From 13ffb874f8a1206d9d20faaaa80af61849466632 Mon Sep 17 00:00:00 2001
From: Daniel Traynor <7traynor@gmail.com>
Date: Wed, 8 Apr 2026 10:29:17 -0400
Subject: [PATCH 1/2] Add logout button to dashboard layout, include
 credentials in fetch requests, and update environment variable handling in
 Docker Compose

---
 .env.example                                  | 10 +++
 .github/workflows/ci.yml                      | 27 ++++++-
 .gitleaks.toml                                | 16 ++++
 CONTRIBUTING.md                               |  2 +
 README.md                                     | 10 +--
 dashboard/next.config.js                      |  4 +-
 dashboard/src/app/(dashboard)/layout.tsx      | 14 +++-
 dashboard/src/app/api/auth/login/route.ts     | 48 +++++++++++
 dashboard/src/app/api/auth/logout/route.ts    | 16 ++++
 dashboard/src/app/layout.tsx                  |  3 +-
 dashboard/src/app/login/page.tsx              | 70 ++++++++++++++++
 dashboard/src/components/LogoutButton.tsx     | 40 ++++++++++
 .../src/components/system/ControlsPanel.tsx   |  5 +-
 .../lib/__tests__/dashboard-session.test.ts   | 22 ++++++
 dashboard/src/lib/branding.ts                 |  7 ++
 dashboard/src/lib/dashboard-fetch.ts          |  8 ++
 dashboard/src/lib/dashboard-session.ts        | 79 +++++++++++++++++++
 dashboard/src/middleware.ts                   | 52 ++++++++++++
 docker-compose.yml                            | 34 ++++----
 docs/DEPLOY_RUNBOOK.md                        |  3 +
 execution/src/index.ts                        |  8 +-
 first-run-setup.sh                            | 13 +--
 .../monitoring/docker-compose.monitoring.yml  |  2 +-
 23 files changed, 455 insertions(+), 38 deletions(-)
 create mode 100644 .gitleaks.toml
 create mode 100644 dashboard/src/app/api/auth/login/route.ts
 create mode 100644 dashboard/src/app/api/auth/logout/route.ts
 create mode 100644 dashboard/src/app/login/page.tsx
 create mode 100644 dashboard/src/components/LogoutButton.tsx
 create mode 100644 dashboard/src/lib/__tests__/dashboard-session.test.ts
 create mode 100644 dashboard/src/lib/branding.ts
 create mode 100644 dashboard/src/lib/dashboard-fetch.ts
 create mode 100644 dashboard/src/lib/dashboard-session.ts
 create mode 100644 dashboard/src/middleware.ts

diff --git a/.env.example b/.env.example
index ae7564d..6038424 100644
--- a/.env.example
+++ b/.env.example
@@ -67,6 +67,16 @@ IMAGE_TAG=latest
 # ================================
 GRAFANA_ADMIN_PASSWORD=
 
+# ================================
+# Dashboard (Next.js UI)
+# ================================
+# Optional label in the sidebar / login (default: Trading Terminal)
+# NEXT_PUBLIC_APP_NAME=
+# Required for production: min 16 characters. Signs the session cookie only (not sent to Polymarket).
+DASHBOARD_API_SECRET=
+# Local dev only: set to "true" to skip dashboard login (never use in production)
+# DASHBOARD_INSECURE_DEV_BYPASS=true
+
 # ================================
 # Trading Parameters
 # ================================
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ed10d02..f441430 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,16 @@ on:
     branches: [main]
 
 jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   build-rust:
     runs-on: ubuntu-latest
     strategy:
@@ -48,9 +58,24 @@ jobs:
         run: npm run build
         working-directory: ${{ matrix.service }}
 
+  build-dashboard:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: dashboard/package-lock.json
+      - name: Install and build
+        env:
+          DASHBOARD_API_SECRET: ci_placeholder_secret_min_len_16
+        run: npm ci && npm run build
+        working-directory: dashboard
+
   build-docker:
     runs-on: ubuntu-latest
-    needs: [build-rust, build-typescript]
+    needs: [build-rust, build-typescript, build-dashboard]
     steps:
       - uses: actions/checkout@v4
       - name: Build all images
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 0000000..984cebc
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,16 @@
+# Gitleaks: extend defaults; allowlist known false positives from generic-api-key.
+# Re-run after edits: gitleaks git . -c .gitleaks.toml -v
+
+title = "algorithmic-trading-polymarket"
+
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Hardhat/Anvil test key #0; Redis kill-switch key names (not API secrets)"
+regexes = [
+  '''0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80''',
+  '''^BTC_5M_TRADING_ENABLED$''',
+  '''^BTC_5M_LATENCY_TRADING_ENABLED$''',
+  '''^BTC_5M_MOMENTUM_TRADING_ENABLED$''',
+]
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index a1d7492..7b34031 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -2,6 +2,8 @@
 
 Thanks for your interest in contributing to the Polymarket trading platform.
 
+The codebase is meant as a **neutral, structured deployment**: every environment brings its own wallets, RPC URLs, and API keys via `.env` — nothing in the tree should assume a specific operator.
+
 ## Getting Started
 
 1. Fork the repo and clone it locally
diff --git a/README.md b/README.md
index bb9480d..20bd3ed 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,8 @@
 # Polymarket Trading Platform
 
-A 12-service automated trading system for [Polymarket](https://polymarket.com) prediction markets, running multiple strategies simultaneously — from sub-second arbitrage scanning to Bayesian sports modeling. Built with Rust and TypeScript, orchestrated via Docker Compose, with a real-time Bloomberg terminal-style dashboard.
+**Deployment template** — this repo ships **no** accounts, wallets, or API secrets. Fork or clone it, copy [`.env.example`](.env.example) to `.env`, and fill in **your** Polygon RPC, Gnosis Safe, Polymarket CLOB credentials, dashboard password, and optional GCP settings. Behavior is strategy-agnostic: the same layout runs paper or live depending on your env flags.
 
-This started as a box spread arbitrage bot and grew into a multi-strategy platform handling live capital on Polygon L2.
+A 12-service automated trading system for [Polymarket](https://polymarket.com) prediction markets, running multiple strategies simultaneously — from sub-second arbitrage scanning to Bayesian sports modeling. Built with Rust and TypeScript, orchestrated via Docker Compose, with a real-time terminal-style dashboard.
 
