chore: next16

AGENTS.md

@@ -45,7 +45,7 @@ Grida heavily relies on Supabase (PostgreSQL).
 **Web**
 
 - React.js 19
-- Next.js 15
+- Next.js 16
 
 **UI**
 

apps/backgrounds/eslint.config.mjs

@@ -0,0 +1,18 @@
+import { defineConfig, globalIgnores } from "eslint/config";
+import nextVitals from "eslint-config-next/core-web-vitals";
+import nextTs from "eslint-config-next/typescript";
+
+const eslintConfig = defineConfig([
+  ...nextVitals,
+  ...nextTs,
+  // Override default ignores of eslint-config-next.
+  globalIgnores([
+    // Default ignores of eslint-config-next:
+    ".next/**",
+    "out/**",
+    "build/**",
+    "next-env.d.ts",
+  ]),
+]);
+
+export default eslintConfig;

apps/backgrounds/package.json

@@ -4,21 +4,21 @@
   "private": true,
   "homepage": "https://bg.grida.co",
   "scripts": {
-    "dev": "next dev --turbopack",
+    "dev": "next dev",
     "build": "next build",
     "start": "next start",
-    "lint": "next lint",
+    "lint": "eslint",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@next/third-parties": "15.3.8",
+    "@next/third-parties": "16.1.2",
     "@react-three/drei": "^10.0.7",
     "@react-three/fiber": "9.1.2",
     "clsx": "^2.1.1",
     "motion": "^12.11.0",
-    "next": "15.3.8",
-    "react": "19.2.1",
-    "react-dom": "19.2.1",
+    "next": "16.1.2",
+    "react": "19.2.3",
+    "react-dom": "19.2.3",
     "shadergradient": "^1.2.14",
     "tailwind-merge": "^3.2.0",
     "three": "^0.170.0",
@@ -31,7 +31,7 @@
     "@types/react-dom": "^19",
     "@types/three": "^0.170.0",
     "eslint": "^9",
-    "eslint-config-next": "15.3.8",
+    "eslint-config-next": "16.1.2",
     "tailwindcss": "^4",
     "typescript": "^5"
   }

apps/backgrounds/tsconfig.json

@@ -1,10 +1,7 @@
 {
   "compilerOptions": {
-    "lib": [
-      "dom",
-      "dom.iterable",
-      "esnext"
-    ],
+    "target": "ES2017",
+    "lib": ["dom", "dom.iterable", "esnext"],
     "allowJs": true,
     "skipLibCheck": true,
     "strict": true,
@@ -14,27 +11,24 @@
     "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
-    "jsx": "preserve",
+    "jsx": "react-jsx",
     "incremental": true,
     "plugins": [
       {
         "name": "next"
       }
     ],
     "paths": {
-      "@/*": [
-        "./*"
-      ]
-    },
-    "target": "ES2017"
+      "@/*": ["./*"]
+    }
   },
   "include": [
     "next-env.d.ts",
     "**/*.ts",
     "**/*.tsx",
-    ".next/types/**/*.ts"
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts",
+    "**/*.mts"
   ],
-  "exclude": [
-    "node_modules"
-  ]
+  "exclude": ["node_modules"]
 }

apps/viewer/eslint.config.mjs

@@ -1,16 +1,18 @@
-import { dirname } from "path";
-import { fileURLToPath } from "url";
-import { FlatCompat } from "@eslint/eslintrc";
+import { defineConfig, globalIgnores } from "eslint/config";
+import nextVitals from "eslint-config-next/core-web-vitals";
+import nextTs from "eslint-config-next/typescript";
 
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-const compat = new FlatCompat({
-  baseDirectory: __dirname,
-});
-
-const eslintConfig = [
-  ...compat.extends("next/core-web-vitals", "next/typescript"),
-];
+const eslintConfig = defineConfig([
+  ...nextVitals,
+  ...nextTs,
+  // Override default ignores of eslint-config-next.
+  globalIgnores([
+    // Default ignores of eslint-config-next:
+    ".next/**",
+    "out/**",
+    "build/**",
+    "next-env.d.ts",
+  ]),
+]);
 
 export default eslintConfig;

