diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..56269b3 --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,38 @@ +# AGENTS.md + +Instructions for AI coding agents working in this repository. + +## Project Overview + +ThruBox Client is a zero-runtime-dependency TypeScript SDK for the [ThruBox Server](https://github.com/AOSSIE-Org/ThruBox-Server), a self-hostable encrypted message relay. The SDK sends, receives, and manages encrypted messages over the relay's REST API. Works in Node.js 18+ and modern browsers. + +## Repository Layout + +- `src/` — SDK source (TypeScript) +- `tests/` — Vitest test suite +- `public/` — logo assets referenced by README +- `brand/` — logo, favicons, and brand guidelines (see `brand/Brand.md`) + +## Build, Test & Lint + +```bash +npm install +npm run build # tsup — builds ESM + CJS with type declarations +npm test # vitest run +npm run test:watch # vitest watch mode +npm run coverage # vitest run --coverage +npm run lint # eslint src/ tests/ +npm run format # prettier --write +npm run format:check # prettier --check +``` + +## Hard Constraints + +- **Zero runtime dependencies.** Only `devDependencies` may be added for build/test tooling — never add a runtime dependency without discussing it in an issue first. This is enforced by `.coderabbit.yaml` review rules. +- The package must keep shipping both ESM and CJS builds with TypeScript declarations (via `tsup`) — don't introduce APIs that only work in one module format. +- Use the native `fetch` API rather than an HTTP client library, to stay dependency-free and work in both Node and browsers. + +## Conventions + +- New functionality needs tests in `tests/` using Vitest. +- Errors are typed (specific error classes for rate limiting, payload size, not found, etc.) — follow this pattern for new failure modes rather than throwing generic `Error`. diff --git a/BestPracticesChecklist.md b/BestPracticesChecklist.md index ed8ba50..66c4195 100644 --- a/BestPracticesChecklist.md +++ b/BestPracticesChecklist.md @@ -25,44 +25,44 @@ | Category | Met | Total | Status | |--------------------|-----|-------|--------| -| Basics | 0 | 8 | 🔴 | -| Change Control | 0 | 6 | 🔴 | -| Reporting | 0 | 8 | 🔴 | -| Quality | 0 | 11 | 🔴 | -| Security | 0 | 9 | 🔴 | -| Analysis | 0 | 7 | 🔴 | -| **Total** | **0** | **49** | **0%** | +| Basics | 7 | 8 | 🟡 | +| Change Control | 5 | 6 | 🟡 | +| Reporting | 3 | 8 | 🔴 | +| Quality | 5 | 11 | 🔴 | +| Security | 6 | 9 | 🟡 | +| Analysis | 3 | 7 | 🔴 | +| **Total** | **29** | **49** | **59%** | --- ## 🏗️ Basics ### Project Website & Documentation -- [ ] 🔴 **description_good** — The project README/website clearly describes what the software does and what problem it solves. - - *Evidence URL:* +- [x] 🔴 **description_good** — The project README/website clearly describes what the software does and what problem it solves. + - *Evidence URL:* `README.md` — "ThruBox Client SDK" intro -- [ ] 🔴 **interact** — The project provides information on how to obtain the software, submit bug reports, and contribute. - - *Evidence URL:* +- [x] 🔴 **interact** — The project provides information on how to obtain the software, submit bug reports, and contribute. + - *Evidence URL:* `README.md` (npm install), GitHub Issues, `CONTRIBUTING.md` -- [ ] 🔴 **contribution** — `CONTRIBUTING.md` explains the contribution process (e.g., PRs are used, how to open one). - - *Evidence URL:* +- [x] 🔴 **contribution** — `CONTRIBUTING.md` explains the contribution process (e.g., PRs are used, how to open one). + - *Evidence URL:* `CONTRIBUTING.md` "Development Workflow" / "Pull Request Guidelines" -- [ ] 🟡 **contribution_requirements** — `CONTRIBUTING.md` references acceptable contribution standards (coding style, tests required, etc.). - - *Evidence URL:* +- [x] 🟡 **contribution_requirements** — `CONTRIBUTING.md` references acceptable contribution standards (coding style, tests required, etc.). + - *Evidence URL:* `CONTRIBUTING.md` "Code Style Guidelines" (zero-dependency rule), "Test Your Changes" -- [ ] 🔴 **documentation_basics** — Basic documentation exists for the software (README, Wiki, or docs folder). - - *Evidence URL:* `[ ]` N/A — *Justification:* +- [x] 🔴 **documentation_basics** — Basic documentation exists for the software (README, Wiki, or docs folder). + - *Evidence URL:* `README.md`, `AGENTS.md`, `brand/Brand.md` - [ ] 🔴 **documentation_interface** — Reference documentation describes the external interface (API inputs/outputs, CLI flags, config schema, etc.). - - *Evidence URL:* `[ ]` N/A — *Justification:* + - *Evidence URL:* Not present — README has a Quick Start usage example but no generated API reference (e.g. TypeDoc). ### Other Basics -- [ ] 🔴 **discussion** — Project has a searchable, URL-addressable discussion mechanism (GitHub Issues, Discord with archive, mailing list, etc.) that doesn't require proprietary client software. - - *Evidence URL:* +- [x] 🔴 **discussion** — Project has a searchable, URL-addressable discussion mechanism (GitHub Issues, Discord with archive, mailing list, etc.) that doesn't require proprietary client software. + - *Evidence URL:* GitHub Issues; [#thrubox Discord channel](https://discord.com/channels/995968619034984528/1525382676964446258) -- [ ] 🟡 **english** — Documentation is provided in English and English bug reports/comments are accepted. - - *Note:* +- [x] 🟡 **english** — Documentation is provided in English and English bug reports/comments are accepted. + - *Note:* All docs and issues are in English. --- @@ -70,27 +70,27 @@ ### Version Control -- [ ] 🔵 **repo_distributed** — Project uses a distributed VCS (e.g., git). *(SUGGESTED)* - - *Evidence URL:* +- [x] 🔵 **repo_distributed** — Project uses a distributed VCS (e.g., git). *(SUGGESTED)* + - *Evidence URL:* GitHub repo, git history ### Version Numbering -- [ ] 🔴 **version_unique** — Each release has a unique version identifier (e.g., v1.0.0). - - *Evidence URL:* +- [x] 🔴 **version_unique** — Each release has a unique version identifier (e.g., v1.0.0). + - *Evidence URL:* Git tags `v1.0.0`, `v1.0.1`, `v1.0.2`; GitHub Releases -- [ ] 🔵 **version_semver** — Project uses [SemVer](https://semver.org) or [CalVer](https://calver.org/) format. *(SUGGESTED)* - - *Note:* +- [x] 🔵 **version_semver** — Project uses [SemVer](https://semver.org) or [CalVer](https://calver.org/) format. *(SUGGESTED)* + - *Note:* Tags follow strict SemVer (`v1.0.0`, `v1.0.1`, `v1.0.2`). -- [ ] 🔵 **version_tags** — Releases are tagged in the VCS (e.g., `git tag v1.0.0`). *(SUGGESTED)* - - *Evidence URL:* +- [x] 🔵 **version_tags** — Releases are tagged in the VCS (e.g., `git tag v1.0.0`). *(SUGGESTED)* + - *Evidence URL:* `git tag` output ### Release Notes -- [ ] 🔴 **release_notes** — Each release includes human-readable release notes summarizing major changes. Raw `git log` output is NOT acceptable. - - *Evidence URL:* `[ ]` N/A — *Justification (continuous delivery / no external reuse):* +- [x] 🔴 **release_notes** — Each release includes human-readable release notes summarizing major changes. Raw `git log` output is NOT acceptable. + - *Evidence URL:* `.github/workflows/release-drafter.yml` auto-generates categorized release notes from PR titles/labels. - [ ] 🔴 **release_notes_vulns** — Release notes identify every publicly known vulnerability (with CVE) fixed in that release. - - *Evidence URL:* `[ ]` N/A — *Justification (no publicly known vulns / users can't self-update):* + - *Evidence URL:* `[~]` N/A — Justification: no publicly known/disclosed vulnerabilities to date. --- @@ -98,31 +98,31 @@ ### Bug Reporting -- [ ] 🔴 **report_process** — A