 ## Architecture
 
@@ -122,12 +122,12 @@ Key features:
 ### Setup
 
 ```bash
-git clone https://github.com/dantraynor/algorithmic-trading-polymarket.git
-cd algorithmic-trading-polymarket
+git clone https://github.com/<your-org>/<your-repo>.git
+cd <your-repo>
 
 # Configure credentials
 cp .env.example .env
-# Edit .env: PRIVATE_KEY, GNOSIS_SAFE_ADDRESS, POLYGON_RPC_URL
+# Edit .env: PRIVATE_KEY, GNOSIS_SAFE_ADDRESS, POLYGON_RPC_URL, DASHBOARD_API_SECRET (min 16 chars)
 
 # Derive CLOB API keys (must run from the server that will trade)
 cd scripts && npm install && PRIVATE_KEY=0x... node derive-keys.js
diff --git a/dashboard/next.config.js b/dashboard/next.config.js
index 4c72b7d..122a141 100644
--- a/dashboard/next.config.js
+++ b/dashboard/next.config.js
@@ -1,7 +1,9 @@
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   output: 'standalone',
-  serverExternalPackages: ['better-sqlite3'],
+  experimental: {
+    serverComponentsExternalPackages: ['better-sqlite3'],
+  },
 };
 
 module.exports = nextConfig;
diff --git a/dashboard/src/app/(dashboard)/layout.tsx b/dashboard/src/app/(dashboard)/layout.tsx
index 2ce9f18..b399293 100644
--- a/dashboard/src/app/(dashboard)/layout.tsx
+++ b/dashboard/src/app/(dashboard)/layout.tsx
@@ -1,3 +1,5 @@
+import { LogoutButton } from '@/components/LogoutButton';
+import { getAppDisplayName } from '@/lib/branding';
 import Link from 'next/link';
 
 const NAV_ITEMS = [
@@ -28,14 +30,18 @@ function SidebarHealthPlaceholder() {
 }
 
 export default function DashboardLayout({ children }: { children: React.ReactNode }) {
+  const appName = getAppDisplayName();
   return (
     <div className="flex h-screen overflow-hidden">
       {/* Left sidebar */}
       <aside className="w-48 flex flex-col border-r border-bb-border bg-bb-bg shrink-0">
-        {/* Top bar branding */}
-        <div className="px-3 py-3 border-b border-bb-border">
-          <div className="text-[11px] font-bold text-bb-orange tracking-wider">DOHA TERMINAL</div>
-          <div className="text-[10px] text-bb-dim mt-0.5">Polymarket HFT</div>
+        {/* Top bar branding + logout */}
+        <div className="px-3 py-3 border-b border-bb-border flex items-start justify-between gap-2">
+          <div className="min-w-0">
+            <div className="text-[11px] font-bold text-bb-orange tracking-wider">{appName}</div>
+            <div className="text-[10px] text-bb-dim mt-0.5">Polymarket</div>
+          </div>
+          <LogoutButton className="shrink-0 px-2 py-1 text-[10px] uppercase tracking-wider text-bb-dim hover:text-bb-red border border-transparent hover:border-bb-border disabled:opacity-50" />
         </div>
 
         {/* Navigation */}
diff --git a/dashboard/src/app/api/auth/login/route.ts b/dashboard/src/app/api/auth/login/route.ts
new file mode 100644
index 0000000..9a67234
--- /dev/null
+++ b/dashboard/src/app/api/auth/login/route.ts
@@ -0,0 +1,48 @@
+import {
+  SESSION_COOKIE,
+  dashboardSecretConfigured,
+  isDevAuthBypass,
+  signSessionToken,
+} from '@/lib/dashboard-session';
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export async function POST(request: Request) {
+  if (isDevAuthBypass()) {
+    return NextResponse.json(
+      { error: 'Login disabled when DASHBOARD_INSECURE_DEV_BYPASS is enabled' },
+      { status: 503 },
+    );
+  }
+
+  const secret = process.env.DASHBOARD_API_SECRET;
+  if (!dashboardSecretConfigured() || !secret) {
+    return NextResponse.json(
+      { error: 'Server misconfiguration: set DASHBOARD_API_SECRET (min 16 characters)' },
+      { status: 503 },
+    );
+  }
+
+  let body: { password?: string };
+  try {
+    body = await request.json();
+  } catch {
+    return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 });
+  }
+
+  if (typeof body.password !== 'string' || body.password !== secret) {
+    return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 });
+  }
+
+  const token = await signSessionToken(secret);
+  const res = NextResponse.json({ ok: true });
+  res.cookies.set(SESSION_COOKIE, token, {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax',
+    maxAge: 60 * 60 * 24 * 7,
+    path: '/',
+  });
+  return res;
+}
diff --git a/dashboard/src/app/api/auth/logout/route.ts b/dashboard/src/app/api/auth/logout/route.ts
new file mode 100644
index 0000000..28a77da
--- /dev/null
+++ b/dashboard/src/app/api/auth/logout/route.ts
@@ -0,0 +1,16 @@
+import { SESSION_COOKIE } from '@/lib/dashboard-session';
+import { NextResponse } from 'next/server';
+
+export const dynamic = 'force-dynamic';
+
+export async function POST() {
+  const res = NextResponse.json({ ok: true });
+  res.cookies.set(SESSION_COOKIE, '', {
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax',
+    maxAge: 0,
+    path: '/',
+  });
+  return res;
+}
diff --git a/dashboard/src/app/layout.tsx b/dashboard/src/app/layout.tsx
index a3a18c4..7b5a262 100644
--- a/dashboard/src/app/layout.tsx
+++ b/dashboard/src/app/layout.tsx
@@ -1,5 +1,6 @@
 import type { Metadata } from 'next';
 import { IBM_Plex_Mono } from 'next/font/google';
+import { getAppDisplayName } from '@/lib/branding';
 import './globals.css';
 
 const ibmPlexMono = IBM_Plex_Mono({
@@ -9,7 +10,7 @@ const ibmPlexMono = IBM_Plex_Mono({
 });
 
 export const metadata: Metadata = {
-  title: 'DOHA — Trading Terminal',
+  title: getAppDisplayName(),
 };
 
 export default function RootLayout({ children }: { children: React.ReactNode }) {
diff --git a/dashboard/src/app/login/page.tsx b/dashboard/src/app/login/page.tsx
new file mode 100644
index 0000000..5fd0367
--- /dev/null
+++ b/dashboard/src/app/login/page.tsx
@@ -0,0 +1,70 @@
+'use client';
+
+import { getAppDisplayName } from '@/lib/branding';
+import { dashboardFetch } from '@/lib/dashboard-fetch';
+import { useState } from 'react';
+import { useRouter } from 'next/navigation';
+
+export default function LoginPage() {
+  const router = useRouter();
+  const [password, setPassword] = useState('');
+  const [error, setError] = useState<string | null>(null);
+  const [pending, setPending] = useState(false);
+
+  async function onSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    setError(null);
+    setPending(true);
+    try {
+      const res = await dashboardFetch('/api/auth/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ password }),
+      });
+      if (!res.ok) {
+        const data = (await res.json().catch(() => ({}))) as { error?: string };
+        setError(data.error || `Login failed (${res.status})`);
+        setPending(false);
+        return;
+      }
+      router.replace('/overview');
+      router.refresh();
+    } catch {
+      setError('Network error');
+    }
+    setPending(false);
+  }
+
+  return (
+    <div className="min-h-screen flex items-center justify-center bg-[#0a0a0a] p-4">
+      <div className="w-full max-w-sm border border-bb-border bg-bb-panel p-6">
+        <div className="text-[11px] font-bold text-bb-orange tracking-wider mb-1">{getAppDisplayName()}</div>
+        <div className="text-[10px] text-bb-dim mb-6">Sign in to access the dashboard</div>
+        <form onSubmit={onSubmit} className="space-y-4">
+          <div>
+            <label htmlFor="pw" className="block text-[10px] uppercase tracking-wider text-bb-dim mb-1">
+              Password
+            </label>
+            <input
+              id="pw"
+              type="password"
