diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..56269b3
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,38 @@
+# AGENTS.md
+
+Instructions for AI coding agents working in this repository.
+
+## Project Overview
+
+ThruBox Client is a zero-runtime-dependency TypeScript SDK for the [ThruBox Server](https://github.com/AOSSIE-Org/ThruBox-Server), a self-hostable encrypted message relay. The SDK sends, receives, and manages encrypted messages over the relay's REST API. Works in Node.js 18+ and modern browsers.
+
+## Repository Layout
+
+- `src/` — SDK source (TypeScript)
+- `tests/` — Vitest test suite
+- `public/` — logo assets referenced by README
+- `brand/` — logo, favicons, and brand guidelines (see `brand/Brand.md`)
+
+## Build, Test & Lint
+
+```bash
+npm install
+npm run build # tsup — builds ESM + CJS with type declarations
+npm test # vitest run
+npm run test:watch # vitest watch mode
+npm run coverage # vitest run --coverage
+npm run lint # eslint src/ tests/
+npm run format # prettier --write
+npm run format:check # prettier --check
+```
+
+## Hard Constraints
+
+- **Zero runtime dependencies.** Only `devDependencies` may be added for build/test tooling — never add a runtime dependency without discussing it in an issue first. This is enforced by `.coderabbit.yaml` review rules.
+- The package must keep shipping both ESM and CJS builds with TypeScript declarations (via `tsup`) — don't introduce APIs that only work in one module format.
+- Use the native `fetch` API rather than an HTTP client library, to stay dependency-free and work in both Node and browsers.
+
+## Conventions
+
+- New functionality needs tests in `tests/` using Vitest.
+- Errors are typed (specific error classes for rate limiting, payload size, not found, etc.) — follow this pattern for new failure modes rather than throwing generic `Error`.
diff --git a/BestPracticesChecklist.md b/BestPracticesChecklist.md
index ed8ba50..66c4195 100644
--- a/BestPracticesChecklist.md
+++ b/BestPracticesChecklist.md
@@ -25,44 +25,44 @@
| Category | Met | Total | Status |
|--------------------|-----|-------|--------|
-| Basics | 0 | 8 | 🔴 |
-| Change Control | 0 | 6 | 🔴 |
-| Reporting | 0 | 8 | 🔴 |
-| Quality | 0 | 11 | 🔴 |
-| Security | 0 | 9 | 🔴 |
-| Analysis | 0 | 7 | 🔴 |
-| **Total** | **0** | **49** | **0%** |
+| Basics | 7 | 8 | 🟡 |
+| Change Control | 5 | 6 | 🟡 |
+| Reporting | 3 | 8 | 🔴 |
+| Quality | 5 | 11 | 🔴 |
+| Security | 6 | 9 | 🟡 |
+| Analysis | 3 | 7 | 🔴 |
+| **Total** | **29** | **49** | **59%** |
---
## 🏗️ Basics
### Project Website & Documentation
-- [ ] 🔴 **description_good** — The project README/website clearly describes what the software does and what problem it solves.
- - *Evidence URL:*
+- [x] 🔴 **description_good** — The project README/website clearly describes what the software does and what problem it solves.
+ - *Evidence URL:* `README.md` — "ThruBox Client SDK" intro
-- [ ] 🔴 **interact** — The project provides information on how to obtain the software, submit bug reports, and contribute.
- - *Evidence URL:*
+- [x] 🔴 **interact** — The project provides information on how to obtain the software, submit bug reports, and contribute.
+ - *Evidence URL:* `README.md` (npm install), GitHub Issues, `CONTRIBUTING.md`
-- [ ] 🔴 **contribution** — `CONTRIBUTING.md` explains the contribution process (e.g., PRs are used, how to open one).
- - *Evidence URL:*
+- [x] 🔴 **contribution** — `CONTRIBUTING.md` explains the contribution process (e.g., PRs are used, how to open one).
+ - *Evidence URL:* `CONTRIBUTING.md` "Development Workflow" / "Pull Request Guidelines"
-- [ ] 🟡 **contribution_requirements** — `CONTRIBUTING.md` references acceptable contribution standards (coding style, tests required, etc.).
- - *Evidence URL:*
+- [x] 🟡 **contribution_requirements** — `CONTRIBUTING.md` references acceptable contribution standards (coding style, tests required, etc.).
