Next.js 16

S03 · Client Components read only NEXT_PUBLIC_ environment variables (and NODE_ENV)

X05 · No secret-named variable is exposed to the browser (NEXT_PUBLIC_ prefix, next.config env)

X10 · Proxy and route handlers do not copy request headers into the response

X01/X02 · Outside declared scopes, warns about data-writing actions and handlers without a visible guard

X01/X02 · Server Actions and mutating route handlers that write data call an authorization guard themselves

X09 · Webhook route handlers verify the provider signature before acting

X12 · An auth check added to a layout is not the only protection of the pages and actions below it

X03 · Untrusted input (FormData, request bodies) is validated before it reaches a data write

X08 · No SQL text built from interpolated or concatenated values

X08 · HTML injected with dangerouslySetInnerHTML goes through a sanitizer (warning: the source may be trusted)

A12 · No blanket type-check or lint suppression (@ts-nocheck, @ts-ignore, rule-less eslint-disable)

A12 · tsconfig strictness is not weakened (strict, noImplicitAny, strictNullChecks)

A12/U09 · The user confirms switching off build type errors or relaxing image security in next.config

T09 · Route prop types come from `next typegen` (global PageProps/LayoutProps/RouteContext), not hand-written copies

Q08 · With reactCompiler on, new manual memoization needs a measured reason

U01 · Independent awaited reads start together instead of waiting for each other

A01 · A new import does not close a cycle of value imports (up to three modules)

A02 · Imports respect the project's declared dependency directions (layerRules)

A03 · Route entries and action modules stay within the project's declared size (maxRouteEntryLines)

A04 · Data clients are imported only by the declared data access layer (dataAccessPaths)

A07 · A 'use client' module re-exports named components, never `export *`

A07 · A barrel does not re-export client components together with server-only modules

A08 · Server modules keep no request or user state in mutable module-level variables

X06/X07 · GET handlers and Server Component renders write no data and no cookies

C02 · 'use cache' needs cacheComponents enabled and an async function (every export of a file-level 'use cache' module)

C03/C04 · With Cache Components on, no dynamic/revalidate/fetchCache/dynamicParams segment config nor edge runtime

C05/C06/C07 · A 'use cache' scope reads no request API or identity and does not inspect pass-through children

C08 · A new 'use cache' scope states its freshness (cacheLife) or its invalidation (cacheTag)

C09 · revalidateTag is called with its cache-life profile (the one-argument form is deprecated)

C10 · updateTag() and refresh() from next/cache are called from Server Actions only

C14 · 'use cache' sits in a helper called by a GET handler, not in the HTTP export itself

C17 · ensureStatic, instant and prefetch segment exports are used only with cacheComponents (and never prefetch = 'auto')

B03 · The user confirms changing the app's declared rendering, output, bundler and routing choices in next.config

C13 · A client page does not read useSearchParams() at its top level (prerendering needs a Suspense boundary)

Q06 · With output: 'export', code uses no server-only feature (actions, proxy, request APIs, non-GET handlers, optimized images)

Q07 · Route handlers and Server Actions do not use the local filesystem as storage

R01 · page, layout and route files export only what their convention allows (and pages/layouts a default component)

R02 · A root layout renders <html> and <body>; nested layouts never do

R03 · One owner per URL: no page and route in one segment, no App and Pages route for one path

R03 · Route groups and slots never give one URL two pages or handlers

R04 · App Router route handlers use Web Request/Response, not the Pages API contract

R05 · The proxy/middleware matcher is a literal Next.js can analyze at build time

R06 · A proxy states which requests it intercepts (a matcher scoping out assets and images)

R07 · redirect()/notFound()/forbidden()/unauthorized() are not swallowed by a try/catch

R08 · error files are Client Components; global-error also renders <html> and <body>

R09 · Internal navigation uses <Link>; no javascript: URL; no relative window.location assignment

R10 · Client Components export no metadata or route segment config (they only work in Server Components)

S01 · 'use client' / 'use server' sit in the module's directive prologue, spelled exactly, never both

S02 · Components in a 'use client' module are synchronous functions

S03 · Client Components import no server-only module, database client or Node.js built-in (followed through aliases and re-exports)

S04 · Modules holding data access or secrets import 'server-only'

S05 · A page or layout becomes a Client Component only for a reason (smallest client boundary)

S06 · Server Components pass no event handler to host elements (functions cannot cross to the client)

S07 · Client Components receive Server Components as children/props instead of importing them

S08 · Code that also renders on the server reads no browser global during module init or render

S09 · next/dynamic with `ssr: false` is declared inside a Client Component

S10 · A 'use server' module exports only async functions; Client Components define no inline Server Action

S11 · Server route entries call no client-only hook (state, effects, context, navigation hooks)

T11 · Long-running dev/start servers run in the background, never blocking the Bash tool

U02 · Server code calls the data function directly instead of fetching its own Route Handler

U03 · Client Components read data with server reads or client fetching, not Server Actions called from Effects

U04 · Client data fetching reuses the project's data library instead of fetch-in-useEffect

B01/B02 · At session start, Claude learns the installed Next.js version and where its version-matched docs are

B02 · The user confirms removing or rewriting the Next.js-managed block of AGENTS.md

B02 · Before its first Next.js-specific change of a session, Claude is pointed at the bundled docs (once)

B02 · Records that Claude read the version-matched docs in node_modules/next/dist/docs

