Nitro + Tanstack Start | cannot use server-only package pub-sub-api-node-client in production

[nktnet1]

Environment

nitro: npm:nitro-nightly@latest
node: v24.9.0

Reproduction

Minimal reproducible example:

• https://github.com/nktnet-bug-report/sf-pubsub-api-test

Instructions are in the project's README.md

click to view

Setup

pnpm install
cp .env.example .env

Set up env as per ./.env.example

Development

pnpm dev

Click on the green "Salesforce Pubsub Test" button or go to http://localhost:3000/sf-pubsub

Observe that there are no errors.

Production

Install the dotenv CLI tool is install to read from .env.

Bug 1 - no such file (cert)

Error: ENOENT: no such file or directory, open '/path/.output/server/_libs/cacert-2ebcb9e8.pem'

pnpm build && dotenv -f .env run node .output/server/index.mjs

Bug 2 - fs is null

TypeError: Cannot read properties of null (reading 'readFileSync')

pnpm build && cp ./node_modules/salesforce-pubsub-api-client/dist/*.pem .output/server/_libs/ && dotenv -f .env run node .output/server/index.mjs

Describe the bug

Full details in this original issue:

• [Bug] bundled CA root certificates not found in production pozil/pub-sub-api-node-client#85

Basically, the library pub-sub-api-node-client cannot be used in production (works fine in development). The library author suggested that it might be because of the bundling process (pozil/pub-sub-api-node-client#85 (comment)).

Main issues are the library's cert file not being found, and fs being null (but only in the context of the @grpc/grpc-js's proto-loader package).

Additional context

There are two separate issues as noted in the README.md of the reproducible example:

• https://github.com/nktnet-bug-report/sf-pubsub-api-test

When using Next.JS, the library works fine (with a small hiccup where I needed to use turbopackMinify: false).

I've also cross-posted here (not sure if it's a nitro issue or tanstack start issue):

• Tanstack Start cannot use server-only package pub-sub-api-node-client in production TanStack/router#6450

Logs

Issue 1:

Connecting to Pub/Sub API
Failed to connect Error: Failed to connect to Pub/Sub API
    at PubSubApiClient.connect (file:///path/.output/server/_libs/salesforce-pubsub-api-client.mjs:17403:10)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    ... 5 lines matching cause stack trace ...
    at async file:///path/.output/server/_libs/@orpc/client.mjs:676:36
    at async file:///path/.output/server/_libs/@orpc/client.mjs:103:20
    at async file:///path/.output/server/_libs/@orpc/client.mjs:678:12 {
  [cause]: Error: ENOENT: no such file or directory, open '/path/.output/server/_libs/cacert-2ebcb9e8.pem'
      at Object.openSync (node:fs:560:18)
      at Object.readFileSync (node:fs:444:35)
      at PubSubApiClient.connect (file:///path/.output/server/_libs/salesforce-pubsub-api-client.mjs:17387:24)

Issue 2:

Connecting to Pub/Sub API
Failed to connect Error: Failed to connect to Pub/Sub API
    at PubSubApiClient.connect (file:///path/.output/server/_libs/salesforce-pubsub-api-client.mjs:17403:10)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    ... 2 lines matching cause stack trace ...
    at async file:///path/.output/server/_libs/@orpc/client.mjs:155:19
    at async file:///path/.output/server/_libs/@orpc/client.mjs:103:20
    at async file:///path/.output/server/_libs/@orpc/client.mjs:678:12
    at async file:///path/.output/server/_libs/@orpc/client.mjs:676:36
    at async file:///path/.output/server/_libs/@orpc/client.mjs:103:20
    at async file:///path/.output/server/_libs/@orpc/client.mjs:678:12 {
  [cause]: TypeError: Cannot read properties of null (reading 'readFileSync')
      at fetch$1 (file:///path/.output/server/_libs/@grpc/grpc-js.mjs:6263:25)
      at Root$3.load$3 [as load] (file:///path/.output/server/_libs/@grpc/grpc-js.mjs:6287:115)
      at Root$3.loadSync$2 [as loadSync] (file:///path/.output/server/_libs/@grpc/grpc-js.mjs:6297:15)
      at loadProtosWithOptionsSync (file:///path/.output/server/_libs/@grpc/grpc-js.mjs:8818:29)
      at Object.loadSync (file:///path/.output/server/_libs/@grpc/grpc-js.mjs:9772:73)
      at PubSubApiClient.connect (file:///path/.output/server/_libs/salesforce-pubsub-api-client.mjs:17389:44)
      at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
      at async initPubsub (file:///path/.output/server/_ssr/router-BHZW07Zt.mjs:196:3)
      at async Object.handler (file:///path/.output/server/_ssr/router-BHZW07Zt.mjs:223:2)
      at async file:///path/.output/server/_libs/@orpc/client.mjs:155:19
}