bug-reporting process exists (e.g., GitHub Issues link in README). - - *Evidence URL:* +- [x] 🔴 **report_process** — A bug-reporting process exists (e.g., GitHub Issues link in README). + - *Evidence URL:* GitHub Issues; `.github/workflows/create-initial-issues.yml` -- [ ] 🟡 **report_tracker** — An issue tracker (e.g., GitHub Issues) is used to track individual bugs. - - *Evidence URL:* +- [x] 🟡 **report_tracker** — An issue tracker (e.g., GitHub Issues) is used to track individual bugs. + - *Evidence URL:* GitHub Issues - [ ] 🔴 **report_responses** — A majority of bug reports submitted in the last 2–12 months have been acknowledged (response ≠ fix). - - *Self-certification note:* + - *Self-certification note:* Not yet assessed — needs maintainer review of issue history. - [ ] 🟡 **enhancement_responses** — More than 50% of enhancement requests in the last 2–12 months have received a response. - - *Self-certification note:* + - *Self-certification note:* Not yet assessed. -- [ ] 🔴 **report_archive** — Reports and responses are publicly archived and searchable (GitHub Issues satisfies this). - - *Evidence URL:* +- [x] 🔴 **report_archive** — Reports and responses are publicly archived and searchable (GitHub Issues satisfies this). + - *Evidence URL:* GitHub Issues ### Vulnerability Reporting - [ ] 🔴 **vulnerability_report_process** — A vulnerability reporting process is documented (e.g., `SECURITY.md`). - - *Evidence URL:* + - *Evidence URL:* Not present — no `SECURITY.md` in repo. - [ ] 🟡 **vulnerability_report_private** — If private vulnerability reporting is supported, the method for private submission is documented. - - *Evidence URL:* `[ ]` N/A — *Justification:* + - *Evidence URL:* `[~]` N/A — Justification: no `SECURITY.md`/private channel documented yet. - [ ] 🔴 **vulnerability_report_response** — Initial response to any vulnerability report received in the last 6 months was within 14 days. - - *Self-certification note:* `[ ]` N/A — *Justification (no reports received):* + - *Self-certification note:* `[~]` N/A — Justification: no reports received (no vulnerability reporting process exists yet). --- @@ -130,44 +130,44 @@ ### Build System -- [ ] 🔴 **build** — If the project requires building, a working build system exists that can auto-rebuild from source. - - *Evidence URL:* `[ ]` N/A — *Justification (interpreted language / no build step):* +- [x] 🔴 **build** — If the project requires building, a working build system exists that can auto-rebuild from source. + - *Evidence URL:* `package.json` — `npm run build` (tsup, ESM+CJS+d.ts) -- [ ] 🔵 **build_common_tools** — Common build tools are used (npm, pip, cargo, make, gradle, etc.). *(SUGGESTED)* - - *Evidence URL:* `[ ]` N/A +- [x] 🔵 **build_common_tools** — Common build tools are used (npm, pip, cargo, make, gradle, etc.). *(SUGGESTED)* + - *Evidence URL:* npm, tsup -- [ ] 🟡 **build_floss_tools** — The project can be built using only FLOSS tools. - - *Note:* `[ ]` N/A +- [x] 🟡 **build_floss_tools** — The project can be built using only FLOSS tools. + - *Note:* npm/tsup/vitest are all FLOSS. ### Automated Testing -- [ ] 🔵 **test_invocation** — The test suite can be invoked in a standard way for the language (e.g., `npm test`, `pytest`, `cargo test`). *(SUGGESTED)* - - *Evidence URL:* +- [x] 🔵 **test_invocation** — The test suite can be invoked in a standard way for the language (e.g., `npm test`, `pytest`, `cargo test`). *(SUGGESTED)* + - *Evidence URL:* `npm test` (Vitest); also run in `.github/workflows/version-release.yml` before publishing. - [ ] 🔵 **test_most** — The test suite covers most code branches, input fields, and functionality. *(SUGGESTED)* - - *Estimated coverage %:* + - *Estimated coverage %:* Not measured/published (a `coverage` script exists but no published threshold/report). ### New