+              autoComplete="current-password"
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+              className="w-full bg-bb-bg border border-bb-border px-2 py-1.5 text-[11px] text-bb-text focus:outline-none focus:border-bb-orange"
+              disabled={pending}
+            />
+          </div>
+          {error ? <div className="text-[10px] text-bb-red">{error}</div> : null}
+          <button
+            type="submit"
+            disabled={pending || !password}
+            className="w-full py-2 text-[10px] font-bold uppercase tracking-wider border border-bb-orange text-bb-orange hover:bg-bb-orange/10 disabled:opacity-50"
+          >
+            {pending ? '…' : 'Sign in'}
+          </button>
+        </form>
+      </div>
+    </div>
+  );
+}
diff --git a/dashboard/src/components/LogoutButton.tsx b/dashboard/src/components/LogoutButton.tsx
new file mode 100644
index 0000000..d75a678
--- /dev/null
+++ b/dashboard/src/components/LogoutButton.tsx
@@ -0,0 +1,40 @@
+'use client';
+
+import { dashboardFetch } from '@/lib/dashboard-fetch';
+import { useRouter } from 'next/navigation';
+import { useState } from 'react';
+
+interface Props {
+  /** e.g. compact header vs full-width sidebar footer */
+  className?: string;
+}
+
+export function LogoutButton({ className }: Props) {
+  const router = useRouter();
+  const [pending, setPending] = useState(false);
+
+  async function logout() {
+    setPending(true);
+    try {
+      await dashboardFetch('/api/auth/logout', { method: 'POST' });
+      router.replace('/login');
+      router.refresh();
+    } finally {
+      setPending(false);
+    }
+  }
+
+  return (
+    <button
+      type="button"
+      onClick={() => void logout()}
+      disabled={pending}
+      className={
+        className ??
+        'w-full text-left px-3 py-1.5 text-[10px] uppercase tracking-wider text-bb-dim hover:text-bb-red hover:bg-bb-border/30 disabled:opacity-50'
+      }
+    >
+      {pending ? '…' : 'Log out'}
+    </button>
+  );
+}
diff --git a/dashboard/src/components/system/ControlsPanel.tsx b/dashboard/src/components/system/ControlsPanel.tsx
index dbb55ad..9bb6cc6 100644
--- a/dashboard/src/components/system/ControlsPanel.tsx
+++ b/dashboard/src/components/system/ControlsPanel.tsx
@@ -2,6 +2,7 @@
 
 import { useState, useCallback } from 'react';
 import { Panel, SectionHeader } from '@/components/bloomberg';
+import { dashboardFetch } from '@/lib/dashboard-fetch';
 import { STRATEGIES, ALL_STRATEGY_IDS } from '@/lib/strategy-registry';
 import type { CoreStreamState } from '@/lib/types';
 
@@ -58,7 +59,7 @@ export function ControlsPanel({ coreState }: Props) {
     setPendingKeys((prev) => new Set([...prev, key]));
 
     try {
-      await fetch('/api/controls/toggle', {
+      await dashboardFetch('/api/controls/toggle', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ key, enabled: !currentValue }),
@@ -76,7 +77,7 @@ export function ControlsPanel({ coreState }: Props) {
 
   const setParam = useCallback(async (paramKey: string, value: string, resetConfirm: () => void) => {
     try {
-      await fetch('/api/controls/params', {
+      await dashboardFetch('/api/controls/params', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ [paramKey]: parseFloat(value) }),
diff --git a/dashboard/src/lib/__tests__/dashboard-session.test.ts b/dashboard/src/lib/__tests__/dashboard-session.test.ts
new file mode 100644
index 0000000..cb9c617
--- /dev/null
+++ b/dashboard/src/lib/__tests__/dashboard-session.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from 'vitest';
+import { signSessionToken, verifySessionToken } from '../dashboard-session';
+
+describe('dashboard-session', () => {
+  const secret = 'test_secret_value_min_16';
+
+  it('signs and verifies a session token', async () => {
+    const token = await signSessionToken(secret);
+    expect(await verifySessionToken(token, secret)).toBe(true);
+  });
+
+  it('rejects tampered tokens', async () => {
+    const token = await signSessionToken(secret);
+    const tampered = token.slice(0, -4) + 'xxxx';
+    expect(await verifySessionToken(tampered, secret)).toBe(false);
+  });
+
+  it('rejects wrong secret', async () => {
+    const token = await signSessionToken(secret);
+    expect(await verifySessionToken(token, 'wrong_secret_value_min_16')).toBe(false);
+  });
+});
diff --git a/dashboard/src/lib/branding.ts b/dashboard/src/lib/branding.ts
new file mode 100644
index 0000000..0088558
--- /dev/null
+++ b/dashboard/src/lib/branding.ts
@@ -0,0 +1,7 @@
+/**
+ * Dashboard chrome — override with NEXT_PUBLIC_APP_NAME at build/runtime (e.g. in `.env`).
+ */
+export function getAppDisplayName(): string {
+  const n = process.env.NEXT_PUBLIC_APP_NAME?.trim();
+  return n && n.length > 0 ? n : 'Trading Terminal';
+}
diff --git a/dashboard/src/lib/dashboard-fetch.ts b/dashboard/src/lib/dashboard-fetch.ts
new file mode 100644
index 0000000..4ef6b55
--- /dev/null
+++ b/dashboard/src/lib/dashboard-fetch.ts
@@ -0,0 +1,8 @@
+/**
+ * Same-origin fetch that always sends the httpOnly session cookie.
+ * (Default fetch uses `credentials: 'same-origin'`, which also sends cookies on same-origin
+ * requests; `include` is explicit and matches cross-subdomain setups if you add them later.)
+ */
+export function dashboardFetch(input: RequestInfo | URL, init: RequestInit = {}): Promise<Response> {
+  return fetch(input, { ...init, credentials: 'include' });
+}
diff --git a/dashboard/src/lib/dashboard-session.ts b/dashboard/src/lib/dashboard-session.ts
new file mode 100644
index 0000000..c165220
--- /dev/null
+++ b/dashboard/src/lib/dashboard-session.ts
@@ -0,0 +1,79 @@
+/**
+ * Signed session cookie for dashboard access (Edge-safe: Web Crypto only).
+ */
+
+export const SESSION_COOKIE = 'tradingbot_dashboard_session';
+
+const MAX_AGE_SEC = 60 * 60 * 24 * 7;
+
+function base64UrlEncode(bytes: Uint8Array): string {
+  let binary = '';
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]!);
+  const b64 = btoa(binary);
+  return b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+function base64UrlDecode(s: string): Uint8Array {
+  const pad = (4 - (s.length % 4)) % 4;
+  const b64 = s.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat(pad);
+  const binary = atob(b64);
+  const out = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) out[i] = binary.charCodeAt(i);
+  return out;
+}
+
+async function importHmacKey(secret: string): Promise<CryptoKey> {
+  return crypto.subtle.importKey(
+    'raw',
+    new TextEncoder().encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign', 'verify'],
+  );
+}
+
+export function isDevAuthBypass(): boolean {
+  return (
+    process.env.NODE_ENV !== 'production' &&
+    process.env.DASHBOARD_INSECURE_DEV_BYPASS === 'true'
+  );
+}
+
+export function dashboardSecretConfigured(): boolean {
+  const s = process.env.DASHBOARD_API_SECRET;
+  return typeof s === 'string' && s.length >= 16;
+}
+
+export async function signSessionToken(secret: string): Promise<string> {
+  const exp = Math.floor(Date.now() / 1000) + MAX_AGE_SEC;
+  const payload = JSON.stringify({ exp });
+  const payloadB64 = base64UrlEncode(new TextEncoder().encode(payload));
+  const key = await importHmacKey(secret);
+  const sigBuf = await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(payloadB64));
+  const sigB64 = base64UrlEncode(new Uint8Array(sigBuf));
