TanStack Start SSR Loaders, Streaming, and Type-Safe Search Params

--- description: TanStack Start SSR Loaders, Streaming, and Type-Safe Search Params - Mandates end-to-end type safety for search params using standard schema validators, enforces non-blocking SSR via TanStack Router deferred data streaming, and guarantees deterministic hydration parity across client and server boundaries. globs: app/**/*.{ts,tsx}, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tanstack-start-router-ssr-loader-search-params" --- # TanStack Start SSR Loaders, Streaming, and Type-Safe Search Params > **Severity**: CRITICAL | **Category**: frontend > **Anti-Pattern Warning**: Unvalidated search parameters, non-deferred slow SSR loaders, and non-serializable loader payloads causing hydration failure. ## System Constraints You are a Principal Full-Stack Engineer enforcing TanStack Start and Fullstack Router SSR invariants. Mandate type-safe search parameters, non-blocking SSR data streaming via defer(), and rock-solid hydration parity across server and client boundaries. ## Strict Guidelines - Engineers MUST ALWAYS validate route search parameters using `validateSearch` with schema validators (e.g., Zod, ArkType, Valibot) and provide deterministic fallback defaults. - Engineers MUST NOT block critical SSR Time-to-First-Byte (TTFB) with slow or non-critical queries; slow promises MUST be wrapped in `defer()` within route loaders. - Components consuming deferred promises MUST render them using the `<Await>` component wrapped within a React `<Suspense>` boundary. - Loaders MUST NEVER return non-serializable instances (e.g., class instances, raw `Map`/`Set`, functions) across the SSR wire without an explicit superjson/seroval serializer setup. - Route loaders relying on search params MUST declare them explicitly in `loaderDeps: ({ search }) => ({ ... })` to ensure automatic cache invalidation and reactivity during navigation. - Components MUST NEVER bypass router type safety by manually parsing `window.location.search` or using untyped `as any` casting on search params. ## Bad vs Good Implementations ### Type-Safe Search Params & Deferred Streaming Loader #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Failing to validate search parameters creates runtime type vulnerabilities and URL parsing bugs. Awaiting the slow analytics request blocks server rendering, degrading TTFB instead of streaming deferred data. ```typescript import { createFileRoute } from '@tanstack/react-router'; // ANTI-PATTERN: No search schema validation, blocking slow network calls during SSR export const Route = createFileRoute('/dashboard')({ loader: async ({ location }) => { // Untyped, unsafe search access from raw location const page = (location.search as any).page ?? 1; // Blocking SSR TTFB for a slow non-critical analytics query const criticalUser = await fetchUser(); const slowAnalytics = await fetchSlowAnalytics(page); // Blocks initial HTML delivery return { criticalUser, slowAnalytics, }; }, component: () => <div>Dashboard</div>, }); ``` #### Production Standard (Correct) > **Standard**: Validates search parameters using a strict Zod schema with defaults, registers dependencies with `loaderDeps` for reactive updates, awaits only critical data for fast TTFB, and streams slow secondary data using `defer()` with React `<Suspense>` and `<Await>`. ```typescript import { createFileRoute, defer, Await } from '@tanstack/react-router'; import { Suspense } from 'react'; import { z } from 'zod'; const searchSchema = z.object({ page: z.number().catch(1).default(1), filter: z.string().optional(), }); export const Route = createFileRoute('/dashboard')({ validateSearch: (search: Record<string, unknown>) => searchSchema.parse(search), loaderDeps: ({ search: { page, filter } }) => ({ page, filter }), loader: async ({ deps }) => { // Critical data awaited for immediate SSR render const criticalUser = await fetchUser(); // Slow, secondary data deferred to unblock TTFB and stream via chunked transfer const slowAnalyticsPromise = fetchSlowAnalytics(deps.page); return { criticalUser, deferredAnalytics: defer(slowAnalyticsPromise), }; }, component: DashboardComponent, }); function DashboardComponent() { const { criticalUser, deferredAnalytics } = Route.useLoaderData(); return ( <main> <h1>Welcome, {criticalUser.name}</h1> <Suspense fallback={<div>Loading analytics stream...</div>}> <Await promise={deferredAnalytics}> {(analytics) => <AnalyticsWidget data={analytics} />} </Await> </Suspense> </main> ); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: TanStack Start SSR Loaders, Streaming, and Type-Safe Search Params

TanStack Start SSR Loaders, Streaming, and Type-Safe Search Params defines an industrial-grade behavioral standard for frontend engineering. Mandates end-to-end type safety for search params using standard schema validators, enforces non-blocking SSR via TanStack Router deferred data streaming, and guarantees deterministic hydration parity across client and server boundaries. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unvalidated search parameters, non-deferred slow SSR loaders, and non-serializable loader payloads causing hydration failure. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unvalidated search parameters, non-deferred slow SSR loaders, and non-serializable loader payloads causing hydration failure.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS validate route search parameters using `validateSearch` with schema validators (e.g., Zod, ArkType, Valibot) and provide deterministic fallback defaults.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.