Functionality Testing Policy - [ ] 🔴 **test_policy** — The project has a general policy that new functionality must include tests in the automated test suite. - - *Evidence (CONTRIBUTING reference or informal policy):* + - *Evidence (CONTRIBUTING reference or informal policy):* Not formally documented — `CONTRIBUTING.md` describes how to run tests but doesn't mandate adding them for new functionality. - [ ] 🔴 **tests_are_added** — Evidence exists that the test policy has been followed in recent major changes (e.g., PRs include tests). - - *Evidence URL (recent PR with tests):* + - *Evidence URL (recent PR with tests):* Not yet compiled. - [ ] 🔵 **tests_documented_added** — The test policy is documented in contribution instructions. *(SUGGESTED)* - - *Evidence URL:* + - *Evidence URL:* Not documented (see `test_policy` above). ### Linting / Warning Flags -- [ ] 🔴 **warnings** — At least one linter or compiler warning flag is enabled (ESLint, Pylint, clippy, golangci-lint, Slither for Solidity, etc.). - - *Tool used:* +- [x] 🔴 **warnings** — At least one linter or compiler warning flag is enabled (ESLint, Pylint, clippy, golangci-lint, Slither for Solidity, etc.). + - *Tool used:* ESLint (`npm run lint` → `eslint src/ tests/`) - [ ] 🔴 **warnings_fixed** — Warnings from the linter are addressed (not suppressed without reason). - - *Note:* + - *Note:* Not verified — lint isn't currently run as a required PR CI check (only referenced via `npm run lint` locally/CONTRIBUTING.md). - [ ] 🔵 **warnings_strict** — Project uses maximum strictness in linter config where practical. *(SUGGESTED)* - - *Note:* + - *Note:* Not assessed. --- @@ -176,33 +176,33 @@ ### Secure Development Knowledge - [ ] 🔴 **know_secure_design** — At least one primary developer knows how to design secure software (familiar with OWASP, threat modeling, secure-by-default principles). - - *Self-certification note:* + - *Self-certification note:* To be self-certified by a maintainer. - [ ] 🔴 **know_common_errors** — At least one primary developer knows common vulnerability types for this software's category and how to mitigate them (e.g., injection, XSS, reentrancy for Solidity, prompt injection for AI). - - *Self-certification note:* + - *Self-certification note:* To be self-certified by a maintainer. ### Cryptography (mark N/A if project does not handle cryptography) -- [ ] 🔴 **crypto_published** — Only publicly reviewed cryptographic protocols/algorithms are used by default. - - *Note:* `[ ]` N/A +- [~] 🔴 **crypto_published** — Only publicly reviewed cryptographic protocols/algorithms are used by default. + - *Note:* N/A — This SDK transports opaque, already-encrypted payloads; it does not implement encryption/decryption itself (that's the consuming application's responsibility). -- [ ] 🟡 **crypto_call** — Project calls an established crypto library rather than reimplementing crypto functions. - - *Library used:* `[ ]` N/A +- [~] 🟡 **crypto_call** — Project calls an established crypto library rather than reimplementing crypto functions. + - *Library used:* N/A — No cryptography implemented in this SDK. -- [ ] 🔴 **crypto_working** — No broken algorithms (MD4, MD5, single DES, RC4, Dual_EC_DRBG) used unless required for interoperability (must be documented). - - *Note:* `[ ]` N/A +- [~] 🔴 **crypto_working** — No broken algorithms (MD4, MD5, single DES, RC4, Dual_EC_DRBG) used unless required for interoperability (must be documented). + - *Note:* N/A — No cryptography implemented in this SDK. -- [ ] 🔴 **crypto_keylength** — Key lengths meet [NIST 2030 minimums](https://www.keylength.com/en/4/) by default. - - *Note:* `[ ]` N/A +- [~] 🔴 **crypto_keylength** — Key lengths meet [NIST 2030 minimums](https://www.keylength.com/en/4/) by default. + - *Note:* N/A — No cryptography