+ - *Evidence URL:* `CONTRIBUTING.md` "Code Style Guidelines" (zero-dependency rule), "Test Your Changes"
-- [ ] 🔴 **documentation_basics** — Basic documentation exists for the software (README, Wiki, or docs folder).
- - *Evidence URL:* `[ ]` N/A — *Justification:*
+- [x] 🔴 **documentation_basics** — Basic documentation exists for the software (README, Wiki, or docs folder).
+ - *Evidence URL:* `README.md`, `AGENTS.md`, `brand/Brand.md`
- [ ] 🔴 **documentation_interface** — Reference documentation describes the external interface (API inputs/outputs, CLI flags, config schema, etc.).
- - *Evidence URL:* `[ ]` N/A — *Justification:*
+ - *Evidence URL:* Not present — README has a Quick Start usage example but no generated API reference (e.g. TypeDoc).
### Other Basics
-- [ ] 🔴 **discussion** — Project has a searchable, URL-addressable discussion mechanism (GitHub Issues, Discord with archive, mailing list, etc.) that doesn't require proprietary client software.
- - *Evidence URL:*
+- [x] 🔴 **discussion** — Project has a searchable, URL-addressable discussion mechanism (GitHub Issues, Discord with archive, mailing list, etc.) that doesn't require proprietary client software.
+ - *Evidence URL:* GitHub Issues; [#thrubox Discord channel](https://discord.com/channels/995968619034984528/1525382676964446258)
-- [ ] 🟡 **english** — Documentation is provided in English and English bug reports/comments are accepted.
- - *Note:*
+- [x] 🟡 **english** — Documentation is provided in English and English bug reports/comments are accepted.
+ - *Note:* All docs and issues are in English.
---
@@ -70,27 +70,27 @@
### Version Control
-- [ ] 🔵 **repo_distributed** — Project uses a distributed VCS (e.g., git). *(SUGGESTED)*
- - *Evidence URL:*
+- [x] 🔵 **repo_distributed** — Project uses a distributed VCS (e.g., git). *(SUGGESTED)*
+ - *Evidence URL:* GitHub repo, git history
### Version Numbering
-- [ ] 🔴 **version_unique** — Each release has a unique version identifier (e.g., v1.0.0).
- - *Evidence URL:*
+- [x] 🔴 **version_unique** — Each release has a unique version identifier (e.g., v1.0.0).
+ - *Evidence URL:* Git tags `v1.0.0`, `v1.0.1`, `v1.0.2`; GitHub Releases
-- [ ] 🔵 **version_semver** — Project uses [SemVer](https://semver.org) or [CalVer](https://calver.org/) format. *(SUGGESTED)*
- - *Note:*
+- [x] 🔵 **version_semver** — Project uses [SemVer](https://semver.org) or [CalVer](https://calver.org/) format. *(SUGGESTED)*
+ - *Note:* Tags follow strict SemVer (`v1.0.0`, `v1.0.1`, `v1.0.2`).
-- [ ] 🔵 **version_tags** — Releases are tagged in the VCS (e.g., `git tag v1.0.0`). *(SUGGESTED)*
- - *Evidence URL:*
+- [x] 🔵 **version_tags** — Releases are tagged in the VCS (e.g., `git tag v1.0.0`). *(SUGGESTED)*
+ - *Evidence URL:* `git tag` output
### Release Notes
-- [ ] 🔴 **release_notes** — Each release includes human-readable release notes summarizing major changes. Raw `git log` output is NOT acceptable.
- - *Evidence URL:* `[ ]` N/A — *Justification (continuous delivery / no external reuse):*
+- [x] 🔴 **release_notes** — Each release includes human-readable release notes summarizing major changes. Raw `git log` output is NOT acceptable.
+ - *Evidence URL:* `.github/workflows/release-drafter.yml` auto-generates categorized release notes from PR titles/labels.
- [ ] 🔴 **release_notes_vulns** — Release notes identify every publicly known vulnerability (with CVE) fixed in that release.
- - *Evidence URL:* `[ ]` N/A — *Justification (no publicly known vulns / users can't self-update):*
+ - *Evidence URL:* `[~]` N/A — Justification: no publicly known/disclosed vulnerabilities to date.
