Hardening and completeness pass, released as 1.0.0

.gitattributes

@@ -0,0 +1,18 @@
+* text=auto eol=lf
+
+# Keep development-only material out of the distributed package.
+/.github            export-ignore
+/.githooks          export-ignore
+/scripts            export-ignore
+/tests              export-ignore
+/workbench          export-ignore
+/.gitattributes     export-ignore
+/.gitignore         export-ignore
+/phpstan.neon.dist  export-ignore
+/phpunit.xml.dist   export-ignore
+/pint.json          export-ignore
+/testbench.yaml     export-ignore
+
+# Diff/linguist hints
+*.php               diff=php
+/tests/**           linguist-vendored

.githooks/commit-msg

@@ -0,0 +1,64 @@
+#!/bin/bash
+#
+# Enforce single-line commit messages with no attribution trailers.
+#
+# Repository reporting and per-developer exposure coverage are derived from git
+# history. Co-author trailers split authorship across two identities and skew
+# those reports; multi-line bodies are noise the parser has to strip. The "why"
+# belongs in the PR description, the CHANGELOG, or a comment at the code site,
+# where it stays readable.
+#
+# Installed by `composer setup-hooks`, which points core.hooksPath at .githooks.
+
+MSG_FILE="$1"
+SOURCE="$2"
+
+# Merges, squashes and reverts generate bodies git wrote itself.
+case "$SOURCE" in
+    merge|squash) exit 0 ;;
+esac
+
+# Strip comments and trailing blank lines; that is what git will actually store.
+BODY="$(grep -v '^#' "$MSG_FILE" | sed -e :a -e '/^\s*$/{$d;N;ba' -e '}')"
+
+if [[ -z "${BODY//[[:space:]]/}" ]]; then
+    # An empty message aborts the commit anyway; let git say so.
+    exit 0
+fi
+
+FIRST_LINE="$(printf '%s\n' "$BODY" | head -n 1)"
+
+case "$FIRST_LINE" in
+    Revert\ \"*) exit 0 ;;
+esac
+
+fail() {
+    echo ""
+    echo "🚫 Commit rejected: $1"
+    echo ""
+    echo "   Commit messages must be a single line, with no body and no trailers."
+    echo "   Put the reasoning in the PR description, the CHANGELOG, or a code comment."
+    echo ""
+    echo "   Got:"
+    printf '%s\n' "$BODY" | sed 's/^/     | /'
+    echo ""
+    exit 1
+}
+
+if printf '%s\n' "$BODY" | grep -qiE '^[[:space:]]*(co-authored-by|claude-session|signed-off-by[[:space:]]*:[[:space:]]*claude)'; then
+    fail "attribution trailers break authorship reporting."
+fi
+
+if printf '%s\n' "$BODY" | grep -qiE 'claude\.ai/code/session'; then
+    fail "session links do not belong in git history."
+fi
+
+if [[ "$(printf '%s\n' "$BODY" | wc -l | tr -d ' ')" -gt 1 ]]; then
+    fail "the message has more than one line."
+fi
+
+if [[ ${#FIRST_LINE} -gt 72 ]]; then
+    fail "the subject is ${#FIRST_LINE} characters; keep it to 72."
+fi
+
+exit 0

.github/dependabot.yml

@@ -9,4 +9,10 @@ updates:
     schedule:
       interval: "weekly"
     labels:
-      - "dependencies"
+      - "dependencies"
+  - package-ecosystem: "composer"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"

.github/workflows/php-tests.yml

@@ -10,19 +10,18 @@ jobs:
   test:
     runs-on: ${{ matrix.os }}
     strategy:
-      fail-fast: true
+      # One unusable matrix leg should not cancel the other nine.
+      fail-fast: false
       matrix:
         os: [ubuntu-latest]
-        php: [8.3, 8.4]
-        laravel: [11.*, 12.*]
+        php: ['8.3', '8.4', '8.5']
+        laravel: [12.*, 13.*]
         stability: [prefer-lowest, prefer-stable]
         include:
-          - laravel: 11.*
-            testbench: ^9.9
-            carbon: ^2.63
           - laravel: 12.*
             testbench: 10.*
-            carbon: ^2.63|^3.0
+          - laravel: 13.*
+            testbench: 11.*
 
     name: P${{ matrix.php }} - L${{ matrix.laravel }} - ${{ matrix.stability }} - ${{ matrix.os }}
 
@@ -42,13 +41,40 @@ jobs:
           echo "::add-matcher::${{ runner.tool_cache }}/php.json"
           echo "::add-matcher::${{ runner.tool_cache }}/phpunit.json"
 
