jasper-liquidationhub 1.0.0

package/.claude/settings.local.json

@@ -0,0 +1,29 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(npx tsc:*)",
+      "Bash(npm run build:*)",
+      "Bash(redis-cli:*)",
+      "Bash(# 直接删除整个 active set redis-cli -u \"\"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\"\" --no-auth-warning DEL \"\"limit_orders:active\"\" echo \"\"Active orders set deleted\"\" # 删除所有 limit_order keys redis-cli -u \"\"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\"\" --no-auth-warning KEYS \"\"limit_order:*\"\")",
+      "Bash(# 删除所有 limit_order keys redis-cli -u \"\"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\"\" --no-auth-warning KEYS \"\"limit_order:*\"\")",
+      "Bash(xargs -r redis-cli -u \"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\" --no-auth-warning DEL echo \"Deleted staging keys\" echo \"Done!\")",
+      "Bash(# 验证清理结果 echo \"\"limit_order keys:\"\" redis-cli -u \"\"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\"\" --no-auth-warning KEYS \"\"limit_order:*\"\")",
+      "Bash(# 再次清理 redis-cli -u \"\"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\"\" --no-auth-warning KEYS \"\"limit_order:*\"\")",
+      "Bash(xargs -r redis-cli -u \"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\" --no-auth-warning DEL redis-cli -u \"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\" --no-auth-warning KEYS \"limit_orders:*\")",
+      "Bash(xargs -r redis-cli -u \"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\" --no-auth-warning DEL redis-cli -u \"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\" --no-auth-warning KEYS \"staging:*\")",
+      "Bash(# 使用 SCAN 来删除，避免 KEYS 命令的问题 redis-cli -u \"\"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\"\" --no-auth-warning --scan --pattern \"\"limit_order:*\"\")",
+      "Bash(xargs -r -L 100 redis-cli -u \"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\" --no-auth-warning DEL redis-cli -u \"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\" --no-auth-warning --scan --pattern \"limit_orders:*\")",
+      "Bash(xargs -r -L 100 redis-cli -u \"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\" --no-auth-warning DEL redis-cli -u \"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\" --no-auth-warning --scan --pattern \"staging:*\")",
+      "Bash(xargs redis-cli -u \"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\" --no-auth-warning DEL echo \"Deleted batch\" done)",
+      "Bash(# 最终验证 echo \"\"Final check:\"\" echo \"\"limit_order keys:\"\" redis-cli -u \"\"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\"\" --no-auth-warning --scan --pattern \"\"limit_order:*\"\")",
+      "Bash(# 最终验证 echo \"\"Final verification:\"\" echo \"\"limit_order keys:\"\" redis-cli -u \"\"rediss://default:AVNS_aHG9OiCmgukRZmON7ne@jaspervault-v2-redis-test-do-user-13941051-0.c.db.ondigitalocean.com:25061\"\" --no-auth-warning --scan --pattern \"\"limit_order:*\"\")",
+      "Bash(__NEW_LINE_26eb10485465cc73__ echo \"\")",
+      "Bash(node -e:*)",
+      "Bash(git show:*)",
+      "Bash(git add:*)",
+      "Bash(git commit -m \"$\\(cat <<''EOF''\nsecurity: remove exposed credentials from env.sample\n\nReplace real passwords and API keys with placeholders:\n- Quote Center Redis password\n- Quote Center database password  \n- Blockscholes API key\n- Database hostnames\n\nCo-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>\nEOF\n\\)\")",
+      "Bash(git push:*)",
+      "Bash(npm run typecheck:*)"
+    ]
+  }
+}

package/.eslintrc.json

@@ -0,0 +1,30 @@
+{
+    "env": {
+        "es2022": true,
+        "node": true
+    },
+    "extends": [
+        "eslint:recommended",
+        "plugin:@typescript-eslint/recommended"
+    ],
+    "parser": "@typescript-eslint/parser",
+    "parserOptions": {
+        "ecmaVersion": "latest",
+        "sourceType": "module"
+    },
+    "plugins": [
+        "@typescript-eslint"
+    ],
+    "rules": {
+        "@typescript-eslint/no-unused-vars": "error",
+        "@typescript-eslint/no-explicit-any": "warn",
+        "@typescript-eslint/explicit-function-return-type": "warn",
+        "no-console": "warn",
+        "prefer-const": "error"
+    },
+    "ignorePatterns": [
+        "dist/",
+        "node_modules/",
+        "coverage/"
+    ]
+}

