4.0.2

.editorconfig

@@ -0,0 +1,22 @@
+# https://editorconfig.org
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{kt,kts,java,swift,cs,dart}]
+indent_size = 4
+
+[*.{gradle,xml}]
+indent_size = 4
+
+[Makefile]
+indent_style = tab

.github/workflows/ci.yml

@@ -31,49 +31,52 @@ jobs:
     name: JS/TS packages
     runs-on: [self-hosted]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '20'
       - run: npm ci --ignore-scripts
+      - run: npm run versions:check
       - run: npm run build
       - run: npm run lint
       - run: npm test
+      - run: npm run typecheck --workspace=@screeb/react-native
 
   flutter:
     name: Flutter package
     runs-on: [self-hosted]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           java-version: '17'
           distribution: 'temurin'
-      - uses: android-actions/setup-android@v3
+      - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
         with:
           packages: tools platform-tools build-tools;35.0.0 platforms;android-35
-      - uses: subosito/flutter-action@v2
+      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
         with:
           flutter-version: '3.x'
           channel: 'stable'
       - name: Trust Flutter SDK checkout
         run: git config --global --add safe.directory "$FLUTTER_ROOT"
       - run: cd packages/sdk-flutter && flutter pub get
       - run: cd packages/sdk-flutter && flutter analyze
+      - run: cd packages/sdk-flutter && flutter test
 
   maui-android:
     name: .NET MAUI Android SDK
     runs-on: [self-hosted]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           java-version: '17'
           distribution: 'temurin'
-      - uses: android-actions/setup-android@v3
+      - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
         with:
           packages: tools platform-tools build-tools;35.0.0 platforms;android-35
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: '9.0.x'
       - name: Install MAUI workloads
@@ -90,8 +93,8 @@ jobs:
     runs-on: macos-latest
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.run_macos_native }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: '9.0.x'
       - name: Install MAUI workloads
@@ -113,7 +116,7 @@ jobs:
     name: Kotlin Multiplatform Android SDK
     runs-on: [self-hosted]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Check native Android artifact
         id: native-android
         run: |
@@ -126,12 +129,12 @@ jobs:
             echo "::warning::app.screeb.sdk:survey:${version} is not published yet; skipping KMP Android build."
             echo "available=false" >> "$GITHUB_OUTPUT"
           fi
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         if: steps.native-android.outputs.available == 'true'
         with:
           java-version: '17'
           distribution: 'temurin'
-      - uses: android-actions/setup-android@v3
+      - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3
         if: steps.native-android.outputs.available == 'true'
         with:
           packages: tools platform-tools build-tools;35.0.0 platforms;android-35
@@ -147,8 +150,8 @@ jobs:
     runs-on: macos-latest
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.run_macos_native }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-java@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           java-version: '17'
           distribution: 'temurin'

.github/workflows/publish-angular.yml

@@ -12,12 +12,11 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
-      - run: npm install -g npm@latest
-      - run: npm install --ignore-scripts
+      - run: npm ci --ignore-scripts
       - run: npm run build
       - run: npm publish --workspace=packages/sdk-angular --access public --provenance

.github/workflows/publish-browser.yml

@@ -12,12 +12,11 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
-      - run: npm install -g npm@latest
-      - run: npm install --ignore-scripts
+      - run: npm ci --ignore-scripts
       - run: npm run build
       - run: npm publish --workspace=packages/sdk-browser --access public --provenance

.github/workflows/publish-flutter.yml

@@ -9,8 +9,8 @@ jobs:
   publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: subosito/flutter-action@v2
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
         with:
           flutter-version: '3.x'
           channel: 'stable'

.github/workflows/publish-kmp.yml

@@ -9,26 +9,28 @@ jobs:
   publish:
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '20'
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
         with:
           java-version: '17'
           distribution: 'temurin'
 
       - run: npm run versions:check
 
       - name: Download Screeb iOS XCFramework
+        env:
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           SCREEB_IOS_SDK_VERSION=$(grep '^SCREEB_IOS_SDK_VERSION=' packages/sdk-kmp/gradle.properties | cut -d= -f2)
-          SCREEB_IOS_URL=$(curl -sL "https://api.github.com/repos/ScreebApp/sdk-ios-public/releases/tags/v${SCREEB_IOS_SDK_VERSION}" \
-            | python3 -c "import sys,json; print(next(a['browser_download_url'] for a in json.load(sys.stdin)['assets'] if a['name']=='Screeb.zip'))")
-          curl -sL "$SCREEB_IOS_URL" -o /tmp/Screeb.zip
+          # Authenticated download (anonymous api.github.com calls are rate-limited
+          # on shared runners and come back without 'assets').
+          gh release download "${SCREEB_IOS_SDK_VERSION}" --repo ScreebApp/sdk-ios-public --pattern 'Screeb.zip' --output /tmp/Screeb.zip --clobber
           unzip -q /tmp/Screeb.zip -d /tmp/screeb_ios
           mkdir -p packages/sdk-kmp/native/ios
           cp -r /tmp/screeb_ios/Screeb.xcframework packages/sdk-kmp/native/ios/
@@ -45,4 +47,4 @@ jobs:
           GPG_KEY_ID: ${{ secrets.GPG_KEY_ID }}
           GPG_KEY: ${{ secrets.GPG_KEY }}
           GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
-        run: ./gradlew publishAllPublicationsToOSSRHRepository --no-daemon
+        run: ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository --no-daemon

