`@convex-dev/better-auth/react-start` causes SSR code to leak into client bundle with `@cloudflare/vite-plugin`

[jasongitmail]

(Issue written by Opus 4.5 :)

When using @convex-dev/better-auth/react-start with TanStack Start and the new @cloudflare/vite-plugin, the production build fails because SSR code is being bundled into the client.

Error

  node_modules/@tanstack/router-core/dist/esm/ssr/transformStreamWithRouter.js (2:9):
  "Readable" is not exported by "__vite-browser-external"

  1: import { ReadableStream } from "node:stream/web";
  2: import { Readable } from "node:stream";
              ^

Root Cause

In @convex-dev/better-auth/dist/react-start/index.js, there's a dynamic import:

  const { getRequestHeaders } = await import("@tanstack/react-start/server");

Even though this is a dynamic import inside an async function, the bundler includes @tanstack/react-start/server in the client bundle. This module transitively imports SSR-specific code from @tanstack/router-core/ssr/ which references node:stream - a Node.js API that doesn't exist in the browser/Cloudflare Workers environment.

Reproduction

1. Use @convex-dev/better-auth/react-start in a TanStack Start project
2. Import convexBetterAuthReactStart in a server function file
3. Import that server function in __root.tsx (even if only called in beforeLoad)
4. Configure vite with @cloudflare/vite-plugin
5. Run vite build

Environment

• @convex-dev/better-auth: 0.10.9
• @tanstack/react-start: 1.139.12 - 1.145.3 (tested multiple versions)
• @cloudflare/vite-plugin: 1.15.3
• vite: 7.1.2

Expected Behavior

The build should succeed. Server-only imports should not leak into the client bundle.

Possible Fix

The dynamic import of @tanstack/react-start/server needs to be properly isolated so the bundler doesn't include it in the client build. Options:

1. Use import.meta.env.SSR check before the import
2. Move the import to a separate entry point that's explicitly server-only
3. Use bundler hints like /* @vite-ignore */ or restructure to avoid the import being traced

Workaround

Currently, the only workaround is to use TanStack Start's older target: "cloudflare-module" pattern instead of the new @cloudflare/vite-plugin, but this has other issues (blake3-wasm errors in dev).

[jasongitmail]

Specific Suggested Fix

Add the /* @vite-ignore */ comment to the dynamic import in src/react-start/index.ts:

- const { getRequestHeaders } = await import("@tanstack/react-start/server");
+ const { getRequestHeaders } = await import(
+   /* @vite-ignore */ "@tanstack/react-start/server"
+ );

This tells Vite to skip bundling analysis of this import, preventing SSR code from leaking into the client bundle.