diff --git a/nextjs-best-practices/skill.md b/nextjs-best-practices/skill.md new file mode 100644 index 0000000..044a3bb --- /dev/null +++ b/nextjs-best-practices/skill.md @@ -0,0 +1,203 @@ +--- +name: nextjs-best-practices +description: Next.js App Router principles. Server Components, data fetching, routing patterns. +allowed-tools: Read, Write, Edit, Glob, Grep +--- + +# Next.js Best Practices + +> Principles for Next.js App Router development. + +--- + +## 1. Server vs Client Components + +### Decision Tree + +``` +Does it need...? +│ +├── useState, useEffect, event handlers +│ └── Client Component ('use client') +│ +├── Direct data fetching, no interactivity +│ └── Server Component (default) +│ +└── Both? + └── Split: Server parent + Client child +``` + +### By Default + +| Type | Use | +|------|-----| +| **Server** | Data fetching, layout, static content | +| **Client** | Forms, buttons, interactive UI | + +--- + +## 2. Data Fetching Patterns + +### Fetch Strategy + +| Pattern | Use | +|---------|-----| +| **Default** | Static (cached at build) | +| **Revalidate** | ISR (time-based refresh) | +| **No-store** | Dynamic (every request) | + +### Data Flow + +| Source | Pattern | +|--------|---------| +| Database | Server Component fetch | +| API | fetch with caching | +| User input | Client state + server action | + +--- + +## 3. Routing Principles + +### File Conventions + +| File | Purpose | +|------|---------| +| `page.tsx` | Route UI | +| `layout.tsx` | Shared layout | +| `loading.tsx` | Loading state | +| `error.tsx` | Error boundary | +| `not-found.tsx` | 404 page | + +### Route Organization + +| Pattern | Use | +|---------|-----| +| Route groups `(name)` | Organize without URL | +| Parallel routes `@slot` | Multiple same-level pages | +| Intercepting `(.)` | Modal overlays | + +--- + +## 4. API Routes + +### Route Handlers + +| Method | Use | +|--------|-----| +| GET | Read data | +| POST | Create data | +| PUT/PATCH | Update data | +| DELETE | Remove data | + +### Best Practices + +- Validate input with Zod +- Return proper status codes +- Handle errors gracefully +- Use Edge runtime when possible + +--- + +## 5. Performance Principles + +### Image Optimization + +- Use next/image component +- Set priority for above-fold +- Provide blur placeholder +- Use responsive sizes + +### Bundle Optimization + +- Dynamic imports for heavy components +- Route-based code splitting (automatic) +- Analyze with bundle analyzer + +--- + +## 6. Metadata + +### Static vs Dynamic + +| Type | Use | +|------|-----| +| Static export | Fixed metadata | +| generateMetadata | Dynamic per-route | + +### Essential Tags + +- title (50-60 chars) +- description (150-160 chars) +- Open Graph images +- Canonical URL + +--- + +## 7. Caching Strategy + +### Cache Layers + +| Layer | Control | +|-------|---------| +| Request | fetch options | +| Data | revalidate/tags | +| Full route | route config | + +### Revalidation + +| Method | Use | +|--------|-----| +| Time-based | `revalidate: 60` | +| On-demand | `revalidatePath/Tag` | +| No cache | `no-store` | + +--- + +## 8. Server Actions + +### Use Cases + +- Form submissions +- Data mutations +- Revalidation triggers + +### Best Practices + +- Mark with 'use server' +- Validate all inputs +- Return typed responses +- Handle errors + +--- + +## 9. Anti-Patterns + +| ❌ Don't | ✅ Do | +|----------|-------| +| 'use client' everywhere | Server by default | +| Fetch in client components | Fetch in server | +| Skip loading states | Use loading.tsx | +| Ignore error boundaries | Use error.tsx | +| Large client bundles | Dynamic imports | + +--- + +## 10. Project Structure + +``` +app/ +├── (marketing)/ # Route group +│ └── page.tsx +├── (dashboard)/ +│ ├── layout.tsx # Dashboard layout +│ └── page.tsx +├── api/ +│ └── [resource]/ +│ └── route.ts +└── components/ + └── ui/ +``` + +--- + +> **Remember:** Server Components are the default for a reason. Start there, add client only when needed. diff --git a/nextjs/skill.md b/nextjs/skill.md new file mode 100644 index 0000000..becad63 --- /dev/null +++ b/nextjs/skill.md @@ -0,0 +1,1745 @@ +--- +name: nextjs +description: | + Build Next.js 16 apps with App Router, Server Components/Actions, Cache Components ("use cache"), and async route params. Includes proxy.ts and React 19.2. Prevents 25 documented errors. + + Use when: building Next.js 16 projects, or troubleshooting async params (Promise types), "use cache" directives, parallel route 404s, Turbopack issues, i18n caching, navigation throttling. +user-invocable: true +allowed-tools: ["Read", "Write", "Edit", "Bash", "Glob", "Grep"] +--- + +# Next.js App Router - Production Patterns + +**Version**: Next.js 16.1.1 +**React Version**: 19.2.3 +**Node.js**: 20.9+ +**Last Verified**: 2026-01-09 + +--- + +## Table of Contents + +1. [When to Use This Skill](#when-to-use-this-skill) +2. [When