---
@@ -98,31 +98,31 @@
### Bug Reporting
-- [ ] 🔴 **report_process** — A bug-reporting process exists (e.g., GitHub Issues link in README).
- - *Evidence URL:*
+- [x] 🔴 **report_process** — A bug-reporting process exists (e.g., GitHub Issues link in README).
+ - *Evidence URL:* GitHub Issues; `.github/workflows/create-initial-issues.yml`
-- [ ] 🟡 **report_tracker** — An issue tracker (e.g., GitHub Issues) is used to track individual bugs.
- - *Evidence URL:*
+- [x] 🟡 **report_tracker** — An issue tracker (e.g., GitHub Issues) is used to track individual bugs.
+ - *Evidence URL:* GitHub Issues
- [ ] 🔴 **report_responses** — A majority of bug reports submitted in the last 2–12 months have been acknowledged (response ≠ fix).
- - *Self-certification note:*
+ - *Self-certification note:* Not yet assessed — needs maintainer review of issue history.
- [ ] 🟡 **enhancement_responses** — More than 50% of enhancement requests in the last 2–12 months have received a response.
- - *Self-certification note:*
+ - *Self-certification note:* Not yet assessed.
-- [ ] 🔴 **report_archive** — Reports and responses are publicly archived and searchable (GitHub Issues satisfies this).
- - *Evidence URL:*
+- [x] 🔴 **report_archive** — Reports and responses are publicly archived and searchable (GitHub Issues satisfies this).
+ - *Evidence URL:* GitHub Issues
### Vulnerability Reporting
- [ ] 🔴 **vulnerability_report_process** — A vulnerability reporting process is documented (e.g., `SECURITY.md`).
- - *Evidence URL:*
+ - *Evidence URL:* Not present — no `SECURITY.md` in repo.
- [ ] 🟡 **vulnerability_report_private** — If private vulnerability reporting is supported, the method for private submission is documented.
- - *Evidence URL:* `[ ]` N/A — *Justification:*
+ - *Evidence URL:* `[~]` N/A — Justification: no `SECURITY.md`/private channel documented yet.
- [ ] 🔴 **vulnerability_report_response** — Initial response to any vulnerability report received in the last 6 months was within 14 days.
- - *Self-certification note:* `[ ]` N/A — *Justification (no reports received):*
+ - *Self-certification note:* `[~]` N/A — Justification: no reports received (no vulnerability reporting process exists yet).
---
@@ -130,44 +130,44 @@
### Build System
-- [ ] 🔴 **build** — If the project requires building, a working build system exists that can auto-rebuild from source.
- - *Evidence URL:* `[ ]` N/A — *Justification (interpreted language / no build step):*
+- [x] 🔴 **build** — If the project requires building, a working build system exists that can auto-rebuild from source.
+ - *Evidence URL:* `package.json` — `npm run build` (tsup, ESM+CJS+d.ts)
-- [ ] 🔵 **build_common_tools** — Common build tools are used (npm, pip, cargo, make, gradle, etc.). *(SUGGESTED)*
- - *Evidence URL:* `[ ]` N/A
+- [x] 🔵 **build_common_tools** — Common build tools are used (npm, pip, cargo, make, gradle, etc.). *(SUGGESTED)*
+ - *Evidence URL:* npm, tsup
-- [ ] 🟡 **build_floss_tools** — The project can be built using only FLOSS tools.
- - *Note:* `[ ]` N/A
+- [x] 🟡 **build_floss_tools** — The project can be built using only FLOSS tools.
+ - *Note:* npm/tsup/vitest are all FLOSS.
### Automated Testing
-- [ ] 🔵 **test_invocation** — The test suite can be invoked in a standard way for the language (e.g., `npm test`, `pytest`, `cargo test`). *(SUGGESTED)*
- - *Evidence URL:*
+- [x] 🔵 **test_invocation** — The test suite can be invoked in a standard way for the language (e.g., `npm test`, `pytest`, `cargo test`). *(SUGGESTED)*
+ - *Evidence URL:* `npm test` (Vitest); also run in `.github/workflows/version-release.yml` before publishing.
- [ ] 🔵 **test_most** — The test suite covers most code branches, input fields, and functionality. *(SUGGESTED)*
- - *Estimated coverage %:*
+ - *Estimated coverage %:* Not measured/published (a `coverage` script exists but no published threshold/report).
