build(deps): upgrade to next 16 and drop the postcss override

CLAUDE.md

@@ -1,6 +1,6 @@
 # CLAUDE.md
 
-**Stack:** Next.js 15 (App Router), React 19, TypeScript, Tailwind CSS v4, Framer Motion 11, Geist Sans/Mono, Lucide, Recharts, wavesurfer.js. Auth via `@auth0/nextjs-auth0`; billing/usage/keys via `@pymthouse/builder-sdk`. Package manager: **pnpm**.
+**Stack:** Next.js 16 (App Router), React 19, TypeScript, Tailwind CSS v4, Framer Motion 11, Geist Sans/Mono, Lucide, Recharts, wavesurfer.js. Auth via `@auth0/nextjs-auth0`; billing/usage/keys via `@pymthouse/builder-sdk`. Package manager: **pnpm**.
 
 **Tests:** there are ~9 `*.test.ts` files under `lib/console/`, but **no test runner is installed and no `test` script exists** — they cannot currently run. Either wire up a runner or treat those files as documentation; don't assume `pnpm test` works.
 
@@ -16,7 +16,7 @@
 
 ## Environment
 
-Local dev needs `.env.local` (see `.env.example`). Auth0 vars are required — without them `middleware.ts` throws `DomainResolutionError` on every request and the whole app 404s. Preview values can be pulled with `vercel env pull --environment=preview` against `livepeer-foundation/console`, except values Vercel marks **Sensitive** (`AUTH0_SECRET`, `AUTH0_CLIENT_SECRET`, `LP_DASHBOARD_SESSION_SECRET`, `PYMTHOUSE_M2M_CLIENT_SECRET`) which the API will not return to anyone.
+Local dev needs `.env.local` (see `.env.example`). Auth0 vars are required — without them `proxy.ts` throws `DomainResolutionError` on every request and the whole app 404s. Preview values can be pulled with `vercel env pull --environment=preview` against `livepeer-foundation/console`, except values Vercel marks **Sensitive** (`AUTH0_SECRET`, `AUTH0_CLIENT_SECRET`, `LP_DASHBOARD_SESSION_SECRET`, `PYMTHOUSE_M2M_CLIENT_SECRET`) which the API will not return to anyone.
 
 `CONSOLE_DEV_MOCK=1` serves auth + PymtHouse endpoints from `lib/console/dev-mock.ts` so auth-gated surfaces can be worked on without credentials. Hard-disabled when `NODE_ENV === "production"`.
 

app/(app)/install/InstallContent.tsx

@@ -546,7 +546,7 @@ export default function InstallPage() {
   const { isConnected, isLoading } = useAuth();
 
   // Middleware already sends signed-out requests to /login before this page
-  // is served (see middleware.ts). This client-side fallback only fires if
+  // is served (see proxy.ts). This client-side fallback only fires if
   // the session lapses while the console is open.
   useEffect(() => {
     if (!isLoading && !isConnected) {

components/console/AuthContext.tsx

@@ -86,6 +86,9 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     [profile]
   );
   const disconnect = useCallback(() => {
+    // Full-page navigation on purpose: /auth/logout is an Auth0 route handled
+    // in proxy.ts, not a Next.js page, so the client router cannot reach it.
+    // eslint-disable-next-line @next/next/no-location-assign-relative-destination
     window.location.assign("/auth/logout");
   }, []);
   return (

eslint.config.mjs

@@ -1,15 +1,9 @@
-import { dirname } from "path";
-import { fileURLToPath } from "url";
-import { FlatCompat } from "@eslint/eslintrc";
+import { defineConfig } from "eslint/config";
+import nextCoreWebVitals from "eslint-config-next/core-web-vitals";
+import nextTypescript from "eslint-config-next/typescript";
+import prettier from "eslint-config-prettier";
 
