via raw @fs, so the default import fails — yielding the
SyntaxError above.

Why this regressed at 0.7.0

0.5.0 depended on @workos/authkit-session@0.3.4, which pinned @workos-inc/node to exactly 8.0.0 (no eventemitter3 dep). 0.7.0 bumps the session dep to 0.5.1,
which uses ^8.0.0 and lets pnpm resolve to whatever the host app has — for most apps, 8.13.0. The bundling chain has otherwise been unchanged since 0.3.0.

[brandonfancher]

This problem persists for me. The latest version that works for me without the eventemitter3 error is v0.6.0. I've tried every version up to v0.8.2 without success.

[brandonfancher]

For those still facing this issue, this workaround added to my vite.config.ts is working for me on v0.8.2 of this package:

  optimizeDeps: {
    include: [
      "@workos/authkit-tanstack-react-start > @workos/authkit-session > @workos-inc/node > eventemitter3",
    ],
  },