### New Functionality Testing Policy
- [ ] 🔴 **test_policy** — The project has a general policy that new functionality must include tests in the automated test suite.
- - *Evidence (CONTRIBUTING reference or informal policy):*
+ - *Evidence (CONTRIBUTING reference or informal policy):* Not formally documented — `CONTRIBUTING.md` describes how to run tests but doesn't mandate adding them for new functionality.
- [ ] 🔴 **tests_are_added** — Evidence exists that the test policy has been followed in recent major changes (e.g., PRs include tests).
- - *Evidence URL (recent PR with tests):*
+ - *Evidence URL (recent PR with tests):* Not yet compiled.
- [ ] 🔵 **tests_documented_added** — The test policy is documented in contribution instructions. *(SUGGESTED)*
- - *Evidence URL:*
+ - *Evidence URL:* Not documented (see `test_policy` above).
### Linting / Warning Flags
-- [ ] 🔴 **warnings** — At least one linter or compiler warning flag is enabled (ESLint, Pylint, clippy, golangci-lint, Slither for Solidity, etc.).
- - *Tool used:*
+- [x] 🔴 **warnings** — At least one linter or compiler warning flag is enabled (ESLint, Pylint, clippy, golangci-lint, Slither for Solidity, etc.).
+ - *Tool used:* ESLint (`npm run lint` → `eslint src/ tests/`)
- [ ] 🔴 **warnings_fixed** — Warnings from the linter are addressed (not suppressed without reason).
- - *Note:*
+ - *Note:* Not verified — lint isn't currently run as a required PR CI check (only referenced via `npm run lint` locally/CONTRIBUTING.md).
- [ ] 🔵 **warnings_strict** — Project uses maximum strictness in linter config where practical. *(SUGGESTED)*
- - *Note:*
+ - *Note:* Not assessed.
---
@@ -176,33 +176,33 @@
### Secure Development Knowledge
- [ ] 🔴 **know_secure_design** — At least one primary developer knows how to design secure software (familiar with OWASP, threat modeling, secure-by-default principles).
- - *Self-certification note:*
+ - *Self-certification note:* To be self-certified by a maintainer.
- [ ] 🔴 **know_common_errors** — At least one primary developer knows common vulnerability types for this software's category and how to mitigate them (e.g., injection, XSS, reentrancy for Solidity, prompt injection for AI).
- - *Self-certification note:*
+ - *Self-certification note:* To be self-certified by a maintainer.
### Cryptography (mark N/A if project does not handle cryptography)
-- [ ] 🔴 **crypto_published** — Only publicly reviewed cryptographic protocols/algorithms are used by default.
- - *Note:* `[ ]` N/A
+- [~] 🔴 **crypto_published** — Only publicly reviewed cryptographic protocols/algorithms are used by default.
+ - *Note:* N/A — This SDK transports opaque, already-encrypted payloads; it does not implement encryption/decryption itself (that's the consuming application's responsibility).
-- [ ] 🟡 **crypto_call** — Project calls an established crypto library rather than reimplementing crypto functions.
- - *Library used:* `[ ]` N/A
+- [~] 🟡 **crypto_call** — Project calls an established crypto library rather than reimplementing crypto functions.
+ - *Library used:* N/A — No cryptography implemented in this SDK.
-- [ ] 🔴 **crypto_working** — No broken algorithms (MD4, MD5, single DES, RC4, Dual_EC_DRBG) used unless required for interoperability (must be documented).
- - *Note:* `[ ]` N/A
+- [~] 🔴 **crypto_working** — No broken algorithms (MD4, MD5, single DES, RC4, Dual_EC_DRBG) used unless required for interoperability (must be documented).
+ - *Note:* N/A — No cryptography implemented in this SDK.
-- [ ] 🔴 **crypto_keylength** — Key lengths meet [NIST 2030 minimums](https://www.keylength.com/en/4/) by default.
- - *Note:* `[ ]` N/A
+- [~] 🔴 **crypto_keylength** — Key lengths meet [NIST 2030 minimums](https://www.keylength.com/en/4/) by default.
+ - *Note:* N/A — No cryptography implemented in this SDK.
-- [ ] 🔴 **crypto_password_storage** — Passwords for external users are stored as iterated salted hashes (Argon2id, bcrypt, scrypt, PBKDF2).