implemented in this SDK. -- [ ] 🔴 **crypto_password_storage** — Passwords for external users are stored as iterated salted hashes (Argon2id, bcrypt, scrypt, PBKDF2). - - *Note:* `[ ]` N/A — *Justification (project doesn't store passwords):* +- [~] 🔴 **crypto_password_storage** — Passwords for external users are stored as iterated salted hashes (Argon2id, bcrypt, scrypt, PBKDF2). + - *Note:* N/A — Justification: SDK doesn't store passwords; auth is via server-issued API keys. -- [ ] 🔴 **crypto_random** — Cryptographic keys and nonces are generated using a CSPRNG; insecure generators (Math.random, rand()) are NOT used for security purposes. - - *Note:* `[ ]` N/A +- [~] 🔴 **crypto_random** — Cryptographic keys and nonces are generated using a CSPRNG; insecure generators (Math.random, rand()) are NOT used for security purposes. + - *Note:* N/A — SDK doesn't generate cryptographic keys/nonces; encryption happens client-side in the consuming application before calling this SDK. - [ ] 🟡 **delivery_unsigned** — Cryptographic hashes are NOT retrieved over plain HTTP without a signature check. - - *Note:* + - *Note:* Not assessed. --- @@ -211,27 +211,27 @@ ### Static Code Analysis - [ ] 🔴 **static_analysis_fixed** — All medium+ severity vulnerabilities found by static analysis are fixed in a timely manner after confirmation. - - *Note:* `[ ]` N/A + - *Note:* Not yet assessed — needs maintainer review of CodeQL alert history. -- [ ] 🔵 **static_analysis_common_vulnerabilities** — The static analysis tool includes checks for common vulnerabilities in the language/environment (e.g., eslint-plugin-security, bandit, Slither). *(SUGGESTED)* - - *Tool + ruleset:* `[ ]` N/A +- [x] 🔵 **static_analysis_common_vulnerabilities** — The static analysis tool includes checks for common vulnerabilities in the language/environment (e.g., eslint-plugin-security, bandit, Slither). *(SUGGESTED)* + - *Tool + ruleset:* CodeQL (`.github/workflows/codeql.yml`), default security query pack. -- [ ] 🔵 **static_analysis_often** — Static analysis runs on every commit or at least daily (CI integration). *(SUGGESTED)* - - *Evidence URL:* `[ ]` N/A +- [x] 🔵 **static_analysis_often** — Static analysis runs on every commit or at least daily (CI integration). *(SUGGESTED)* + - *Evidence URL:* `.github/workflows/codeql.yml` — runs on every push/PR to `main` plus a weekly schedule. ### Dynamic Code Analysis - [ ] 🔵 **dynamic_analysis** — At least one dynamic analysis tool is applied before major releases (fuzzer, web app scanner like OWASP ZAP, etc.). *(SUGGESTED)* - - *Tool used:* `[ ]` N/A — *Justification:* + - *Tool used:* Not currently used. - [ ] 🔵 **dynamic_analysis_enable_assertions** — Dynamic analysis / testing runs with assertions enabled (not just production mode). *(SUGGESTED)* - - *Note:* + - *Note:* Not assessed. - [ ] 🔴 **dynamic_analysis_fixed** — Medium+ severity vulnerabilities found by dynamic analysis are fixed in a timely manner. - - *Note:* `[ ]` N/A + - *Note:* Not applicable yet — no dynamic analysis tool configured. -- [ ] 🔵 **dynamic_analysis_unsafe** — If the project uses memory-unsafe languages (C/C++), memory safety tools (Valgrind, AddressSanitizer) are used. *(SUGGESTED)* - - *Note:* `[ ]` N/A — *Justification (project uses memory-safe languages):* +- [~] 🔵 **dynamic_analysis_unsafe** — If the project uses memory-unsafe languages (C/C++), memory safety tools (Valgrind, AddressSanitizer) are used. *(SUGGESTED)* + - *Note:* N/A — Justification: project uses a memory-safe language (TypeScript). --- @@ -239,20 +239,12 @@ > Add domain-specific notes here for Web3, Full-Stack, or AI projects. -### Web3 / Solidity Notes -- Scorecard does not audit Solidity-specific security. Use [Slither](https://github.com/crytic/slither) for `static_analysis` and `warnings` criteria. -- For `crypto_*` criteria, document which cryptographic primitives your contracts rely on (e.g., ECDSA in EVM is standard). -- Smart contract audit reports count as evidence for `know_secure_design`. +### SDK / Library Notes -### Full-Stack / Next.js Notes -- For `crypto_password_storage`: document which auth library handles hashing (e.g., NextAuth + bcrypt). -- For `dynamic_analysis`: [OWASP ZAP](https://www.zaproxy.org/) can be run as a GitHub Action. - -### AI / LLM Notes -- For `know_common_errors`: include awareness of prompt injection, data leakage, and model output validation. -- For `dynamic_analysis`: consider adversarial input testing as a form of dynamic analysis. +- This SDK is a thin transport layer over the ThruBox Server REST API; it does not implement cryptography itself. See `crypto_*` notes above. +- `.coderabbit.yaml` enforces a zero-runtime-dependency rule for this package — see `AGENTS.md`. --- *This checklist complements [OpenSSF Scorecard](https://scorecard.dev/) (auto-detected checks) and is -inspired by the [OpenSSF Best Practices Badge](https://www.bestpractices.dev/en/criteria/0) passing criteria.* \ No newline at end of file +inspired by the [OpenSSF Best Practices Badge](https://www.bestpractices.dev/en/criteria/0) passing criteria.* diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 8b5300b..9b2e0af 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -1,4 +1,4 @@ -# Contributing to TODO: Project Name +# Contributing to ThruBox Client SDK ⭐ First off, thank you for considering contributing to this project! ⭐ @@ -9,7 +9,7 @@ We welcome contributions from everyone. By participating in this project, you ag **All project communication MUST happen on Discord. We do not pay attention to GitHub notifications.** - Join our [Discord server](https://discord.gg/hjUhu33uAn) before starting any work -- Post your PR/issue updates in the relevant Discord channel (**MANDATORY**) +- Post your PR/issue updates in the [#thrubox channel](https://discord.com/channels/995968619034984528/1525382676964446258) (**MANDATORY**) - All discussions, questions, and updates should be on Discord - GitHub is for code only - Discord is for communication @@ -68,36 +68,40 @@ What we expect: ### Prerequisites -TODO: List prerequisites specific to your project +- Node.js 18 or later +- npm (or yarn/pnpm) ### Setup 1. **Fork the Repository** + ```bash # Click the 'Fork' button at the top right of this page ``` 2. **Clone Your Fork** + ```bash - git clone https://github.com/YOUR_USERNAME/TODO.git - cd TODO + git clone https://github.com/YOUR_USERNAME/ThruBox-Client.git + cd ThruBox-Client ``` 3. **Add Upstream Remote** + ```bash - git remote add upstream https://github.com/AOSSIE-Org/TODO.git + git remote add upstream https://github.com/AOSSIE-Org/ThruBox-Client.git ``` 4. **Install Dependencies** + ```bash npm install - # or yarn install - # or pnpm install ``` -5. **Run the Project** +5. **Build the SDK** + ```bash - npm run dev + npm run build ``` ## 🔄 Development Workflow @@ -121,12 +125,13 @@ git checkout -b fix/your-bug-fix ### 3. Test Your Changes -TODO: Add project-specific testing instructions +Run the test suite (Vitest), linter, and format check before opening a PR: ```bash -npm test -# or -npm run lint +npm test # run the Vitest suite +npm run coverage # run tests with coverage +npm run lint # ESLint +npm run format:check # Prettier check ``` ### 4. Commit Your Changes @@ -210,7 +215,7 @@ Steps to test the changes ### After Submission -- Post your PR in the project's Discord channel for visibility(**IMPORTANT**) +- Post your PR in the [#thrubox channel](https://discord.com/channels/995968619034984528/1525382676964446258) for visibility(**IMPORTANT**) - Respond to review comments promptly - Make requested changes in new commits - Be