Technology Stack and Dependencies
FlintTrade combines a React trading terminal, a Python backend, a Rust tick engine, an Electron desktop shell, and a Next.js documentation site. This guide explains what the main dependencies do and where to find their versions.
Where versions come from
The version families below describe the architecture. The linked manifests and
lockfiles record the exact dependency requirements and resolved versions for
the same source revision; they are the authoritative inventory. A requirement
such as ^19.2.8 or >=3.0 is a permitted range, not the exact installed version.
| Version question | Source of truth |
|---|---|
| Which FlintTrade release is this? | VERSION; this is separate from dependency versions. |
| Which Python and Node versions are supported? | flint.toml, [requirements]: supported minimums and development targets are separate. See Compatibility. |
| Which JavaScript packages does each app require? | The terminal, desktop, site, and design-system manifests. |
| Which JavaScript versions are resolved? | pnpm-lock.yaml, including each workspace importer; shared overrides live in pnpm-workspace.yaml. |
| Which Python versions are resolved? | uv.lock. requirements.lock is its frozen export for the pip installation path. Each package's pyproject.toml declares its direct requirements. |
| Which Rust versions are resolved? | Cargo.toml and Cargo.lock. |
| Which package manager is used? | The root package.json packageManager field pins pnpm. Installer tool downloads have separate verified pins in the bootstrap manifest. |
The terminal's Settings → About shows selected frontend dependency requirements and links to this guide. They are declared version ranges from that build; the lockfile records exact resolved versions. They do not report the running backend's Python packages or the installed Electron shell. For a reproducible dependency inventory, inspect the lockfiles at the commit used to build that installation. The public docs follow the site's source revision and may be newer than an installed app.
Trading terminal and shared UI
| Dependency | What FlintTrade uses it for |
|---|---|
| React 19 and React DOM | Rendering the terminal routes, widgets, forms, and shared design-system components. |
| TypeScript and Vite 8 | Static checking, development server, and production terminal bundling. TypeScript is a build tool; the site can use a different compiler version from the terminal. |
| Tailwind CSS 4, Radix UI, shadcn/ui patterns | Styling, design tokens, and accessible interactive primitives. shadcn components are owned source files, not a single runtime package with one version. |
| FlexLayout 0.11 and FINOS FDC3 2 | Dockable panels and saved workspaces; in-process symbol linking and widget intents. |
| Lightweight Charts 5 | Price charts through FlintTrade's shared chart runtime and theme. TradingView attribution is also visible in About. |
| FINOS Perspective 3, Glide Data Grid 6, TanStack Table 9 | Portfolio pivot analytics, canvas grids, and headless sortable/filterable tables respectively. |
| Zustand 5, Jotai 2, TanStack Query 5 | UI/derived state, streaming quote atoms, and cached REST responses respectively. See the state boundaries. |
| React Router 8, React Hook Form 7, Zod 4 | Route loading, form state, and runtime validation. |
| Three.js, React Three Fiber, Drei, Plotly | Specialist 3D and analytical visualisations. Shared standard charts use FlintTrade's design-system primitives. |
| Lucide React, Framer Motion, date-fns | Icons, interface motion, and date formatting/calculations. |
Direct requirements are in the terminal manifest and shared design-system manifest.
Python backend, data, and integrations
| Dependency | What FlintTrade uses it for |
|---|---|
| Python, Flask, Waitress | Backend services, HTTP routes, and the local WSGI server. Flask extensions provide CORS handling and request limits. |
| Pydantic, httpx, websockets | Validated data models, outbound HTTP clients, and streaming WebSocket connections. |
| SQLite, DuckDB, PyArrow | Transactional local state, analytical queries, and columnar/Parquet data respectively. SQLite is provided by Python's standard library. |
| NumPy, pandas, SciPy | Indicator arrays, historical-data processing, numerical statistics, and backtest analytics. |
| filelock | Cross-process coordination for workspace migrations, provisioning, and local configuration/service state. Owner-validated lock subclasses preserve the lock file and check its ownership. |
| python-dotenv | Optional repository .env fallback for contributor/server configuration; desktop startup does not load this fallback. |
| structlog and Sentry SDK | Structured service logs and configured error reporting. |
| argon2-cffi, cryptography, PyJWT, pyotp | Password hashing, encrypted credential storage, signed authentication tokens, and time-based one-time passwords. |
| DhanHQ, Upstox, Kotak Neo, Groww SDKs | Native broker integration adapters. An SDK upgrade does not establish live-order readiness; broker capabilities and order-safety gates remain separate. |
| LightGBM, CatBoost, joblib | Model training, inference, and model persistence for analysis/signals. The AI package's optional ml extra adds scikit-learn and Optuna support. |
| pypdf | PDF ingestion for the optional AI rag extra. The vector store uses local SQLite/NumPy; local model execution uses the managed Ollama service. |
| Sentence Transformers | Optional in-process text embeddings through the RAG provider's SentenceTransformer.encode adapter. Its requirement is listed in the supplemental requirements.txt, outside the frozen workspace installation. |
Start with the core manifest,
gateway manifest, and
AI manifest. The
package map identifies the remaining
services. Optional extras are distinct from the default runtime installation.
The supplemental requirements.txt is not the frozen
installation manifest: setup uses uv.lock or its requirements.lock export.
Updating its Sentence Transformers requirement does not install that provider in
the normal workspace; it must already be available when explicitly selected.
Desktop, website, and native processing
| Surface | Dependencies and purpose | Direct requirements |
|---|---|---|
| Desktop | Electron provides the sandboxed native window, tray, and local source lifecycle. Electron Builder creates installers; archive and signature libraries support verified bootstrap/update handling. | Desktop package |
| Website | Next.js 16 and React 19 serve the public site. Fumadocs renders repository docs; MCP libraries expose the read-only documentation/contribution interface. | Site package |
| Tick engine | Rust with PyO3 exposes the native engine to Python. Rayon provides parallel processing; thiserror defines Rust errors. | Tick engine crate |
The desktop shell and the managed source checkout update separately. Updating JavaScript or Python source dependencies does not update an already installed Electron shell. See Desktop App.
Development dependencies and maintenance
Vitest and Testing Library test TypeScript/React behaviour; Playwright exercises browser workflows. pytest and its plugins test Python; Ruff checks Python style and correctness; ESLint checks frontend code. These tools support development and CI rather than broker connectivity or strategy execution.
Dependabot configuration covers JavaScript, Python, Rust, and GitHub Actions. Review a proposed bump against the owning package and its actual call sites, keep the manifests and lockfiles consistent, and run the relevant checks described in CI. A major upgrade can require code or configuration changes even when the lockfile resolves successfully.
When a dependency changes, update this guide if its role or version family has changed, and regenerate the dependency notice:
python scripts/generate-notice.pynotice contains project attribution; notice.generated records lockfile fingerprints. Dependency licences remain with their respective authors. Historical release notes describe the versions shipped at that time.
FlintTrade Architecture
Broker connections use six native adapters: Dhan, Upstox, Kotak Neo, INDmoney, Groww, and Delta Exchange. Availability remains evidence-gated. Native broker HTTP mutations and read
FlintTrade API Reference
FlintTrade owns the terminal’s authenticated HTTP transport. Native broker reads and account mutations remain frozen; Practice uses the local sandbox.