- - *Note:* `[ ]` N/A — *Justification (project doesn't store passwords):*
+- [~] 🔴 **crypto_password_storage** — Passwords for external users are stored as iterated salted hashes (Argon2id, bcrypt, scrypt, PBKDF2).
+ - *Note:* N/A — Justification: SDK doesn't store passwords; auth is via server-issued API keys.
-- [ ] 🔴 **crypto_random** — Cryptographic keys and nonces are generated using a CSPRNG; insecure generators (Math.random, rand()) are NOT used for security purposes.
- - *Note:* `[ ]` N/A
+- [~] 🔴 **crypto_random** — Cryptographic keys and nonces are generated using a CSPRNG; insecure generators (Math.random, rand()) are NOT used for security purposes.
+ - *Note:* N/A — SDK doesn't generate cryptographic keys/nonces; encryption happens client-side in the consuming application before calling this SDK.
- [ ] 🟡 **delivery_unsigned** — Cryptographic hashes are NOT retrieved over plain HTTP without a signature check.
- - *Note:*
+ - *Note:* Not assessed.
---
@@ -211,27 +211,27 @@
### Static Code Analysis
- [ ] 🔴 **static_analysis_fixed** — All medium+ severity vulnerabilities found by static analysis are fixed in a timely manner after confirmation.
- - *Note:* `[ ]` N/A
+ - *Note:* Not yet assessed — needs maintainer review of CodeQL alert history.
-- [ ] 🔵 **static_analysis_common_vulnerabilities** — The static analysis tool includes checks for common vulnerabilities in the language/environment (e.g., eslint-plugin-security, bandit, Slither). *(SUGGESTED)*
- - *Tool + ruleset:* `[ ]` N/A
+- [x] 🔵 **static_analysis_common_vulnerabilities** — The static analysis tool includes checks for common vulnerabilities in the language/environment (e.g., eslint-plugin-security, bandit, Slither). *(SUGGESTED)*
+ - *Tool + ruleset:* CodeQL (`.github/workflows/codeql.yml`), default security query pack.
-- [ ] 🔵 **static_analysis_often** — Static analysis runs on every commit or at least daily (CI integration). *(SUGGESTED)*
- - *Evidence URL:* `[ ]` N/A
+- [x] 🔵 **static_analysis_often** — Static analysis runs on every commit or at least daily (CI integration). *(SUGGESTED)*
+ - *Evidence URL:* `.github/workflows/codeql.yml` — runs on every push/PR to `main` plus a weekly schedule.
### Dynamic Code Analysis
- [ ] 🔵 **dynamic_analysis** — At least one dynamic analysis tool is applied before major releases (fuzzer, web app scanner like OWASP ZAP, etc.). *(SUGGESTED)*
- - *Tool used:* `[ ]` N/A — *Justification:*
+ - *Tool used:* Not currently used.
- [ ] 🔵 **dynamic_analysis_enable_assertions** — Dynamic analysis / testing runs with assertions enabled (not just production mode). *(SUGGESTED)*
- - *Note:*
+ - *Note:* Not assessed.
- [ ] 🔴 **dynamic_analysis_fixed** — Medium+ severity vulnerabilities found by dynamic analysis are fixed in a timely manner.
- - *Note:* `[ ]` N/A
+ - *Note:* Not applicable yet — no dynamic analysis tool configured.
-- [ ] 🔵 **dynamic_analysis_unsafe** — If the project uses memory-unsafe languages (C/C++), memory safety tools (Valgrind, AddressSanitizer) are used. *(SUGGESTED)*
- - *Note:* `[ ]` N/A — *Justification (project uses memory-safe languages):*
+- [~] 🔵 **dynamic_analysis_unsafe** — If the project uses memory-unsafe languages (C/C++), memory safety tools (Valgrind, AddressSanitizer) are used. *(SUGGESTED)*
+ - *Note:* N/A — Justification: project uses a memory-safe language (TypeScript).
---
@@ -239,20 +239,12 @@
> Add domain-specific notes here for Web3, Full-Stack, or AI projects.
-### Web3 / Solidity Notes
-- Scorecard does not audit Solidity-specific security. Use [Slither](https://github.com/crytic/slither) for `static_analysis` and `warnings` criteria.
-- For `crypto_*` criteria, document which cryptographic primitives your contracts rely on (e.g., ECDSA in EVM is standard).