package/.gitlab-ci.yml

@@ -0,0 +1,55 @@
+stages:
+  - deploy
+
+variables:
+  BASE_REGISTRY: registry.digitalocean.com/jaspervault/liquidationhub
+  ENV_NAME: latest
+
+.liquidationhub_template: &liquidationhub_template
+  stage: deploy
+  only:
+    - master
+  when: manual
+  script: |
+    export COMMIT_IMG_NAME="$BASE_REGISTRY/$SERVICE_NAME:$CI_COMMIT_SHORT_SHA"
+    export IMG_NAME="$BASE_REGISTRY/$SERVICE_NAME:$ENV_NAME"
+    echo "Building and pushing $SERVICE_NAME..."
+    echo "Tags: $COMMIT_IMG_NAME, $IMG_NAME"
+    docker buildx build --push -t $COMMIT_IMG_NAME -t $IMG_NAME --target $SERVICE_NAME .
+    doctl apps create-deployment $DO_APPID --force-rebuild
+
+manager-deploy:
+  <<: *liquidationhub_template
+  variables:
+    SERVICE_NAME: manager
+    DO_APPID: "413a20c1-1b50-4916-8cf3-02b61ba34559"
+
+sync-deploy:
+  <<: *liquidationhub_template
+  variables:
+    SERVICE_NAME: sync
+    DO_APPID: "d2328fb0-ddf1-48d5-9702-9ab9e43121c9"
+
+worker-deploy:
+  <<: *liquidationhub_template
+  variables:
+    SERVICE_NAME: worker
+    DO_APPID: "5ac2a676-3c60-4732-bc2b-1e2a4f2f612d"
+
+dispatcher-deploy:
+  <<: *liquidationhub_template
+  variables:
+    SERVICE_NAME: dispatcher
+    DO_APPID: "b05e3d06-c375-4364-a3f2-865bdc8e923d"
+
+test-liquidationhub:
+  stage: deploy
+  when: manual
+  script:
+    - fly deploy --dockerfile Dockerfile.test -c fly.toml
+
+liquidationhub-jasper-dev:
+  stage: deploy
+  when: manual
+  script:
+    - fly deploy --dockerfile Dockerfile.test -c fly_jasper_dev.toml