NOT to Use This Skill](#when-not-to-use-this-skill) +3. [Security Advisories (December 2025)](#security-advisories-december-2025) +4. [Next.js 16.1 Updates](#nextjs-161-updates-december-2025) +5. [Next.js 16 Breaking Changes](#nextjs-16-breaking-changes) +6. [Cache Components & Caching APIs](#cache-components--caching-apis) +7. [Route Handlers (Next.js 16 Updates)](#route-handlers-nextjs-16-updates) +8. [Proxy vs Middleware](#proxy-vs-middleware) +9. [Parallel Routes - default.js Required](#parallel-routes---defaultjs-required-breaking) +10. [React 19.2 Features](#react-192-features) +11. [Turbopack (Stable in Next.js 16)](#turbopack-stable-in-nextjs-16) +12. [Common Errors & Solutions](#common-errors--solutions) +13. [Templates & Resources](#templates--resources) + +--- + +## When to Use This Skill + +**Focus**: Next.js 16 breaking changes and knowledge gaps (December 2024+). + +Use this skill when you need: + +- **Next.js 16 breaking changes** (async params, proxy.ts, parallel routes default.js, removed features) +- **Cache Components** with `"use cache"` directive (NEW in Next.js 16) +- **New caching APIs**: `revalidateTag()`, `updateTag()`, `refresh()` (Updated in Next.js 16) +- **Migration from Next.js 15 to 16** (avoid breaking change errors) +- **Async route params** (`params`, `searchParams`, `cookies()`, `headers()` now async) +- **Parallel routes with default.js** (REQUIRED in Next.js 16) +- **React 19.2 features** (View Transitions, `useEffectEvent()`, React Compiler) +- **Turbopack** (stable and default in Next.js 16) +- **Image defaults changed** (TTL, sizes, qualities in Next.js 16) +- **Error prevention** (25 documented Next.js 16 errors with solutions) + +--- + +## When NOT to Use This Skill + +Do NOT use this skill for: + +- **Cloudflare Workers deployment** → Use `cloudflare-nextjs` skill instead +- **Pages Router patterns** → This skill covers App Router ONLY (Pages Router is legacy) +- **Authentication libraries** → Use `clerk-auth`, `better-auth`, or other auth-specific skills +- **Database integration** → Use `cloudflare-d1`, `drizzle-orm-d1`, or database-specific skills +- **UI component libraries** → Use `tailwind-v4-shadcn` skill for Tailwind + shadcn/ui +- **State management** → Use `zustand-state-management`, `tanstack-query` skills +- **Form libraries** → Use `react-hook-form-zod` skill +- **Vercel-specific features** → Refer to Vercel platform documentation +- **Next.js Enterprise features** (ISR, DPR) → Refer to Next.js Enterprise docs +- **Deployment configuration** → Use platform-specific deployment skills + +**Relationship with Other Skills**: +- **cloudflare-nextjs**: For deploying Next.js to Cloudflare Workers (use BOTH skills together if deploying to Cloudflare) +- **tailwind-v4-shadcn**: For Tailwind v4 + shadcn/ui setup (composable with this skill) +- **clerk-auth**: For Clerk authentication in Next.js (composable with this skill) +- **better-auth**: For Better Auth integration (composable with this skill) + +--- + +## Security Advisories (December 2025) + +**CRITICAL**: Three security vulnerabilities were disclosed in December 2025 affecting Next.js with React Server Components: + +| CVE | Severity | Affected | Description | +|-----|----------|----------|-------------| +| **CVE-2025-66478** | CRITICAL (10.0) | 15.x, 16.x | Server Component arbitrary code execution | +| **CVE-2025-55184** | HIGH | 13.x-16.x | Denial of Service via malformed request | +| **CVE-2025-55183** | MEDIUM | 13.x-16.x | Source code exposure in error responses | + +**Action Required**: Upgrade to Next.js 16.1.1 or later immediately. + +```bash +npm update next +# Verify: npm list next should show 16.1.1+ +``` + +**References**: +- https://nextjs.org/security +- https://github.com/vercel/next.js/security/advisories + +--- + +## Next.js 16.1 Updates (December 2025) + +**New in 16.1**: +- **Turbopack File System Caching (STABLE)**: Now enabled by default in development +- **Next.js Bundle Analyzer**: New experimental feature for bundle analysis +- **Improved Debugging**: Enhanced `next dev --inspect` support +- **Security Fixes**: Addresses CVE-2025-66478, CVE-2025-55184, CVE-2025-55183 + +--- + +## Next.js 16 Breaking Changes + +**IMPORTANT**: Next.js 16 introduces multiple breaking changes. Read this section carefully if migrating from Next.js 15 or earlier. + +### 1. Async Route Parameters (BREAKING) + +**Breaking Change**: `params`, `searchParams`, `cookies()`, `headers()`, `draftMode()` are now **async** and must be awaited. + +**Before (Next.js 15)**: +```typescript +// ❌ This no longer works in Next.js 16 +export default function Page({ params, searchParams }: { + params: { slug: string } + searchParams: { query: string } +}) { + const slug = params.slug // ❌ Error: params is a Promise + const query = searchParams.query // ❌ Error: searchParams is a Promise + return
{json.description}
+