fix: whitespace in server function .handler() not matching compiler regex

[kylekz]

with a server function like so:

const $submitFunction = createServerFn({
  method: 'POST'
})
.middleware([authMiddleware])
.handler(async () => {
  return await db.select().from(songs).limit(1);
});

for whatever reason, vite sometimes passes the transformed code to the start compiler like so:

const $submitFunction = createServerFn({
  method: 'POST'
}).
middleware([authMiddleware]).
handler(async () => {
  return await db.select().from(songs).limit(1);
});

when there's whitespace between . and handler(, the compiler doesn't detect the server function and this can leak server code

Summary by CodeRabbit

• Bug Fixes

  • Improved compiler detection to recognize both factory-style server-function creation and chained handler usages across varied formatting, reducing false positives without altering public interfaces.

• Tests

  • Expanded coverage for additional pattern scenarios, whitespace/formatting variants, and to reject similarly named functions.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

📝 Walkthrough

Walkthrough

Broadened ServerFn pre-scan detection: the regex now matches createServerFn(...) factory calls and chained .handler(...) usages including whitespace variants. Tests were added for whitespace variants, direct createServerFn detection, and false-positive avoidance; detectKindsInCode import added to tests.

Changes

Cohort / File(s)	Summary
Compiler Pattern Detection packages/start-plugin-core/src/start-compiler-plugin/compiler.ts	Broadened ServerFn pre-detection regex from /\.handler\s*\(/ to `/\bcreateServerFn\b
Tests / Detection Cases packages/start-plugin-core/tests/compiler.test.ts	Added tests for whitespace between . and handler (multiple variants), direct createServerFn() detection, and ensuring no false positives for similarly named identifiers; detectKindsInCode imported alongside StartCompiler.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix: trace nested server function factory re-export chain #6166 — related changes around createServerFn detection and chained .handler usage.
• fix: ignore whitespace when detecting handler and createMiddleware calls #5458 — similar regex updates to accept method-style .handler patterns and optional whitespace handling.

Poem

🐰 I hopped through code and regex trails,
Spotted factories and dotted sails,
Spaces, handlers, names made right,
Tests cheered softly in the night,
A rabbit nods — the patterns prevail.

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: fixing a regex pattern to detect .handler() calls with whitespace, which is the core issue addressed by broadening the KindDetectionPatterns regex in the compiler.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between fb7444c and 016fc61.

📒 Files selected for processing (1)

• packages/start-plugin-core/src/start-compiler-plugin/compiler.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/start-plugin-core/src/start-compiler-plugin/compiler.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

packages/start-plugin-core/src/start-compiler-plugin/compiler.ts (1)

90-90: Critical security fix: LGTM with optional enhancement suggestion.

The regex update correctly addresses the reported security issue where server code could leak to the client when whitespace appears between the dot and handler(). The pattern \.\s*handler\s*\( properly matches method chains with whitespace/newlines, and adding createServerFn\s*\( provides broader coverage for edge cases in reformatted code.

Optional: Add word boundary for more precise matching

Consider adding a word boundary \b before createServerFn to prevent potential false positives like mycreateServerFn():

-  ServerFn: /createServerFn\s*\(|\.\s*handler\s*\(/,
+  ServerFn: /\bcreateServerFn\s*\(|\.\s*handler\s*\(/,

Note: This is a minor improvement since the pre-scan is validated by AST parsing, so the current implementation is acceptable.

📜 Review details

Configuration used: defaults

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 8e4cf5b and c4589d0.

📒 Files selected for processing (2)

• packages/start-plugin-core/src/start-compiler-plugin/compiler.ts
• packages/start-plugin-core/tests/compiler.test.ts

🧰 Additional context used

📓 Path-based instructions (2)

**/*.{ts,tsx}

📄 CodeRabbit inference engine (AGENTS.md)

Use TypeScript strict mode with extensive type safety for all code

Files:

• packages/start-plugin-core/src/start-compiler-plugin/compiler.ts
• packages/start-plugin-core/tests/compiler.test.ts

**/*.{js,ts,tsx}

📄 CodeRabbit inference engine (AGENTS.md)

Implement ESLint rules for router best practices using the ESLint plugin router

Files:

• packages/start-plugin-core/src/start-compiler-plugin/compiler.ts
• packages/start-plugin-core/tests/compiler.test.ts

🧬 Code graph analysis (1)

packages/start-plugin-core/tests/compiler.test.ts (1)

packages/start-plugin-core/src/start-compiler-plugin/compiler.ts (1)

• detectKindsInCode (146-162)

🔇 Additional comments (2)

packages/start-plugin-core/tests/compiler.test.ts (2)

4-4: Good addition to test API.

Importing detectKindsInCode enables direct testing of the detection patterns, which is appropriate for validating the regex fix.

