Tanstack start server functions
Skill MakFly/superpowers-tanstack-start/skills/tanstack-start-server-functions
Implement, secure, review, or debug TanStack Start server functions. Use for createServerFn handlers, input validation, request context, redirects, not-found results, raw responses, progressive enhancement, streaming, static functions, cancellation, serialization, or server-only data access.From its SKILL.md
npx -y skills add MakFly/superpowers-tanstack-start --skill tanstack-start-server-functionsAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
1.7 KB, 268 tokens by cl100k_base, as published. Nobody here has run it
TanStack Start Server Functions
Confirm the boundary
Read ../../docs/server-functions.md and ../../docs/execution-boundaries.md. Use a server function for application RPC. Use a server route when an external caller needs an ordinary HTTP contract.
Build the request pipeline
- Define one explicit serializable input object.
- Validate it before domain work.
- Resolve request context and session per request.
- Authenticate and authorize access to the concrete resource or tenant.
- Call server-only domain or data modules.
- Return an explicit serializable result, framework redirect/not-found value, or intentional raw
Response.
Preserve Start's same-origin protection. Never move secrets or trusted authorization decisions into client-callable code.
Keep code focused
Keep handlers thin and put reusable domain logic in server-only modules. Use middleware only for repeated cross-cutting context. Do not add generic error swallowing, hidden defaults, or a fallback value that masks a failed dependency.
Verify
Test malformed input, anonymous access, unauthorized resource access, success, domain failure, redirect, and not-found behavior. Inspect client output when a server-only import or secret could leak. Run a production build to exercise function ID generation and import protection.
Report the endpoint contract, security checks, serialization choices, and tests run.
What ships with it: 1 file
225 B alongside SKILL.md
agents/
- openai.yaml225 B