Critical rules: a server function is an independent HTTP endpoint reachable directly, so a route's beforeLoad redirect protects the UI only — auth must live inside the handler or its middleware for every function touching private data; never use Next.js/Remix patterns ("use server", getServerSideProps, Remix loader/action); loaders are isomorphic, so DB/secrets/filesystem access belongs in a server function, never a loader; useServerFn is mandatory when a function throws redirect() or notFound() (optional otherwise); and strict serialization is on by default (FormData allowed as POST input, Response as output).

Includes templates for a full CRUD module and for FormData submissions with Zod validation.

Do NOT use this skill for raw external/public HTTP endpoints (use start-server-routes), for composable middleware chains (use start-middleware), or for Next.js/Remix "use server" patterns.

TanStack Start Server Functions

Server functions are same-origin, type-safe RPC endpoints created with createServerFn. They run only on the server but are callable from loaders, components, hooks, and other server functions. This skill targets @tanstack/react-start v1.166.2.

Agent Workflow (MANDATORY)