Merge branch 'main' into feature/vault-state-reconciliation

Author: Simongodw

.env.example

@@ -52,8 +52,22 @@ JWT_REFRESH_EXPIRES_IN=7d
 # MUST be changed from the default in production.
 DOWNLOAD_SECRET=change-me-in-production
 
-# ── Horizon / Stellar ─────────────────────────────────────────────────────────
+# ── Soroban ──────────────────────────────────────────────────────────────────────
 
+# Soroban contract ID (56-char base32 starting with C). Required for submit mode.
+SOROBAN_CONTRACT_ID=CXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+
+# Soroban network passphrase (e.g., Test SDF Network ; September 2015)
+SOROBAN_NETWORK_PASSPHRASE=Test SDF Network ; September 2015
+
+# Soroban source account (public key starting with G)
+SOROBAN_SOURCE_ACCOUNT=GXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+
+# Soroban RPC URL (https endpoint)
+SOROBAN_RPC_URL=https://example.com/soroban-rpc
+
+# Soroban secret key (private key starting with S) – keep this secret!
+SOROBAN_SECRET_KEY=SXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 # Stellar Horizon API endpoint (required when the Horizon listener is active).
 # Must be a valid http:// or https:// URL.
 HORIZON_URL=https://horizon-testnet.stellar.org
@@ -70,6 +84,21 @@ RETRY_MAX_ATTEMPTS=3
 # Initial retry back-off delay in milliseconds (default: 100).
 RETRY_BACKOFF_MS=100
 
+# ── Soroban submit mode ──────────────────────────────────────────────────────
+
+# Required together to enable on-chain submit mode for vault creation.
+SOROBAN_CONTRACT_ID=CDISCIPLRSOROBANCONTRACT1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ
+SOROBAN_NETWORK_PASSPHRASE=Test SDF Network ; September 2015
+SOROBAN_SOURCE_ACCOUNT=GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+SOROBAN_RPC_URL=https://soroban-testnet.stellar.org
+SOROBAN_SECRET_KEY=SBXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
+
+# Polling and timeout controls for submit mode.
+SOROBAN_SUBMIT_POLL_INTERVAL_MS=1000
+SOROBAN_SUBMIT_POLL_MAX_ATTEMPTS=30
+SOROBAN_RPC_TIMEOUT_MS=30000
+SOROBAN_SUBMIT_RETRY_MAX_BACKOFF_MS=5000
+
 # JWT Configuration
 # Access token secret — used to sign/verify short-lived access tokens.
 # Must be at least 32 characters in production.
@@ -80,3 +109,26 @@ JWT_REFRESH_SECRET=your-refresh-secret-min-32-chars-long
 # Token lifetimes (defaults: 15m access, 7d refresh)
 JWT_ACCESS_EXPIRES_IN=15m
 JWT_REFRESH_EXPIRES_IN=7d
+ORG_RATE_LIMIT_MAX=200
+ORG_RATE_LIMIT_WINDOW_MS=60000
+
+# ── Webhooks ──────────────────────────────────────────────────────────────────
+
+# Comma-separated hostnames allowed for outbound webhook delivery.
+# If empty, all public hosts are allowed (RFC-1918, loopback, link-local blocked).
+WEBHOOK_ALLOWED_HOSTS=hooks.example.com
+
+# Secret for verifying inbound webhook signatures.
+WEBHOOK_INBOUND_SECRET=your-inbound-webhook-secret
+
+# Allowed timestamp skew for inbound webhook verification (ms, default: 300000).
+WEBHOOK_INBOUND_SKEW_MS=300000
+
+# Circuit breaker: consecutive failures before tripping (default: 5).
+WEBHOOK_CIRCUIT_BREAKER_THRESHOLD=5
+
+# Circuit breaker: sliding window in ms for failure counting (default: 60000).
+WEBHOOK_CIRCUIT_BREAKER_WINDOW_MS=60000
+
+# Circuit breaker: time before an OPEN breaker transitions to HALF_OPEN (default: 30000).
+WEBHOOK_CIRCUIT_BREAKER_HALF_OPEN_TIMEOUT_MS=30000

.github/workflows/codeql.yml

@@ -0,0 +1,53 @@
+name: "CodeQL and Dependency Review"
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 0 * * 0"
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          fail-on-scopes: runtime
+
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      packages: read
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["typescript"]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3