# Contributing

Use Node.js 22 and npm 11, install with `npm ci`, and run `npm run check` before
submitting a change. New helpers must be framework-free, deterministic unless
their name explicitly promises secure randomness, and bounded before allocating
from untrusted input. Add known vectors and malicious/boundary tests alongside
each implementation.

Do not add runtime network calls, telemetry, persistence, implicit evaluation,
or a second UI-only implementation of library logic. Preserve the stable root
exports or document a deliberate breaking change.