package/.husky/pre-commit

@@ -0,0 +1,2 @@
+npm run typecheck
+npm run test:precommit

package/AGENTS.md

@@ -0,0 +1,63 @@
+RIPER-5 模式：严格操作协议（来源：.cursor/rules/riper-5.mdc）
+
+先决背景
+你是Claude，你已集成到Cursor IDE(VS Code)中。因你的高级能力你往往过于急切经常在无明确要求的情况下实施更改，以为你比我更了解而误判而偏离设计。为防止这种情况，你必须严格遵循以下协议：
+你须在每个响应的开头标出你当前的模式和模型。格式：[模式:模式名称][模型:模型名称]
+
+[模式1:研究]
+目的:仅收集信息
+允许:阅读文件、提出澄清问题、理解代码结构
+禁止:建议、实施、计划或任何行动暗示
+要求:你只能试图了解存在什么，而不是可能是什么。仅观察和提问。
+
+[模式2:创新]
+目的:集思广益，寻找潜在方法
+允许:讨论想法、优点/缺点、寻求反馈
+禁止:具体规划、实施细节或任何代码编写
+要求:所有想法都必须以可能性而非决策的形式呈现，仅显示可能性和考虑因素
+
+[模式3:计划]
+目的:创建详尽的技术规范
+允许:含确切文件路径、功能名称和更改的详细计划
+禁止:任何实现或代码、示例代码
+要求:计划须够全面
+强制性最后一步:将整个计划转换为1个按编号顺序排列的清单，每个原子操作作为单独的项目
+清单格式:
+实施检查清单:
+1. [动作1]
+2. [动作2]
+...
+仅显示规格和实施细节
+
+[模式4:执行]
+目的:准确执行模式3中的计划
+允许:仅执行批准计划中明确详述的内容
+禁止:任何不在计划内的偏离、改进或创意添加
+进入要求:仅在我明确发出“进入执行模式”命令后才能进入
+偏差处理:如果发现任何需要纠正的问题，返回计划模式
+仅执行与计划匹配的内容
+
+[模式5：回顾]
+目的:严格验证计划的实施情况
+允许:逐行比较计划和实施
+要求:明确标记任何偏差，无论偏差有多小
+偏差格式:“ :warning: 检测到偏差：[准确偏差描述]”
+报告:必须报告实施情况是否与计划一致
+结论格式:“ :white_check_mark: 实施与计划完全相符”或“ :cross_mark: 实施与计划有偏差”
+输出格式:以[模式: 回顾]开始，然后进行系统比较和明确判决
+
+协议指南
+- 未经我明确许可，你不能在模式之间转换。
+- 在执行模式下，你须 100% 忠实地遵循计划。
+- 在回顾模式下，你须标记哪怕是最小的偏差。
+- 你无权在声明的模式之外做出独立的决定。
+- 仅当我明确发出信号时才转换模式：
+“进入研究模式”
+“进入创新模式”
+“进入计划模式”
+“进入执行模式”
+“进入回顾模式”或输入+符号
+如果没有这些确切的信号，请保持当前模式。
+
+注：此 AGENTS.md 由 .cursor/rules/riper-5.mdc 内容同步而来；后续如需修改规则，建议在该源文件中更新并将变更同步到此处。
+

package/CLAUDE.md

@@ -0,0 +1,77 @@
+# Jasper LiquidationHub
+
+Blockchain-based liquidation service for perpetual contracts with role-driven modular architecture, supporting horizontal scaling via Docker containerization.
+
+## Tech Stack
+
+- **Runtime**: Node.js 18+ / TypeScript 5.3+
+- **Framework**: Fastify 4.24+
+- **Queue**: BullMQ 5.1+
+- **Storage**: Redis 4.6+
+- **Blockchain**: Ethers.js 6.8+ (Arbitrum)
+- **Data Source**: GraphQL (Subgraph API)
+- **Logging**: Pino 8.16+
+
+## Commands
+
+```bash
+npm run dev          # Start development server
+npm run build        # Build TypeScript
+npm run lint         # Run ESLint
+npm run test         # Run tests
+npm run typecheck    # TypeScript type checking
+```
+
+## Architecture Overview
+
+Four core services with Redis leader election for HA:
+
+| Service              | Role                                                   | Instances      |
+| -------------------- | ------------------------------------------------------ | -------------- |
+| **Manager**    | REST API, sentinel monitoring, manual liquidation      | Active/Standby |
+| **Data Sync**  | Poll Subgraph, calculate health factors, update Redis  | Single Leader  |
+| **Dispatcher** | Scan orders, compare prices, produce liquidation tasks | Single Leader  |
+| **Worker**     | Consume BullMQ tasks, execute blockchain transactions  | Multi-Instance |
+
+Service roles are set via `SERVICE_ROLE` env var: `sync`, `dispatcher`, `worker`, `manager`
+
+## Key Directories
+
+```
+src/services/
+├── manager/          # API server, status monitoring, service control
+├── data-sync/        # Subgraph client, order processing, Redis updates
+├── dispatcher/       # Order scanning, task production, deduplication
+└── worker/           # Task consumer, liquidation executor, retry handling
+```
+
+## API Patterns
+
+- Order creation: `POST /api/order/create` (unified for market/limit orders)
+- Job status: `GET /api/job/status/{jobId}` or SSE `GET /api/job/stream/{jobId}`
+- Market order: `targetPrice = MAX_UINT256` (Long) or `"0"` (Short)
+- Limit order: `targetPrice` = valid price value
+
+## Code Style
+
+- Use ES modules, not CommonJS
+- Prefer named exports
+- All numeric values in contracts use string format (uint256/uint64)
+- Prices and amounts in wei (18 decimals)
+- Use EIP-712 signatures for order signing
+
+## Important Notes
+
+IMPORTANT: Code, comments, documentation, and UI text in English. Communicate with user in 中文.
+
+- NEVER commit `.env` files or expose private keys
+- Redis keys use `leadership:{service}:leader` pattern for HA
+- BullMQ retry: exponential backoff, max 5 attempts, max delay 5min
+- All blockchain transactions support Flashbots/Flashblocks for fast confirmation
+- Order deduplication uses `signature` as unique identifier
+
+## Documentation References
+
+- Architecture details: @docs/architecture.md
+- Order API specs: @docs/API_ORDER_CREATE.md
+- Perps flow: @docs/perps-order-flow.md

