From 5f47efc4baf1bcfed00b69b5ea0272d1bffe27ae Mon Sep 17 00:00:00 2001 From: Ben Davidson Date: Sat, 12 Sep 2026 14:35:28 +0100 Subject: [PATCH 1/2] fix(server): import request and cookie helpers from @tanstack/start-server-core/request-response --- src/server/auth0-server.test.ts | 2 +- src/server/auth0-server.ts | 2 +- src/server/cookie-handler.ts | 8 ++++---- src/server/handlers.test.ts | 2 +- src/server/handlers.ts | 2 +- src/server/redirect-uri.test.ts | 2 +- src/server/redirect-uri.ts | 2 +- 7 files changed, 10 insertions(+), 10 deletions(-) diff --git a/src/server/auth0-server.test.ts b/src/server/auth0-server.test.ts index f837e8e..e897cef 100644 --- a/src/server/auth0-server.test.ts +++ b/src/server/auth0-server.test.ts @@ -9,7 +9,7 @@ const serverClientArgs: unknown[] = [] // The domain-resolver wrapper reads the ambient request via `getRequest()`. Mock // it so a test can drive what the wrapper sees on each call. let currentRequest: Request -vi.mock('@tanstack/start-server-core', () => ({ +vi.mock('@tanstack/start-server-core/request-response', () => ({ getRequest: () => currentRequest, })) diff --git a/src/server/auth0-server.ts b/src/server/auth0-server.ts index ed7466d..b768ee6 100644 --- a/src/server/auth0-server.ts +++ b/src/server/auth0-server.ts @@ -6,7 +6,7 @@ import { type StateStore, type DomainResolver as FoundationDomainResolver, } from '@auth0/auth0-server-js' -import { getRequest } from '@tanstack/start-server-core' +import { getRequest } from '@tanstack/start-server-core/request-response' import { TanStackStartCookieHandler } from './cookie-handler.js' import { getConfig, resolveRoutePaths, type ResolvedConfig } from './config.js' import type { Auth0ServerOptions } from '../types/index.js' diff --git a/src/server/cookie-handler.ts b/src/server/cookie-handler.ts index 1a1bdcd..1771c97 100644 --- a/src/server/cookie-handler.ts +++ b/src/server/cookie-handler.ts @@ -1,17 +1,17 @@ -// Import the cookie/request helpers from the narrow `@tanstack/start-server-core` +// Import the cookie/request helpers from the narrow `@tanstack/start-server-core/request-response` // entry, NOT the broad `@tanstack/react-start/server` barrel. The barrel // re-exports the SSR render handlers (renderRouterToString → react-dom/server), // which, if this module is ever reached from a client-bundled file (e.g. a // `start.ts` that registers middleware), would drag server-only render code into // the client bundle and break hydration. The narrow entry exposes the same -// helpers without the renderer. (start-server-core is a direct dependency of -// @tanstack/react-start, so it is always present.) +// helpers without the renderer or internal virtual module references. (start-server-core +// is a direct dependency of @tanstack/react-start, so it is always present.) import { getCookie, getCookies, setCookie, deleteCookie, -} from '@tanstack/start-server-core' +} from '@tanstack/start-server-core/request-response' import type { CookieHandler, CookieSerializeOptions, diff --git a/src/server/handlers.test.ts b/src/server/handlers.test.ts index b695de8..0cbd6ee 100644 --- a/src/server/handlers.test.ts +++ b/src/server/handlers.test.ts @@ -3,7 +3,7 @@ import { describe, expect, it, vi, beforeEach } from 'vitest' let currentRequest: Request let ambientResponseHeaders: Headers -vi.mock('@tanstack/start-server-core', () => ({ +vi.mock('@tanstack/start-server-core/request-response', () => ({ getRequest: () => currentRequest, getResponseHeaders: () => ambientResponseHeaders, })) diff --git a/src/server/handlers.ts b/src/server/handlers.ts index 37a0b95..ced086b 100644 --- a/src/server/handlers.ts +++ b/src/server/handlers.ts @@ -1,6 +1,6 @@ // Narrow entry (not the @tanstack/react-start/server barrel) so the SSR render // handlers are never pulled into a client-reachable graph. See cookie-handler.ts. -import { getRequest, getResponseHeaders } from '@tanstack/start-server-core' +import { getRequest, getResponseHeaders } from '@tanstack/start-server-core/request-response' import type { Auth0Instance } from './auth0-server.js' import { resolveAppBaseUrl, diff --git a/src/server/redirect-uri.test.ts b/src/server/redirect-uri.test.ts index 