Grant-readiness P0s: LICENSE, SECURITY.md, Dockerfile, tool status sync

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024-2026 Savitura
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -12,18 +12,22 @@ SaviTools is a standalone product in the [Savitura](https://savitura.com) ecosys
 
 ## Tools
 
-| Tool                       | What it does                                                                          | Status      |
-| -------------------------- | ------------------------------------------------------------------------------------- | ----------- |
-| **Transaction Inspector**  | Decode any tx hash, Stellar address, or raw XDR into a human-readable breakdown       | In progress |
-| **Wallet Sandbox**         | Generate testnet keypairs, fund via Friendbot, send test payments                     | In progress |
-| **Transaction Composer**   | Visual builder for multi-operation Stellar transactions; sign and submit without code | In progress |
-| **Payment Simulator**      | Find path payment routes between assets; preview hops, rates, and fees                | In progress |
-| **Webhook Tester**         | Fire sample CrowdPay / Fluxa webhook payloads at your endpoint; inspect the response  | In progress |
-| **Ledger Monitor**         | Watch a Stellar address or contract for live activity; set threshold alerts           | Planned     |
-| **API Playground**         | Interactive request builder for Fluxa and CrowdPay APIs                               | Planned     |
-| **Contract Deploy Helper** | Upload and deploy Soroban WASM files to testnet from the browser                      | Planned     |
-| **SDK Generator**          | Generate copy-paste client code (JS, Python, Go, cURL) from Fluxa/CrowdPay endpoints  | Planned     |
-| **Network Status**         | Live Stellar network health: ledger close time, fee tracker, Horizon latency          | Planned     |
+| Tool                      | What it does                                                                          | Status |
+| ------------------------- | ------------------------------------------------------------------------------------- | ------ |
+| **Transaction Inspector** | Decode any tx hash, Stellar address, or raw XDR into a human-readable breakdown       | MVP    |
+| **Wallet Sandbox**        | Generate testnet keypairs, fund via Friendbot, send test payments                     | MVP    |
+| **Transaction Composer**  | Visual builder for multi-operation Stellar transactions; sign and submit without code | MVP    |
+| **Payment Simulator**     | Find path payment routes between assets; preview hops, rates, and fees                | MVP    |
+| **Webhook Tester**        | Fire sample CrowdPay / Fluxa webhook payloads at your endpoint; inspect the response  | MVP    |
+| **Ledger Monitor**        | Watch a Stellar address or contract for live activity; set threshold alerts           | MVP    |
+| **API Playground**        | Interactive request builder for Fluxa and CrowdPay APIs                               | MVP    |
+| **Contract Deployer**     | Upload and deploy Soroban WASM files to testnet from the browser                      | MVP    |
+| **SDK Generator**         | Generate copy-paste client code (JS, Python, Go, cURL) from Fluxa/CrowdPay endpoints  | Planned |
+| **Network Status**        | Live Stellar network health: ledger close time, fee tracker, Horizon latency          | Planned |
+| **Federation & TOML**     | Resolve federation addresses, inspect stellar.toml files, check SEP compliance        | MVP    |
+| **Order Book**            | Live DEX order book, spread analytics, and liquidity depth chart for any asset pair   | MVP    |
+| **Account Graph**         | Visualize signer networks, offers, and payment relationships with a force-directed graph | MVP |
+| **Contract Events**       | Decode, filter, and replay Soroban contract events from raw ScVal XDR                 | MVP    |
 
 ---
 

SECURITY.md

@@ -0,0 +1,58 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.1.x   | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in SaviTools, please report it responsibly:
+
+1. **Do not** open a public GitHub issue for security vulnerabilities.
+2. Email security concerns to: **security@savitura.com**
+3. Include a detailed description of the vulnerability.
+4. If possible, provide steps to reproduce or a proof-of-concept.
+
+We aim to acknowledge reports within 48 hours and will work with you to understand and address the issue promptly.
+
+## Security Measures
+
+SaviTools implements the following security measures:
+
+### API Protection
+
+- **CORS**: Restricted origins via `WEB_ORIGIN` environment variable
+- **Rate Limiting**: Configurable via `THROTTLE_LIMIT` and `THROTTLE_TTL`
+- **Input Validation**: All API inputs are validated using class-validator
+
+### Webhook Security
+
+- **HMAC-SHA256 Signing**: Outbound webhooks are signed when `WEBHOOK_SIGNING_SECRET` is configured
+- **Timestamp Verification**: Replay protection with configurable time window (default 300s)
+- **Signature Header**: `X-SaviTools-Signature` with format `sha256=<hex>`
+
+### Authentication
+
+- **JWT Tokens**: Secure session management with refresh token rotation
+- **Password Hashing**: Argon2 for password storage
+
+### Network Security
+
+- **SSRF Protection**: Guards on outbound requests from Playground and Webhook modules
+- **TLS**: All external API calls use HTTPS
+
+## Security-Related Configuration
+
+| Variable                  | Description                              |
+| ------------------------- | ---------------------------------------- |
+| `WEB_ORIGIN`              | Allowed CORS origin                      |
+| `THROTTLE_TTL`            | Rate limit window (ms)                   |
+| `THROTTLE_LIMIT`          | Max requests per window                  |
+| `WEBHOOK_SIGNING_SECRET`  | HMAC key for webhook signatures          |
+| `JWT_SECRET`              | Secret for JWT token signing             |
+
+## Responsible Disclosure
+
+We appreciate the security research community and will acknowledge researchers who report valid vulnerabilities (with permission) in our release notes.

apps/api/Dockerfile

@@ -0,0 +1,42 @@
+# Stage 1: Build
+FROM node:20-alpine AS builder
+
+WORKDIR /app
+
+# Copy root package files for monorepo
+COPY package.json package-lock.json turbo.json ./
+
+# Copy api package files
+COPY apps/api/package.json apps/api/
+
+# Install all dependencies
+RUN npm ci
+
+# Copy source files
+COPY apps/api apps/api
+
+# Build the API
+RUN npm run build --workspace=@savitools/api
+
+# Stage 2: Production
+FROM node:20-alpine AS runner
+
+WORKDIR /app
+
+ENV NODE_ENV=production
+
+# Copy built artifacts and production dependencies
+COPY --from=builder /app/apps/api/dist ./dist
+COPY --from=builder /app/apps/api/package.json ./
+
+# Install production dependencies only
+RUN npm install --omit=dev
+
+# Create non-root user
+RUN addgroup --system --gid 1001 nodejs && \
+    adduser --system --uid 1001 nestjs
+USER nestjs
+
+EXPOSE 3001
+
+CMD ["node", "dist/main.js"]

apps/api/src/modules/webhook/webhook.service.ts

@@ -79,7 +79,7 @@ export class WebhookService {
       }
 
       let responseStatus: number | null = null;
-      let responseHeaders: Record<string, string> = {};
+      const responseHeaders: Record<string, string> = {};
       let responseBody = '';
       let errorMessage: string | undefined;
 

apps/web/src/lib/tools.ts

@@ -48,7 +48,7 @@ export const tools = [
     href: "/monitor",
     label: "Monitor",
     description: "Watch addresses and contracts for live ledger activity.",
-    status: "Planned" as const,
+    status: "MVP" as const,
   },
   {
     href: "/inspector/federation",