+  return `${payloadB64}.${sigB64}`;
+}
+
+export async function verifySessionToken(full: string, secret: string): Promise<boolean> {
+  const i = full.lastIndexOf('.');
+  if (i <= 0) return false;
+  const payloadB64 = full.slice(0, i);
+  const sigB64 = full.slice(i + 1);
+  if (!payloadB64 || !sigB64) return false;
+  try {
+    const key = await importHmacKey(secret);
+    const sigBytes = base64UrlDecode(sigB64);
+    const ok = await crypto.subtle.verify(
+      'HMAC',
+      key,
+      sigBytes as BufferSource,
+      new TextEncoder().encode(payloadB64),
+    );
+    if (!ok) return false;
+    const payloadJson = new TextDecoder().decode(base64UrlDecode(payloadB64));
+    const { exp } = JSON.parse(payloadJson) as { exp?: number };
+    return typeof exp === 'number' && Math.floor(Date.now() / 1000) < exp;
+  } catch {
+    return false;
+  }
+}
diff --git a/dashboard/src/middleware.ts b/dashboard/src/middleware.ts
new file mode 100644
index 0000000..89ed88f
--- /dev/null
+++ b/dashboard/src/middleware.ts
@@ -0,0 +1,52 @@
+import {
+  SESSION_COOKIE,
+  dashboardSecretConfigured,
+  isDevAuthBypass,
+  verifySessionToken,
+} from '@/lib/dashboard-session';
+import type { NextRequest } from 'next/server';
+import { NextResponse } from 'next/server';
+
+export async function middleware(request: NextRequest) {
+  if (isDevAuthBypass()) {
+    return NextResponse.next();
+  }
+
+  const secret = process.env.DASHBOARD_API_SECRET;
+  const { pathname } = request.nextUrl;
+
+  if (
+    pathname === '/login' ||
+    pathname === '/api/auth/login' ||
+    pathname === '/api/auth/logout'
+  ) {
+    return NextResponse.next();
+  }
+
+  if (!dashboardSecretConfigured() || !secret) {
+    const err = 'Server misconfiguration: set DASHBOARD_API_SECRET (min 16 characters)';
+    if (pathname.startsWith('/api/')) {
+      return NextResponse.json({ error: err }, { status: 503 });
+    }
+    return new NextResponse(err, {
+      status: 503,
+      headers: { 'content-type': 'text/plain; charset=utf-8' },
+    });
+  }
+
+  const token = request.cookies.get(SESSION_COOKIE)?.value;
+  const ok = token ? await verifySessionToken(token, secret) : false;
+
+  if (!ok) {
+    if (pathname.startsWith('/api/')) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+    return NextResponse.redirect(new URL('/login', request.url));
+  }
+
+  return NextResponse.next();
+}
+
+export const config = {
+  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+};
diff --git a/docker-compose.yml b/docker-compose.yml
index a1014b7..4306aea 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,11 +1,19 @@
 # Base configuration — must be used with an override file:
 #   Dev:  docker compose -f docker-compose.yml -f docker-compose.dev.yml up -d --build
 #   Prod: docker compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+#
+# Optional `.env` (copy from `.env.example`): loaded when present; compose still parses without it.
+x-env-file-optional: &env-file-optional
+  env_file:
+    - path: .env
+      required: false
+
 services:
   redis:
     image: redis:7-alpine
     container_name: tradingbot-redis
     user: root
+    # Socket must stay world-accessible (777): appuser/nextjs across services are different UIDs than redis.
     command: >
       sh -c "mkdir -p /var/run/redis && chmod 777 /var/run/redis &&
       exec redis-server
@@ -74,6 +82,7 @@ services:
       - tradingbot
 
   execution:
+    <<: *env-file-optional
     container_name: tradingbot-execution
     depends_on:
       redis:
@@ -87,8 +96,6 @@ services:
       - NODE_ENV=production
     volumes:
       - redis-socket:/var/run/redis
-    env_file:
-      - .env
     restart: unless-stopped
     logging:
       driver: json-file
@@ -99,6 +106,7 @@ services:
       - tradingbot
 
   settlement:
+    <<: *env-file-optional
     container_name: tradingbot-settlement
     depends_on:
       redis:
@@ -111,8 +119,6 @@ services:
       - NODE_ENV=production
     volumes:
       - redis-socket:/var/run/redis
-    env_file:
-      - .env
     restart: unless-stopped
     logging:
       driver: json-file
@@ -123,6 +129,7 @@ services:
       - tradingbot
 
   btc-5m:
+    <<: *env-file-optional
     container_name: tradingbot-btc-5m
     depends_on:
       redis:
@@ -133,8 +140,6 @@ services:
       - NODE_ENV=production
     volumes:
       - redis-socket:/var/run/redis
-    env_file:
-      - .env
     restart: unless-stopped
     logging:
       driver: json-file
@@ -145,6 +150,7 @@ services:
       - tradingbot
 
   btc-5m-momentum:
+    <<: *env-file-optional
     container_name: tradingbot-btc-5m-momentum
     depends_on:
       redis:
@@ -155,8 +161,6 @@ services:
       - NODE_ENV=production
     volumes:
       - redis-socket:/var/run/redis
-    env_file:
-      - .env
     restart: unless-stopped
     logging:
       driver: json-file
@@ -167,6 +171,7 @@ services:
       - tradingbot
 
   btc-5m-latency:
+    <<: *env-file-optional
     container_name: tradingbot-btc-5m-latency
     depends_on:
       redis:
@@ -178,8 +183,6 @@ services:
     volumes:
       - redis-socket:/var/run/redis
       - sqlite-data:/data
-    env_file:
-      - .env
     restart: unless-stopped
     logging:
       driver: json-file
@@ -190,14 +193,13 @@ services:
       - tradingbot
 
   crypto-signals:
+    <<: *env-file-optional
     container_name: tradingbot-crypto-signals
     depends_on:
       redis:
         condition: service_healthy
     volumes:
       - redis-socket:/var/run/redis
-    env_file:
-      - .env
     restart: unless-stopped
     logging:
       driver: json-file
@@ -208,6 +210,7 @@ services:
       - tradingbot
 
   alpha-executor:
+    <<: *env-file-optional
     container_name: tradingbot-alpha-executor
     depends_on:
       redis:
@@ -215,8 +218,6 @@ services:
     volumes:
       - redis-socket:/var/run/redis
       - sqlite-data:/data
-    env_file:
-      - .env
     restart: unless-stopped
     logging:
       driver: json-file
@@ -227,6 +228,7 @@ services:
       - tradingbot
 
   sports-signals:
+    <<: *env-file-optional
     container_name: tradingbot-sports-signals
     restart: unless-stopped
     depends_on:
@@ -235,8 +237,6 @@ services:
     volumes:
       - redis-socket:/var/run/redis
       - sqlite-data:/data
-    env_file:
-      - .env
     networks:
       - tradingbot
     logging:
@@ -246,6 +246,7 @@ services:
         max-file: "3"
 
   dashboard:
+    <<: *env-file-optional
     container_name: tradingbot-dashboard
     restart: unless-stopped
     depends_on:
@@ -254,7 +255,6 @@ services:
     volumes:
       - redis-socket:/var/run/redis
       - sqlite-data:/data
-      - /var/run/docker.sock:/var/run/docker.sock
     ports:
       - "127.0.0.1:3001:3000"
     environment:
diff --git a/docs/DEPLOY_RUNBOOK.md b/docs/DEPLOY_RUNBOOK.md
index e7ecabc..0100c2e 100644
--- a/docs/DEPLOY_RUNBOOK.md
+++ b/docs/DEPLOY_RUNBOOK.md
@@ -116,8 +116,11 @@ docker exec tradingbot-redis redis-cli -s /var/run/redis/redis.sock HGETALL exec
 
 ## Step 7: Start Monitoring
 
+`docker-compose.monitoring.yml` requires `GRAFANA_ADMIN_PASSWORD` (no default). Set it in the shell or in `/opt/tradingbot/.env` before starting the stack.
+
 ```bash
 # On the instance
+export GRAFANA_ADMIN_PASSWORD='your-strong-password'
 cd /opt/tradingbot/infrastructure/monitoring
 docker compose -f docker-compose.monitoring.yml up -d
 
