Greptile Summary

This PR adds noExternal configuration to bundle iron-webcrypto and uint8array-extras into the build output. These packages are ESM-only and cause ERR_REQUIRE_ESM errors when CJS consumers try to import them.

Changes:

• Added noExternal: ['iron-webcrypto', 'uint8array-extras'] to tsdown.config.ts
• Ensures ESM-only dependencies are bundled for CJS compatibility while keeping other deps external via unbundle: true

Context:
The iron-webcrypto v2.0.0 dependency was recently introduced in #1416 to replace iron-session, and it has a transitive dependency on uint8array-extras, both of which only publish ESM. This change is essential for CJS consumers who would otherwise encounter import errors.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The change is a straightforward build configuration fix that addresses a real compatibility issue. The solution is correct: using noExternal to bundle ESM-only dependencies while maintaining unbundle: true for other deps. Both packages are MIT licensed, small in size, and already direct/transitive dependencies.
• No files require special attention

Important Files Changed

Sequence Diagram

sequenceDiagram
    participant CJS as CJS Consumer
    participant PKG as @workos-inc/node (CJS)
    participant IRON as iron-webcrypto (bundled)
    participant U8A as uint8array-extras (bundled)
    
    Note over CJS,U8A: Build Process (tsdown)
    Note over PKG: unbundle: true<br/>(deps stay external by default)
    Note over IRON,U8A: noExternal: ['iron-webcrypto', 'uint8array-extras']<br/>(bundle these ESM-only deps)
    
    Note over CJS,U8A: Runtime Usage
    CJS->>PKG: require('@workos-inc/node')
    Note over PKG: CJS build (lib/index.cjs)
    PKG->>IRON: uses bundled iron-webcrypto
    Note over IRON: No ERR_REQUIRE_ESM!<br/>(bundled as CJS)
    IRON->>U8A: uses bundled uint8array-extras
    Note over U8A: No ERR_REQUIRE_ESM!<br/>(bundled as CJS)
    U8A-->>IRON: returns
    IRON-->>PKG: seal/unseal functions
    PKG-->>CJS: WorkOS SDK methods