.github/workflows/publish-maui.yml

@@ -11,21 +11,34 @@ jobs:
     permissions:
       id-token: write # enable GitHub OIDC token issuance for NuGet Trusted Publishing
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
           dotnet-version: '9.0.x'
 
+      # macos-latest also preinstalls .NET 10; without a global.json `dotnet`
+      # resolves to the newest SDK, whose workload set no longer matches the
+      # net9.0 targets (NETSDK1147 asking for maui-android).
+      - name: Pin the .NET 9 SDK
+        run: |
+          set -euo pipefail
+          DOTNET9=$(dotnet --list-sdks | awk '/^9\./{v=$1} END{print v}')
+          test -n "$DOTNET9"
+          printf '{"sdk":{"version":"%s","rollForward":"latestFeature"}}\n' "$DOTNET9" > global.json
+          dotnet --version
+
       - name: Install MAUI workloads
-        run: dotnet workload install android ios
+        run: dotnet workload install maui-android maui-ios
 
       - name: Download Screeb iOS XCFramework
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
+          set -euo pipefail
+          SCREEB_IOS_SDK_VERSION=$(node -p "require('./sdk-versions.json').native.ios")
           mkdir -p packages/sdk-maui/native/ios
-          gh release download --repo ScreebApp/sdk-ios-public --pattern 'Screeb.zip' --output /tmp/Screeb.zip --clobber
+          gh release download "${SCREEB_IOS_SDK_VERSION}" --repo ScreebApp/sdk-ios-public --pattern 'Screeb.zip' --output /tmp/Screeb.zip --clobber
           unzip -q /tmp/Screeb.zip -d /tmp/screeb_ios
           cp -r /tmp/screeb_ios/Screeb.xcframework packages/sdk-maui/native/ios/
 
@@ -43,7 +56,7 @@ jobs:
 
       - name: NuGet login (OIDC -> temporary API key)
         id: login
-        uses: NuGet/login@v1
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1
         with:
           user: alexays
 

.github/workflows/publish-react.yml

@@ -12,12 +12,11 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
-      - run: npm install -g npm@latest
-      - run: npm install --ignore-scripts
+      - run: npm ci --ignore-scripts
       - run: npm run build
       - run: npm publish --workspace=packages/sdk-react --access public --provenance

.github/workflows/publish-reactnative.yml

@@ -12,12 +12,13 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
+      # npm Trusted Publishing (tokenless OIDC) needs npm >= 11.5 — node 22 ships 10.x
       - run: npm install -g npm@latest
-      - run: npm install --ignore-scripts
+      - run: npm ci --ignore-scripts
       - run: npm run build
       - run: npm publish --workspace=packages/sdk-reactnative --access public --provenance

.github/workflows/publish-svelte.yml

@@ -0,0 +1,22 @@
+name: Publish @screeb/sdk-svelte
+
+on:
+  push:
+    tags:
+      - '@screeb/sdk-svelte@*'
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+      - run: npm ci --ignore-scripts
+      - run: npm run build
+      - run: npm publish --workspace=packages/sdk-svelte --access public --provenance

.github/workflows/publish-vue.yml

@@ -12,12 +12,11 @@ jobs:
       id-token: write
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
           registry-url: 'https://registry.npmjs.org'
-      - run: npm install -g npm@latest
-      - run: npm install --ignore-scripts
+      - run: npm ci --ignore-scripts
       - run: npm run build
       - run: npm publish --workspace=packages/sdk-vue --access public --provenance

.gitignore

@@ -13,6 +13,12 @@ build
 dist
 storybook-static
 
+# Android native build output (NDK/CMake), e.g. RN prefab under example-*/android/app/.cxx
+.cxx/
+
+# generated API reference (typedoc) — regenerate with `npm run build:doc`
+packages/*/docs/
+
 # misc
 .DS_Store
 .env.local
@@ -43,3 +49,12 @@ packages/sdk-maui/bin/
 packages/sdk-maui/obj/
 examples/example-maui/bin/
 examples/example-maui/obj/
+
+# build-local-ios-xcframework.mjs temp workdirs (cleaned by the script; belt and braces)
+packages/*/native/ios/.build-*/
+
+# CocoaPods install output (regenerated by `pod install`)
+examples/example-reactnative/ios/Pods/
+
+# React Native local env (per-machine node path, written by pod install)
+.xcode.env.local

.husky/pre-commit

@@ -2,4 +2,3 @@
 . "$(dirname -- "$0")/_/husky.sh"
 
 npm run lint
-npm run build:doc && git add -A packages/*/docs

.nvmrc

@@ -0,0 +1 @@
+20

commitlint.config.js

@@ -14,12 +14,22 @@ module.exports = {
             "example-angular",
             "sdk-vue",
             "example-vue",
+            "sdk-svelte",
+            "example-svelte",
             "sdk-maui",
             "example-maui",
             "sdk-flutter",
             "example-flutter",
+            "sdk-kmp",
+            "example-kmp",
             "sdk-react-native",
-            "example-react-native"
+            "sdk-reactnative",
+            "example-react-native",
+            "example-reactnative",
+            "example-android",
+            "example-ios",
+            "example-ionic",
+            "example-expo"
         ]],
         "scope-empty": [2, "never"],
         "scope-min-length": [2, "always", 1],

examples/example-android/app/build.gradle

@@ -38,5 +38,5 @@ android {
 }
 
 dependencies {
-    implementation 'app.screeb.sdk:survey:4.0.0'
+    implementation 'app.screeb.sdk:survey:4.0.2'
 }