> layout, "server-only", accidentally bundling server code

the main issue i wanted to highlight is that things are not caught at type-check time. maybe vercel could provide eslint plugins? this could codify a lot of the caveats

> There's no way to get around thinking about AuthN/Z with any server APIs

very true! maybe there is a way to make the default secure somehow by making it awkward to publicly expose a POST route by accident. awesome that next.js 15 is doing things in that regard.

thanks for addressing the points leerob, shows the great governance mentioned in the end of the post :)