web

This is a Next.js project bootstrapped with create-next-app.

Security

The dashboard and API routes are secured using a Stellar Wallet Auth model (similar to SEP-10). Merchants must prove control of the configured MERCHANT_ADDRESS by signing a challenge using Freighter to access the dashboard.

See SECURITY.md and DESIGN.md for full details on the access model and session handling.

Configuration

Environment variables prefixed NEXT_PUBLIC_ are exposed to the browser.

Variable	Values	Default	Purpose
NEXT_PUBLIC_STELLAR_NETWORK	testnet, mainnet (aliases: public, pubnet)	testnet, with a console warning	Network that block-explorer links (stellar.expert) point at. Set it to mainnet for a production deployment — otherwise every transaction and contract link resolves to a testnet page for something that only exists on mainnet. An unrecognised value fails fast at startup.

Other required server-side variables (DATABASE_URL, MERCHANT_ADDRESS, STELLAR_NETWORK_PASSPHRASE, …) are described in SECURITY.md and DESIGN.md.

Getting Started

First, run the development server:

npm run dev
# or
yarn dev
# or
pnpm dev
# or
bun dev

Open http://localhost:3000 with your browser to see the result.

You can start editing the page by modifying app/page.tsx. The page auto-updates as you edit the file.

This project uses next/font to automatically optimize and load Geist, a new font family for Vercel.

Learn More

To learn more about Next.js, take a look at the following resources:

• Next.js Documentation - learn about Next.js features and API.
• Learn Next.js - an interactive Next.js tutorial.

You can check out the Next.js GitHub repository - your feedback and contributions are welcome!

Deploy on Vercel

The easiest way to deploy your Next.js app is to use the Vercel Platform from the creators of Next.js.

Check out our Next.js deployment documentation for more details.

End-to-end tests

The browser-level suite lives in e2e/ and runs against a local dev server via Playwright:

pnpm e2e

The config is playwright.e2e.config.ts. Backend state is mocked at the network layer (no database needed). Debug with:

pnpm e2e:headed   # run with a visible browser
pnpm e2e:trace    # record a trace; open it with: npx playwright show-trace

The suite includes an automated accessibility pass (e2e/a11y.spec.ts) using @axe-core/playwright; pre-existing violations are listed in an allowlist in that file, each linked to its tracking issue, so new violations fail the run.