diff --git a/execution/src/index.ts b/execution/src/index.ts
index da48d86..94540a0 100644
--- a/execution/src/index.ts
+++ b/execution/src/index.ts
@@ -12,7 +12,13 @@ async function main() {
   try {
     // Load configuration
     const config = await loadConfig();
-    
+
+    if (process.env.NODE_ENV === 'production' && process.env.USE_SECRET_MANAGER !== 'true') {
+      logger.warn(
+        'USE_SECRET_MANAGER is not enabled in production — CLOB and wallet secrets are loaded from the environment',
+      );
+    }
+
     // Validate required config
     if (!config.privateKey) {
       throw new Error('Private key not configured');
diff --git a/first-run-setup.sh b/first-run-setup.sh
index 0453a25..198d066 100755
--- a/first-run-setup.sh
+++ b/first-run-setup.sh
@@ -30,13 +30,16 @@ cd /opt/tradingbot
 npm init -y 2>/dev/null || true
 npm install @polymarket/clob-client @ethersproject/wallet
 
-# Run key derivation
-node scripts/derive-keys.js 2>&1 | tee /tmp/derive-output.txt
+# Run key derivation (restricted temp file)
+DERIVE_OUT="$(mktemp)"
+chmod 600 "$DERIVE_OUT"
+trap 'rm -f "$DERIVE_OUT"' EXIT
+node scripts/derive-keys.js 2>&1 | tee "$DERIVE_OUT"
 
 # Extract credentials and update .env
-API_KEY=$(grep "^CLOB_API_KEY=" /tmp/derive-output.txt | cut -d= -f2-)
-API_SECRET=$(grep "^CLOB_API_SECRET=" /tmp/derive-output.txt | cut -d= -f2-)
-PASSPHRASE=$(grep "^CLOB_PASSPHRASE=" /tmp/derive-output.txt | cut -d= -f2-)
+API_KEY=$(grep "^CLOB_API_KEY=" "$DERIVE_OUT" | cut -d= -f2-)
+API_SECRET=$(grep "^CLOB_API_SECRET=" "$DERIVE_OUT" | cut -d= -f2-)
+PASSPHRASE=$(grep "^CLOB_PASSPHRASE=" "$DERIVE_OUT" | cut -d= -f2-)
 
 if [ -n "$API_KEY" ] && [ -n "$API_SECRET" ] && [ -n "$PASSPHRASE" ]; then
     sed -i "s|^CLOB_API_KEY=.*|CLOB_API_KEY=$API_KEY|" /opt/tradingbot/.env
diff --git a/infrastructure/monitoring/docker-compose.monitoring.yml b/infrastructure/monitoring/docker-compose.monitoring.yml
index 5f1e864..763a719 100644
--- a/infrastructure/monitoring/docker-compose.monitoring.yml
+++ b/infrastructure/monitoring/docker-compose.monitoring.yml
@@ -49,7 +49,7 @@ services:
     container_name: tradingbot-grafana
     environment:
       - GF_SECURITY_ADMIN_USER=admin
-      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:-changeme}
+      - GF_SECURITY_ADMIN_PASSWORD=${GRAFANA_ADMIN_PASSWORD:?Set GRAFANA_ADMIN_PASSWORD in the environment}
       - GF_USERS_ALLOW_SIGN_UP=false
     volumes:
       - grafana-data:/var/lib/grafana

