Add health audit and harden docs CI

.editorconfig

@@ -0,0 +1,13 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+
+[*.md]
+max_line_length = off
+trim_trailing_whitespace = false

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default owners for all files
+* @hellopaywaz

.github/workflows/docs-ci.yml

@@ -4,16 +4,24 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
-      - name: Generate API docs
-        run: |
-          npx redoc-cli build openapi/openapi.yaml \
-            --output docs/api/reference.html
-
-      - name: Deploy Docs
-        run: echo "Deploy step here (Pages / Cloudflare / etc)"
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
+      - name: Build static docs
+        run: npm run build
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: paywaz-docs-dist
+          path: dist

.github/workflows/node-ci.yml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     runs-on: ubuntu-latest
@@ -24,25 +27,13 @@ jobs:
         run: npm ci
 
       - name: Lint
-        run: |
-          if npm run | grep -q "lint"; then
-            npm run lint
-          else
-            echo "No lint script – skipping"
-          fi
+        run: npm run lint
+
+      - name: Typecheck
+        run: npm run typecheck
 
       - name: Test
-        run: |
-          if npm run | grep -q "test"; then
-            npm test
-          else
-            echo "No test script – skipping"
-          fi
+        run: npm test
 
       - name: Build
-        run: |
-          if npm run | grep -q "build"; then
-            npm run build
-          else
-            echo "No build script – skipping"
-          fi
+        run: npm run build

.gitignore

@@ -0,0 +1,9 @@
+node_modules
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+.DS_Store
+.dist
+/dist
+.env*

CONTRIBUTING.md

@@ -1,7 +1,7 @@
 # Contributing to Paywaz
 
-First off — thank you for your interest in contributing to Paywaz!  
-Our ecosystem powers **zero-fee payments**, **stablecoin infrastructure**, and **developer-first APIs/SDKs**.  
+First off — thank you for your interest in contributing to Paywaz!
+Our ecosystem powers **zero-fee payments**, **stablecoin infrastructure**, and **developer-first APIs/SDKs**.
 We welcome improvements, bug fixes, documentation updates, and new sample integrations.
 
 This document explains how to contribute and what we expect from contributors.
@@ -10,11 +10,11 @@ This document explains how to contribute and what we expect from contributors.
 
 ## Ways You Can Contribute
 
-- Report bugs or issues  
-- Suggest features or improvements  
-- Submit pull requests for fixes or enhancements  
-- Improve documentation  
-- Add sample integrations or SDK upgrades  
+- Report bugs or issues
+- Suggest features or improvements
+- Submit pull requests for fixes or enhancements
+- Improve documentation
+- Add sample integrations or SDK upgrades
 - Improve developer experience (DX), tooling, or testing
 
 ---
@@ -23,47 +23,47 @@ This document explains how to contribute and what we expect from contributors.
 
 We maintain several public repos:
 
-- `paywaz-public-api` — API schemas, references, and public interface definitions  
-- `paywaz-sdk-js` — JavaScript/TypeScript SDK  
-- `paywaz-docs` — developer documentation and guides  
-- `paywaz-samples` — integration samples  
-- `paywaz-license` — licensing information  
+- `paywaz-public-api` — API schemas, references, and public interface definitions
+- `paywaz-sdk-js` — JavaScript/TypeScript SDK
+- `paywaz-docs` — developer documentation and guides
+- `paywaz-samples` — integration samples
+- `paywaz-license` — licensing information
 
 Each repo may have repo-specific instructions in its README.
 
 ---
 
 ## Development Workflow
 
-### 1. Fork the repo  
+### 1. Fork the repo
 Click **Fork** in the top-right corner of the GitHub repo.
 
-### 2. Create a feature branch  
+### 2. Create a feature branch
 
 git checkout -b feature/your-feature-name
 
-### 3. Make your changes  
+### 3. Make your changes
 Please follow:
-- existing code style  
-- naming conventions  
-- project folder structure  
+- existing code style
+- naming conventions
+- project folder structure
 - TypeScript / JS linting rules (if applicable)
 
-### 4. Write tests (if applicable)  
+### 4. Write tests (if applicable)
 PRs without tests may not be accepted for core SDK repos.
 
