$npx -y skills add DeckardGer/tanstack-agent-skills --skill tanstack-startTanStack Start best practices for full-stack React applications. Server functions, middleware, SSR, authentication, and deployment patterns. Activate when building full-stack apps with TanStack Start.
| 1 | # TanStack Start Best Practices |
| 2 | |
| 3 | Comprehensive guidelines for implementing TanStack Start patterns in full-stack React applications. These rules cover server functions, middleware, SSR, authentication, and deployment. |
| 4 | |
| 5 | ## When to Apply |
| 6 | |
| 7 | - Creating server functions for data mutations |
| 8 | - Setting up middleware for auth/logging |
| 9 | - Configuring SSR and hydration |
| 10 | - Implementing authentication flows |
| 11 | - Handling errors across client/server boundary |
| 12 | - Organizing full-stack code |
| 13 | - Deploying to various platforms |
| 14 | |
| 15 | ## Rule Categories by Priority |
| 16 | |
| 17 | | Priority | Category | Rules | Impact | |
| 18 | |----------|----------|-------|--------| |
| 19 | | CRITICAL | Server Functions | 5 rules | Core data mutation patterns | |
| 20 | | CRITICAL | Security | 4 rules | Prevents vulnerabilities | |
| 21 | | HIGH | Middleware | 4 rules | Request/response handling | |
| 22 | | HIGH | Authentication | 4 rules | Secure user sessions | |
| 23 | | MEDIUM | API Routes | 1 rule | External endpoint patterns | |
| 24 | | MEDIUM | SSR | 6 rules | Server rendering patterns | |
| 25 | | MEDIUM | Error Handling | 3 rules | Graceful failure handling | |
| 26 | | MEDIUM | Environment | 1 rule | Configuration management | |
| 27 | | LOW | File Organization | 3 rules | Maintainable code structure | |
| 28 | | LOW | Deployment | 2 rules | Production readiness | |
| 29 | |
| 30 | ## Quick Reference |
| 31 | |
| 32 | ### Server Functions (Prefix: `sf-`) |
| 33 | |
| 34 | - `sf-create-server-fn` — Use createServerFn for server-side logic |
| 35 | - `sf-input-validation` — Always validate server function inputs |
| 36 | - `sf-method-selection` — Choose appropriate HTTP method |
| 37 | - `sf-error-handling` — Handle errors in server functions |
| 38 | - `sf-response-headers` — Customize response headers when needed |
| 39 | |
| 40 | ### Security (Prefix: `sec-`) |
| 41 | |
| 42 | - `sec-validate-inputs` — Validate all user inputs with schemas |
| 43 | - `sec-auth-middleware` — Protect routes with auth middleware |
| 44 | - `sec-sensitive-data` — Keep secrets server-side only |
| 45 | - `sec-csrf-protection` — Implement CSRF protection for mutations |
| 46 | |
| 47 | ### Middleware (Prefix: `mw-`) |
| 48 | |
| 49 | - `mw-request-middleware` — Use request middleware for cross-cutting concerns |
| 50 | - `mw-function-middleware` — Use function middleware for server functions |
| 51 | - `mw-context-flow` — Properly pass context through middleware |
| 52 | - `mw-composability` — Compose middleware effectively |
| 53 | |
| 54 | ### Authentication (Prefix: `auth-`) |
| 55 | |
| 56 | - `auth-session-management` — Implement secure session handling |
| 57 | - `auth-route-protection` — Protect routes with beforeLoad |
| 58 | - `auth-server-functions` — Verify auth in server functions |
| 59 | - `auth-cookie-security` — Configure secure cookie settings |
| 60 | |
| 61 | ### API Routes (Prefix: `api-`) |
| 62 | |
| 63 | - `api-routes` — Create API routes for external consumers |
| 64 | |
| 65 | ### SSR (Prefix: `ssr-`) |
| 66 | |
| 67 | - `ssr-data-loading` — Load data appropriately for SSR |
| 68 | - `ssr-hydration-safety` — Prevent hydration mismatches |
| 69 | - `ssr-streaming` — Implement streaming SSR for faster TTFB |
| 70 | - `ssr-selective` — Apply selective SSR when beneficial |
| 71 | - `ssr-prerender` — Configure static prerendering and ISR |
| 72 | |
| 73 | ### Environment (Prefix: `env-`) |
| 74 | |
| 75 | - `env-functions` — Use environment functions for configuration |
| 76 | |
| 77 | ### Error Handling (Prefix: `err-`) |
| 78 | |
| 79 | - `err-server-errors` — Handle server function errors |
| 80 | - `err-redirects` — Use redirects appropriately |
| 81 | - `err-not-found` — Handle not-found scenarios |
| 82 | |
| 83 | ### File Organization (Prefix: `file-`) |
| 84 | |
| 85 | - `file-separation` — Separate server and client code |
| 86 | - `file-functions-file` — Use .functions.ts pattern |
| 87 | - `file-shared-validation` — Share validation schemas |
| 88 | |
| 89 | ### Deployment (Prefix: `deploy-`) |
| 90 | |
| 91 | - `deploy-env-config` — Configure environment variables |
| 92 | - `deploy-adapters` — Choose appropriate deployment adapter |
| 93 | |
| 94 | ## How to Use |
| 95 | |
| 96 | Each rule file in the `rules/` directory contains: |
| 97 | 1. **Explanation** — Why this pattern matters |
| 98 | 2. **Bad Example** — Anti-pattern to avoid |
| 99 | 3. **Good Example** — Recommended implementation |
| 100 | 4. **Context** — When to apply or skip this rule |
| 101 | |
| 102 | ## Full Reference |
| 103 | |
| 104 | See individual rule files in `rules/` directory for detailed guidance and code examples. |