eventemitter3 default export error still occurs in Vite dev with v0.9.1

[50BytesOfJohn]

Describe the bug

@workos/authkit-tanstack-react-start@0.9.1 still causes the Vite dev browser client to crash with the same eventemitter3 default export error described in #82.

The console error is:

Uncaught SyntaxError: The requested module '/@fs/.../node_modules/.bun/eventemitter3@5.0.4/node_modules/eventemitter3/index.js?v=b3194e12' does not provide an export named 'default' (at index.mjs?v=b3194e12:1:8)

This looks related to #82 / #93. I can confirm v0.9.1 contains the lazy import fix in dist/server/authkit-loader.js, but there still appear to be static imports/re-exports from @workos/authkit-session in server modules that can enter the Vite dev client graph.

Examples in the published 0.9.1 package:

// dist/server/server-fn-bodies.js
import { selectStalePKCEVerifierCookieNames } from '@workos/authkit-session';

// dist/server/server.js
import { getPKCECookieNameForState } from '@workos/authkit-session';

// dist/server/index.js
export { OAuthStateMismatchError, PKCECookieMissingError } from '@workos/authkit-session';

Since @workos/authkit-session pulls in @workos-inc/node, which imports eventemitter3, this seems to reintroduce the browser dev graph leak that #93 was intended to fix.

To Reproduce

Steps to reproduce the behavior:

1. Install @workos/authkit-tanstack-react-start@0.9.1
2. Use authkitMiddleware() in src/start.ts
3. Use client imports from @workos/authkit-tanstack-react-start/client
4. Start the app with Vite dev
5. Open the app in Chrome
6. See the browser console error above

Expected behavior

Vite dev should not load @workos-inc/node / eventemitter3 into the browser client graph. The app should load without the eventemitter3 default export syntax error.

Screenshots

N/A

Desktop (please complete the following information):

• OS: macOS
• Browser: Chrome
• authkit-tanstack-start version: 0.9.1
• Tanstack Start version: 1.168.25
• Vite version: 8.0.16
• Package manager: Bun

Additional context

Related upstream items:

• Adding authkitMiddleware() causes the Vite dev client to crash #82 reported the same class of Vite dev crash.
• fix: lazy-import @workos/authkit-session in authkit-loader #93 fixed one static import path by lazy-importing @workos/authkit-session in authkit-loader.
• v0.9.1 includes fix: lazy-import @workos/authkit-session in authkit-loader #93, but the issue still reproduces.

[nicknisi]

Looking into this deeper. I think there's a problem in how I've been reproducing.

[50BytesOfJohn]

@nicknisi Let me know if I can help in any way. The vite config I use is pretty simple, but maybe it can help.

import { cloudflare } from "@cloudflare/vite-plugin";
import tailwindcss from "@tailwindcss/vite";
import { devtools } from "@tanstack/devtools-vite";
import { tanstackStart } from "@tanstack/react-start/plugin/vite";
import viteReact from "@vitejs/plugin-react";
import { defineConfig } from "vite";

import path from "node:path";
import { fileURLToPath } from "node:url";

const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);

const config = defineConfig(({ command }) => ({
  root: __dirname,

  plugins: [
    devtools(),
    cloudflare({ viteEnvironment: { name: "ssr" } }),

    tailwindcss(),

    tanstackStart({
      router: {
        routesDirectory: path.join(__dirname, "src", "routes"),
        generatedRouteTree: path.join(__dirname, "src", "routeTree.gen.ts"),
      },
    }),

    viteReact(),
  ],
}));

export default config;

[nicknisi]

Figured this out — thanks for the detailed report and the pointers, they were spot on.

The fix. @workos-inc/node@10.4.0 dropped eventemitter3, which removes the landmine at the source. You can fix this right now without waiting on a release — just make sure @workos-inc/node resolves to >=10.4.0:

npm install @workos-inc/node@^10.4.0      # or pnpm add / bun add / yarn add

If you don't depend on it directly, force the transitive version and reinstall:

// npm / bun:  "overrides": { "@workos-inc/node": "^10.4.0" }
// pnpm: "pnpm": { "overrides": { "@workos-inc/node": "^10.4.0" } }
// yarn: "resolutions": { "@workos-inc/node": "^10.4.0" }

Then confirm it's gone: npm ls eventemitter3 should print nothing. Note @workos-inc/node@10 requires Node ≥ 22.11.

#107 pins @workos-inc/node >=10.4.0 as a peer dependency so this is enforced automatically in the next release. I'll close this once that lands. Thanks!

[50BytesOfJohn]

@nicknisi Upgrading @workos-inc/node to latest version fixed the problem. Thanks a lot!