Next.js 16.3

Apply the Node.js 24, React 19, TypeScript 7, and JavaScript ES2026 prompts first. These rules cover Next.js 16.3 Server and Client Components, Server Functions and Actions, data access and sessions, Route Handlers and Pages Router API routes, proxy boundaries, caching, rendering, next/og images, headers, cookies, and deployment.

Server and client boundaries

• Add import 'server-only' to every module that holds secrets, database clients, privileged SDKs, or the data access layer, so an import from a Client Component fails the build.
• Treat every value crossing into a Client Component as public and serializable to the browser.
• Do not expose secrets through NEXT_PUBLIC_ variables, build output, source maps, React props, or hydration data; env entries in next.config.js are bundled regardless of their prefix.
• Return only fields the browser may see from Pages Router getServerSideProps and getStaticProps, because their props are serialized into the page HTML for hydration.
• Validate client-supplied route, search, cookie, header, form, and serialized action data again on the server.
• Prevent dynamic imports and module paths from being selected directly by request data.
• Treat variables captured by a Server Function closure as data that leaves the server: Next.js encrypts them and round-trips them through the browser, so a captured secret is only as protected as the encryption key.
• Set NEXT_SERVER_ACTIONS_ENCRYPTION_KEY at build time only when separately built instances or overlapping deployments must accept the same action payloads; otherwise keep