T08 · Codemod markers (@next-codemod-error, UnsafeUnwrapped casts) are resolved before the turn ends (once per stop)

T12 · No package that Next.js replaced with a built-in (@next/font, next-transpile-modules, next-images, @zeit/next-*…)

T13 · ESLint is configured with a flat eslint.config.* (what eslint-config-next 16 ships), not a new .eslintrc

V02 · cookies(), headers(), draftMode(), params and searchParams are awaited (or use()d) before their values are read

V03 · Metadata image and sitemap generators await their `id` (and image `params`); generateImageMetadata keeps sync params

V04 · App Router code imports no Pages Router API (next/router, next/head, next/document, data fetching exports); Pages code no next/headers

V05 · No removed `next lint` command or `next build --no-lint` flag

V05 · package.json scripts drop the removed `next lint` and `next build --no-lint`

V06 · No import of the removed next/config (getConfig)

V07 · No `experimental_ppr` route segment export (removed in Next.js 16)

V05/V06/V07/V12/C15 · next.config holds no option removed by Next.js 16 or earlier majors (eslint, runtime config, PPR flags, AMP…) and no partialPrefetching without cacheComponents

V08/V13/B06/C16 · next.config uses the stable location of moved options (turbopack, reactCompiler, adapterPath, proxy names, remotePatterns…), recorded experiments, explicit partialPrefetching

V08 · next/cache uses stable names (cacheLife, cacheTag); no removed unstable_rootParams

V09 · A custom webpack config is not silently left behind by the default Turbopack build

V10 · proxy files set no runtime (Proxy always runs on Node.js)

V11 · Migrating middleware to proxy goes through the official codemod, not a bare rename

V11 · New request interception uses proxy, never both proxy and middleware entries

V13 · next/image code uses the 16.x API: no next/legacy/image, priority or onLoadingComplete

V14 · next.config detects the phase with the phase argument or NODE_ENV, not process.argv

V15 · Every parallel route slot (@slot) touched this turn has a default file (once per stop)

V16 · Build-size reasoning does not rely on the removed `size` / `First Load JS` columns of next build

V17 · Static export is `output: 'export'` + `next build`, never the removed `next export`

V18 · The App Router's useRouter() object is used without the Pages Router members (pathname, query, events…)

V19 · next/image and next/link use the post-13 API: no layout/objectFit/lazyBoundary props, no <a> child or legacyBehavior

V20 · No package or import that Next.js or React replaced (@next/font, next/amp, react-dom render/hydrate, react-dom/test-utils, useFormState)

V21 · Proxy and route handlers read no removed NextRequest.geo / NextRequest.ip

V22 · Route segments keep the default Node.js runtime: no new deprecated `runtime = 'edge'` / 'experimental-edge'

X11 · Browser code reads NEXT_PUBLIC_ variables literally (process.env.NEXT_PUBLIC_X), never by dynamic lookup

A09 · Render-derived values are computed, not mirrored into state by an Effect

U06 · List keys are stable and Effects that subscribe clean up after themselves

U07 · next/image elements have alt, intrinsic size or fill, and a configured remote source

U08 · Image qualities are configured and preloading is reserved to the above-the-fold image

U10 · Pages use next/image, next/script, next/font and the Metadata API instead of raw <img>, <script>, font links and <head>

U10 · next/script inline scripts have an id; beforeInteractive scripts live in the root layout

T01/T02 · A new package.json comes from create-next-app or `npm init`, and gets its dependencies from the package manager

T02 · A new package.json without dependencies is initialized with the package manager

T03 · Dependencies change through the package manager (add/remove/update), never by editing package.json by hand

T03/T06 · Records the tool calls that run a package manager (they may rewrite package.json and lockfiles)

T04 · Registry version lookups are not a step before installing

T04 · Packages are installed by name: no guessed exact version, no --save-exact without a reason

T05 · Dependencies are installed with the project's package manager (packageManager field, lockfile)

T05 · No second lockfile next to another package manager's lockfile

T06 · Lockfiles are written by the package manager only (no hand edit, no script rewriting them)

T06 · A turn that changes package.json dependencies also updates the lockfile next to it (once per stop)

T07 · CI and image builds install from the lockfile (npm ci, frozen/immutable installs)

T08 · Next.js upgrades go through `next upgrade` / the upgrade codemod, not a bare install

T10 · Dependency conflicts are repaired, not masked with --force, --legacy-peer-deps or broad overrides

B07 · Generated Next.js output (.next/, next-env.d.ts, out/) is regenerated, never edited

Q04 · Unit tests do not render async Server Components (Vitest/Jest cannot); test them end to end

A11 · New placeholders (TODO, not-implemented stubs) are flagged before completion

A11 · Written code contains no elision marker standing for code that is not there (// ... existing code ...)

C19 · Final messages do not claim that fetch or GET handlers are cached by default (they are not since Next.js 15)

Records the work tree when a prompt starts: the baseline of the Next.js end-of-turn checks (T06, V15, Q01–Q03)

Q01–Q03/Q09 · Records, per session, Claude's edits and the lint, typecheck, build and test runs that succeeded after them

Q01 · A turn adds no TypeScript errors to the changed files or their importers (language server, once per stop)

Q01–Q03 · A turn that changed app code ends only after the configured lint, typecheck and build succeeded on the final files (once per stop)

Q09 · A final message claiming passing lint, types, build or tests needs a successful run after Claude's last edit