Server functions: how to preventing leaking server-only code (e.g. secrets) into client javascript? - TanStack