package/Dockerfile

@@ -0,0 +1,99 @@
+# =========================================
+#  阶段 1: Builder (构建器)
+#  负责安装所有依赖并编译 TypeScript
+# =========================================
+FROM node:18-alpine AS builder
+
+WORKDIR /app
+
+# 复制依赖文件 (利用缓存)
+COPY package*.json ./
+COPY tsconfig.json ./
+
+# 安装所有依赖 (包括 devDependencies)
+RUN npm ci
+
+# 复制源代码和配置
+COPY src/ ./src/
+COPY config/ ./config/
+
+# 编译 TypeScript
+RUN npm run build
+
+
+# =========================================
+#  阶段 2: Runtime Base (运行时基础)
+#  构建一个包含生产依赖和已编译代码的通用基础镜像
+# =========================================
+FROM node:18-alpine AS runtime-base
+
+# 安装 curl (用于健康检查) 并创建非 root 用户
+RUN apk add --no-cache curl && \
+    addgroup -g 1001 -S liquidation && \
+    adduser -S liquidation -u 1001 -G liquidation
+
+WORKDIR /app
+
+# 复制 package.json 以安装生产依赖
+COPY package*.json ./
+
+# 仅安装生产依赖
+RUN npm ci --omit=dev --ignore-scripts && npm cache clean --force
+
+# 从 builder 阶段复制编译好的代码和配置
+COPY --from=builder /app/dist ./dist/
+COPY --from=builder /app/config ./config/
+
+# 设置文件权限
+RUN chown -R liquidation:liquidation /app
+
+# 切换到非 root 用户
+USER liquidation
+
+# 设置所有服务共享的环境变量
+ENV RISK_MMR=0.005
+ENV USE_BUNDLER=false
+ENV BUNDLER_PROVIDER=eoa
+# ENV USE_BUNDLER=false
+# ENV BUNDLER_PROVIDER=eoa
+ENV COINBASE_ENTRYPOINT=0x5FF137D4b0FDCD49DcA30c7CF57E578a026d2789
+ENV COINBASE_VAULT_INDEX=1
+ENV FLASHBLOCKS_WS_RPC_URL=wss://base-mainnet.g.alchemy.com/v2/igHoSYAWMvPX86unqNbyZ
+# 默认启动命令
+CMD ["node", "dist/app.js"]
+
+
+# =========================================
+#  阶段 3: Final Services (最终服务)
+#  每个服务都继承自 runtime-base，并只添加各自特定的配置
+# =========================================
+
+# --- Manager 服务 ---
+FROM runtime-base AS manager
+EXPOSE 3000
+ENV SERVICE_ROLE=manager
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
+  CMD curl -f http://localhost:3000 || exit 1
+
+# --- Sync 服务 ---
+FROM runtime-base AS sync
+EXPOSE 3001
+ENV SERVICE_ROLE=sync
+ENV SUBGRAPH_TIMEOUT=30000
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
+  CMD curl -f http://localhost:3001/health || exit 1
+
+# --- Worker 服务 ---
+FROM runtime-base AS worker
+EXPOSE 3002
+ENV SERVICE_ROLE=worker
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
+  CMD curl -f http://localhost:3002/health || exit 1
+
+# --- Dispatcher 服务 ---
+FROM runtime-base AS dispatcher
+EXPOSE 3003
+ENV SERVICE_ROLE=dispatcher
+# 假设健康检查路径为 /health，端口为 3003，请根据你的代码实际情况修改
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
+  CMD curl -f http://localhost:3003/health || exit 1