From a17545127b52fae6147ec86ac23a53b9b23d1463 Mon Sep 17 00:00:00 2001
From: Daniel Traynor <7traynor@gmail.com>
Date: Wed, 8 Apr 2026 10:29:28 -0400
Subject: [PATCH 2/2] Update package-lock.json to reflect dependency version
 upgrades for @napi-rs/wasm-runtime, @oxc-project/types, and @rolldown
 bindings, ensuring compatibility with the latest releases.

---
 dashboard/package-lock.json | 194 ++++++++++++++++++------------------
 1 file changed, 99 insertions(+), 95 deletions(-)

diff --git a/dashboard/package-lock.json b/dashboard/package-lock.json
index d54d9d0..570b841 100644
--- a/dashboard/package-lock.json
+++ b/dashboard/package-lock.json
@@ -136,20 +136,22 @@
       }
     },
     "node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.1.tgz",
-      "integrity": "sha512-p64ah1M1ld8xjWv3qbvFwHiFVWrq1yFvV4f7w+mzaqiR4IlSgkqhcRdHwsGgomwzBH51sRY4NEowLxnaBjcW/A==",
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.1.3.tgz",
+      "integrity": "sha512-xK9sGVbJWYb08+mTJt3/YV24WxvxpXcXtP6B172paPZ+Ts69Re9dAr7lKwJoeIx8OoeuimEiRZ7umkiUVClmmQ==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "^1.7.1",
-        "@emnapi/runtime": "^1.7.1",
         "@tybys/wasm-util": "^0.10.1"
       },
       "funding": {
         "type": "github",
         "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
       }
     },
     "node_modules/@next/env": {
@@ -380,9 +382,9 @@
       }
     },
     "node_modules/@oxc-project/types": {
-      "version": "0.120.0",
-      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.120.0.tgz",
-      "integrity": "sha512-k1YNu55DuvAip/MGE1FTsIuU3FUCn6v/ujG9V7Nq5Df/kX2CWb13hhwD0lmJGMGqE+bE1MXvv9SZVnMzEXlWcg==",
+      "version": "0.123.0",
+      "resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.123.0.tgz",
+      "integrity": "sha512-YtECP/y8Mj1lSHiUWGSRzy/C6teUKlS87dEfuVKT09LgQbUsBW1rNg+MiJ4buGu3yuADV60gbIvo9/HplA56Ew==",
       "dev": true,
       "license": "MIT",
       "funding": {
@@ -390,9 +392,9 @@
       }
     },
     "node_modules/@rolldown/binding-android-arm64": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.0-rc.10.tgz",
-      "integrity": "sha512-jOHxwXhxmFKuXztiu1ORieJeTbx5vrTkcOkkkn2d35726+iwhrY1w/+nYY/AGgF12thg33qC3R1LMBF5tHTZHg==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.0.0-rc.13.tgz",
+      "integrity": "sha512-5ZiiecKH2DXAVJTNN13gNMUcCDg4Jy8ZjbXEsPnqa248wgOVeYRX0iqXXD5Jz4bI9BFHgKsI2qmyJynstbmr+g==",
       "cpu": [
         "arm64"
       ],
@@ -407,9 +409,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-arm64": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.0-rc.10.tgz",
-      "integrity": "sha512-gED05Teg/vtTZbIJBc4VNMAxAFDUPkuO/rAIyyxZjTj1a1/s6z5TII/5yMGZ0uLRCifEtwUQn8OlYzuYc0m70w==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.0.0-rc.13.tgz",
+      "integrity": "sha512-tz/v/8G77seu8zAB3A5sK3UFoOl06zcshEzhUO62sAEtrEuW/H1CcyoupOrD+NbQJytYgA4CppXPzlrmp4JZKA==",
       "cpu": [
         "arm64"
       ],
@@ -424,9 +426,9 @@
       }
     },
     "node_modules/@rolldown/binding-darwin-x64": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.0-rc.10.tgz",
-      "integrity": "sha512-rI15NcM1mA48lqrIxVkHfAqcyFLcQwyXWThy+BQ5+mkKKPvSO26ir+ZDp36AgYoYVkqvMcdS8zOE6SeBsR9e8A==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.0.0-rc.13.tgz",
+      "integrity": "sha512-8DakphqOz8JrMYWTJmWA+vDJxut6LijZ8Xcdc4flOlAhU7PNVwo2MaWBF9iXjJAPo5rC/IxEFZDhJ3GC7NHvug==",
       "cpu": [
         "x64"
       ],
@@ -441,9 +443,9 @@
       }
     },
     "node_modules/@rolldown/binding-freebsd-x64": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.0-rc.10.tgz",
-      "integrity": "sha512-XZRXHdTa+4ME1MuDVp021+doQ+z6Ei4CCFmNc5/sKbqb8YmkiJdj8QKlV3rCI0AJtAeSB5n0WGPuJWNL9p/L2w==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.0.0-rc.13.tgz",
+      "integrity": "sha512-4wBQFfjDuXYN/SVI8inBF3Aa+isq40rc6VMFbk5jcpolUBTe5cYnMsHZ51nFWsx3PVyyNN3vgoESki0Hmr/4BA==",
       "cpu": [
         "x64"
       ],
@@ -458,9 +460,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm-gnueabihf": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.0-rc.10.tgz",
-      "integrity": "sha512-R0SQMRluISSLzFE20sPWYHVmJdDQnRyc/FzSCN72BqQmh2SOZUFG+N3/vBZpR4C6WpEUVYJLrYUXaj43sJsNLA==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.0.0-rc.13.tgz",
+      "integrity": "sha512-JW/e4yPIXLms+jmnbwwy5LA/LxVwZUWLN8xug+V200wzaVi5TEGIWQlh8o91gWYFxW609euI98OCCemmWGuPrw==",
       "cpu": [
         "arm"
       ],
@@ -475,9 +477,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-gnu": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.0-rc.10.tgz",
-      "integrity": "sha512-Y1reMrV/o+cwpduYhJuOE3OMKx32RMYCidf14y+HssARRmhDuWXJ4yVguDg2R/8SyyGNo+auzz64LnPK9Hq6jg==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.0.0-rc.13.tgz",
+      "integrity": "sha512-ZfKWpXiUymDnavepCaM6KG/uGydJ4l2nBmMxg60Ci4CbeefpqjPWpfaZM7PThOhk2dssqBAcwLc6rAyr0uTdXg==",
       "cpu": [
         "arm64"
       ],
