Skip to content

CONTRIBUTING.md

Latest commit

 

History

History
69 lines (55 loc) · 2.83 KB

CONTRIBUTING.md

File metadata and controls

69 lines (55 loc) · 2.83 KB
Raw

Contributing

Thanks for taking the time to contribute! The facevault Node.js SDK is the primary integration path for server-side KYC verification — it runs inside customer backends — so we ask for a bit of rigour to keep it stable and safe.

Repo layout

  • src/ — TypeScript source files (client.ts, webhook.ts, models.ts, errors.ts, index.ts).
  • dist/ — build output (ESM + CJS). Gitignored — do not commit it. Generated by npm run build via tsup.
  • tests/ — Vitest unit tests.
  • tsup.config.ts — dual-format build configuration.
  • vitest.config.ts — test runner configuration.
  • README.md — integration guide and API reference.

Local development

npm ci              # install exact dependencies from package-lock.json
npm run build       # compile src/ → dist/ (ESM + CJS)
npm test            # run the Vitest suite once
npm run test:watch  # watch mode for interactive development

The CI matrix runs on Node 18, 20, and 22. Test locally on Node 18 or later before opening a PR.

Pull requests

  • One topic per PR.
  • Keep the public API stable. FaceVaultClient, createSession, getSession, verifySignature, parseEvent, and the exported error classes are a contract — renaming or removing them is a breaking change. Additive changes (new optional parameters, new fields on response models) are much easier to accept.
  • Update CHANGELOG.md under ## [Unreleased] for any user-facing change. Don't bump the version — cutting a release (moving [Unreleased] to a tag) is a maintainer step.
  • Don't commit dist/. The release workflow builds it from source; a committed dist diverging from src causes confusion and review noise.
  • The release workflow publishes the matching CHANGELOG.md section verbatim as the GitHub release body. Keep a blank line after each ### heading and between bullets, and never wrap the section in a code fence.
  • Adhere to Semantic Versioning. Bug fixes are patch; new backwards-compatible features are minor; breaking changes are major.

Code style

  • TypeScript, strict mode. Match the existing style: single quotes, semicolons, 2-space indent.
  • Comments explain why, not what.
  • New public-facing types go in models.ts; new error classes in errors.ts; HTTP logic in client.ts; webhook helpers in webhook.ts.
  • Keep runtime dependencies at zero. The SDK uses only native fetch (Node 18+) and node:crypto; every runtime dependency added increases the attack surface and the install footprint for all integrators.

Reporting a security issue

See SECURITY.md. Please do not open public issues for security-relevant bugs.

License

By contributing you agree your contribution will be licensed under the MIT License — the same as the rest of the project.