package/Dockerfile.manager

@@ -0,0 +1,61 @@
+# Multi-stage build for production deployment
+# Build stage
+FROM node:18-alpine AS builder
+
+WORKDIR /app
+
+# Copy dependency files first for better caching
+COPY package*.json ./
+COPY tsconfig.json ./
+
+# Install all dependencies including devDependencies for building
+RUN npm ci
+
+# Copy source code and config
+COPY src/ ./src/
+COPY config/ ./config/
+
+# Build TypeScript to JavaScript
+RUN npm run build
+
+# Runtime stage
+FROM node:18-alpine AS runtime
+
+# Install curl for health checks
+RUN apk add --no-cache curl
+
+# Create non-root user for security
+RUN addgroup -g 1001 -S liquidation && \
+    adduser -S liquidation -u 1001 -G liquidation
+
+WORKDIR /app
+
+# Copy package files for production install
+COPY package*.json ./
+
+# Install only production dependencies
+RUN npm ci --only=production && npm cache clean --force
+
+# Copy built application and config from builder stage
+COPY --from=builder /app/dist ./dist/
+COPY --from=builder /app/config ./config/
+
+# Set proper ownership
+RUN chown -R liquidation:liquidation /app
+
+# Expose required ports
+EXPOSE 3000 3001 3002
+
+# Set default environment variables
+ENV SERVICE_ROLE=manager
+ENV RISK_MMR=0.005
+
+# Configure health check
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
+  CMD curl -f http://localhost:3000 || exit 1
+
+# Switch to non-root user
+USER liquidation
+
+# Start the application
+CMD ["node", "dist/app.js"]

package/Dockerfile.sync

@@ -0,0 +1,59 @@
+# Multi-stage build for sync service deployment
+# Build stage
+FROM node:18-alpine AS builder
+
+WORKDIR /app
+
+# Copy dependency files first for better caching
+COPY package*.json ./
+COPY tsconfig.json ./
+
+# Install all dependencies including devDependencies for building
+RUN npm ci
+
+# Copy source code and config
+COPY src/ ./src/
+COPY config/ ./config/
+
+# Build TypeScript to JavaScript
+RUN npm run build
+
+# Runtime stage
+FROM node:18-alpine AS runtime
+
+# Install curl for health checks
+RUN apk add --no-cache curl
+
+# Create non-root user for security
+RUN addgroup -g 1001 -S liquidation && \
+    adduser -S liquidation -u 1001 -G liquidation
+
+WORKDIR /app
+
+# Copy package files for production install
+COPY package*.json ./
+
+# Install only production dependencies
+RUN npm ci --only=production && npm cache clean --force
+
+# Copy built application and config from builder stage
+COPY --from=builder /app/dist ./dist/
+COPY --from=builder /app/config ./config/
+
+# Set proper ownership
+RUN chown -R liquidation:liquidation /app
+
+# Set default environment variables for sync service
+ENV SERVICE_ROLE=sync
+ENV RISK_MMR=0.005
+ENV SUBGRAPH_TIMEOUT=30000
+
+# Configure health check
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
+  CMD curl -f http://localhost:3001/health || exit 1
+
+# Switch to non-root user
+USER liquidation
+
+# Start the sync service
+CMD ["node", "dist/app.js"]

