vercel/next.js

User-facing surface splits four ways: the `next` CLI subcommands, the runtime request-handling features (App Router, Pages Router, middleware/proxy, server actions, image optimization, RSC prefetching), the sibling npm packages (create-next-app, eslint-plugin-next, codemods, fonts, third-parties, bundle-analyzer UI), and a dev-time developer-experience layer (dev overlay, MCP server, request insights, typegen). Nearly every experimental capability is gated behind a key in `ExperimentalConfig` and mirrored into bundles by `define-env.ts`. Documentation is itself a product: 1153 markdown files including `docs/01-app` + `docs/02-pages` and 258 `errors/*.mdx` pages that the dev overlay deep-links into.

• `next dev` supports self-signed HTTPS (`--experimental-https`, `--experimental-https-key/-cert/-ca` via `createSelfSignedCertificate`), Node inspector passthrough with automatic port+1 remapping for the forked child, and CPU profiling through `--experimental-cpu-prof` writing into a `.next-profiles` directory.
  packages/next/src/cli/next-dev.ts#L45-L63packages/next/src/cli/next-dev.ts#L378-L428packages/next/src/bin/next.ts#L38-L56
• A dev-only MCP server is mounted at `/_next/mcp` by both hot reloaders via `getMcpMiddleware`, using `StreamableHTTPServerTransport` with a 1MB body cap, exposing agent tools `compile-route`, `get-compilation-issues`, `get-errors`, `get-logs`, `get-page-metadata`, `get-project-metadata`, `get-request-insights`, `get-routes`, and `get-server-action-by-id`.
  packages/next/src/server/mcp/get-mcp-middleware.ts#L9-L30packages/next/src/server/dev/hot-reloader-turbopack.ts#L1271packages/next/src/server/dev/hot-reloader-webpack.ts#L1721
• Request Insights is a dev feature reachable at a dedicated endpoint (`REQUEST_INSIGHTS_DEV_ENDPOINT`) that returns `getRequestInsightsSnapshot()` as JSON, 404s with an explanatory body when `experimental.requestInsights` is off, and is also surfaced as the `next experimental-request-insights` CLI subcommand.
  packages/next/src/server/lib/router-server.ts#L316-L355packages/next/src/bin/next.ts#L636-L664packages/next/src/cli/next-request-insights.ts
• Image optimization is a first-class route: `NextNodeServer.handleNextImageRequest` validates params, consults an `ImageOptimizerCache`, and calls `imageOptimizer`/`fetchExternalImage`/`fetchInternalImage`, enforcing `images.localPatterns`, `images.remotePatterns`, http/https-only protocols, and an anti-recursion check on `/_next/image`.
  packages/next/src/server/next-server.ts#L954-L1065packages/next/src/server/image-optimizer.ts#L173-L235
• Server Actions ship with built-in CSRF defence: `action-handler.ts` compares the `Origin` header against `x-forwarded-host`/`host`, allows extra hosts via `serverActions.allowedOrigins` through `isCsrfOriginAllowed`, and aborts with `Invalid Server Actions request.` when neither host header is present.
  packages/next/src/server/app-render/action-handler.ts#L506-L545packages/next/src/server/app-render/action-handler.ts#L710-L745packages/next/src/server/app-render/csrf-protection.ts#L69-L90
• Both routers are live: `server/route-modules/` carries four families — `app-page`, `app-route`, `pages`, `pages-api` — each a `RouteModule` subclass, with `AppPageRouteModule.render()` and `.prerender()` delegating to `renderToHTMLOrFlight` / `prerenderToHTMLOrFlight`.
  packages/next/src/server/route-modules/route-module.ts#L111-L150packages/next/src/server/route-modules/app-page/module.ts#L88-L250
• Cache Components / PPR is the headline experimental feature: `cacheComponents` is now a top-level config key (the old `experimental.cacheComponents` and `experimental.ppr` are marked `@deprecated`), and enabling it implicitly turns on `experimental.ppr` and `experimental.cachedNavigations`.
  packages/next/src/server/config-shared.ts#L1231-L1234packages/next/src/server/config-shared.ts#L2126-L2135test/lib/gate/conditions.ts#L23-L28
• `"use cache"` is backed by a swappable handler registry keyed on `Symbol.for('@next/cache-handlers')` / `-map` / `-set`, with dev-only extras (`-dev-fronts`, `-dev-tiered`, `-private`) and a `DEV_MEMORY_CACHE_SIZE` of 50MB so `cacheMaxMemorySize: 0` does not make dev reloads uncached.
  packages/next/src/server/use-cache/handlers.ts#L14-L95packages/next/src/server/lib/cache-handlers/types.ts#L1-L60
• i18n domain routing and locale redirects are handled before render, directly in the router-server request handler, using `detectDomainLocale` + `getLocaleRedirect` and short-circuiting with a `307 TemporaryRedirect`.
  packages/next/src/server/lib/router-server.ts#L358-L405
• `packages/next-codemod` ships 21 named transforms for migrations, including `next-async-request-api`, `middleware-to-proxy`, `metadata-to-viewport-export`, `cra-to-next`, `remove-experimental-ppr`, and `next-lint-to-eslint-cli`, driven by the `next upgrade` subcommand.
  packages/next-codemod/transforms/packages/next/src/bin/next.ts#L564-L600packages/next/src/cli/next-upgrade.ts
• `@next/eslint-plugin-next` exposes 23 rules through a single `plugin.rules` map with two presets — `recommendedRules` (16 warn + 6 error) and `coreWebVitalsRules` which escalates `no-html-link-for-pages` and `no-sync-scripts` to error.
  packages/eslint-plugin-next/src/index.ts#L1-L80packages/eslint-plugin-next/src/rules/
• Telemetry is opt-out: `Telemetry` stores an `anonymousId` and `telemetry.enabled` in a conf file, disables itself on `NEXT_TELEMETRY_DISABLED`, prints the `https://nextjs.org/telemetry` notice, and is toggled by the `next telemetry` subcommand.
  packages/next/src/telemetry/storage.ts#L16-L155packages/next/src/bin/next.ts#L508-L527
• `next typegen` generates route types independently of a full build, backed by `server/lib/router-utils/typegen.ts` and `route-types-utils.ts` / `root-params-type-utils.ts`.
  packages/next/src/bin/next.ts#L529-L545packages/next/src/server/lib/router-utils/typegen.tspackages/next/src/server/lib/router-utils/route-types-utils.ts
• The dev overlay is a separate sub-application under `packages/next/src/next-devtools/` with `dev-overlay/`, `userspace/`, `server/`, and `shared/` layers plus a browser entry (`dev-overlay.browser.tsx`) and a shim, and its UX can be killed at build time via `process.env.__NEXT_DISABLE_DEV_OVERLAY_UX`.
  packages/next/src/next-devtools/packages/next/src/build/define-env.ts#L161
• An `evals/` workspace exists for agent evaluation (`evals/next-upgrade`, `eval.config.json`, run via `pnpm eval` / `pnpm eval:upgrade` using `@vercel/agent-eval`), making automated upgrade quality a tracked product surface.
  package.json#L14-L16evals/README.mdevals/eval.config.json