chore(repo): add community health files, security policy and code scanning

.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# Review is requested automatically from these accounts.
+* @mariano-aguero @Ghadi8
+
+# The oracles and the published gas figures are what the library exists for,
+# so a change to either always gets a second pair of eyes.
+/src/gas.ts @mariano-aguero
+/test/fixtures/ @mariano-aguero

.github/ISSUE_TEMPLATE/01-divergence.yml

@@ -0,0 +1,80 @@
+name: Divergence from ethrex
+description: This library and the reference client disagree about bytes, a hash, a price or a receipt.
+title: 'divergence: '
+labels: [divergence]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This is the report the project most wants. A second implementation exists to disagree usefully, so a confirmed disagreement is a result, not a nuisance.
+
+        If the disagreement is in signing or hashing and could let someone produce a transaction that a signer did not intend, stop and file a private advisory instead.
+  - type: dropdown
+    id: subject
+    attributes:
+      label: What disagrees
+      options:
+        - Encoded bytes or transaction hash
+        - Sig-hash or recovered signer
+        - Gas, intrinsic or a limit-derived term
+        - maxCost
+        - Receipt decoding, including frame status
+        - Something else
+    validations:
+      required: true
+  - type: input
+    id: evidence
+    attributes:
+      label: Transaction hash or raw bytes
+      description: A hash on hegota-testnet, or the hex the two implementations were fed. Without one of these the report cannot be reproduced.
+      placeholder: '0x…'
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What ethrex produces
+      description: The value, and where it came from. A node response, a published figure, or a path and line in the ethrex repository on its `hegota-testnet` branch.
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: What frametx-kit produces
+      description: The value, plus the call that produced it.
+      render: text
+    validations:
+      required: true
+  - type: input
+    id: ethrex-version
+    attributes:
+      label: ethrex version
+      description: The commit the node reports, or the endpoint you queried. The gas rule sets are pinned per binary, so this decides which of them applies.
+      placeholder: 31b532266, or rpc1.privacy.ethrex.xyz
+    validations:
+      required: true
+  - type: dropdown
+    id: ruleset
+    attributes:
+      label: Rule set
+      description: Which rule set you priced under, if this is a gas report.
+      options:
+        - chain
+        - pins
+        - head
+        - Not a gas report
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: frametx-kit version
+      placeholder: 0.1.1
+    validations:
+      required: true
+  - type: input
+    id: genesis
+    attributes:
+      label: Genesis hash
+      description: The chain has already been re-genesised twice, and fixtures record the genesis they were captured against. Leave blank if you do not have it.
+      placeholder: '0x…'

.github/ISSUE_TEMPLATE/02-bug.yml

@@ -0,0 +1,69 @@
+name: Bug report
+description: The library behaves differently from its documentation, throws where it should not, or fails to type-check.
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        If the disagreement is with the ethrex node rather than with this library's own documentation, use the divergence report instead.
+
+        If it lets someone produce a transaction a signer did not intend, file a private advisory instead.
+  - type: textarea
+    id: what
+    attributes:
+      label: What happened
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: What you expected
+      description: Point at the README, `docs/DESIGN.md` or `CONTRIBUTING.md` line if one of them promises the other behaviour.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Reproduction
+      description: The smallest snippet that shows it. A transaction hash or a hex blob is worth more than a description.
+      render: ts
+    validations:
+      required: true
+  - type: textarea
+    id: output
+    attributes:
+      label: Error or output
+      render: text
+  - type: input
+    id: version
+    attributes:
+      label: frametx-kit version
+      placeholder: 0.1.1
+    validations:
+      required: true
+  - type: input
+    id: viem
+    attributes:
+      label: viem version
+      description: viem is a peer dependency, and a duplicated copy of it is a common cause of type errors around `client.extend`.
+      placeholder: 2.21.0
+    validations:
+      required: true
+  - type: input
+    id: runtime
+    attributes:
+      label: Runtime and package manager
+      placeholder: bun 1.3.2, or node 22.8 with pnpm 10.16
+    validations:
+      required: true
+  - type: dropdown
+    id: entry
+    attributes:
+      label: Which entry point
+      options:
+        - '@jaw.id/frametx-kit'
+        - '@jaw.id/frametx-kit/viem'
+        - Both
+        - Not relevant
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/03-feature.yml