-### 5. Commit with clear messages  
+### 5. Commit with clear messages
 
 git commit -m "feat: add X"
 git commit -m "fix: correct Y"
 git commit -m "docs: improve Z"
 
-### 6. Submit your Pull Request  
+### 6. Submit your Pull Request
 Ensure your PR includes:
-- A clear explanation of the change  
-- Linked issue numbers  
-- Steps to reproduce or test  
-- Any screenshots if UI or docs-related  
+- A clear explanation of the change
+- Linked issue numbers
+- Steps to reproduce or test
+- Any screenshots if UI or docs-related
 
 The Paywaz team will review your PR and may request revisions.
 
@@ -72,33 +72,33 @@ The Paywaz team will review your PR and may request revisions.
 ## Testing & Quality
 
 SDK repos require:
-- Unit tests  
-- Linting  
-- Type definitions  
+- Unit tests
+- Linting
+- Type definitions
 
 Docs repos require:
-- No broken links  
-- Accurate descriptions  
-- Proper formatting and structure  
+- No broken links
+- Accurate descriptions
+- Proper formatting and structure
 
 Samples repos require:
-- Clear README per sample  
-- Minimal dependencies  
+- Clear README per sample
+- Minimal dependencies
 - Secure handling of API keys
 
 ---
 
 ## Licensing Agreement
 
-By submitting a pull request, you agree that your contributions fall under the **Paywaz License** contained in:  
+By submitting a pull request, you agree that your contributions fall under the **Paywaz License** contained in:
 https://github.com/hellopaywaz/paywaz-license
 
 ---
 
 ## Questions? Need help?
 
-Open a discussion or issue, or reach out at:  
+Open a discussion or issue, or reach out at:
 **hello@paywaz.com**
 
-Thank you again for contributing to the Paywaz ecosystem!  
+Thank you again for contributing to the Paywaz ecosystem!
 Your improvements help power the next generation of zero-fee global payments.

HEALTH.md

@@ -0,0 +1,49 @@
+# Repository Health Audit
+
+**Overall score:** 68/100 — Static documentation hub with minimal build/test coverage now wired into CI. Core hygiene files exist, but automated security/release/deploy practices are light.
+
+**Subscores**
+- CI/Build Reproducibility (25): 20 — Node 20 pinned; lint/test/build scripted; CI caches npm and runs on push/PR. No scheduled runs or matrix coverage.
+- Tests/Quality Gates (20): 12 — Smoke test validates landing page and links; lint covers whitespace/title checks. No deeper content validation or regression tests.
+- Security Baseline (20): 13 — SECURITY.md present and CI permissions narrowed to read; proprietary license documented. Missing secret/dependency scanning and SBOM generation.
+- Release/Packaging (15): 9 — Build script produces static `dist/`, but no automated publish/release cadence or changelog/tagging.
+- Documentation/Onboarding (10): 8 — README now documents golden commands and local serving; CONTRIBUTING and CODE_OF_CONDUCT present.
+- Ops/Runbooks/Observability (10): 6 — Static site only; no deploy/runbook, monitoring, or uptime checks noted.
+
+## P0 blockers
+- None identified after adding build/test scripts, CI coverage, and baseline governance files.
+
+## P1 risks
+- No automated dependency or secret scanning (e.g., Dependabot, secret scanning, npm audit) to catch supply-chain issues early.
+- Docs build relies on external OpenAPI URL without availability guardrails; no caching or checksum verification.
+- No automated deployment pipeline or changelog/versioning for published docs.
+- Typechecking is a placeholder; no schema/HTML validation beyond the smoke test.
+
+## P2 hygiene
+- Add link/HTML validation and accessibility checks to improve doc quality.
+- Add scheduled CI runs to surface drift and external link rot.
+- Consider a static site generator or templating to simplify future expansion and theming.
+- Expand `.gitignore`/tooling as new build artifacts emerge (e.g., screenshots, coverage reports).
+
+## CI status
+- **Node CI** (`.github/workflows/node-ci.yml`): runs on push/PR to `main`; installs dependencies with npm, then runs lint → typecheck (placeholder) → test (smoke) → build.
+- **Build Docs** (`.github/workflows/docs-ci.yml`): runs on push to `main`; installs dependencies, builds `dist/`, and uploads the artifact for distribution.
+
+## Security baseline
+- SECURITY.md defines reporting channel (`security@paywaz.com`).
+- Permissions tightened to `contents: read` for workflows. No secret context required.
+- No dependency scanning, secret scanning, or SBOM generation is enabled yet.
+
+## Release readiness
+- Proprietary license documented in `LICENSE` (mirrors `paywaz-license`).
+- No tagged releases, changelog, or automated publishing of the `dist/` artifact; builds are manual.
+- Package is marked `private` with Node 20+ engine declaration to avoid accidental publication.
+
+## Ops readiness
+- Static docs served via `npm run start`/`npm run preview`; no runtime services or health endpoints.
+- No deployment runbook or monitoring for hosted docs; add if/when a hosting target is configured.
+
+## Repo hygiene
+- Baseline governance files present: README, LICENSE, CODEOWNERS, CONTRIBUTING, CODE_OF_CONDUCT, SECURITY, HEALTH.
+- `.editorconfig` and `.gitignore` added for consistent formatting and artifact hygiene.
+- Golden commands documented in README and enforced in CI.

