ci: add npm audit check to CI to catch new vulnerabilities

.changeset/config.json

@@ -0,0 +1,14 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@2.3.0/schema.json",
+  "changelog": [
+    "@changesets/changelog-github",
+    {
+      "repo": "spiffamani/stellar-hooks"
+    }
+  ],
+  "commit": false,
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.changeset/new-hooks.md

@@ -0,0 +1,5 @@
+---
+"stellar-hooks": minor
+---
+
+feat: implement useCreateAccount() and useAssets() hooks

.changeset/use-effects-hook.md

@@ -0,0 +1,5 @@
+---
+"stellar-hooks": minor
+---
+
+Add `useEffects()` hook to fetch and stream account effects from Horizon via SSE.

.changeset/use-payment-stellar-toml.md

@@ -0,0 +1,5 @@
+---
+"stellar-hooks": minor
+---
+
+feat: add usePayment() and useStellarToml() hooks with full test coverage

.eslintrc.cjs

@@ -1,8 +1,12 @@
 module.exports = {
   root: true,
   parser: "@typescript-eslint/parser",
-  plugins: ["@typescript-eslint"],
-  extends: ["eslint:recommended", "plugin:@typescript-eslint/recommended"],
+  plugins: ["@typescript-eslint", "react-hooks"],
+  extends: [
+    "eslint:recommended",
+    "plugin:@typescript-eslint/recommended",
+    "plugin:react-hooks/recommended",
+  ],
   env: {
     browser: true,
     es2022: true,
@@ -11,4 +15,20 @@ module.exports = {
     ecmaVersion: "latest",
     sourceType: "module",
   },
+  overrides: [
+    {
+      files: [
+        "**/__tests__/**",
+        "**/__mocks__/**",
+        "**/*.test.ts",
+        "**/*.test.tsx",
+        "**/*.test-d.ts",
+      ],
+      rules: {
+        "@typescript-eslint/no-explicit-any": "off",
+        "@typescript-eslint/no-unused-vars": "off",
+        "react-hooks/rules-of-hooks": "off",
+      },
+    },
+  ],
 };

.github/CODEOWNERS

@@ -0,0 +1,11 @@
+# CODEOWNERS — auto-assigns reviewers when pull requests are opened.
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+#
+# Format: <path-pattern>  @<github-username-or-team>
+#
+# Entries are ordered from least specific to most specific.
+# Later entries override earlier ones for the same path.
+
+# ===== Default ownership =====
+# Repository owner is the default reviewer for all paths
+*  @Amas-01

.github/dependabot.yml

@@ -0,0 +1,39 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    versioning-strategy: increase
+    groups:
+      stellar:
+        patterns:
+          - '@stellar/*'
+      react:
+        patterns:
+          - react
+          - react-dom
+          - '@types/react'
+          - '@types/react-dom'
+      testing:
+        patterns:
+          - 'vitest'
+          - '@testing-library/*'
+          - 'jsdom'
+          - 'react-test-renderer'
+          - '@types/react-test-renderer'
+      typescript-eslint:
+        patterns:
+          - '@typescript-eslint/*'
+      changesets:
+        patterns:
+          - '@changesets/*'
+      semantic-release:
+        patterns:
+          - semantic-release
+          - '@semantic-release/*'
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/pull_request_template.md

@@ -0,0 +1,17 @@
+# Pull Request
+
+## Summary
+- Added stricter typing for Soroban contract call arguments in `ContractCallOptions`.
+- `args` now accepts `xdr.ScVal[]` instead of `unknown[]`.
+- `parseResult` now receives `xdr.ScVal` instead of `any`.
+
+## Files Changed
+- `src/types/index.ts`
+
+## Testing
+- Run `npm run typecheck`
+- Run `npm test`
+
+## Notes
+- The hook implementation still supports runtime conversion of plain JS values via `nativeToScVal`.
+- This change improves compile-time type safety for contract call arguments and result parsing.

.github/workflows/ci.yml

@@ -1,19 +1,91 @@
 name: CI
 
+permissions:
+  pull-requests: write
+
 on:
   push:
+    branches: ["**"]
   pull_request:
 
 jobs:
-  checks:
+  lint:
+    name: Lint & Type-check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
         with:
           node-version: 20
           cache: npm
-      - run: npm ci
-      - run: npm run typecheck
-      - run: npm run lint
-      - run: npm test
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Lint
+        run: npm run lint
+
+      - name: Type-check
+        run: npm run typecheck
+
+  audit:
+    name: Security audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Audit dependencies
+        run: npm audit --audit-level=high
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm test
+
+  build:
+    name: Build & bundle size
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Bundle size report
+        uses: andresz1/size-limit-action@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/docs.yml

@@ -0,0 +1,56 @@
+name: Deploy Docs
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Setup Pages
+        uses: actions/configure-pages@v4
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build docs
+        run: npm run docs:build
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: docs/.vitepress/dist
+
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    needs: build
+    runs-on: ubuntu-latest
+    name: Deploy
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/release.yml

@@ -0,0 +1,39 @@
+name: Release
+
+on:
+  workflow_run:
+    workflows: ["CI"]
+    branches: [main]
+    types: [completed]
+
+jobs:
+  release:
+    # Only run when CI passed on main
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Semantic Release
+        run: npx semantic-release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/stale.yml

@@ -0,0 +1,24 @@
+name: Stale Issue Bot
+
+on:
+  schedule:
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Auto-close stale issues
+        uses: actions/stale@v9
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          days-before-issue-stale: 60
+          days-before-issue-close: 0
+          days-before-pr-stale: -1
+          stale-issue-label: stale
+          close-issue-message: "Closing this issue due to prolonged inactivity."

.gitignore

@@ -1,7 +1,11 @@
+node_modules
 node_modules/
 dist/
 .env
 .env.local
 *.tsbuildinfo
 .DS_Store
 coverage/
+AGENTS.md
+docs/.vitepress/dist
+docs/.vitepress/cache

.husky/pre-commit

@@ -0,0 +1,2 @@
+npx lint-staged
+npm run typecheck

.prettierignore

@@ -0,0 +1,5 @@
+dist
+node_modules
+coverage
+*.md
+package-lock.json

.prettierrc

@@ -0,0 +1,11 @@
+{
+  "semi": true,
+  "singleQuote": false,
+  "trailingComma": "all",
+  "printWidth": 80,
+  "tabWidth": 2,
+  "useTabs": false,
+  "bracketSpacing": true,
+  "arrowParens": "always",
+  "endOfLine": "lf"
+}