Implement shared validators for params/state/auth

.cargo/config.toml

@@ -4,3 +4,8 @@
 # together. Disabling reference-types prevents LLVM from emitting the
 # extended call_indirect encoding.
 rustflags = ["-C", "target-feature=-reference-types"]
+
+[build]
+# Default build target for WASM contract compilation.
+# Override per-invocation with --target if needed (e.g. for host-native tests).
+target = "wasm32-unknown-unknown"

.clippy.toml

@@ -0,0 +1,15 @@
+# Clippy configuration for the Soroban Cookbook workspace.
+# Applied automatically when `cargo clippy` is run.
+# CI enforces these alongside the -D warnings flag in .github/workflows/ci.yml.
+
+# Maximum cyclomatic complexity allowed per function before clippy warns.
+# Clippy default: 25. Tighten this value over time as the codebase matures.
+cognitive-complexity-threshold = 25
+
+# Warn when a public function takes more than this many arguments.
+# Clippy default: 7. Prefer grouping related parameters into a struct.
+too-many-arguments-threshold = 7
+
+# Warn when a function body exceeds this many lines.
+# Clippy default: 100.
+too-many-lines-threshold = 100

.github/CODE_OF_CONDUCT.md

@@ -0,0 +1,131 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in the
+Soroban Cookbook community a harassment-free experience for everyone, regardless
+of age, body size, visible or invisible disability, ethnicity, sex
+characteristics, gender identity and expression, level of experience, education,
+socio-economic status, nationality, personal appearance, race, caste, color,
+religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall
+  community
+- Helping newcomers feel welcome and supported
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Reporting
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement by opening a
+**[GitHub issue](https://github.com/Soroban-Cookbook/Soroban-Cookbook-/issues)**
+or by emailing the maintainers at
+**[maintainers@sorobancookbook.dev](mailto:maintainers@sorobancookbook.dev)**.
+
+All complaints will be reviewed and investigated promptly and fairly. All
+community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of
+actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or permanent
+ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior, harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the
+community.
+
+## Attribution
+
+This Code of Conduct is adapted from the
+[Contributor Covenant](https://www.contributor-covenant.org/), version 2.1,
+available at
+[https://www.contributor-covenant.org/version/2/1/code_of_conduct.html](https://www.contributor-covenant.org/version/2/1/code_of_conduct.html).
+
+Community Impact Guidelines were inspired by
+[Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity).
+
+For answers to common questions about this code of conduct, see the FAQ at
+[https://www.contributor-covenant.org/faq](https://www.contributor-covenant.org/faq).
+Translations are available at
+[https://www.contributor-covenant.org/translations](https://www.contributor-covenant.org/translations).

.github/ISSUE_TEMPLATE/bug_report.md

@@ -8,29 +8,35 @@ assignees: ''
 ---
 
 ## Description
-A clear and concise description of what the bug is.
+
+<!-- Describe what is broken and where it happens. -->
 
 ## Steps to Reproduce
-Please provide steps to reproduce the behavior:
-1. 
-2. 
-3. 
+
+<!-- Provide clear steps so maintainers can reproduce the issue reliably. -->
+1.
+2.
+3.
 
 ## Expected Behavior
-A clear and concise description of what you expected to happen.
+
+<!-- Describe what you expected to happen instead. -->
 
 ## Actual Behavior
-A clear and concise description of what actually happened.
+
+<!-- Describe what happened, including any errors or unexpected output. -->
 
 ## Environment Information
-- **OS:** [e.g. Windows 11, macOS 14.0, Ubuntu 22.04]
-- **Rust Version:** [e.g. 1.75.0]
-- **Soroban SDK Version:** [e.g. 21.7.0]
-- **Stellar CLI Version:** [e.g. 22.1.0]
-- **Network:** [e.g. Testnet, Mainnet, Sandbox]
+
+- **OS:** <!-- e.g. Windows 11, macOS 14.0, Ubuntu 22.04 -->
+- **Rust Version:** <!-- e.g. 1.75.0 -->
+- **Soroban SDK Version:** <!-- e.g. 21.7.0 -->
+- **Stellar CLI Version:** <!-- e.g. 22.1.0 -->
+- **Network:** <!-- e.g. Testnet, Mainnet, Sandbox -->
 
 ## Additional Context
-Add any other context about the problem here (e.g., logs, screenshots, or code snippets).
+
+<!-- Add any other context (screenshots, links, related issues, etc.). -->
 
 ### Logs
 ```bash

.github/ISSUE_TEMPLATE/feature_request.md

@@ -10,13 +10,13 @@ assignees: ''
 ## Use Case
 
 <!-- Describe the use case or problem this feature addresses.
-     Who needs this? What are they trying to accomplish? -->
+     Who needs this, and what are they trying to accomplish? -->
 
 ## Proposed Solution
 
 <!-- Describe the feature you'd like to see implemented.
-     Be as specific as possible — include file paths, function names,
-     or code snippets if applicable. -->
+     Be as specific as possible and include file paths, function names,
+     or code snippets when applicable. -->
 
 ```rust
 // Optional: sketch of the proposed implementation
@@ -25,7 +25,7 @@ assignees: ''
 ## Alternative Solutions
 
 <!-- Have you considered other approaches?
-     List any alternatives and explain why the proposed solution is preferred. -->
+     List alternatives and explain why the proposed solution is preferred. -->
 
 ## Additional Context
 

.github/workflows/README.md

@@ -12,10 +12,15 @@ Runs on every pull request and push to the main branch.
 Runs all unit and integration tests across the examples and shared tooling.
 - **Tasks:** Executes `cargo test` for all packages in the workspace.
 