package/Dockerfile.test

@@ -0,0 +1,104 @@
+# Multi-stage build for production deployment
+# Build stage
+FROM node:18-alpine AS builder
+
+WORKDIR /app
+
+# Copy dependency files first for better caching
+COPY package*.json ./
+COPY tsconfig.json ./
+
+# Install all dependencies including devDependencies for building
+RUN npm ci
+
+# Copy source code and config
+COPY src/ ./src/
+COPY config/ ./config/
+
+# Build TypeScript to JavaScript
+RUN npm run build
+
+# Runtime stage
+FROM node:18-alpine AS runtime
+
+# Install curl for health checks and PM2
+RUN apk add --no-cache curl && npm install -g pm2
+
+# Create non-root user for security
+RUN addgroup -g 1001 -S liquidation && \
+    adduser -S liquidation -u 1001 -G liquidation
+
+WORKDIR /app
+
+# Copy package files for production install
+COPY package*.json ./
+
+# Install only production dependencies (skip prepare/husky in container)
+RUN npm ci --omit=dev --ignore-scripts && npm cache clean --force
+
+# Copy built application and config from builder stage
+COPY --from=builder /app/dist ./dist/
+COPY --from=builder /app/config ./config/
+
+# Create PM2 ecosystem file
+RUN cat <<EOF > ecosystem.config.js
+module.exports = {
+  apps: [
+    {
+      name: 'manager',
+      script: 'dist/app.js',
+      instances: 2,
+      env: {
+        SERVICE_ROLE: 'manager',
+        PORT: 3000
+      }
+    },
+    {
+      name: 'sync',
+      script: 'dist/app.js',
+      instances: 2,
+      env: {
+        SERVICE_ROLE: 'sync',
+        PORT: 3001
+      }
+    },
+    {
+      name: 'worker',
+      script: 'dist/app.js',
+      instances: 2,
+      env: {
+        SERVICE_ROLE: 'worker',
+        PORT: 3002
+      }
+    },
+    {
+      name: 'dispatcher',
+      script: 'dist/app.js',
+      instances: 2,
+      env: {
+        SERVICE_ROLE: 'dispatcher',
+        PORT: 3003
+      }
+    }
+  ]
+};
+EOF
+
+# Set proper ownership
+RUN chown -R liquidation:liquidation /app
+
+# Expose required ports
+EXPOSE 3000 3001 3002 3003
+
+# Set default environment variables
+ENV RISK_MMR=0.005
+
+# Configure health checks for all services
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
+  CMD sh -c 'curl -f http://localhost:3000/health && curl -f http://localhost:3001/health && curl -f http://localhost:3002/health && curl -f http://localhost:3003/health' || exit 1
+
+# Switch to non-root user
+USER liquidation
+
+# Start all services with PM2
+CMD ["pm2-runtime", "ecosystem.config.js"]

package/Dockerfile.worker

@@ -0,0 +1,62 @@
+# Multi-stage build for worker service deployment
+# Build stage
+FROM node:18-alpine AS builder
+
+WORKDIR /app
+
+# Copy dependency files first for better caching
+COPY package*.json ./
+COPY tsconfig.json ./
+
+# Install all dependencies including devDependencies for building
+RUN npm ci
+
+# Copy source code and config
+COPY src/ ./src/
+COPY config/ ./config/
+
+# Build TypeScript to JavaScript
+RUN npm run build
+
+# Runtime stage
+FROM node:18-alpine AS runtime
+
+# Install curl for health checks
+RUN apk add --no-cache curl
+
+# Create non-root user for security
+RUN addgroup -g 1001 -S liquidation && \
+    adduser -S liquidation -u 1001 -G liquidation
+
+WORKDIR /app
+
+# Copy package files for production install
+COPY package*.json ./
+
+# Install only production dependencies
+RUN npm ci --only=production && npm cache clean --force
+
+# Copy built application and config from builder stage
+COPY --from=builder /app/dist ./dist/
+COPY --from=builder /app/config ./config/
+
+# Set proper ownership
+RUN chown -R liquidation:liquidation /app
+
+# Set default environment variables for worker service
+ENV SERVICE_ROLE=worker
+ENV RISK_MMR=0.005
+ENV USE_BUNDLER=true
+ENV BUNDLER_PROVIDER=coinbase
+ENV COINBASE_ENTRYPOINT=0x5FF137D4b0FDCD49DcA30c7CF57E578a026d2789
+ENV COINBASE_VAULT_INDEX=1
+
+# Configure health check
+HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=3 \
+  CMD curl -f http://localhost:3002/health || exit 1
+
+# Switch to non-root user
+USER liquidation
+
+# Start the worker service
+CMD ["node", "dist/app.js"]