Validate Production Readiness of Next.js Apps

Production QA Validator runs a phased, command-driven QA checklist for shipping or promoting a fullstack Next.js app to production, fixing failures before moving to the next phase. It's driven by shell functions rather than manual clicking: qa:code checks code integrity (tsc --noEmit, ESLint with zero warnings, test suite), qa:build verifies the production build succeeds with no errors and that SEO pages render static/SSG (○/●) rather than dynamic (λ), qa:auth and qa:auth:cookies hit login/session/logout endpoints and check that protected routes return 401/403 and session cookies carry HttpOnly/Secure/SameSite flags, and qa:routes verifies core pages, sitemap, and robots.txt all return 200 with valid XML and correct crawler access.

Use it before shipping or promoting a fullstack Next.js app to production, after large UI/SEO/auth/API/database/dependency changes need a concrete launch-readiness pass, or when you need a compact, command-driven checklist covering build, route, metadata, performance, security, and cleanup checks in one pass.

Configured via PROD_URL, an optional QA_AUTH_HEADER bearer token, and an optional PAGESPEED_API_KEY. Two consolidated runners chain the phases: qa:all (code, build, routes, SEO, API, git, smoke test) for a standard pre-ship pass, and qa:full (adds auth, auth cookies, lazy-load, heavy-load, vulnerability scan, cleanup, UX card/boundary/animation checks, database, and secure-headers checks) for a deeper audit. SEO phase checks title length (30-60 chars, unique per page), meta description presence in raw HTML, Open Graph tag consistency (og:title matching <title>, og:image at least 1200x630px and resolving 200), favicon presence, and slug format. Each command returns a pass/fail count so failures are visible immediately rather than buried in log output.

qa:auth() {
  for ep in /api/auth/login /api/auth/session /api/auth/logout; do
    curl -so /dev/null -w "%{http_code}" "$PROD_URL$ep" | grep -q "200\|401" || echo "  x $ep unreachable"
  done
}

Wraps standard tooling - TypeScript compiler, ESLint, the project's test runner, curl for endpoint checks, and Python's XML parser for sitemap validation - into composable shell functions that can run individually per phase or chained via the consolidated runners. Additional phases cover API route behavior (correct status codes and Content-Type, consistent { error, message } JSON error shape, response times under 200ms, correct CORS headers), git hygiene (qa:git scans the diff for leaked secrets/credentials and flags staged .next/node_modules build artifacts), a post-deployment smoke test (qa:smoke checks homepage and sitemap return 200), and performance (qa:lazyload and qa:heavyload check for lazy-loaded images, next/dynamic imports for heavy components, largest JS chunk size, and total page weight against a Lighthouse-informed budget: FCP under 2.5s, LCP under 4.0s, CLS under 0.1, largest chunk under 200KB gzipped, total page weight under 1MB).

Teams shipping a Next.js app who want a repeatable, scriptable pre-production gate instead of manually re-checking build output, auth behavior, SEO tags, and routes by hand before every release.