Next.js App Router / RSC：.cursor/rules/app-router.mdc 与 rsc.mdc
用 Next.js App Router（app/ 或 src/app/）的 Cursor 用户。路径：.cursor/rules/app-router.mdc · .cursor/rules/rsc.mdc
不是 Roo / Cline 模版。本站不托管安装包。订哪档去 /compare。
把下面两个 .mdc 放到仓库根的 .cursor/rules/。这是 Cursor Project Rules 路径，不是 Roo 的 .roo，也不是 Cline 的 .clinerules。
规则投进仓库之后，再去 /compare 对照 Pro / Business / 自备 Key。本站不托管安装包，桌面 IDE 走 /downloads。
.cursor/rules/app-router.mdc---
description: Next.js App Router routing, layouts, metadata, and route files
globs: "{app,src/app}/**/*.{ts,tsx,js,jsx}"
alwaysApply: false
---
# App Router
- Routes live under `app/` or `src/app/`. Do not add `pages/` or `getServerSideProps` / `getStaticProps`.
- `layout.tsx` wraps a segment; `page.tsx` is the leaf. Keep the unique `<h1>` in `page.tsx` (or the leaf that owns the document title story), not in a shared layout that would collide across URLs.
- Colocate `loading.tsx`, `error.tsx`, `not-found.tsx`, and `route.ts` with the segment they belong to.
- Next.js 15+: `params` and `searchParams` on pages are `Promise`s. Type them as `Promise<{ ... }>` and `await` them. Same for `generateMetadata`.
- `generateStaticParams` for known slugs; call `notFound()` for unknown ones when the set is closed.
- Put server-only I/O (fs, db, secrets) in `page.tsx`, `layout.tsx`, `route.ts`, or `src/lib/` modules that client components never import.
- Navigation uses `next/link`. Do not invent a second client-side router.
- Route handlers (`app/**/route.ts`) return `Response` / `NextResponse`. They are not React components..cursor/rules/rsc.mdc---
description: React Server Components — server/client boundary, data fetching, secrets stay server-side
globs: "{app,src/app,src/components,src/lib}/**/*.{ts,tsx,js,jsx}"
alwaysApply: false
---
# RSC / server-client boundary
- Files are Server Components by default. Add `"use client"` only when the module needs hooks, event handlers, or browser APIs.
- Do not import a server-only module (fs, db, env secrets, `next/headers`) from a client module.
- Props from Server Components to Client Components must be JSON-serializable. Do not pass functions, class instances, or `Date` unless the local code already serializes them.
- Fetch and query in Server Components or Server Actions. Client components receive already-loaded data, or they call an explicit API / Server Action.
- `"use server"` marks a Server Action module or async function. Validate input. Never echo secrets back to the client.
- `cookies()` / `headers()` make the route dynamic. Do not call them from a page that is supposed to be static unless that is intended.
- Keep API keys and tokens in server-only env. Do not prefix secrets with `NEXT_PUBLIC_`.
- Prefer `dynamic = "force-static"` or `revalidate` when the page is a file-backed template with no per-user data.