@@ -492,9 +494,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-arm64-musl": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.0-rc.10.tgz",
-      "integrity": "sha512-vELN+HNb2IzuzSBUOD4NHmP9yrGwl1DVM29wlQvx1OLSclL0NgVWnVDKl/8tEks79EFek/kebQKnNJkIAA4W2g==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.0.0-rc.13.tgz",
+      "integrity": "sha512-bmRg3O6Z0gq9yodKKWCIpnlH051sEfdVwt+6m5UDffAQMUUqU0xjnQqqAUm+Gu7ofAAly9DqiQDtKu2nPDEABA==",
       "cpu": [
         "arm64"
       ],
@@ -509,9 +511,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-ppc64-gnu": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.0-rc.10.tgz",
-      "integrity": "sha512-ZqrufYTgzxbHwpqOjzSsb0UV/aV2TFIY5rP8HdsiPTv/CuAgCRjM6s9cYFwQ4CNH+hf9Y4erHW1GjZuZ7WoI7w==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.0.0-rc.13.tgz",
+      "integrity": "sha512-8Wtnbw4k7pMYN9B/mOEAsQ8HOiq7AZ31Ig4M9BKn2So4xRaFEhtCSa4ZJaOutOWq50zpgR4N5+L/opnlaCx8wQ==",
       "cpu": [
         "ppc64"
       ],
@@ -526,9 +528,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-s390x-gnu": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.0-rc.10.tgz",
-      "integrity": "sha512-gSlmVS1FZJSRicA6IyjoRoKAFK7IIHBs7xJuHRSmjImqk3mPPWbR7RhbnfH2G6bcmMEllCt2vQ/7u9e6bBnByg==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.0.0-rc.13.tgz",
+      "integrity": "sha512-D/0Nlo8mQuxSMohNJUF2lDXWRsFDsHldfRRgD9bRgktj+EndGPj4DOV37LqDKPYS+osdyhZEH7fTakTAEcW7qg==",
       "cpu": [
         "s390x"
       ],
@@ -543,9 +545,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-gnu": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.0-rc.10.tgz",
-      "integrity": "sha512-eOCKUpluKgfObT2pHjztnaWEIbUabWzk3qPZ5PuacuPmr4+JtQG4k2vGTY0H15edaTnicgU428XW/IH6AimcQw==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.0.0-rc.13.tgz",
+      "integrity": "sha512-eRrPvat2YaVQcwwKi/JzOP6MKf1WRnOCr+VaI3cTWz3ZoLcP/654z90lVCJ4dAuMEpPdke0n+qyAqXDZdIC4rA==",
       "cpu": [
         "x64"
       ],
@@ -560,9 +562,9 @@
       }
     },
     "node_modules/@rolldown/binding-linux-x64-musl": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.0-rc.10.tgz",
-      "integrity": "sha512-Xdf2jQbfQowJnLcgYfD/m0Uu0Qj5OdxKallD78/IPPfzaiaI4KRAwZzHcKQ4ig1gtg1SuzC7jovNiM2TzQsBXA==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.0.0-rc.13.tgz",
+      "integrity": "sha512-PsdONiFRp8hR8KgVjTWjZ9s7uA3uueWL0t74/cKHfM4dR5zXYv4AjB8BvA+QDToqxAFg4ZkcVEqeu5F7inoz5w==",
       "cpu": [
         "x64"
       ],
@@ -577,9 +579,9 @@
       }
     },
     "node_modules/@rolldown/binding-openharmony-arm64": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.0-rc.10.tgz",
-      "integrity": "sha512-o1hYe8hLi1EY6jgPFyxQgQ1wcycX+qz8eEbVmot2hFkgUzPxy9+kF0u0NIQBeDq+Mko47AkaFFaChcvZa9UX9Q==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.0.0-rc.13.tgz",
+      "integrity": "sha512-hCNXgC5dI3TVOLrPT++PKFNZ+1EtS0mLQwfXXXSUD/+rGlB65gZDwN/IDuxLpQP4x8RYYHqGomlUXzpO8aVI2w==",
       "cpu": [
         "arm64"
       ],
@@ -594,9 +596,9 @@
       }
     },
     "node_modules/@rolldown/binding-wasm32-wasi": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.0-rc.10.tgz",
-      "integrity": "sha512-Ugv9o7qYJudqQO5Y5y2N2SOo6S4WiqiNOpuQyoPInnhVzCY+wi/GHltcLHypG9DEUYMB0iTB/huJrpadiAcNcA==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-wasm32-wasi/-/binding-wasm32-wasi-1.0.0-rc.13.tgz",
+      "integrity": "sha512-viLS5C5et8NFtLWw9Sw3M/w4vvnVkbWkO7wSNh3C+7G1+uCkGpr6PcjNDSFcNtmXY/4trjPBqUfcOL+P3sWy/g==",
       "cpu": [
         "wasm32"
       ],
@@ -604,16 +606,18 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@napi-rs/wasm-runtime": "^1.1.1"
+        "@emnapi/core": "1.9.1",
+        "@emnapi/runtime": "1.9.1",
+        "@napi-rs/wasm-runtime": "^1.1.2"
       },
       "engines": {
         "node": ">=14.0.0"
       }
     },
     "node_modules/@rolldown/binding-win32-arm64-msvc": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.0-rc.10.tgz",
-      "integrity": "sha512-7UODQb4fQUNT/vmgDZBl3XOBAIOutP5R3O/rkxg0aLfEGQ4opbCgU5vOw/scPe4xOqBwL9fw7/RP1vAMZ6QlAQ==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.0.0-rc.13.tgz",
+      "integrity": "sha512-Fqa3Tlt1xL4wzmAYxGNFV36Hb+VfPc9PYU+E25DAnswXv3ODDu/yyWjQDbXMo5AGWkQVjLgQExuVu8I/UaZhPQ==",
       "cpu": [
         "arm64"
       ],
@@ -628,9 +632,9 @@
       }
     },
     "node_modules/@rolldown/binding-win32-x64-msvc": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.0-rc.10.tgz",
-      "integrity": "sha512-PYxKHMVHOb5NJuDL53vBUl1VwUjymDcYI6rzpIni0C9+9mTiJedvUxSk7/RPp7OOAm3v+EjgMu9bIy3N6b408w==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.0.0-rc.13.tgz",
+      "integrity": "sha512-/pLI5kPkGEi44TDlnbio3St/5gUFeN51YWNAk/Gnv6mEQBOahRBh52qVFVBpmrnU01n2yysvBML9Ynu7K4kGAQ==",
       "cpu": [
         "x64"
       ],
@@ -645,9 +649,9 @@
       }
     },
     "node_modules/@rolldown/pluginutils": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.10.tgz",
