Individual skill
opinionated-nextjs-patterns
Opinionated, backend-agnostic Next.js 16 (App Router) architecture — authorization at the data layer, server-side loading with cache()+Promise.all, mutations through next-safe-action + typed route handlers, client/server boundaries ('use client' at leaves + TanStack Query), forms with RHF + Zod, UI via shadcn/ui + Tailwind + Base UI + next-intl, request handling in proxy.ts (Next.js 16's renamed middleware), and a Turbo monorepo of @app/* packages confining the backend behind one data-access package. Examples use Supabase but every rule states the transferable principle. Use when writing, reviewing, or refactoring Next.js 16 code. Trigger on server actions, route handlers, RSC vs 'use client' placement, TanStack Query, RHF/Zod, proxy.ts, or monorepo package layout — even when the user doesn't say 'patterns' or 'best practices'.
skills/.experimental/opinionated-nextjs-patterns/SKILL.md
Source commit cf93c57cac89d6fc3e4194686000411567f5caf3
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Not checked yet
- Last checked
- Nov 5, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 222
- Repository last updated
- Aug 15, 2026
- License
- MIT
Observed agent integration: codex
- engineering Derived category
- design Derived category
- writing Derived category
- data Derived category
- design-interface Derived category
- engineering-web Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
AGENTS.mddoc · 13,119 bytesSKILL.mdcore · 12,282 bytesSKILL.mdcore · 12,282 bytesassets/templates/_template.mddoc · 4,596 bytesmetadata.jsonasset · 1,868 bytesreferences/_sections.mddoc · 4,009 bytesreferences/arch-app-vs-packages-boundary.mddoc · 4,565 bytesreferences/arch-config-driven-navigation.mddoc · 5,030 bytesreferences/arch-data-access-adapter.mddoc · 2,726 bytesreferences/arch-feature-package-layout.mddoc · 4,717 bytesreferences/arch-import-via-package-exports.mddoc · 4,249 bytesreferences/arch-policy-engine-for-business-rules.mddoc · 8,374 bytesreferences/arch-provider-gateway-pattern.mddoc · 5,083 bytesreferences/auth-gate-admin-client.mddoc · 3,844 bytesreferences/auth-mfa-in-middleware.mddoc · 3,377 bytesreferences/auth-server-only-imports.mddoc · 2,801 bytesreferences/auth-trust-rls-no-duplicate-checks.mddoc · 3,254 bytesreferences/auth-use-require-user.mddoc · 3,979 bytesreferences/auth-use-sql-policy-helpers.mddoc · 3,357 bytesreferences/auth-use-standard-server-client.mddoc · 3,048 bytesreferences/client-pass-server-data-as-props.mddoc · 4,637 bytesreferences/client-realtime-cleanup-subscription.mddoc · 5,227 bytesreferences/client-stable-query-keys.mddoc · 4,623 bytesreferences/client-use-action-hook.mddoc · 4,973 bytesreferences/client-use-client-at-leaves.mddoc · 4,661 bytesreferences/client-use-supabase-with-react-query.mddoc · 6,094 bytesreferences/mutate-enhance-route-handler.mddoc · 6,309 bytesreferences/mutate-revalidate-path-after-write.mddoc · 4,378 bytesreferences/mutate-thin-action-service-holds-logic.mddoc · 5,780 bytesreferences/mutate-use-getlogger-not-console.mddoc · 5,138 bytesreferences/mutate-use-safe-action-clients.mddoc · 4,611 bytesreferences/mutate-webhook-verify-signature.mddoc · 5,348 bytesreferences/mutate-zod-schema-separate-file.mddoc · 4,909 bytesreferences/proxy-redirect-auth-at-boundary.mddoc · 4,066 bytesreferences/proxy-secure-headers-flagged.mddoc · 3,305 bytesreferences/proxy-set-correlation-id.mddoc · 3,411 bytesreferences/proxy-single-pipeline.mddoc · 3,425 bytesreferences/proxy-url-pattern-matching.mddoc · 3,270 bytesreferences/server-cache-workspace-loaders.mddoc · 4,519 bytesreferences/server-fetch-in-server-components.mddoc · 4,460 bytesreferences/server-promise-all-parallel-loads.mddoc · 4,076 bytesreferences/server-redirect-on-missing-workspace.mddoc · 4,134 bytesreferences/server-services-receive-client.mddoc · 4,715 bytesreferences/server-use-feature-api-factories.mddoc · 4,586 bytesreferences/server-use-tables-generic-for-types.mddoc · 4,044 bytesreferences/tenant-account-id-on-product-tables.mddoc · 4,078 bytesreferences/tenant-accounts-as-tenant-root.mddoc · 3,935 bytesreferences/tenant-never-edit-generated-types.mddoc · 4,091 bytesreferences/tenant-slug-in-team-urls.mddoc · 3,467 bytesreferences/tenant-storage-paths-include-account-id.mddoc · 4,455 bytesreferences/ui-base-ui-render-not-aschild.mddoc · 3,915 bytesreferences/ui-form-message-per-field.mddoc · 3,933 bytesreferences/ui-kit-ui-package-imports.mddoc · 4,169 bytesreferences/ui-rhf-zod-no-generics.mddoc · 3,728 bytesreferences/ui-semantic-tailwind-tokens.mddoc · 4,273 bytesreferences/ui-trans-for-display-text.mddoc · 5,018 bytes
Read excerpt
# Opinionated Next.js 16 Patterns
Implementation-pattern reference for **Next.js 16 (App Router)** codebases that want a single, opinionated architecture. Contains **50 rules across 8 categories**, prioritised by execution-lifecycle cascade impact — authorization and (optional) tenant modeling first, then the request boundary, server fetching, mutations, client boundaries, architecture, and UI conventions.
The rules are **backend-agnostic in principle but use Supabase as the concrete example**. Each rule teaches the transferable idea (e.g. "authorize at the data layer", "read through a typed repository"); where the backend genuinely matters, a `*Transferable:*` note explains the pattern for other stores (Drizzle, Prisma). The structure is a **Turbo monorepo** with `@app/*` packages you own — built on canonical libraries (`next-safe-action`, `@supabase/ssr`, `@tanstack/react-query`, `react-hook-form` + `zod`, `shadcn/ui`, `next-intl`, `pino`), not a vendored starter kit.
## When to Apply
Reach for these rules when:
- **Writing new code** — pages, layouts, server actions, route handlers, `proxy.ts`, feature packages, client components, hooks, the data-access package, SQL/migrations, forms.
- **Reviewing a PR** — authorization slips (privileged client without a guard, missing `'server-only'`), waterfalls (sequential awaits, client-fetching server data), drift (hand-edited generated types, deep package imports, hardcoded i18n strings).
- **Refactoring** — moving code between `apps/web` and `packages/*`, splitting actions and services, lifting `'use client'` boundaries, replacing raw queries with a typed data-access factory, swapping a backend behind the data-access package.
- **Designing a feature** — choosing the right client (request-scoped vs privileged vs browser), deciding action vs route handler, planning the form/server-action contract, scoping a tenant (if multi-tenant).
- **Onboarding** — understanding *why* the codebase looks the way it does, with concrete, transferable examples.