chore(deps-dev): bump lodash from 4.17.23 to 4.18.1

.github/dependabot.yml

@@ -0,0 +1,30 @@
+version: 2
+updates:
+  # Library dependencies
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      minor-and-patch:
+        update-types: [minor, patch]
+
+  # Example app dependencies
+  - package-ecosystem: npm
+    directory: /example
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      minor-and-patch:
+        update-types: [minor, patch]
+
+  # GitHub Actions versions (also bumps the deprecated Node-20 actions)
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ['*']

.github/pull_request_template.md

@@ -0,0 +1,16 @@
+## Summary
+
+<!-- What does this change and why? -->
+
+## Target branch
+
+- [ ] Feature/fix → targets **`develop`** (not `main`)
+- [ ] Hotfix → targets **`main`** (and will be back-merged to `develop`)
+
+## Checklist
+
+- [ ] Conventional Commit title (`feat:`, `fix:`, `perf:`, `docs:`, `chore:`, …)
+- [ ] `bun run lint-ci` and `bun run format:check` pass
+- [ ] `bun run test` passes (unit + native fuzz)
+- [ ] If `.proto`/codec changed: regenerated and verified on iOS/Android
+- [ ] Docs updated if behavior or API changed

.github/workflows/codeql.yml

@@ -0,0 +1,60 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main, develop]
+  schedule:
+    - cron: '0 6 * * 1' # weekly, Monday 06:00 UTC
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: javascript-typescript
+            build-mode: none
+          - language: c-cpp
+            build-mode: manual
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - run: npm ci
+
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+
+      # Compile the C++ codec (no protoc needed: ProtobufCodec.cpp/Base64.cpp do
+      # not depend on generated sources) so CodeQL can analyze it. Uses the same
+      # NitroModules shim as the tests so the <NitroModules/...> includes resolve.
+      - name: Build C++ codec for CodeQL
+        if: matrix.language == 'c-cpp'
+        run: |
+          NM=node_modules/react-native-nitro-modules/cpp
+          RN=node_modules/react-native/ReactCommon/jsi
+          mkdir -p .codeql-shim
+          ln -sfn "$PWD/$NM/core" .codeql-shim/NitroModules
+          clang++ -std=c++20 -c cpp/ProtobufCodec.cpp cpp/Base64.cpp \
+            -I .codeql-shim -I cpp -I cpp/nanopb -I "$NM/core" -I "$NM/utils" -I "$RN"
+
+      - uses: github/codeql-action/analyze@v3
+        with:
+          category: '/language:${{ matrix.language }}'

.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+name: Dependency Review
+
+# Flags vulnerable or disallowed-license dependencies introduced by a PR.
+# Requires the Dependency Graph (free on public repos; private repos need
+# GitHub Advanced Security). If private without GHAS, replace this with an
+# `npm audit --audit-level=high` job.
+on: pull_request
+
+permissions:
+  contents: read
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high

.github/workflows/release-please.yml

@@ -0,0 +1,24 @@
+name: release-please
+
+# Maintains a release PR (version bump in package.json + CHANGELOG.md from
+# Conventional Commits). Merging that PR creates a GitHub Release + tag, which
+# triggers release.yml to publish to npm.
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: googleapis/release-please-action@v4
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

.github/workflows/release.yml

@@ -0,0 +1,47 @@
+name: Release
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  # Run the full CI suite first; never publish a red build.
+  test:
+    uses: ./.github/workflows/test.yml
+
+  publish:
+    needs: test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: https://registry.npmjs.org
+          cache: npm
+
+      - run: npm ci
+
+      - name: Verify tag matches package.json version
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          PKG=$(node -p "require('./package.json').version")
+          TAG="${GITHUB_REF_NAME#v}"
+          if [ "$PKG" != "$TAG" ]; then
+            echo "::error::Tag v$TAG does not match package.json version $PKG"
+            exit 1
+          fi
+          echo "Publishing v$PKG"
+
+      # `prepublishOnly` builds lib/ via tsc before packing.
+      - name: Publish to npm
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/test.yml

@@ -0,0 +1,64 @@
+name: CI
+
+on:
+  push:
+    branches: [main, develop, 'feature/**', 'release/**', 'hotfix/**']
+  pull_request:
+    branches: [develop, main]
+  workflow_call: # reused by release.yml as a publish gate
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - run: npm ci
+      - name: Lint
+        run: npm run lint-ci
+      - name: Format check
+        run: npm run format:check
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Build (tsc)
+        run: npm run build
+
+      # Toolchain for the native ASan/UBSan fuzz + round-trip tests. They invoke
+      # the generator with explicit --protoc / --nanopb and compile under clang;
+      # without these on PATH the native tests self-skip. nanopb is pinned to the
+      # vendored runtime version (cpp/nanopb).
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install protoc, nanopb generator, and clang
+        run: |
+          python -m pip install --quiet "nanopb==0.4.9.1"
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends protobuf-compiler clang
+          protoc --version
+          protoc-gen-nanopb --version || true
+          clang++ --version
+
+      - name: Test (unit + native ASan/UBSan fuzz)
+        run: npm test

.gitignore

@@ -80,6 +80,8 @@ lib/
 # Nitro Protobuf generated files
 generated/*.pb.h
 generated/*.pb.c
+generated/nitro-protobuf.ts
+generated/.nanopb-options/
 
 # caches
 .eslintcache

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.0.0"
+}