patient - maintainers will review when available @@ -223,7 +228,7 @@ Steps to test the changes ## 📝 Code Style Guidelines -TODO: Add project-specific code style guidelines +This SDK is **zero-dependency at runtime** — only `devDependencies` may be used for build/test tooling. Do not add runtime dependencies without discussing it in an issue first. The package ships both ESM and CJS builds (via `tsup`) with TypeScript declarations, so avoid Node/browser-specific APIs that aren't available in both environments (the SDK uses the native `fetch` API). ### General Guidelines @@ -538,4 +543,4 @@ If you encounter issues not covered here: - Check for existing PRs before starting to avoid duplication, as there might PRs that didn't mention the related issue -Thank you for contributing to TODO! Your efforts help make this project better for everyone. 🚀 +Thank you for contributing to ThruBox Client SDK! Your efforts help make this project better for everyone. 🚀 diff --git a/MAINTAINERS.md b/MAINTAINERS.md new file mode 100644 index 0000000..6b287cb --- /dev/null +++ b/MAINTAINERS.md @@ -0,0 +1,25 @@ +# Maintainers, Mentors and Ideators + +This document lists the individuals fulfilling the key roles of [Maintainer](https://github.com/AOSSIE-Org/Info/blob/main/Roles/Maintainer.md), [Mentor](https://github.com/AOSSIE-Org/Info/blob/main/Roles/Mentors.md) and [Ideator](https://github.com/AOSSIE-Org/Info/blob/main/Roles/Ideator.md) for this repository, in accordance with [AOSSIE's Role Definitions](https://github.com/AOSSIE-Org/Info/tree/main/Roles). + +--- + +> **Note:** If multiple contributors are fulfilling a role in a single repository, please include and fill out the extra columns to clarify responsibilities (e.g., `Project / Feature Idea`, `Area / Focus`, and `Proposal / Discussion Link` for Ideators; `Area / Focus` for Mentors and Maintainers). If there is only one person for a role, do not add these columns. + +## Mentors + +| Name | GitHub Username | Discord Username | +| ----- | ---------------- | ------------------ | +| Bruno | @Zahnentferner | @b.wp | + +## Maintainers + +| Name | GitHub Username | Discord Username | Area / Focus | +| ------- | ------------------- | ------------------ | ----------------------------------- | +| Atharva | @Atharva0506 | @atharva0506 | Repository Maintenance & Merging | +| Karan | @kumawatkaran523 | @karankk9616 | Repository Maintenance & Merging | +| Aditya | @adityabhattad2021 | @adityabhattad | Repository Maintenance & Merging | + +## Ideators + +_No Ideators are currently assigned to this repository._ diff --git a/README.md b/README.md index bf134ad..a9feb4f 100644 --- a/README.md +++ b/README.md @@ -115,6 +115,23 @@ await relay.delete(messages[0].id); --- +## 🛠️ Development + +To build and test the SDK itself (not just consume it): + +```bash +git clone https://github.com/AOSSIE-Org/ThruBox-Client.git +cd ThruBox-Client +npm install + +npm run build # build ESM + CJS output with tsup +npm test # run the Vitest suite +npm run coverage # run tests with coverage +npm run lint # ESLint +``` + +--- + ## 📖 API Reference ### `new RelayClient(baseUrl, options?)` diff --git a/brand/Brand.md b/brand/Brand.md new file mode 100644 index 0000000..d1b41e4 --- /dev/null +++ b/brand/Brand.md @@ -0,0 +1,43 @@ +# ThruBox Brand Kit + +This folder is the canonical source for ThruBox's visual identity: logos, favicons/icons, and color palette. All assets referenced below live in this `brand/` folder. + +## Logo + +| Asset | File | +| --- | --- | +| ThruBox logo (SVG, with wordmark) | [`thrubox-logo.svg`](./thrubox-logo.svg) | +| AOSSIE org logo (SVG) | [`aossie-logo.svg`](./aossie-logo.svg) | + +The ThruBox mark is a Menger-sponge-style cube made of green tessellated tiles wrapped around a padlock, representing an encrypted "box" relaying