Contributing to spoken-token
git clone https://github.com/forgesworn/spoken-token.git
cd spoken-token
npm install
Command
Purpose
npm run build
Compile TypeScript to dist/
npm test
Run all tests (vitest)
npm run test:watch
Watch mode
npm run typecheck
Type-check without emitting
npm run lint
Run ESLint
npm run lint:fix
ESLint with auto-fix
British English — colour, initialise, behaviour
ESM-only — import/export, no CommonJS
Zero runtime dependencies — all crypto is pure JS
Commit messages use type: description format (fix:, feat:, docs:, refactor:, test:)
Tests are co-located with source files in src/ (e.g. token.ts + token.test.ts). Write a failing test first, then implement.
npm test # run once
npm run test:watch # watch mode
File
Purpose
src/token.ts
Core derivation: deriveToken, deriveDirectionalPair
src/verify.ts
Verification with tolerance window
src/encoding.ts
Output encoding (words, PIN, hex)
src/wordlist.ts
2048-word en-v1 spoken-clarity wordlist
src/counter.ts
Time-based and event-ID counter derivation
src/crypto.ts
Pure JS SHA-256, HMAC-SHA256, hex/base64 utilities
src/index.ts
Barrel re-export
Create a branch from main
Make your changes with tests
Ensure npm test, npm run typecheck, and npm run lint all pass
Submit a PR against main
Automated via semantic-release on push to main. Use conventional commit types to control version bumps:
Type
Version bump
fix:
Patch
feat:
Minor
BREAKING CHANGE: in body
Major
docs:, chore:, refactor:
None