---

204-231: Excellent test coverage for the security fix.

These tests thoroughly validate the bug fix and prevent regressions:

1. Lines 204-213: Directly test the reported issue (whitespace/newlines between . and handler)
2. Lines 215-222: Validate the complementary improvement (direct createServerFn() detection)
3. Lines 224-231: Prevent false positives on similarly-named functions like createServerFnExample()

The test cases cover critical edge cases including various whitespace combinations (\n, \t, multiple spaces) that could appear in reformatted code.

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 016fc61

Command	Status	Duration	Result
nx affected --targets=test:eslint,test:unit,tes...	✅ Succeeded	8m 7s	View ↗
nx run-many --target=build --exclude=examples/*...	✅ Succeeded	21s	View ↗

---

☁️ Nx Cloud last updated this comment at 2025-12-25 14:02:19 UTC

[pkg-pr-new]

More templates

• tanstack-router-vue-example-basic-jsx
• tanstack-router-vue-example-basic-file-based-jsx
• tanstack-router-vue-example-basic-file-based-sfc
• tanstack-router-react-example-authenticated-routes
• tanstack-router-react-example-authenticated-routes-firebase
• tanstack-router-react-example-basic
• tanstack-router-react-example-basic-default-search-params
• tanstack-router-react-example-basic-devtools-panel
• tanstack-router-react-example-basic-file-based
• tanstack-router-react-example-basic-non-nested-devtools
• tanstack-router-react-example-react-query
• tanstack-router-react-example-basic-react-query-file-based
• tanstack-router-react-example-basic-ssr-file-based
• tanstack-router-react-example-basic-ssr-streaming-file-based
• tanstack-router-react-example-basic-virtual-file-based
• tanstack-router-react-example-basic-virtual-inside-file-based
• tanstack-router-react-example-deferred-data
• tanstack-router-i18n-paraglide
• tanstack-router-react-example-kitchen-sink
• tanstack-router-react-example-kitchen-sink-file-based
• tanstack-router-react-example-kitchen-sink-react-query
• tanstack-router-react-example-kitchen-sink-react-query-file-based
• tanstack-router-react-example-large-file-based
• tanstack-router-react-example-location-masking
• tanstack-router-react-example-navigation-blocking
• tanstack-router-react-example-quickstart
• tanstack-router-react-example-quickstart-esbuild-file-based
• tanstack-router-react-example-quickstart-file-based
• tanstack-router-react-example-quickstart-rspack-file-based
• tanstack-router-react-example-quickstart-webpack-file-based
• router-monorepo-react-query
• router-mono-simple
• router-mono-simple-lazy
• tanstack-router-react-example-scroll-restoration
• tanstack-search-validator-adapters
• tanstack-start-example-bare
• tanstack-start-example-basic
• tanstack-start-example-basic-auth
• tanstack-router-react-example-basic-authjs
• tanstack-start-example-basic-cloudflare
• tanstack-start-example-basic-react-query
• tanstack-start-example-basic-rsc
• tanstack-start-example-basic-static
• tanstack-start-bun-hosting
• tanstack-start-example-clerk-basic
• tanstack-start-example-convex-trellaux
• tanstack-start-example-counter
• tanstack-start-i18n-paraglide
• tanstack-start-example-large
• tanstack-start-example-material-ui
• tanstack-start-streaming-data-from-server-functions
• tanstack-start-example-supabase-basic
• tanstack-start-tailwind-v4
• tanstack-start-example-trellaux
• tanstack-start-example-workos
• tanstack-router-react-example-view-transitions
• tanstack-router-react-example-with-framer-motion
• tanstack-router-react-example-with-trpc
• tanstack-router-react-example-with-trpc-react-query
• tanstack-router-solid-example-authenticated-routes
• tanstack-router-solid-example-authenticated-routes-firebase
• tanstack-router-solid-example-basic
• tanstack-router-solid-example-basic-default-search-params
• tanstack-router-solid-example-basic-devtools-panel
• tanstack-router-solid-example-basic-file-based
• tanstack-router-solid-example-basic-non-nested-devtools
• tanstack-router-solid-example-basic-solid-query
• tanstack-router-solid-example-basic-solid-query-file-based
• tanstack-router-solid-example-basic-ssr-file-based
• tanstack-router-solid-example-basic-ssr-streaming-file-based
• tanstack-router-solid-example-basic-virtual-file-based
• tanstack-router-solid-example-basic-virtual-inside-file-based
• tanstack-router-solid-example-deferred-data
• tanstack-router-solid-i18n-paraglide
• tanstack-router-solid-example-kitchen-sink
• tanstack-router-solid-example-kitchen-sink-file-based
• tanstack-router-solid-example-kitchen-sink-solid-query
• tanstack-router-solid-example-kitchen-sink-solid-query-file-based
• tanstack-router-solid-example-large-file-based
• tanstack-router-solid-example-location-masking
• tanstack-router-solid-example-navigation-blocking
• tanstack-router-solid-example-quickstart
• tanstack-router-solid-example-quickstart-esbuild-file-based
• tanstack-router-solid-example-quickstart-file-based
• tanstack-router-solid-example-quickstart-rspack-file-based
• tanstack-router-solid-example-quickstart-webpack-file-based
• @tanstack/router-solid-mono-simple
• router-solid-mono-simple-lazy
• router-solid-monorepo-solid-query
• tanstack-router-solid-example-scroll-restoration
• tanstack-solid-router-search-validator-adapters
• tanstack-solid-start-example-basic
• tanstack-solid-start-example-basic-auth
• tanstack-solid-start-example-basic-authjs
• tanstack-solid-start-example-basic-cloudflare
• tanstack-solid-start-example-basic-netlify
• tanstack-solid-start-example-basic-nitro
• tanstack-start-example-basic-solid-query
• tanstack-solid-start-example-basic-static
• tanstack-solid-start-bun-hosting
• tanstack-solid-start-example-convex-better-auth
• tanstack-solid-start-example-counter
• tanstack-solid-start-i18n-paraglide
• tanstack-solid-start-example-large
• tanstack-solid-start-streaming-data-from-server-functions
• tanstack-solid-start-example-supabase-basic
• tanstack-solid-start-tailwind-v4
• tanstack-router-solid-example-view-transitions
• tanstack-router-solid-example-with-framer-motion
• tanstack-router-solid-example-with-trpc

