Importing middleware registers unrelated token-returning ServerFns

[hudson155]

Describe the bug

Could be missing an intended import path here, but importing only authkitMiddleware or handleCallbackRoute from the package root causes every ServerFn exported by dist/server/index.js to be registered in the production server build.

That includes getAuth, getAccessTokenAction, refreshAccessTokenAction, and switchToOrganization. Several of those responses include the access token.

We don't import or use those helpers. This app keeps the access token behind server-owned handlers, so we need the maintained middleware, callback, and request context without also registering caller-addressable token RPCs.

To Reproduce

1. Install @workos/authkit-tanstack-react-start@0.11.0 with TanStack Start.
2. Import only the middleware from the package root:

import { createStart } from '@tanstack/react-start';
import { authkitMiddleware } from '@workos/authkit-tanstack-react-start';

export const startInstance = createStart(() => ({
  requestMiddleware: [authkitMiddleware()],
}));

3. Run a production build.
4. Inspect the emitted server-function registry/server bundle.
5. Observe that the package's unrelated ServerFns are present even though application source never imports them.

For example:

rg 'getAuth|getAccessTokenAction|refreshAccessTokenAction|switchToOrganization' .output/server

Expected behavior

Importing the middleware or callback shouldn't require evaluating the barrel that defines unrelated ServerFns.

Would you be open to supported narrow server exports for the existing built modules? Something along these lines would cover the use case without changing any runtime code:

{
  "./middleware": {
    "types": "./dist/server/middleware.d.ts",
    "import": "./dist/server/middleware.js"
  },
  "./callback": {
    "types": "./dist/server/server.d.ts",
    "import": "./dist/server/server.js"
  },
  "./context": {
    "types": "./dist/server/context.d.ts",
    "import": "./dist/server/context.js"
  },
  "./authkit": {
    "types": "./dist/server/authkit-loader.d.ts",
    "import": "./dist/server/authkit-loader.js"
  }
}

The exact subpath names aren't important; the useful boundary is being able to consume those maintained server modules without loading server-functions.js or actions.js.

Screenshots

N/A.

Desktop

• OS: macOS 26.5.1
• Browser: N/A; this is production server output
• @workos/authkit-tanstack-react-start: 0.11.0
• @tanstack/react-start: 1.168.32
• Node.js: 26.5.0
• pnpm: 11.15.1

Additional context

The client bundle doesn't contain these functions. The issue is that TanStack registers them as server functions when the root barrel is evaluated.

A package-manager export-map patch works around it locally, but an upstream subpath would be much easier to keep correct across upgrades. Happy to send the small export-map PR if this shape makes sense.