Publish hardened SnapMeter Mini App

.env.example

@@ -7,6 +7,12 @@ HYPERSNAP_GRPC_TLS=false
 # Optional complete authorization metadata values for authenticated proxies.
 SNAPCHAIN_GRPC_AUTHORIZATION=
 HYPERSNAP_GRPC_AUTHORIZATION=
+# Optional x-api-key metadata values for hosted providers such as Neynar.
+SNAPCHAIN_GRPC_API_KEY=
+HYPERSNAP_GRPC_API_KEY=
+# Minimum delay between GetEvents request starts. Use 250ms (4 RPS) for Neynar Starter.
+SNAPCHAIN_RPC_MIN_INTERVAL_MS=0
+HYPERSNAP_RPC_MIN_INTERVAL_MS=0
 SNAPCHAIN_SOURCE_MODE=verified
 # Keep derived unless a dedicated verified Hyper-write source is implemented.
 HYPERSNAP_SOURCE_MODE=derived

.gitattributes

@@ -0,0 +1,8 @@
+* text=auto eol=lf
+
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.gif binary
+*.webp binary
+*.ico binary

.github/dependabot.yml

@@ -0,0 +1,26 @@
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5
+    versioning-strategy: increase-if-necessary
+    groups:
+      production-dependencies:
+        dependency-type: production
+      development-dependencies:
+        dependency-type: development
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:30"
+      timezone: Etc/UTC
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -12,6 +12,20 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  dependency-review:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Check out source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
+        with:
+          fail-on-severity: moderate
+
   validate:
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -34,6 +48,9 @@ jobs:
       - name: Install locked dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Publication and dependency safety
+        run: pnpm security:check
+
       - name: Install Playwright Chromium
         run: pnpm exec playwright install --with-deps chromium
 

.github/workflows/codeql.yml

@@ -0,0 +1,38 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 4 * * 2"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+concurrency:
+  group: codeql-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze JavaScript and TypeScript
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Check out source
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3
+        with:
+          languages: javascript-typescript
+          build-mode: none
+
+      - name: Analyze
+        uses: github/codeql-action/analyze@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3
+        with:
+          category: /language:javascript-typescript

.github/workflows/deploy.yml

@@ -27,6 +27,7 @@ jobs:
           node-version: 24
           cache: pnpm
       - run: pnpm install --frozen-lockfile
+      - run: pnpm security:check
       - run: pnpm exec playwright install --with-deps chromium
       - run: pnpm lint
       - run: pnpm typecheck
@@ -68,6 +69,10 @@ jobs:
         if: env.CLOUDFLARE_READY == 'true'
         run: pnpm install --frozen-lockfile
 
+      - name: Verify signed Mini App release metadata
+        if: env.CLOUDFLARE_READY == 'true'
+        run: pnpm --filter @snapmeter/dashboard verify:miniapp:release
+
       - name: Apply production D1 migrations
         if: env.CLOUDFLARE_READY == 'true'
         env:

.gitignore

@@ -9,6 +9,15 @@ coverage/
 *.db
 *.db-shm
 *.db-wal
+*.db-journal
+*.sqlite
+*.sqlite-*
+*.sqlite3
+*.sqlite3-*
+*.pem
+*.key
+*.p12
+*.pfx
 *.log
 playwright-report/
 test-results/

AGENTS.md

@@ -23,6 +23,7 @@ The workspace uses Node.js 24+, pnpm 11.19, TypeScript, Vitest, Playwright, and
 pnpm install --frozen-lockfile
 pnpm lint
 pnpm typecheck
+pnpm security:check
 pnpm test
 pnpm build
 pnpm test:e2e
@@ -31,7 +32,7 @@ pnpm collector doctor|run|status|backfill
 pnpm --filter @snapmeter/dashboard run deploy
 ```
 
-Run all five quality commands before a release. For a focused change, run the affected package test first, then the complete gates. Inspect mobile captures at 390x844 and verify no horizontal overflow, source ordering, reduced motion, offline/stale states, and real pulse behavior.
+Run all six quality commands before a release. For a focused change, run the affected package test first, then the complete gates. Inspect mobile captures at 390x844 and verify no horizontal overflow, source ordering, reduced motion, offline/stale states, and real pulse behavior.
 
 ## Non-negotiable data rules
 

CONTRIBUTING.md

@@ -0,0 +1,53 @@
+# Contributing to SnapMeter
+
+Thank you for helping improve SnapMeter. Contributions should preserve the
+project's metric integrity, privacy boundary, and reproducible build.
+
+## Before opening a change
+
+- Read `AGENTS.md`, `docs/metrics.md`, `docs/security.md`, and the document for
+  the surface you intend to change.
+- Open a public issue for behavior or design discussion, but use GitHub's
+  private vulnerability-reporting form for security findings.
+- Never attach credentials, `.env` files, databases, logs, raw node events,
+  cast contents, signatures, or production screenshots containing private
+  operator data.
+
+## Development setup
+
+Follow `docs/local-reconstruction.md`. A deterministic `?demo=1` dashboard and
+the full test suite require no production credentials or database.
+
+Create a topic branch, keep the patch focused, and add tests for behavior
+changes. Do not regenerate or replace pinned upstream protocol files without
+following the source-upgrade procedure in `docs/upstream-sources.md`.
+
+## Required checks
+
+Run these commands with Node.js 24 and pnpm 11.19.0:
+
+```text
+pnpm install --frozen-lockfile
+pnpm lint
+pnpm typecheck
+pnpm security:check
+pnpm test
+pnpm build
+pnpm test:e2e
+```
+
+Inspect responsive behavior, reduced motion, offline/stale states, and source
+quality claims when the dashboard changes. A successful page load does not
+prove that either source is live.
+
+## Pull requests and licensing
+
+Explain the problem, the integrity/security impact, the tests run, and any
+deployment or migration implications. Keep secrets and production data out of
+the PR description and CI logs.
+
+By submitting a contribution, you agree that your SnapMeter-authored
+contribution is licensed under the repository's MIT license. Do not submit
+third-party material unless redistribution is permitted and its exact source,
+license, and notice requirements are included. The vendored Snapchain
+protobufs are separately identified in `THIRD_PARTY_NOTICES.md`.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ael-dev3
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.