chore: upgrade nft-meta-data-pointer app to Next.js 16 and React 18.3

[Harsh-H-Shah]

Summary

This Token-2022 example's frontend was on Next.js 13.4.4 / React 18.2.0 (mid-2023) — the only browser app in this repo, and the one place where dependency staleness is a security question (wallet-connected) rather than pure hygiene. This PR brings it to Next.js 16.2.12 / React 18.3.1.

Stays on React 18.x rather than 19: @magicblock-labs/gum-react-sdk (used for the session-key feature) hard-pins react: ^18.2.0 in every published release up to latest (3.0.10), with no React 19 support. Next.js itself doesn't force the issue — both Next 15 and 16 still accept react: ^18.2.0.

What's in scope vs. what surfaced

The version jump itself is small. Getting next build to pass under it was not — Next 16's stricter type-checking and Turbopack bundling caught several pre-existing bugs that had never been exercised before. I've tried to keep those fixes minimal and mechanical rather than rewriting anything.

Direct upgrade

• next 13.4.4 → 16.2.12, react/react-dom 18.2.0 → 18.3.1
• eslint 8.41.0 → 9.39.5, eslint-config-next → 16.2.12
• .eslintrc.json → eslint.config.mjs (flat config) — next lint was removed entirely in Next 16
• typescript 5.0.4 → 5.9.3 (needed — several @solana/* transitive deps require typescript >= 5.4.0)

Pre-existing bugs this surfaced

• idl/extension_nft.ts hand-writes this program's Anchor IDL and was in an old schema (isOptional instead of optional, account structs embedded directly instead of pointing into a types array, "publicKey" instead of "pubkey" as a type literal, and missing the now-required address/metadata/discriminator fields) — incompatible with the already-installed @anchor-lang/core client, which silently collapsed every account's decoded type to never. Restructured to the current schema. Instruction/account discriminators are computed via sha256("global:"|"account:" + name).slice(0, 8), matching Anchor's own algorithm exactly — not guessed — worth double-checking against the real deployed program's IDL if you have it handy.
• utils/anchor.ts: the Program constructor no longer takes programId as a positional argument now that idl.address is required and used instead.
• @coral-xyz/anchor and axios were imported in a couple of files but never declared as dependencies — they only resolved before by accident, via node_modules hoisting under Next 13's looser module resolution. Now declared properly (axios) or replaced with the already-used @anchor-lang/core/@solana/web3.js equivalents.
• @solana/wallet-adapter-wallets (the mega-package bundling every hardware/mobile wallet adapter) pulls in a Ledger dependency with a broken ESM export under Turbopack, crashing the build. This app only ever uses Phantom + Solflare, so swapped to the standalone @solana/wallet-adapter-phantom / @solana/wallet-adapter-solflare packages instead of fighting the bundler over unused code.
• gum-react-sdk's createSession() signature drifted between the pinned ^3.0.4 range and the resolved 3.0.10: the 2nd parameter changed from a boolean to topUpLamports: number.
• ChopTreeButton.tsx: one chopTree instruction call was missing the required systemProgram/tokenProgram accounts (would have failed on-chain), and an NFT-authority field (typed as string | { address: string }) was read unsafely in two places without checking which shape it was.

Requesting extra scrutiny on

• The discriminator values and restructured idl/extension_nft.ts — I computed these correctly against Anchor's known algorithm, but I don't have a way to test them against the actual deployed program (H31ofLpWqeAzF2Pg54HSPQGYifJad843tTJg8vCYVoh3) in this environment.
• The ChopTreeButton.tsx account/null-safety fixes — logically sound based on the sibling code path in the same file, but not exercised against a live wallet.

Test plan

• next build passes: full TypeScript check + static generation of all routes
• next dev serves the homepage (GET / 200), and the SSR output contains real Chakra UI + wallet-adapter markup — the full provider tree mounts and renders without throwing
• eslint . passes with 0 errors (3 pre-existing exhaustive-deps warnings left as-is, unrelated to this change)
• Live browser click-through / wallet connect — not possible in the environment this was built in (no Chromium available). Needs a manual smoke test before merging.

