Docs/dependency review standards

CONTRIBUTING.md

@@ -102,7 +102,7 @@ examples/       Runnable usage examples
 - Run `npm run lint` before pushing — this type-checks the full source tree.
 - Match the naming and file conventions already present in `src/`.
 - Keep functions focused and add JSDoc comments for any exported API.
-- Do not introduce new runtime dependencies without discussion in the issue first.
+- Do not introduce new dependencies without following the [Dependency Review Standards](./docs/dependency-review.md) and discussing in the issue first.
 
 ---
 

README.md

@@ -69,6 +69,7 @@ npm install @axionvera/pocketpay-sdk
 - [Release Checklist](./docs/release-checklist.md) - Pre-release verification steps for maintainers
 - [Architecture Decision Records](./docs/adr/) - Records of significant SDK design decisions and their rationale
 - [Support Policy](./docs/support-policy.md) - Supported runtimes, versions, network status, and maintenance expectations
+- [Dependency Review Standards](./docs/dependency-review.md) - Guidelines for evaluating, adding, and updating SDK dependencies
 - [Changelog](./CHANGELOG.md) - Track changes across SDK versions
 
 ## Package Root Imports

docs/dependency-review.md

@@ -67,4 +67,4 @@ Before merging any dependency change, confirm that:
 - No new high or critical security advisories are introduced.
 - The dependency license is compatible with MIT.
 
-See also [Security Best Practices](./security.md) and the [Contributing Guide](../CONTRIBUTING.md).
+See also [Security Best Practices](./security.md) and the [Contributing Guide](../CONTRIBUTING.md).