-### [Deploy Docs](./deploy-docs.md)
+### [Deploy Docs](./deploy-docs.yml)
 Automatically builds and deploys the mdBook documentation to GitHub Pages.
 - **Tasks:** Builds the book from `book/src/` and pushes the output to the `gh-pages` branch.
 
+### [Security Audit](./security-audit.yml)
+Audits all workspace dependencies for known vulnerabilities using `cargo audit`.
+- **Triggers:** Push/PR to `main` when `Cargo.toml` or `Cargo.lock` changes, weekly on Mondays at 08:00 UTC, and manual dispatch.
+- **Tasks:** Runs `cargo audit --deny warnings --deny unsound` against the RustSec Advisory Database. Fails the job on any HIGH or CRITICAL severity advisory. Uploads a full JSON audit report as a workflow artifact (retained for 30 days).
+
 ### [Dependabot](./dependabot-auto-merge.yml)
 Automates dependency updates and auto-merges safe PRs.
 - **Tasks:** Keeps Rust and Node.js dependencies up-to-date.

.github/workflows/ci.yml

@@ -87,7 +87,50 @@ jobs:
         run: cargo test --workspace --all-features
 
   # ─────────────────────────────────────────────────────────────────────────
-  # Job 4: Basic examples (fast, per-example feedback)
+  # Job 4: Coverage
+  # ─────────────────────────────────────────────────────────────────────────
+  coverage:
+    name: Coverage (Tarpaulin)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: ${{ env.RUST_VERSION }}
+          targets: wasm32-unknown-unknown
+
+      - name: Cache Cargo registry
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-coverage-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: ${{ runner.os }}-cargo-coverage-
+
+      - name: Install cargo-tarpaulin
+        run: cargo install cargo-tarpaulin --locked
+
+      - name: Generate coverage report
+        run: cargo tarpaulin --workspace --all-features --out xml --output-dir ./coverage --timeout 300
+
+      - name: Upload coverage artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: cobertura-xml
+          path: ./coverage/cobertura.xml
+
+      - name: Upload coverage to Codecov (optional)
+        uses: codecov/codecov-action@v4
+        with:
+          files: ./coverage/cobertura.xml
+          fail_ci_if_error: false
+
+  # ─────────────────────────────────────────────────────────────────────────
+  # Job 5: Basic examples (fast, per-example feedback)
   # ─────────────────────────────────────────────────────────────────────────
   basic-examples:
     name: Basic Examples CI
@@ -144,6 +187,8 @@ jobs:
 
   # ─────────────────────────────────────────────────────────────────────────
   # Job 5: Coverage (tarpaulin)
+  # Configured via tarpaulin.toml at the workspace root.
+  # Reports are uploaded to Codecov for historical tracking and badge display.
   # ─────────────────────────────────────────────────────────────────────────
   coverage:
     name: Code Coverage
@@ -156,27 +201,52 @@ jobs:
         with:
           toolchain: ${{ env.RUST_VERSION }}
 
-      - name: Cache Cargo registry
+      # Cache the Cargo registry AND the compiled tarpaulin binary together
+      # so repeated runs don't rebuild tarpaulin from source every time.
+      - name: Cache Cargo registry and tarpaulin binary
         uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
+            ~/.cargo/bin/cargo-tarpaulin
+            ~/.cargo/.crates.toml
+            ~/.cargo/.crates2.json
             target
           key: ${{ runner.os }}-cargo-coverage-${{ hashFiles('**/Cargo.lock') }}
           restore-keys: ${{ runner.os }}-cargo-coverage-
 
       - name: Install cargo-tarpaulin
-        run: cargo install cargo-tarpaulin --locked
+        run: |
+          if ! command -v cargo-tarpaulin &> /dev/null; then
+            cargo install cargo-tarpaulin --locked
+          fi
 
+      # tarpaulin.toml controls output format (xml + html + lcov),
+      # output directory (coverage/), timeout, and exclusions.
       - name: Run tarpaulin
-        run: cargo tarpaulin --workspace --all-features --out xml --timeout 300
+        run: cargo tarpaulin
+
+      # Keep the full coverage report as a downloadable artifact for
+      # historical review — retained for 90 days.
+      - name: Upload coverage artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: coverage/
+          retention-days: 90
 
-      - name: Upload coverage report
+      # Upload Cobertura XML to Codecov for badge + historical trend graphs.
+      # CODECOV_TOKEN is required for private repos; harmless for public ones.
+      - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v4
         with:
-          files: ./cobertura.xml
+          files: ./coverage/cobertura.xml
+          flags: workspace
+          name: soroban-cookbook
           fail_ci_if_error: false
+          token: ${{ secrets.CODECOV_TOKEN }}
 
   # ─────────────────────────────────────────────────────────────────────────
   # Job 6: Build Wasm