[greptile-apps]

Greptile Summary

Upgrades the NFT metadata-pointer frontend toolchain and repairs compatibility issues exposed by the upgrade.

• Moves the application to Next.js 16.2.12, React 18.3.1, TypeScript 5.9, and ESLint flat configuration.
• Updates wallet-adapter dependencies, session funding arguments, Anchor client construction, and Token-2022 transaction account wiring.
• Migrates the handwritten Anchor IDL to the current schema and adds an application-local pnpm lockfile.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
tokens/token-2022/nft-meta-data-pointer/app/components/ChopTreeButton.tsx	Adds required transaction accounts and null-safe authority handling while fully correcting the displayed session-loading defects.
tokens/token-2022/nft-meta-data-pointer/app/idl/extension_nft.ts	Migrates the handwritten IDL to the current Anchor schema with explicit program, instruction, and account discriminators.
tokens/token-2022/nft-meta-data-pointer/app/package.json	Upgrades the frontend toolchain and replaces the aggregate wallet package with the two adapters used by the application.
tokens/token-2022/nft-meta-data-pointer/app/pnpm-lock.yaml	Pins the standalone application’s updated dependency graph and integrity metadata.
tokens/token-2022/nft-meta-data-pointer/app/utils/anchor.ts	Updates Anchor Program construction to source the program address from the migrated IDL.

_{Reviews (4): Last reviewed commit: "chore: upgrade nft-meta-data-pointer app..." | Re-trigger Greptile}

[dev-jodee]

The upgrade's still wanted — but #656 flattened anchor-example/ out of this example's path, so everything you touched moved to nft-meta-data-pointer/app/. Needs a rebase (mostly a directory rename on your side). One ask while you're in there: the +8.6k diff suggests a lockfile or generated output got committed — trim it to the actual upgrade if so.

[Harsh-H-Shah]

Thanks for the review, both — pushed a fix.

Rebased onto main. Moved everything from anchor-example/app/ to the new app/ path from #656, and reformatted the touched files with the repo's new Prettier config (@solana/prettier-config-solana) rather than leaving them in the old Biome-era style, so the diff stays minimal against the rest of the app. Also caught that #656 already flattened one thing I'd need to redo — double-checked and everything now applies cleanly on top of current main.

Re: the lockfile size — pnpm-lock.yaml is genuinely net-new, not generated build output. This app never had one committed before this PR (confirmed via git log — it doesn't exist anywhere in history prior to this branch), so the ~8.5k lines are pnpm's full resolution of this app's dependency graph (Chakra UI + the wallet-adapter ecosystem + gum-sdk + Solana web3 all pull in a lot of transitive deps), not a diff against a smaller prior lockfile. CONTRIBUTING.md calls for committing it, so I've kept it — but flag if you'd rather this app go without one for now.

Excluding that lockfile, the real diff is small and focused.

Greptile's P1 is fixed — the added sessionToken guard in onChopClick now resets isLoadingSession before returning, same as the other early-return branches in that function already do.

Re-verified after the rebase: next build passes clean, eslint . passes with 0 errors (same 3 pre-existing exhaustive-deps warnings as before, unrelated to this change).

Update: Greptile caught a second, related bug in the same guard — onChopClick's "no NFT found" branch was calling setIsLoadingMainWallet(false) instead of setIsLoadingSession(false) (a copy-paste leftover from the sibling onChopMainWalletClick handler). Also fixed and pushed. Re-verified next build and eslint . are still clean after both fixes.

[dev-jodee]

can you remove the web3js dependency and move to kit

[dev-jodee]

@Harsh-H-Shah you need ot sign your commit

[Harsh-H-Shah]

Right, my bad. Signed and pushed again, thanks!