+      # Carbon is not pinned here: the package only reaches it through
+      # Laravel's helpers, so whatever the framework resolves is the version
+      # worth testing against.
       - name: Install dependencies
         run: |
-          composer require "laravel/framework:${{ matrix.laravel }}" "orchestra/testbench:${{ matrix.testbench }}" "nesbot/carbon:${{ matrix.carbon }}" --no-interaction --no-update
+          composer require "laravel/framework:${{ matrix.laravel }}" "orchestra/testbench:${{ matrix.testbench }}" --no-interaction --no-update
           composer update --${{ matrix.stability }} --prefer-dist --no-interaction
 
       - name: List Installed Dependencies
         run: composer show -D
 
       - name: Execute tests
-        run: vendor/bin/pest --ci --bail --compact --memory --coverage
+        run: vendor/bin/pest --ci --compact --memory --coverage --min=100
+
+  performance:
+    name: performance guards
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.4'
+          extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, intl, fileinfo
+          # Explicitly no coverage: instrumentation dominates the clock and
+          # flattens the difference between a fast and a slow implementation,
+          # so these assertions skip themselves when a driver is active.
+          coverage: none
+
+      - name: Install composer dependencies
+        uses: ramsey/composer-install@v3
+
+      - name: Run performance guards
+        run: vendor/bin/pest --testsuite=Performance --ci

.github/workflows/security.yml

@@ -0,0 +1,61 @@
+name: Security
+
+# SAST and dependency advisories, on a schedule as well as on push so an
+# advisory published while nobody is committing is still caught.
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '30 5 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  semgrep:
+    name: Semgrep SAST
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    container:
+      image: semgrep/semgrep
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      # The package's own rule samples and test fixtures are credential-shaped
+      # by design; the Stripe sample is Stripe's public documentation key.
+      # That rule is excluded rather than the files, so every other secret
+      # rule still runs over them.
+      - name: Semgrep scan
+        run: >
+          semgrep scan
+          --config p/php
+          --config p/secrets
+          --exclude-rule generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key
+          --error
+          --text
+
+  audit:
+    name: Dependency advisories
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.4'
+          tools: composer:v2
+          coverage: none
+
+      - name: Install dependencies
+        run: composer install --no-interaction --prefer-dist --no-progress
+
+      - name: Composer audit
+        run: composer audit

.github/workflows/static-analysis.yml

@@ -4,9 +4,17 @@ on:
   push:
     paths:
       - '**.php'
-      - 'composer.lock'
+      - 'composer.json'
       - 'phpstan.neon.dist'
-      - '.github/workflows/phpstan.yml'
+      - 'rector.php'
+      - '.github/workflows/static-analysis.yml'
+  pull_request:
+    paths:
+      - '**.php'
+      - 'composer.json'
+      - 'phpstan.neon.dist'
+      - 'rector.php'
+      - '.github/workflows/static-analysis.yml'
 
 jobs:
   phpstan:
@@ -19,12 +27,15 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.4'
+          php-version: '8.5'
           extensions: dom, curl, libxml, mbstring, zip, pcntl, pdo, sqlite, pdo_sqlite, bcmath, soap, intl, gd, exif, iconv, imagick, fileinfo, swoole, openssl
           coverage: none
 
       - name: Install composer dependencies
         uses: ramsey/composer-install@v3
 
+      - name: Run Rector (dry run)
+        run: ./vendor/bin/rector process --dry-run --no-progress-bar
+
       - name: Run PHPStan
-        run: ./vendor/bin/phpstan --error-format=github
+        run: ./vendor/bin/phpstan analyse --error-format=github --no-progress --memory-limit=1G

.github/workflows/style-check.yml

@@ -2,6 +2,7 @@ name: Code Style
 
 on:
   workflow_dispatch:
+  pull_request:
   push:
     branches-ignore:
       - 'dependabot/npm_and_yarn/*'
@@ -14,14 +15,11 @@ jobs:
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
         with:
-          php-version: 8.3
+          php-version: '8.5'
 
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Copy .env
-        run: php -r "file_exists('.env') || copy('.env.example', '.env');"
-
       - name: Install Dependencies
         run: composer install -q --no-ansi --no-interaction --no-scripts --no-progress --prefer-dist
 

.gitignore

@@ -2,6 +2,8 @@ vendor
 composer.lock
 node_modules
 build
+.phpunit.cache
+infection.log
 .pint.cache
 .idea
 .DS_Store

.semgrepignore

@@ -0,0 +1,7 @@
+# Dependencies and generated output; findings there belong upstream.
+vendor/
+node_modules/
+.phpunit.cache/
+
+# Test fixtures hold deliberately fake credentials the scanner must find.
+tests/Feature/fixtures/