# ktrade web terminal (`apps/web`)

Next.js 16 (App Router, TypeScript), Tailwind CSS v4, TanStack Query, TradingView `lightweight-charts`.
Dark "trading terminal" UI for the ktrade API (`apps/api`). All data comes from the API; nothing is mocked.

## Commands

```bash
pnpm install
pnpm dev -p 8471                      # dev server (API must run on 127.0.0.1:8470)
pnpm lint && pnpm tsc --noEmit        # zero errors expected
pnpm build
pnpm next start -H 0.0.0.0 -p 8471    # production
```

## Environment

| Variable       | Default                  | Purpose                                                      |
|----------------|--------------------------|--------------------------------------------------------------|
| `API_UPSTREAM` | `http://127.0.0.1:8470`  | Where `/api/:path*` is rewritten to (read at build/start)    |
| `PORT`         | —                        | Use `-p 8471` on the `next start` command line instead       |

`/api/*` is proxied by a Next.js rewrite (`next.config.ts`); Server-Sent Events (`/api/market/stream`) stream through it
without buffering (verified with `curl -N`), so no custom server is needed. Session cookie `ktrade_session` is checked for
presence by `src/proxy.ts` (Next 16 name for middleware); the API validates it on every call and the client redirects to
`/login` on 401 (`src/lib/api.ts`).

## Pages

`/login`, `/` overview, `/market` (candles + volume, live order book with checksum flag, trade tape, microstructure, data
quality), `/lab` (strategy catalog → parameter form generated from `ParamSpec`, cost model, holdout, walk-forward,
sensitivity), `/backtests` (+ compare up to 8 runs) and `/backtests/[id]` (metrics with bootstrap CI and deflated Sharpe,
equity vs benchmarks, underwater, rolling Sharpe, holdout, walk-forward, sensitivity heatmap, stress, shuffled trades,
ledger, rejected orders, provenance), `/portfolio` / `/paper` / `/execution` (Phase 3–5 placeholders; live tab locked),
`/risk` (limits, kill switch with confirmation, what-if evaluator, risk events, audit chain), `/reports` and
`/reports/[id]` (printable research report), `/settings` (credential status, preflight, balances, environment).

Screenshots from a real session are in `screenshots/`.