@tanstack/arktype-adapter

npm i https://pkg.pr.new/TanStack/router/@tanstack/arktype-adapter@6216

@tanstack/eslint-plugin-router

npm i https://pkg.pr.new/TanStack/router/@tanstack/eslint-plugin-router@6216

@tanstack/history

npm i https://pkg.pr.new/TanStack/router/@tanstack/history@6216

@tanstack/nitro-v2-vite-plugin

npm i https://pkg.pr.new/TanStack/router/@tanstack/nitro-v2-vite-plugin@6216

@tanstack/react-router

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-router@6216

@tanstack/react-router-devtools

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-router-devtools@6216

@tanstack/react-router-ssr-query

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-router-ssr-query@6216

@tanstack/react-start

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-start@6216

@tanstack/react-start-client

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-start-client@6216

@tanstack/react-start-server

npm i https://pkg.pr.new/TanStack/router/@tanstack/react-start-server@6216

@tanstack/router-cli

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-cli@6216

@tanstack/router-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-core@6216

@tanstack/router-devtools

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-devtools@6216

@tanstack/router-devtools-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-devtools-core@6216

@tanstack/router-generator

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-generator@6216

@tanstack/router-plugin

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-plugin@6216

@tanstack/router-ssr-query-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-ssr-query-core@6216

@tanstack/router-utils

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-utils@6216

@tanstack/router-vite-plugin

npm i https://pkg.pr.new/TanStack/router/@tanstack/router-vite-plugin@6216

@tanstack/solid-router

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-router@6216

@tanstack/solid-router-devtools

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-router-devtools@6216

@tanstack/solid-router-ssr-query

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-router-ssr-query@6216

@tanstack/solid-start

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-start@6216

@tanstack/solid-start-client

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-start-client@6216

@tanstack/solid-start-server

npm i https://pkg.pr.new/TanStack/router/@tanstack/solid-start-server@6216

@tanstack/start-client-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-client-core@6216

@tanstack/start-fn-stubs

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-fn-stubs@6216

@tanstack/start-plugin-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-plugin-core@6216

@tanstack/start-server-core

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-server-core@6216

@tanstack/start-static-server-functions

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-static-server-functions@6216

@tanstack/start-storage-context

npm i https://pkg.pr.new/TanStack/router/@tanstack/start-storage-context@6216

@tanstack/valibot-adapter

npm i https://pkg.pr.new/TanStack/router/@tanstack/valibot-adapter@6216

@tanstack/virtual-file-routes

npm i https://pkg.pr.new/TanStack/router/@tanstack/virtual-file-routes@6216

@tanstack/vue-router

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-router@6216

@tanstack/vue-router-devtools

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-router-devtools@6216

@tanstack/vue-router-ssr-query

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-router-ssr-query@6216

@tanstack/vue-start

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-start@6216

@tanstack/vue-start-client

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-start-client@6216

@tanstack/vue-start-server

npm i https://pkg.pr.new/TanStack/router/@tanstack/vue-start-server@6216

@tanstack/zod-adapter

npm i https://pkg.pr.new/TanStack/router/@tanstack/zod-adapter@6216

commit: 016fc61