11269f2..d186895 100644 --- a/src/server/redirect-uri.test.ts +++ b/src/server/redirect-uri.test.ts @@ -2,7 +2,7 @@ import { describe, expect, it, vi, beforeEach } from 'vitest' let currentRequest: Request -vi.mock('@tanstack/start-server-core', () => ({ +vi.mock('@tanstack/start-server-core/request-response', () => ({ getRequest: () => currentRequest, })) diff --git a/src/server/redirect-uri.ts b/src/server/redirect-uri.ts index 899b65d..a4869d2 100644 --- a/src/server/redirect-uri.ts +++ b/src/server/redirect-uri.ts @@ -1,4 +1,4 @@ -import { getRequest } from '@tanstack/start-server-core' +import { getRequest } from '@tanstack/start-server-core/request-response' import type { Auth0Instance } from './auth0-server.js' import { resolveAppBaseUrl, From 17f378f9abe257cbf1a738fc55f0932207abbc76 Mon Sep 17 00:00:00 2001 From: Nandan Bhat Date: Tue, 15 Sep 2026 20:09:23 +0530 Subject: [PATCH 2/2] docs(server): explain the /request-response subpath choice Lead with the actual failure the subpath avoids: the package root (and the @tanstack/react-start/server barrel that re-exports it) pulls in createStartHandler, whose per-app virtual imports #tanstack-router-entry / #tanstack-start-entry can't be resolved when a downstream app pre-bundles this SDK as a dependency (e.g. Vite's dep optimizer), breaking the consumer's dev/build. Keep the SSR renderer / hydration concern as the secondary reason and align the handlers.ts note with cookie-handler.ts. --- src/server/cookie-handler.ts | 19 +++++++++++-------- src/server/handlers.ts | 6 ++++-- 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/src/server/cookie-handler.ts b/src/server/cookie-handler.ts index 1771c97..61432dd 100644 --- a/src/server/cookie-handler.ts +++ b/src/server/cookie-handler.ts @@ -1,11 +1,14 @@ -// Import the cookie/request helpers from the narrow `@tanstack/start-server-core/request-response` -// entry, NOT the broad `@tanstack/react-start/server` barrel. The barrel -// re-exports the SSR render handlers (renderRouterToString → react-dom/server), -// which, if this module is ever reached from a client-bundled file (e.g. a -// `start.ts` that registers middleware), would drag server-only render code into -// the client bundle and break hydration. The narrow entry exposes the same -// helpers without the renderer or internal virtual module references. (start-server-core -// is a direct dependency of @tanstack/react-start, so it is always present.) +// Import the cookie/request helpers from the `@tanstack/start-server-core/request-response` +// subpath, NOT the package root or the `@tanstack/react-start/server` barrel that +// re-exports it. Those roots pull in `createStartHandler`, which references the +// per-app virtual modules `#tanstack-router-entry` / `#tanstack-start-entry`; when a +// downstream app pre-bundles this SDK as a dependency (e.g. Vite's dep optimizer), +// those specifiers cannot be resolved and the consumer's `vite dev`/build fails +// during dependency optimization. The roots also drag in the SSR renderer +// (renderRouterToString → react-dom/server), which would bloat a client bundle that +// transitively reaches this module and break hydration. The `/request-response` +// subpath exposes the same helpers with neither problem — and start-server-core is a +// direct dependency of @tanstack/react-start, so it is always present. import { getCookie, getCookies, diff --git a/src/server/handlers.ts b/src/server/handlers.ts index ced086b..9f9b0fd 100644 --- a/src/server/handlers.ts +++ b/src/server/handlers.ts @@ -1,5 +1,7 @@ -// Narrow entry (not the @tanstack/react-start/server barrel) so the SSR render -// handlers are never pulled into a client-reachable graph. See cookie-handler.ts. +// Import from the `/request-response` subpath, not the package root or the +// `@tanstack/react-start/server` barrel: the root pulls in createStartHandler's +// unresolvable virtual modules (which break a consumer's dep-optimizer build) and +// the SSR renderer. See cookie-handler.ts for the full rationale. import { getRequest, getResponseHeaders } from '@tanstack/start-server-core/request-response' import type { Auth0Instance } from './auth0-server.js' import {