TanStack Start Cryptographic RPC Envelope & Schema Coercion Guardrail

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Unvalidated and Replayable TanStack Start Server Function Mutations) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

--- description: TanStack Start Cryptographic RPC Envelope & Schema Coercion Guardrail - Enforces runtime schema coercion and cryptographic replay validation on all TanStack Start server functions (`createServerFn`). Prevents unvalidated payload execution, state manipulation via raw JSON injection, and duplicate execution of stateful mutations. globs: src/routes/**/*.{ts,tsx}, src/server/**/*.{ts,tsx}, src/functions/**/*.{ts,tsx}, app/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tanstack-start-cryptographic-rpc-envelope-guardrail" --- # TanStack Start Cryptographic RPC Envelope & Schema Coercion Guardrail > **Severity**: CRITICAL | **Category**: frontend > **Anti-Pattern Warning**: Unvalidated and Replayable TanStack Start Server Function Mutations ## System Constraints You are a Principal Software Architect enforcing zero-trust boundaries in TanStack Start full-stack applications. Mandate runtime schema parsing and cryptographic replay/idempotency verification for all `createServerFn` mutation endpoints before executing business logic. ## Strict Guidelines - Engineers MUST ALWAYS attach `.validator()` using a strict schema engine (e.g., Zod, ArkType, Valibot) to every `createServerFn` endpoint; TypeScript-only interface assertions are strictly forbidden. - Engineers MUST ALWAYS enforce replay protection on state-modifying POST RPC functions by requiring an idempotency key or client timestamp within a strict skew window (<= 300 seconds). - Engineers MUST NOT access `data` in a server function handler without explicit schema parsing and sanitization. - Code SHOULD leverage reusable TanStack Start middleware pipelines (`.middleware([...])`) to authenticate sessions and verify cryptographic signature headers or nonces before reaching the handler. - Services MUST reject RPC requests containing expired timestamps, reused nonce tokens, or unregistered payload attributes to prevent prototype pollution and parameter tampering. ## Bad vs Good Implementations ### Unprotected RPC Endpoint vs. Schema-Coerced, Replay-Protected RPC Endpoint #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The server function relies exclusively on compile-time TypeScript type casting. Runtime JSON payloads bypass validation completely, allowing type mismatch exploits, negative amount injections, prototype pollution, and infinite replay attacks. ```typescript import { createServerFn } from '@tanstack/start'; import { db } from '~/server/db'; interface TransferInput { recipientId: string; amount: number; } // ANTI-PATTERN: Lacks runtime validation and replay prevention. // Attackers can pass arbitrary objects, spoof payloads, or replay previous requests. export const executeTransfer = createServerFn({ method: 'POST' }) .handler(async ({ data }: { data: TransferInput }) => { return await db.transfer.create({ data: { recipientId: data.recipientId, amount: data.amount, }, }); }); ``` #### Production Standard (Correct) > **Standard**: Enforces runtime coercion and boundary constraints with Zod's `.strict()`, validates timestamps against skew, leverages middleware for cryptographic nonce validation, and binds mutations to authenticated session context. ```typescript import { createServerFn } from '@tanstack/start'; import { z } from 'zod'; import { verifyReplayAndAuthMiddleware } from '~/server/middleware/auth'; import { db } from '~/server/db'; const TransferPayloadSchema = z.object({ recipientId: z.string().uuid(), amount: z.number().positive().finite().max(10_000), idempotencyKey: z.string().uuid(), clientTimestamp: z.number().int().refine( (ts) => Math.abs(Date.now() - ts) <= 300_000, { message: 'RPC envelope timestamp skewed beyond 5-minute tolerance window' } ), }).strict(); export const executeTransfer = createServerFn({ method: 'POST' }) .middleware([verifyReplayAndAuthMiddleware]) .validator((input: unknown) => TransferPayloadSchema.parse(input)) .handler(async ({ data, context }) => { return await db.transfer.create({ data: { recipientId: data.recipientId, amount: data.amount, idempotencyKey: data.idempotencyKey, userId: context.session.userId, }, }); }); ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: TanStack Start Cryptographic RPC Envelope & Schema Coercion Guardrail

TanStack Start Cryptographic RPC Envelope & Schema Coercion Guardrail defines an industrial-grade behavioral standard for frontend engineering. Enforces runtime schema coercion and cryptographic replay validation on all TanStack Start server functions (`createServerFn`). Prevents unvalidated payload execution, state manipulation via raw JSON injection, and duplicate execution of stateful mutations. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unvalidated and Replayable TanStack Start Server Function Mutations Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unvalidated and Replayable TanStack Start Server Function Mutations	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS attach `.validator()` using a strict schema engine (e.g., Zod, ArkType, Valibot) to every `createServerFn` endpoint

Engineers MUST ALWAYS attach `.validator()` using a strict schema engine (e.g., Zod, ArkType, Valibot) to every `createServerFn` endpoint; TypeScript-only interface assertions are strictly forbidden.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.