chore(deps): bump actions/checkout from 4 to 6

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.0.0/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.editorconfig

@@ -0,0 +1,15 @@
+root = true
+
+[*]
+end_of_line = lf
+charset = utf-8
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.rs]
+indent_size = 4
+
+[*.md]
+trim_trailing_whitespace = false

.github/CODEOWNERS

@@ -0,0 +1,4 @@
+# Default owner for everything
+* @ignromanov
+
+# Phase 3+: add @void-layer/maintainers when team formed

.github/dependabot.yml

@@ -0,0 +1,21 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    groups:
+      changesets:
+        patterns: ["@changesets/*"]
+      typescript:
+        patterns: ["typescript", "@types/*"]
+  - package-ecosystem: "cargo"
+    directory: "/packages/codec"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/ci.yml

@@ -0,0 +1,74 @@
+name: CI
+on:
+  pull_request:
+  push:
+    branches: [main]
+permissions:
+  contents: read
+jobs:
+  lint-and-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
+        with: { version: 10.24.0 }
+      - uses: actions/setup-node@v4
+        with: { node-version: 24, cache: pnpm }
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with: { rustflags: "" }
+      - uses: Swatinem/rust-cache@v2
+      - run: rustup target add wasm32-unknown-unknown
+      - name: Install wasm-pack 0.14.1
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | WASM_PACK_VERSION=v0.14.1 sh
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm -r build
+      - run: cargo build --manifest-path packages/codec/Cargo.toml --release
+      - run: cargo test --manifest-path packages/codec/Cargo.toml
+      - name: Assert size budgets
+        run: bash scripts/assert-size.sh
+        working-directory: packages/codec
+      - run: |
+          for dir in packages/codec packages/types packages/networks; do
+            (cd "$dir" && npm pack --dry-run)
+          done
+  vector-parity:
+    needs: [lint-and-build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: pnpm/action-setup@v4
+        with: { version: 10.24.0 }
+      - uses: actions/setup-node@v4
+        with: { node-version: 24, cache: pnpm }
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with: { rustflags: "" }
+      - uses: Swatinem/rust-cache@v2
+      - run: rustup target add wasm32-unknown-unknown
+      - name: Install wasm-pack 0.14.1
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | WASM_PACK_VERSION=v0.14.1 sh
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm -C packages/codec build
+      - name: TS/JS parity (vitest)
+        run: pnpm -C packages/codec exec vitest run tests/parity.test.ts
+      - name: Rust parity (cargo)
+        run: cargo test --manifest-path packages/codec/Cargo.toml --test parity
+  macos-sanity:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo test --manifest-path packages/codec/Cargo.toml
+  test-wasm-node:
+    needs: [lint-and-build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
+        with: { rustflags: "" }
+      - uses: Swatinem/rust-cache@v2
+      - run: rustup target add wasm32-unknown-unknown
+      - name: Install wasm-pack 0.14.1
+        run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | WASM_PACK_VERSION=v0.14.1 sh
+      - name: Run wasm-pack test --node (AC-9 boundary tests)
+        run: wasm-pack test --node packages/codec

.github/workflows/release.yml

@@ -0,0 +1,18 @@
+name: Release
+on:
+  push:
+    branches: [main]
+permissions:
+  id-token: write
+  contents: write
+  pull-requests: write
+jobs:
+  validate-oidc:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v4
+        with: { node-version: 24 }
+      - run: |
+          echo "Phase 1: release.yml plumbing reserved. Publish job lands Phase 3."
+          echo "OIDC token presence: $([ -n "$ACTIONS_ID_TOKEN_REQUEST_URL" ] && echo yes || echo no)"

.npmrc

@@ -0,0 +1,2 @@
+save-exact=true
+engine-strict=true

.prettierignore

@@ -0,0 +1,8 @@
+node_modules/
+dist/
+pkg/
+target/
+.changeset/
+pnpm-lock.yaml
+Cargo.lock
+*.md

.prettierrc.json

@@ -0,0 +1,10 @@
+{
+  "semi": true,
+  "singleQuote": true,
+  "trailingComma": "all",
+  "printWidth": 100,
+  "tabWidth": 2,
+  "useTabs": false,
+  "arrowParens": "always",
+  "endOfLine": "lf"
+}

CODE_OF_CONDUCT.md

@@ -0,0 +1,23 @@
+# Code of Conduct
+
+This project adopts the [Contributor Covenant version 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/) as its Code of Conduct.
+
+Please read the full text at the link above before contributing.
+
+## Reporting
+
+Report unacceptable behavior to **ign.romanov@gmail.com** with subject prefix `[code-of-conduct][@void-layer/codec]`.
+
+Reports are reviewed within 72 hours. Confidentiality is maintained for reporters.
+
+## Scope
+
+This Code of Conduct applies within all project spaces — GitHub issues, pull requests, discussions, and any official communication channels — and when an individual is officially representing the project.
+
+## Enforcement
+
+Maintainers may take any action deemed appropriate, including warning, temporary ban, or permanent ban from the project.
+
+## Attribution
+
+This document is a pointer to the [Contributor Covenant v2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/), which is licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/).