apps/viewer/package.json

@@ -3,20 +3,20 @@
   "version": "0.1.0",
   "private": true,
   "scripts": {
-    "dev": "next dev --turbopack",
+    "dev": "next dev",
     "build": "next build",
     "start": "next start",
-    "lint": "next lint",
+    "lint": "eslint",
     "typecheck": "tsc --noEmit"
   },
   "packageManager": "pnpm@10.10.0",
   "dependencies": {
     "@uidotdev/usehooks": "^2.4.1",
     "lucide-react": "^0.511.0",
-    "next": "15.3.8",
+    "next": "16.1.2",
     "pdfjs-dist": "4.8.69",
-    "react": "19.2.1",
-    "react-dom": "19.2.1",
+    "react": "19.2.3",
+    "react-dom": "19.2.3",
     "react-pageflip": "^2.0.3",
     "react-pdf": "^9.2.1"
   },
@@ -27,7 +27,7 @@
     "@types/react": "^19",
     "@types/react-dom": "^19",
     "eslint": "^9",
-    "eslint-config-next": "15.3.8",
+    "eslint-config-next": "16.1.2",
     "postcss": "^8",
     "tailwindcss": "^4",
     "typescript": "^5"

apps/viewer/tsconfig.json

@@ -11,7 +11,7 @@
     "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
-    "jsx": "preserve",
+    "jsx": "react-jsx",
     "incremental": true,
     "plugins": [
       {
@@ -22,6 +22,13 @@
       "@/*": ["./*"]
     }
   },
-  "include": ["next-env.d.ts", "**/*.ts", "**/*.tsx", ".next/types/**/*.ts"],
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts",
+    "**/*.mts"
+  ],
   "exclude": ["node_modules"]
 }

editor/.gitignore

@@ -43,6 +43,7 @@ supabase/.temp
 
 # typescript
 *.tsbuildinfo
+next-env.d.ts
 
 # Playwright
 node_modules/

editor/AGENTS.md

@@ -1,6 +1 @@
 # `editor`
-
-**Notes**
-
-- the `next-env.d.ts` file for this project is intentionally included in the git.
-  this is to avoid running dev/build for typechecking in CI envs.

editor/app/(api)/private/customers/[project_id]/with-csv/route.ts

@@ -9,7 +9,7 @@ type PGCustomerInsert =
   Database["grida_ciam_public"]["Views"]["customer_with_tags"]["Row"];
 
 type Params = {
-  project_id: number;
+  project_id: string;
 };
 
 async function parse_customers_csv(
@@ -89,7 +89,12 @@ export async function POST(
   request: NextRequest,
   { params }: { params: Promise<Params> }
 ) {
-  const { project_id } = await params;
+  const { project_id: project_id_param } = await params;
+  const project_id = Number(project_id_param);
+  assert(
+    Number.isFinite(project_id),
+    "Invalid project_id (expected a numeric route param)"
+  );
   const formdata = await request.formData();
   const searchParams = request.nextUrl.searchParams;
   const dryrun = qboolean(searchParams.get("dryrun"));
@@ -150,7 +155,12 @@ export async function PATCH(
   request: NextRequest,
   { params }: { params: Promise<Params> }
 ) {
-  const { project_id } = await params;
+  const { project_id: project_id_param } = await params;
+  const project_id = Number(project_id_param);
+  assert(
+    Number.isFinite(project_id),
+    "Invalid project_id (expected a numeric route param)"
+  );
   const formdata = await request.formData();
   const searchParams = request.nextUrl.searchParams;
   const dryrun = qboolean(searchParams.get("dryrun"));

editor/app/(api)/private/editor/x-supabase/projects/[supabase_project_id]/custom-schema/route.ts

@@ -4,15 +4,21 @@ import { createXSBClient } from "@/lib/supabase/server";
 import { SupabasePostgRESTOpenApi } from "@/lib/supabase-postgrest";
 import assert from "assert";
 
-type Params = { supabase_project_id: number };
+type Params = { supabase_project_id: string };
 
 interface Context {
   params: Promise<Params>;
 }
 
 export async function POST(req: NextRequest, context: Context) {
   const xsbClient = await createXSBClient();
-  const { supabase_project_id } = await context.params;
+  const { supabase_project_id: supabase_project_id_param } =
+    await context.params;
+  const supabase_project_id = Number(supabase_project_id_param);
+  assert(
+    Number.isFinite(supabase_project_id),
+    "Invalid supabase_project_id (expected a numeric route param)"
+  );
 
   const body: XSupabasePrivateApiTypes.AddSchemaNameRequestData =
     await req.json();

editor/app/(api)/private/editor/x-supabase/projects/[supabase_project_id]/route.ts

