[Adeolu01]

Summary

#92 Unused dependency check

• Added scripts/check-unused-deps.sh, a wrapper around cargo-machete, plus --self-test, which proves the check passes on a clean crate and fails on a crate with an unused dependency.
• Added the Unused Dependencies workflow. It runs weekly (Mondays 07:00 UTC), on manual dispatch, and on pushes and pull requests that touch Rust code or manifests. cargo-machete is pinned to 0.7.0 and the actions are pinned.
• Added make unused-deps and make unused-deps-selftest, and documented both in CONTRIBUTING.md.
• Audited every workspace manifest against its sources. No unused dependency was found, so no manifest changed.

#90 Commitlint

• Added commitlint.config.cjs with the seven types documented in CONTRIBUTING.md and a scope list. Subjects are limited to 72 characters, and an empty subject or trailing full stop is rejected.
• Added the Commitlint workflow, which lints every commit in a pull request (base..head). It skips Dependabot.
• Documented the allowed scopes, the ! breaking-change marker and make commitlint in CONTRIBUTING.md.

#89 Pre-commit hooks

• Added .pre-commit-config.yaml with two hooks: cargo fmt --all -- --check when a .rs file is staged, and eslint on staged sdk/src/*.ts files through scripts/pre-commit-eslint.sh.
• Added make hooks and documented the install steps in CONTRIBUTING.md.
• Added sdk/eslint.config.mjs and the eslint devDependencies. The SDK lint script existed but eslint was never installed or configured, and --ext was dropped from the script because it does not apply to flat config. SDK CI now runs npm run lint.

#85 Line endings

• Added .gitattributes forcing LF for *.sh, *.rs, *.ts and *.md, plus *.cjs, *.mjs, *.js, *.json, *.toml, *.yml, *.yaml and Makefile. text=auto is the fallback, and binary files are left alone.
• Marked Cargo.lock and both npm lockfiles linguist-generated.
• The tree needed no re-normalization: git ls-files --eol already shows no i/crlf or i/mixed. git add --renormalize . is documented for older forks.

Tests

Added under sdk/tests/tooling/, in the existing vitest suite:

• gitattributes: attribute checks, plus CRLF input in a scratch repo to confirm LF in the index. A control case without .gitattributes shows the same input stays CRLF.
• commitlint: accepted and rejected messages through the real CLI, and a check that CONTRIBUTING.md and the config list the same types and scopes.
• pre-commit: hook definitions, and the eslint wrapper run against clean and bad files.
• unused-deps: a manifest-versus-source scan of all workspace members, with fixtures for the failure modes, and checks that the version and action pins agree. The cargo-machete self-test runs only when the tool is installed.

No existing test fixture was changed.

Notes

• Behaviour: contract behaviour and SDK public APIs are unchanged. CI gains the commitlint and unused-deps workflows and an SDK Lint step.
• Dependencies: sdk/package.json gains devDependencies eslint, @eslint/js, typescript-eslint and @commitlint/cli, and the lockfile is updated. None ship in the published package.
• Scopes: the scope list adds common, benchmark and readme to the eight documented ones. History uses them, and CONTRIBUTING.md's own docs(readme) example needs readme. Scopes remain optional.
• Assumption: the eslint hook covers sdk/src only, matching npm run lint. TypeScript formatting is not enforced, as there is no prettier in the repo, so "bad formatting is rejected" applies to Rust through cargo fmt.
• Risk: the new SDK Lint step could surface existing eslint findings the first time it runs. The no-unused-vars rule ignores names starting with _.
• Risk: the commitlint check only blocks merging once it is marked as a required status check in branch protection.
• Risk: cargo-machete is regex-based. If it reports a false positive, the documented escape hatch is [package.metadata.cargo-machete] ignored.

closes #92
closes #90
closes #89
closes #85

[OrderStream]

Solid DX and tooling enhancement across the repository:

• Line normalization: Excellent inclusion of .gitattributes enforcing LF across shell, Rust, and TS files to eliminate cross-platform CRLF churn on Windows/Linux environments.
• CI robustness: Pinning cargo-machete (v0.7.0) and action hashes prevents unexpected upstream breakages during scheduled dependency audits.
• Modern ESLint: Updating sdk/eslint.config.mjs to flat config cleanly removes deprecated --ext CLI flags while preserving type linting.
• Recommendation: For commitlint, ensure branch protection also validates PR titles if merge strategy is squash-and-merge.

Clean implementation and comprehensive test coverage.