-- Smart contract audit reports count as evidence for `know_secure_design`.
+### SDK / Library Notes
-### Full-Stack / Next.js Notes
-- For `crypto_password_storage`: document which auth library handles hashing (e.g., NextAuth + bcrypt).
-- For `dynamic_analysis`: [OWASP ZAP](https://www.zaproxy.org/) can be run as a GitHub Action.
-
-### AI / LLM Notes
-- For `know_common_errors`: include awareness of prompt injection, data leakage, and model output validation.
-- For `dynamic_analysis`: consider adversarial input testing as a form of dynamic analysis.
+- This SDK is a thin transport layer over the ThruBox Server REST API; it does not implement cryptography itself. See `crypto_*` notes above.
+- `.coderabbit.yaml` enforces a zero-runtime-dependency rule for this package — see `AGENTS.md`.
---
*This checklist complements [OpenSSF Scorecard](https://scorecard.dev/) (auto-detected checks) and is
-inspired by the [OpenSSF Best Practices Badge](https://www.bestpractices.dev/en/criteria/0) passing criteria.*
\ No newline at end of file
+inspired by the [OpenSSF Best Practices Badge](https://www.bestpractices.dev/en/criteria/0) passing criteria.*
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 8b5300b..9b2e0af 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,4 +1,4 @@
-# Contributing to TODO: Project Name
+# Contributing to ThruBox Client SDK
⭐ First off, thank you for considering contributing to this project! ⭐
@@ -9,7 +9,7 @@ We welcome contributions from everyone. By participating in this project, you ag
**All project communication MUST happen on Discord. We do not pay attention to GitHub notifications.**
- Join our [Discord server](https://discord.gg/hjUhu33uAn) before starting any work
-- Post your PR/issue updates in the relevant Discord channel (**MANDATORY**)
+- Post your PR/issue updates in the [#thrubox channel](https://discord.com/channels/995968619034984528/1525382676964446258) (**MANDATORY**)
- All discussions, questions, and updates should be on Discord
- GitHub is for code only - Discord is for communication
@@ -68,36 +68,40 @@ What we expect:
### Prerequisites
-TODO: List prerequisites specific to your project
+- Node.js 18 or later
+- npm (or yarn/pnpm)
### Setup
1. **Fork the Repository**
+
```bash
# Click the 'Fork' button at the top right of this page
```
2. **Clone Your Fork**
+
```bash
- git clone https://github.com/YOUR_USERNAME/TODO.git
- cd TODO
+ git clone https://github.com/YOUR_USERNAME/ThruBox-Client.git
+ cd ThruBox-Client
```
3. **Add Upstream Remote**
+
```bash
- git remote add upstream https://github.com/AOSSIE-Org/TODO.git
+ git remote add upstream https://github.com/AOSSIE-Org/ThruBox-Client.git
```
4. **Install Dependencies**
+
```bash
npm install
- # or yarn install
- # or pnpm install
```
-5. **Run the Project**
+5. **Build the SDK**
+
```bash
- npm run dev
+ npm run build
```
## 🔄 Development Workflow
@@ -121,12 +125,13 @@ git checkout -b fix/your-bug-fix
### 3. Test Your Changes
-TODO: Add project-specific testing instructions
+Run the test suite (Vitest), linter, and format check before opening a PR:
```bash
-npm test
-# or
-npm run lint
+npm test # run the Vitest suite
+npm run coverage # run tests with coverage
+npm run lint # ESLint
+npm run format:check # Prettier check
```
### 4. Commit Your Changes
@@ -210,7 +215,7 @@ Steps to test the changes
### After Submission
-- Post your PR in the project's Discord channel for visibility(**IMPORTANT**)
+- Post your PR in the [#thrubox channel](https://discord.com/channels/995968619034984528/1525382676964446258) for visibility(**IMPORTANT**)
- Respond to review comments promptly
- Make requested changes in new commits
- Be patient - maintainers will review when available
@@ -223,7 +228,7 @@ Steps to test the changes
## 📝 Code Style Guidelines
-TODO: Add project-specific code style guidelines
+This SDK is **zero-dependency at runtime** — only `devDependencies` may be used for build/test tooling. Do not add runtime dependencies without discussing it in an issue first. The package ships both ESM and CJS builds (via `tsup`) with TypeScript declarations, so avoid Node/browser-specific APIs that aren't available in both environments (the SDK uses the native `fetch` API).