data between clients. + +## Favicons & Icons + +Generated from `thrubox-logo.svg` at the standard sizes used across browsers, bookmarks, and mobile home screens: + +| File | Size | Use | +| --- | --- | --- | +| [`favicon.ico`](./favicon.ico) | 16/32/48 (multi-res) | Classic browser favicon | +| [`favicon-16x16.png`](./favicon-16x16.png) | 16×16 | Browser tab | +| [`favicon-32x32.png`](./favicon-32x32.png) | 32×32 | Browser tab (HiDPI) | +| [`favicon-48x48.png`](./favicon-48x48.png) | 48×48 | Windows taskbar | +| [`apple-touch-icon.png`](./apple-touch-icon.png) | 180×180 | iOS home screen | +| [`icon-512.png`](./icon-512.png) | 512×512 | PWA manifest / app icon | + +This package has no bundled web app (it's a Node.js/browser SDK library), so these assets aren't wired into an `index.html` — they're provided as the canonical brand exports for use in demo apps, npm listing pages, or documentation sites that consume this SDK. + +## Color Palette + +Sourced directly from `thrubox-logo.svg`: + +| Swatch | Name | Hex | Usage in logo | +| --- | --- | --- | --- | +| 🟩 | ThruBox Green (light) | `#3eb03e` | Sponge tile — top face | +| 🟩 | ThruBox Green (mid) | `#228B22` | Sponge tile — front face, wordmark | +| 🟩 | ThruBox Green (dark) | `#145A14` | Sponge tile — side face | +| ⬛ | Outline | `#0f420f` | Tile stroke | +| 🟨 | Lock Gold | `#FFC517` | Padlock accent, sourced from `thrubox-logo.svg` | + +## Typography + +This is a non-UI project (TypeScript SDK library) — there is no application typography to document. The wordmark in `thrubox-logo.svg` uses `'Arial Black', system-ui, sans-serif` at weight 900 as a logotype only. diff --git a/brand/aossie-logo.svg b/brand/aossie-logo.svg new file mode 100644 index 0000000..10cc0a8 --- /dev/null +++ b/brand/aossie-logo.svg @@ -0,0 +1,24 @@ + + + + + + + + + diff --git a/brand/apple-touch-icon.png b/brand/apple-touch-icon.png new file mode 100644 index 0000000..e505b1f Binary files /dev/null and b/brand/apple-touch-icon.png differ diff --git a/brand/favicon-16x16.png b/brand/favicon-16x16.png new file mode 100644 index 0000000..56fde4a Binary files /dev/null and b/brand/favicon-16x16.png differ diff --git a/brand/favicon-32x32.png b/brand/favicon-32x32.png new file mode 100644 index 0000000..9f3e350 Binary files /dev/null and b/brand/favicon-32x32.png differ diff --git a/brand/favicon-48x48.png b/brand/favicon-48x48.png new file mode 100644 index 0000000..ca45d57 Binary files /dev/null and b/brand/favicon-48x48.png differ diff --git a/brand/favicon.ico b/brand/favicon.ico new file mode 100644 index 0000000..1081ed4 Binary files /dev/null and b/brand/favicon.ico differ diff --git a/brand/icon-512.png b/brand/icon-512.png new file mode 100644 index 0000000..1464e7a Binary files /dev/null and b/brand/icon-512.png differ diff --git a/brand/thrubox-logo.svg b/brand/thrubox-logo.svg new file mode 100644 index 0000000..089f2db --- /dev/null +++ b/brand/thrubox-logo.svg @@ -0,0 +1,77 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + ThruBox + diff --git a/checklist-status.json b/checklist-status.json index eb0242b..4df2282 100644 --- a/checklist-status.json +++ b/checklist-status.json @@ -1,36 +1,36 @@ { "schemaVersion": 1, "label": "Best Practices", - "message": "0%", + "message": "59%", "schema": "aossie-best-practices-v1", - "updated": "2026-07-11", - "met": 0, + "updated": "2026-08-11", + "met": 29, "total": 49, - "percent": 0, - "color": "red", + "percent": 59, + "color": "orange", "categories": { "basics": { - "met": 0, + "met": 7, "total": 8 }, "change_control": { - "met": 0, + "met": 5, "total": 6 }, "reporting": { - "met": 0, + "met": 3, "total": 8 }, "quality": { - "met": 0, + "met": 5, "total": 11 }, "security": { - "met": 0, + "met": 6, "total": 9 }, "analysis": { - "met": 0, + "met": 3, "total": 7 } }