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-const compat = new FlatCompat({
-  baseDirectory: __dirname,
-});
-
-const eslintConfig = [
+const eslintConfig = defineConfig([
   {
     ignores: [
       ".next/",
@@ -19,16 +13,25 @@ const eslintConfig = [
       "next-env.d.ts",
     ],
   },
-  ...compat.extends("next/core-web-vitals", "next/typescript", "prettier"),
+  ...nextCoreWebVitals,
+  ...nextTypescript,
+  prettier,
   {
     rules: {
       "@next/next/no-img-element": "off",
+      // React Compiler rules that arrived with eslint-plugin-react-hooks 7 via
+      // eslint-config-next 16. They flag ~40 existing sites (setState inside
+      // effects, ref reads during render, components defined inline). Off
+      // until that refactor lands; re-enable one rule at a time.
+      "react-hooks/set-state-in-effect": "off",
+      "react-hooks/refs": "off",
+      "react-hooks/static-components": "off",
       "@typescript-eslint/no-unused-vars": [
         "warn",
         { argsIgnorePattern: "^_", varsIgnorePattern: "^_" },
       ],
     },
   },
-];
+]);
 
 export default eslintConfig;

lib/console/auth-login.ts

@@ -1,7 +1,7 @@
 import { identitySyncPath } from "@/lib/identity/sync-return";
 
 /** SDK login route. Must be a full navigation (`<a>` / `location.assign`),
- *  not a Next.js client transition — middleware mounts `/auth/*`. */
+ *  not a Next.js client transition — proxy.ts mounts `/auth/*`. */
 export const AUTH_LOGIN_PATH = "/auth/login";
 
 const DEFAULT_RETURN_TO = "/home";

lib/console/dev-mock.ts

@@ -4,10 +4,10 @@
  *
  * Enabled by `CONSOLE_DEV_MOCK=1` in `.env.local`; hard-disabled when
  * `NODE_ENV === "production"` so it can never answer a deployed request.
- * Middleware short-circuits to these payloads before `auth0.middleware()`
+ * The proxy short-circuits to these payloads before `auth0.middleware()`
  * runs, so no Auth0 secret is needed to reach the view.
  *
- * Delete this file (and the guard in `middleware.ts`) once real credentials
+ * Delete this file (and the guard in `proxy.ts`) once real credentials
  * are in place.
  */
 

next.config.ts

@@ -5,24 +5,13 @@ const posthogProxyPath = "/lpx";
 const nextConfig: NextConfig = {
   // Keep production-build checks separate from a running local dev server.
   distDir: process.env.CONSOLE_DIST_DIR || ".next",
+  // Stop `next dev` from appending its generated block to CLAUDE.md.
+  agentRules: false,
   allowedDevOrigins: ["studio.tail0de21e.ts.net"],
-  // Bundler-agnostic polling interval for file watching — works with both
-  // Turbopack (default in Next 15) and Webpack. Needed because the native
-  // file watcher doesn't pick up changes reliably in git worktrees.
+  // Poll for file changes: the native watcher misses edits in git worktrees.
   watchOptions: {
     pollIntervalMs: 1000,
   },
-  webpack: (config) => {
-    // Additional Webpack-specific watch tweaks for git worktree symlinks
-    // (only takes effect when Turbopack is disabled).
-    config.watchOptions = {
-      ...config.watchOptions,
-      followSymlinks: true,
-      poll: 1000,
-      aggregateTimeout: 300,
-    };
-    return config;
-  },
   async rewrites() {
     return [
       {

package.json

@@ -31,7 +31,7 @@
     "jose": "^6.2.10",
     "lucide-react": "^1.6.0",
     "motion": "^13.2.0",
-    "next": "^15.5.25",
+    "next": "^16.3.4",
     "postgres": "^3.4.9",
     "posthog-js": "^1.427.2",
     "posthog-node": "^5.51.6",
@@ -46,15 +46,14 @@
     "zod": "^3.25.76"
   },
   "devDependencies": {
-    "@eslint/eslintrc": "^3.3.7",
     "@tailwindcss/postcss": "^4.0.0",
     "@testing-library/react": "^16.3.3",
     "@types/node": "^22.0.0",
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "drizzle-kit": "^0.31.10",
     "eslint": "^9",
-    "eslint-config-next": "^15.1.0",
+    "eslint-config-next": "^16.3.4",
     "eslint-config-prettier": "^10.1.8",
     "jsdom": "^29.1.1",
     "postcss": "^8.5.23",
@@ -66,7 +65,6 @@
   },
   "pnpm": {
     "overrides": {
-      "postcss": "^8.5.28",
       "esbuild@<0.25.0": "^0.25.12"
     }
   }