### General Guidelines
@@ -538,4 +543,4 @@ If you encounter issues not covered here:
- Check for existing PRs before starting to avoid duplication, as there might PRs that didn't mention the related issue
-Thank you for contributing to TODO! Your efforts help make this project better for everyone. 🚀
+Thank you for contributing to ThruBox Client SDK! Your efforts help make this project better for everyone. 🚀
diff --git a/MAINTAINERS.md b/MAINTAINERS.md
new file mode 100644
index 0000000..6b287cb
--- /dev/null
+++ b/MAINTAINERS.md
@@ -0,0 +1,25 @@
+# Maintainers, Mentors and Ideators
+
+This document lists the individuals fulfilling the key roles of [Maintainer](https://github.com/AOSSIE-Org/Info/blob/main/Roles/Maintainer.md), [Mentor](https://github.com/AOSSIE-Org/Info/blob/main/Roles/Mentors.md) and [Ideator](https://github.com/AOSSIE-Org/Info/blob/main/Roles/Ideator.md) for this repository, in accordance with [AOSSIE's Role Definitions](https://github.com/AOSSIE-Org/Info/tree/main/Roles).
+
+---
+
+> **Note:** If multiple contributors are fulfilling a role in a single repository, please include and fill out the extra columns to clarify responsibilities (e.g., `Project / Feature Idea`, `Area / Focus`, and `Proposal / Discussion Link` for Ideators; `Area / Focus` for Mentors and Maintainers). If there is only one person for a role, do not add these columns.
+
+## Mentors
+
+| Name | GitHub Username | Discord Username |
+| ----- | ---------------- | ------------------ |
+| Bruno | @Zahnentferner | @b.wp |
+
+## Maintainers
+
+| Name | GitHub Username | Discord Username | Area / Focus |
+| ------- | ------------------- | ------------------ | ----------------------------------- |
+| Atharva | @Atharva0506 | @atharva0506 | Repository Maintenance & Merging |
+| Karan | @kumawatkaran523 | @karankk9616 | Repository Maintenance & Merging |
+| Aditya | @adityabhattad2021 | @adityabhattad | Repository Maintenance & Merging |
+
+## Ideators
+
+_No Ideators are currently assigned to this repository._
diff --git a/README.md b/README.md
index bf134ad..a9feb4f 100644
--- a/README.md
+++ b/README.md
@@ -115,6 +115,23 @@ await relay.delete(messages[0].id);
---
+## 🛠️ Development
+
+To build and test the SDK itself (not just consume it):
+
+```bash
+git clone https://github.com/AOSSIE-Org/ThruBox-Client.git
+cd ThruBox-Client
+npm install
+
+npm run build # build ESM + CJS output with tsup
+npm test # run the Vitest suite
+npm run coverage # run tests with coverage
+npm run lint # ESLint
+```
+
+---
+
## 📖 API Reference
### `new RelayClient(baseUrl, options?)`
diff --git a/brand/Brand.md b/brand/Brand.md
new file mode 100644
index 0000000..d1b41e4
--- /dev/null
+++ b/brand/Brand.md
@@ -0,0 +1,43 @@
+# ThruBox Brand Kit
+
+This folder is the canonical source for ThruBox's visual identity: logos, favicons/icons, and color palette. All assets referenced below live in this `brand/` folder.
+
+## Logo
+
+| Asset | File |
+| --- | --- |
+| ThruBox logo (SVG, with wordmark) | [`thrubox-logo.svg`](./thrubox-logo.svg) |
+| AOSSIE org logo (SVG) | [`aossie-logo.svg`](./aossie-logo.svg) |
+
+The ThruBox mark is a Menger-sponge-style cube made of green tessellated tiles wrapped around a padlock, representing an encrypted "box" relaying data between clients.
