fix(start-plugin-core): strip middleware chain on client builds

The `createServerFn` compiler correctly replaces `.handler(fn)` with
`.handler(createClientRpc('hash'))` for client builds, but leaves the
`.middleware([...])` chain intact. This keeps server-only imports
(auth middleware, DB connections, etc.) alive in the client bundle.

With esbuild (Vite 7), these dead references were tree-shaken. With
Rolldown (Vite 8), the middleware functions remain as live references,
pulling the entire server dependency tree into the client bundle. This
causes runtime crashes like `ReferenceError: Buffer is not defined`
when Node.js-only packages (e.g. `postgres`) end up in the browser.

The fix strips `.middleware()` calls on client builds, matching the
existing pattern used for `.inputValidator()`. Since middleware only
executes server-side and the client RPC stub skips it entirely, the
middleware chain is dead code on the client.

Author: afonsojramos

packages/start-plugin-core/src/start-compiler-plugin/handleCreateServerFn.ts

@@ -227,7 +227,7 @@ export function handleCreateServerFn(
 
   for (const candidate of candidates) {
     const { path: candidatePath, methodChain } = candidate
-    const { inputValidator, handler } = methodChain
+    const { inputValidator, handler, middleware } = methodChain
 
     // Check if the call is assigned to a variable
     if (!candidatePath.parentPath.isVariableDeclarator()) {
@@ -284,6 +284,13 @@ export function handleCreateServerFn(
       }
     }
 
+    // Handle middleware - remove on client to prevent server-only
+    // dependencies (auth, DB, etc.) from leaking into the client bundle.
+    // Middleware only executes server-side; the client RPC stub skips it.
+    if (middleware && context.env === 'client') {
+      stripMethodCall(middleware.callPath)
+    }
+
     const handlerFnPath = handler?.firstArgPath
 
     if (!handler || !handlerFnPath?.node) {