LICENSE

@@ -0,0 +1,109 @@
+Paywaz Proprietary License Agreement
+Version 1.0 — © 2025 Paywaz.com LLC
+
+IMPORTANT: This software, documentation, or file set (the “Software”) is the
+intellectual property of Paywaz.com LLC (“Paywaz”). By accessing, downloading,
+copying, or using the Software, you agree to the terms of this License.
+
+If you do not agree, you must immediately cease all use of the Software.
+
+---
+
+1. GRANT OF LIMITED RIGHT
+
+Paywaz grants you a limited, revocable, non-exclusive, non-transferable,
+non-sublicensable license to:
+
+(a) View the Software for informational, evaluation, or integration-planning  
+purposes;  
+(b) Use the Software solely for non-commercial internal evaluation;  
+(c) Reference the Software to assess compatibility with your own systems.
+
+No other rights are granted.
+
+---
+
+2. RESTRICTIONS
+
+Except where explicitly permitted in writing by Paywaz, you MAY NOT:
+
+(a) Copy, modify, distribute, publish, or create derivative works of the Software;  
+(b) Use the Software for any commercial activity, paid service, production
+environment, or merchant processing;  
+(c) Reverse engineer, decompile, disassemble, or attempt to derive source logic,
+data models, API behavior, or internal system architecture;  
+(d) Remove, alter, or obscure any Paywaz ownership notices;  
+(e) Redistribute the Software on GitHub or any other platform;  
+(f) Use the Software to build or improve a competing product or service.
+
+Any unauthorized use terminates this License immediately.
+
+---
+
+3. OWNERSHIP
+
+All rights, title, interest, trademarks, trade secrets, and intellectual property
+associated with the Software remain the exclusive property of Paywaz.com LLC.
+
+Nothing in this License transfers or assigns ownership to you.
+
+---
+
+4. NO WARRANTY
+
+The Software is provided “AS IS” with no warranties, express or implied,
+including but not limited to warranties of:
+
+– Merchantability  
+– Fitness for a particular purpose  
+– Accuracy  
+– Availability  
+– Non-infringement  
+
+Paywaz disclaims all liability arising from use of the Software.
+
+---
+
+5. LIMITATION OF LIABILITY
+
+To the maximum extent permitted by law, Paywaz shall not be liable for any:
+
+– Direct, indirect, incidental, special, punitive, or consequential damages  
+– Loss of revenue, profits, data, business opportunity, goodwill  
+– Security breaches, interruptions, or operational impacts  
+
+Use of the Software is entirely at your own risk.
+
+---
+
+6. TERMINATION
+
+Paywaz may revoke this License at any time without notice.  
+Upon termination, you must immediately cease all use and destroy any copies of
+the Software.
+
+---
+
+7. GOVERNING LAW
+
+This License shall be governed by and construed in accordance with the laws of
+the State of Delaware, without regard to conflict-of-law principles.
+
+---
+
+8. CONTACT
+
+For commercial licensing, permissions, or partnership inquiries:
+
+Paywaz.com LLC  
+Email: legal@paywaz.com  
+Website: https://paywaz.com
+
+---
+
+9. ACCEPTANCE
+
+By accessing or using the Software, you acknowledge that you have read,
+understood, and agree to be bound by this License.
+
+© 2025 Paywaz.com LLC — All Rights Reserved.