+
+## Favicons & Icons
+
+Generated from `thrubox-logo.svg` at the standard sizes used across browsers, bookmarks, and mobile home screens:
+
+| File | Size | Use |
+| --- | --- | --- |
+| [`favicon.ico`](./favicon.ico) | 16/32/48 (multi-res) | Classic browser favicon |
+| [`favicon-16x16.png`](./favicon-16x16.png) | 16×16 | Browser tab |
+| [`favicon-32x32.png`](./favicon-32x32.png) | 32×32 | Browser tab (HiDPI) |
+| [`favicon-48x48.png`](./favicon-48x48.png) | 48×48 | Windows taskbar |
+| [`apple-touch-icon.png`](./apple-touch-icon.png) | 180×180 | iOS home screen |
+| [`icon-512.png`](./icon-512.png) | 512×512 | PWA manifest / app icon |
+
+This package has no bundled web app (it's a Node.js/browser SDK library), so these assets aren't wired into an `index.html` — they're provided as the canonical brand exports for use in demo apps, npm listing pages, or documentation sites that consume this SDK.
+
+## Color Palette
+
+Sourced directly from `thrubox-logo.svg`:
+
+| Swatch | Name | Hex | Usage in logo |
+| --- | --- | --- | --- |
+| 🟩 | ThruBox Green (light) | `#3eb03e` | Sponge tile — top face |
+| 🟩 | ThruBox Green (mid) | `#228B22` | Sponge tile — front face, wordmark |
+| 🟩 | ThruBox Green (dark) | `#145A14` | Sponge tile — side face |
+| ⬛ | Outline | `#0f420f` | Tile stroke |
+| 🟨 | Lock Gold | `#FFC517` | Padlock accent, sourced from `thrubox-logo.svg` |
+
+## Typography
+
+This is a non-UI project (TypeScript SDK library) — there is no application typography to document. The wordmark in `thrubox-logo.svg` uses `'Arial Black', system-ui, sans-serif` at weight 900 as a logotype only.
diff --git a/brand/aossie-logo.svg b/brand/aossie-logo.svg
new file mode 100644
index 0000000..10cc0a8
--- /dev/null
+++ b/brand/aossie-logo.svg
@@ -0,0 +1,24 @@
+
+
+
+
diff --git a/brand/apple-touch-icon.png b/brand/apple-touch-icon.png
new file mode 100644
index 0000000..e505b1f
Binary files /dev/null and b/brand/apple-touch-icon.png differ
diff --git a/brand/favicon-16x16.png b/brand/favicon-16x16.png
new file mode 100644
index 0000000..56fde4a
Binary files /dev/null and b/brand/favicon-16x16.png differ
diff --git a/brand/favicon-32x32.png b/brand/favicon-32x32.png
new file mode 100644
index 0000000..9f3e350
Binary files /dev/null and b/brand/favicon-32x32.png differ
diff --git a/brand/favicon-48x48.png b/brand/favicon-48x48.png
new file mode 100644
index 0000000..ca45d57
Binary files /dev/null and b/brand/favicon-48x48.png differ
diff --git a/brand/favicon.ico b/brand/favicon.ico
new file mode 100644
index 0000000..1081ed4
Binary files /dev/null and b/brand/favicon.ico differ
diff --git a/brand/icon-512.png b/brand/icon-512.png
new file mode 100644
index 0000000..1464e7a
Binary files /dev/null and b/brand/icon-512.png differ
diff --git a/brand/thrubox-logo.svg b/brand/thrubox-logo.svg
new file mode 100644
index 0000000..089f2db
--- /dev/null
+++ b/brand/thrubox-logo.svg
@@ -0,0 +1,77 @@
+
+
diff --git a/checklist-status.json b/checklist-status.json
index eb0242b..4df2282 100644
--- a/checklist-status.json
+++ b/checklist-status.json
@@ -1,36 +1,36 @@
{
"schemaVersion": 1,
"label": "Best Practices",
- "message": "0%",
+ "message": "59%",
"schema": "aossie-best-practices-v1",
- "updated": "2026-07-11",
- "met": 0,
+ "updated": "2026-08-11",
+ "met": 29,
"total": 49,
- "percent": 0,
- "color": "red",
+ "percent": 59,
+ "color": "orange",
"categories": {
"basics": {
- "met": 0,
+ "met": 7,
"total": 8
},
"change_control": {
- "met": 0,
+ "met": 5,
"total": 6
},
"reporting": {
- "met": 0,
+ "met": 3,
"total": 8
},
"quality": {
- "met": 0,
+ "met": 5,
"total": 11
},
"security": {
- "met": 0,
+ "met": 6,
"total": 9
},
"analysis": {
- "met": 0,
+ "met": 3,
"total": 7
}
}