TanStack Start Server Functions

Confirm the boundary

Read ../../docs/server-functions.md and ../../docs/execution-boundaries.md. Use a server function for application RPC. Use a server route when an external caller needs an ordinary HTTP contract.

Build the request pipeline

1. Define one explicit serializable input object.
2. Validate it before domain work.
3. Resolve request context and session per request.
4. Authenticate and authorize access to the concrete resource or tenant.
5. Call server-only domain or data modules.
6. Return an explicit serializable result, framework redirect/not-found value, or intentional raw Response.

Preserve Start's same-origin protection. Never move secrets or trusted authorization decisions into client-callable code.

Keep code focused