@@ -5,15 +5,18 @@ import { DontCastJsonProperties } from "@/types/supabase-ext";
 import { notFound } from "next/navigation";
 import { NextRequest, NextResponse } from "next/server";
 
-type Params = { supabase_project_id: number };
+type Params = { supabase_project_id: string };
 
 interface Context {
   params: Promise<Params>;
 }
 
 export async function GET(req: NextRequest, context: Context) {
   const xsbClient = await createXSBClient();
-  const { supabase_project_id } = await context.params;
+  const { supabase_project_id: supabase_project_id_param } =
+    await context.params;
+  const supabase_project_id = Number(supabase_project_id_param);
+  if (!Number.isFinite(supabase_project_id)) return notFound();
 
   const { data: supabase_project, error: rls_err } = await xsbClient
     .from("supabase_project")
@@ -41,7 +44,10 @@ export async function GET(req: NextRequest, context: Context) {
 
 export async function PATCH(req: NextRequest, context: Context) {
   const xsbClient = await createXSBClient();
-  const { supabase_project_id } = await context.params;
+  const { supabase_project_id: supabase_project_id_param } =
+    await context.params;
+  const supabase_project_id = Number(supabase_project_id_param);
+  if (!Number.isFinite(supabase_project_id)) return notFound();
 
   const { data: supabase_project, error: rls_err } = await xsbClient
     .from("supabase_project")
@@ -118,7 +124,10 @@ export async function PATCH(req: NextRequest, context: Context) {
 
 export async function DELETE(req: NextRequest, context: Context) {
   const xsbClient = await createXSBClient();
-  const { supabase_project_id } = await context.params;
+  const { supabase_project_id: supabase_project_id_param } =
+    await context.params;
+  const supabase_project_id = Number(supabase_project_id_param);
+  if (!Number.isFinite(supabase_project_id)) return notFound();
 
   const { count, error } = await xsbClient
     .from("supabase_project")

editor/app/(api)/private/editor/x-supabase/projects/[supabase_project_id]/secure-service-key/route.ts

@@ -5,15 +5,23 @@ import {
   __dangerously_fetch_secure_service_role_key,
 } from "@/services/x-supabase";
 
-type Params = { supabase_project_id: number };
+type Params = { supabase_project_id: string };
 
 interface Context {
   params: Promise<Params>;
 }
 
 export async function GET(req: NextRequest, context: Context) {
   const xsbClient = await createXSBClient();
-  const { supabase_project_id } = await context.params;
+  const { supabase_project_id: supabase_project_id_param } =
+    await context.params;
+  const supabase_project_id = Number(supabase_project_id_param);
+  if (!Number.isFinite(supabase_project_id)) {
+    return NextResponse.json(
+      { error: "Invalid supabase_project_id" },
+      { status: 400 }
+    );
+  }
 
   // [REQUIRED SECURITY LAYER]
   // Security layer - this is secure (protected by RLS).
@@ -40,7 +48,15 @@ export async function GET(req: NextRequest, context: Context) {
 
 export async function POST(req: NextRequest, context: Context) {
   const xsbClient = await createXSBClient();
-  const { supabase_project_id } = await context.params;
+  const { supabase_project_id: supabase_project_id_param } =
+    await context.params;
+  const supabase_project_id = Number(supabase_project_id_param);
+  if (!Number.isFinite(supabase_project_id)) {
+    return NextResponse.json(
+      { error: "Invalid supabase_project_id" },
+      { status: 400 }
+    );
+  }
 
   // [REQUIRED SECURITY LAYER]
   // Security layer - this is secure (protected by RLS).

editor/app/(api)/private/editor/x-supabase/projects/[supabase_project_id]/storage/buckets/route.ts

@@ -3,15 +3,18 @@ import { createXSupabaseClient } from "@/services/x-supabase";
 import { notFound } from "next/navigation";
 import { NextRequest, NextResponse } from "next/server";
 
-type Params = { supabase_project_id: number };
+type Params = { supabase_project_id: string };
 
 interface Context {
   params: Promise<Params>;
 }
 
 export async function GET(req: NextRequest, context: Context) {
   const xsbClient = await createXSBClient();
-  const { supabase_project_id } = await context.params;
+  const { supabase_project_id: supabase_project_id_param } =
+    await context.params;
+  const supabase_project_id = Number(supabase_project_id_param);
+  if (!Number.isFinite(supabase_project_id)) return notFound();
 
   // [REQUIRED] RLS gate
   const { data: supabase_project } = await xsbClient