CONTRIBUTING.md

@@ -0,0 +1,49 @@
+# Contributing to @void-layer/codec
+
+## Dev Setup
+
+```bash
+# Requires Node >=24 and pnpm >=10
+pnpm install
+```
+
+## Making Changes
+
+Build all packages:
+```bash
+pnpm build
+```
+
+Run tests:
+```bash
+pnpm test
+```
+
+Run lint:
+```bash
+pnpm lint
+```
+
+## Releasing
+
+This repo uses [Changesets](https://github.com/changesets/changesets) for versioning.
+
+Add a changeset for any user-facing change:
+```bash
+pnpm changeset
+```
+
+Then commit the generated `.changeset/*.md` file with your PR.
+
+Maintainers run `pnpm version` to bump versions and `pnpm release` to publish.
+
+## Design Rationale
+
+See [spec 056](https://github.com/ignromanov/voidpay-ai/blob/master/ops/specs/056-void-layer-codec-extraction/spec.md).
+
+The decision to rewrite the codec from TypeScript to Rust+WASM is documented in:
+`voidpay-ai/agent-memory/advisors/decisions/2026-05-09-kai-cto-codec-rust-supersedes-ts-first.md`
+
+## Schema
+
+v1 schema is LOCKED. Old invoice URLs must decode forever. Never break existing field assignments.

README.md

@@ -1,25 +1,56 @@
 # @void-layer/codec
 
-Canonical Invoice codec — TLV + Brotli wire format. v1 schema LOCKED.
+Canonical Invoice codec — TLV + Brotli wire format. v1 schema LOCKED forever.
 
-[![npm version](https://img.shields.io/npm/v/@void-layer/codec)](https://www.npmjs.com/package/@void-layer/codec)
-[![CI](https://github.com/void-layer/codec/actions/workflows/ci.yml/badge.svg)](https://github.com/void-layer/codec/actions/workflows/ci.yml)
-[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![npm](https://img.shields.io/npm/v/@void-layer/codec.svg)](https://npmjs.com/package/@void-layer/codec) [![CI](https://github.com/void-layer/codec/actions/workflows/ci.yml/badge.svg)](https://github.com/void-layer/codec/actions) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 
 ## Status
 
-Phase 1 scaffolding — Rust impl coming Phase 2.
-
-See [spec 056](https://github.com/ignromanov/voidpay-ai/blob/master/ops/specs/056-void-layer-codec-extraction/spec.md) for full design rationale.
+🚧 Phase 1 scaffolding (May 2026) — Rust impl lands Phase 2
 
 ## Packages
 
-| Package | Description | Status |
-|---------|-------------|--------|
-| `@void-layer/codec` | Rust+WASM TLV encoder/decoder | Phase 1 init |
-| `@void-layer/types` | Shared TypeScript types | Phase 1 init |
-| `@void-layer/networks` | Chain configs + token list | Phase 1 init |
+| Package | Status | Description |
+|---------|--------|-------------|
+| `@void-layer/codec` | Phase 1 | Rust + WASM canonical TLV codec |
+| `@void-layer/types` | Phase 1 | Manual TypeScript types (zero runtime deps) |
+| `@void-layer/networks` | Phase 1 | EVM chain configs + token list (no RPC keys) |
+
+## Quick Install
+
+```bash
+pnpm add @void-layer/codec
+```
+
+> Not yet published — Phase 3
+
+## Why
+
+- Third-party developers building on top of VoidPay need a stable, versioned codec they can depend on
+- MCP servers, Farcaster Frames, and AI agents all depend on a common wire format — language-agnostic TLV is the right primitive
+- Version-controlled schema means consumers can pin to v1 and get backward-compat guarantees forever
+- Language-agnostic TLV encoding allows Rust, Go, Python, and JS implementations to interoperate on the same wire format
+
+## Constitution IV — Perpetual
+
+> Schema v1 LOCKED. Old URLs decode forever.
+
+## Development
+
+See [CONTRIBUTING.md](CONTRIBUTING.md)
+
+## Security
+
+See [SECURITY.md](SECURITY.md)
+
+## Architecture
+
+See [docs/architecture-overview.md](docs/architecture-overview.md)
+
+## Spec
+
+Full design: [spec 056 in voidpay-ai](https://github.com/ignromanov/voidpay-ai/blob/master/ops/specs/056-void-layer-codec-extraction/spec.md) (private — internal reference)
 
-## Contributing
+---
 
-See [CONTRIBUTING.md](CONTRIBUTING.md).
+Built by [Ignat Romanov](https://github.com/ignromanov) · MIT License

SECURITY.md

@@ -0,0 +1,41 @@
+# Security Policy
+
+## Supported Versions
+
+Latest published version on npm only (Phase 3+).
+
+| Version | Supported |
+|---------|-----------|
+| latest  | ✅        |
+| < latest | ❌       |
+
+## Reporting a Vulnerability
+
+**Preferred**: open a private advisory at https://github.com/void-layer/codec/security/advisories/new
+
+**Email fallback**: `ign.romanov@gmail.com` with subject prefix `[security][@void-layer/codec]`
+
+**Response SLA**: 72 hours initial acknowledgment.
+
+## Scope
+
+### In scope
+
+- Codec encoding/decoding correctness
+- Schema v1 backward-compatibility violations
+- BigInt boundary issues (precision loss, silent truncation)
+- WASM initialization security (race conditions, init bypass)
+- Wire format determinism (canonical hash drift)
+
+### Out of scope
+
+- VoidPay product application — see [voidpay/SECURITY.md](https://github.com/ignromanov/voidpay/blob/master/SECURITY.md)
+- RPC provider issues — those are external infrastructure
+
+## Constitution VI
+
+RPC keys are server-side only. `@void-layer/*` packages NEVER contain RPC keys or PII.
+
+## Provenance
+
+All releases from Phase 3+ ship with npm Provenance attestations via Trusted Publishing.