@@ -0,0 +1,45 @@
+name: Feature or coverage request
+description: Something the wire format does that this library cannot do yet.
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Check `docs/OPEN-ITEMS.md` first. Known gaps are already recorded there, and a comment on the matching item is more useful than a new issue.
+  - type: textarea
+    id: need
+    attributes:
+      label: What you are trying to do
+      description: The task, not the API. A concrete transaction you cannot build or survey is the strongest case.
+    validations:
+      required: true
+  - type: textarea
+    id: shape
+    attributes:
+      label: The API you have in mind
+      description: Optional, and a sketch is fine.
+      render: ts
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      options:
+        - envelope
+        - sighash
+        - signatures
+        - gas
+        - divergence
+        - rlp
+        - rpc
+        - viem
+        - fixtures
+        - docs
+    validations:
+      required: true
+  - type: textarea
+    id: spec
+    attributes:
+      label: Where the behaviour is specified
+      description: The EIP section, the ethrex path on its `hegota-testnet` branch, or the node response that defines what correct means. Anything added here needs an oracle that is not the code's own output.
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/JustaName-id/frametx-kit/security/advisories/new
+    about: Signature layout, sig-hash, encoder or gas-accounting flaws go through a private advisory, not a public issue. See SECURITY.md.
+  - name: A bug in the ethrex node itself
+    url: https://github.com/lambdaclass/ethrex/issues
+    about: If the reference client is the side that is wrong, it belongs upstream. Open a divergence report here too so we record it.
+  - name: How do I use this
+    url: https://github.com/JustaName-id/frametx-kit#readme
+    about: The README covers the API and the two behaviours that surprise people most. CONTRIBUTING.md covers the wire-format traps.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,50 @@
+## What this changes
+
+<!-- One or two sentences. The PR title carries the conventional-commit prefix; this is the prose version. -->
+
+## Why
+
+<!-- The reasoning goes here, not in a code comment. If this fixes an issue, link it: Closes #N -->
+
+## How the new behaviour is pinned
+
+Which oracle covers this change, and why it could actually fail:
+
+- [ ] A published figure, transcribed rather than derived
+- [ ] The golden byte vector or sig-hash from ethrex's `frame_tx_wire_tests.rs`
+- [ ] Re-encoding captured chain data and reproducing the transaction hash
+- [ ] A live receipt (recovered signer, `maxCost`, or the `gasUsed` decomposition)
+- [ ] N/A, this change has no wire-format or gas behaviour
+
+<!-- A test that asserts the code's own output against itself does not count. See CONTRIBUTING.md, "Verification". -->
+
+## Load-bearing rules
+
+Did this touch anything under "Rules that are not style preferences" in `CONTRIBUTING.md`, such as a derived gas constant, a golden vector, a captured fixture, the module import order, or `encodeFrameTx` validating?
+
+- [ ] No
+- [ ] Yes, and the argument for it is below
+
+## Checks
+
+Only tick what you ran.
+
+- [ ] `bun run test`
+- [ ] `bun run typecheck`
+- [ ] `bun run build && bunx @arethetypeswrong/cli --pack .` (required if `exports`, `files`, `typesVersions` or `tsup.config.ts` changed; otherwise N/A)
+- [ ] `bun run test:live` (optional, hits the public endpoint, not a gate)
+
+## Release impact
+
+The commit history sets the version, so say which this is:
+
+- [ ] No release (`docs`, `chore`, `test`, `ci`, `refactor`, `style`, `perf`, `build`)
+- [ ] Patch (`fix`)
+- [ ] Minor (`feat`)
+- [ ] Major (`feat!` or a `BREAKING CHANGE:` footer)
+
+A wire-format or gas change is almost always at least a `fix:`, because someone downstream is encoding bytes with this.
+
+## AI assistance
+
+- [ ] This change was written or reviewed with an assistant, and I have read every line of it

.github/dependabot.yml

@@ -0,0 +1,26 @@
+version: 2
+updates:
+  - package-ecosystem: bun
+    directory: /
+    schedule:
+      interval: weekly
+    # Matches the seven day minimum release age in bunfig.toml. Without this,
+    # Dependabot proposes versions that a local `bun install` refuses to resolve.
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+    groups:
+      dev-dependencies:
+        dependency-type: development
+        update-types: [minor, patch]
+    commit-message:
+      prefix: 'chore(deps)'
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: 'ci(deps)'

.github/workflows/codeql.yml

@@ -0,0 +1,30 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Monday morning, so a newly published query catches this code without a push.
+    - cron: '0 6 * * 1'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        with:
+          languages: javascript-typescript
+          queries: security-extended
+
+      - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0

.github/workflows/pr-title.yml

@@ -11,7 +11,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/scorecard.yml

@@ -0,0 +1,40 @@
+name: Scorecard
+
+on:
+  branch_protection_rule:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '30 6 * * 1'
+
+permissions: read-all
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      # Signs the results so the public badge and the API can serve them.
+      id-token: write
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 5
+
+      - uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        with:
+          sarif_file: results.sarif