-      "integrity": "sha512-UkVDEFk1w3mveXeKgaTuYfKWtPbvgck1dT8TUG3bnccrH0XtLTuAyfCoks4Q/M5ZGToSVJTIQYCzy2g/atAOeg==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-rc.13.tgz",
+      "integrity": "sha512-3ngTAv6F/Py35BsYbeeLeecvhMKdsKm4AoOETVhAA+Qc8nrA2I0kF7oa93mE9qnIurngOSpMnQ0x2nQY2FPviA==",
       "dev": true,
       "license": "MIT"
     },
@@ -2238,9 +2242,9 @@
       "license": "MIT"
     },
     "node_modules/lodash": {
-      "version": "4.17.23",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
-      "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
       "license": "MIT"
     },
     "node_modules/lodash.defaults": {
@@ -3043,14 +3047,14 @@
       }
     },
     "node_modules/rolldown": {
-      "version": "1.0.0-rc.10",
-      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.0-rc.10.tgz",
-      "integrity": "sha512-q7j6vvarRFmKpgJUT8HCAUljkgzEp4LAhPlJUvQhA5LA1SUL36s5QCysMutErzL3EbNOZOkoziSx9iZC4FddKA==",
+      "version": "1.0.0-rc.13",
+      "resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.0.0-rc.13.tgz",
+      "integrity": "sha512-bvVj8YJmf0rq4pSFmH7laLa6pYrhghv3PRzrCdRAr23g66zOKVJ4wkvFtgohtPLWmthgg8/rkaqRHrpUEh0Zbw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@oxc-project/types": "=0.120.0",
-        "@rolldown/pluginutils": "1.0.0-rc.10"
+        "@oxc-project/types": "=0.123.0",
+        "@rolldown/pluginutils": "1.0.0-rc.13"
       },
       "bin": {
         "rolldown": "bin/cli.mjs"
@@ -3059,21 +3063,21 @@
         "node": "^20.19.0 || >=22.12.0"
       },
       "optionalDependencies": {
-        "@rolldown/binding-android-arm64": "1.0.0-rc.10",
-        "@rolldown/binding-darwin-arm64": "1.0.0-rc.10",
-        "@rolldown/binding-darwin-x64": "1.0.0-rc.10",
-        "@rolldown/binding-freebsd-x64": "1.0.0-rc.10",
-        "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.10",
-        "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.10",
-        "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.10",
-        "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.10",
-        "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.10",
-        "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.10",
-        "@rolldown/binding-linux-x64-musl": "1.0.0-rc.10",
-        "@rolldown/binding-openharmony-arm64": "1.0.0-rc.10",
-        "@rolldown/binding-wasm32-wasi": "1.0.0-rc.10",
-        "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.10",
-        "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.10"
+        "@rolldown/binding-android-arm64": "1.0.0-rc.13",
+        "@rolldown/binding-darwin-arm64": "1.0.0-rc.13",
+        "@rolldown/binding-darwin-x64": "1.0.0-rc.13",
+        "@rolldown/binding-freebsd-x64": "1.0.0-rc.13",
+        "@rolldown/binding-linux-arm-gnueabihf": "1.0.0-rc.13",
+        "@rolldown/binding-linux-arm64-gnu": "1.0.0-rc.13",
+        "@rolldown/binding-linux-arm64-musl": "1.0.0-rc.13",
+        "@rolldown/binding-linux-ppc64-gnu": "1.0.0-rc.13",
+        "@rolldown/binding-linux-s390x-gnu": "1.0.0-rc.13",
+        "@rolldown/binding-linux-x64-gnu": "1.0.0-rc.13",
+        "@rolldown/binding-linux-x64-musl": "1.0.0-rc.13",
+        "@rolldown/binding-openharmony-arm64": "1.0.0-rc.13",
+        "@rolldown/binding-wasm32-wasi": "1.0.0-rc.13",
+        "@rolldown/binding-win32-arm64-msvc": "1.0.0-rc.13",
+        "@rolldown/binding-win32-x64-msvc": "1.0.0-rc.13"
       }
     },
     "node_modules/run-parallel": {
@@ -3455,9 +3459,9 @@
       }
     },
     "node_modules/tinyglobby/node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3626,16 +3630,16 @@
       }
     },
     "node_modules/vite": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.1.tgz",
-      "integrity": "sha512-wt+Z2qIhfFt85uiyRt5LPU4oVEJBXj8hZNWKeqFG4gRG/0RaRGJ7njQCwzFVjO+v4+Ipmf5CY7VdmZRAYYBPHw==",
+      "version": "8.0.7",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-8.0.7.tgz",
+      "integrity": "sha512-P1PbweD+2/udplnThz3btF4cf6AgPky7kk23RtHUkJIU5BIxwPprhRGmOAHs6FTI7UiGbTNrgNP6jSYD6JaRnw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "lightningcss": "^1.32.0",
-        "picomatch": "^4.0.3",
+        "picomatch": "^4.0.4",
         "postcss": "^8.5.8",
-        "rolldown": "1.0.0-rc.10",
+        "rolldown": "1.0.0-rc.13",
         "tinyglobby": "^0.2.15"
       },
       "bin": {
@@ -3653,7 +3657,7 @@
       "peerDependencies": {
         "@types/node": "^20.19.0 || >=22.12.0",
         "@vitejs/devtools": "^0.1.0",
-        "esbuild": "^0.27.0",
+        "esbuild": "^0.27.0 || ^0.28.0",
         "jiti": ">=1.21.0",
         "less": "^4.0.0",
         "sass": "^1.70.0",
@@ -3704,9 +3708,9 @@
       }
     },
     "node_modules/vite/node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -3799,9 +3803,9 @@
       }
     },
     "node_modules/vitest/node_modules/picomatch": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
-      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
       "dev": true,
       "license": "MIT",
       "engines": {