chore: initialize repository baseline (CI, docs, license, library)

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2
+
+[Makefile]
+indent_style = tab

.env.example

@@ -0,0 +1,11 @@
+# This toolset reads NO environment variables, by design. This file exists so
+# nobody goes hunting for configuration that does not exist.
+#
+# Every tool here is a Chrome extension that runs against a HighLevel
+# sub-account you are already signed into. Authentication is borrowed from the
+# page's own session (window.SHELL_STORE.$http) inside the browser tab; no
+# token, API key, or password is ever read, stored, or configured outside it.
+#
+# If a future tool genuinely needs configuration, document its variables here
+# and in the README's Configuration table, and keep the values obviously fake
+# (replace-me / https://example.invalid) so a copy-paste mistake fails loudly.

.github/CODEOWNERS

@@ -0,0 +1,21 @@
+# CODEOWNERS
+# Reference: raw/get-started--codeowners--about-code-owners-official-docs.md
+#
+# Rules:
+# - Owners MUST have write access to this repository (or be a visible team
+#   with write access).
+# - Last matching pattern wins, same as .gitignore, EXCEPT: \# escaping,
+#   ! negation, and [ ] character ranges do NOT work here even though they
+#   look like gitignore syntax.
+# - Multiple owners for one pattern must be listed on the same line, or only
+#   the last-listed owner is applied.
+# - Enable "Require review from Code Owners" on branch protection / a
+#   ruleset for this file to actually gate merges (see guide 06).
+
+# Default owner for everything not matched below.
+*       @legioncodeinc
+
+# Lock down changes to repository governance and CI/CD itself.
+/.github/                @legioncodeinc
+/.github/CODEOWNERS      @legioncodeinc
+/.github/workflows/      @legioncodeinc

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,37 @@
+---
+name: Bug report
+about: Report something that is broken
+title: "bug: "
+labels: bug
+assignees: ""
+---
+
+<!-- Reference: raw/get-started--repo-health--community-profiles-official-docs.md -->
+
+## Describe the bug
+
+{A clear, concise description of what is broken.}
+
+## Steps to reproduce
+
+1. {Step one}
+2. {Step two}
+3. {See error}
+
+## Expected behavior
+
+{What you expected to happen instead.}
+
+## Actual behavior
+
+{What actually happened. Include exact error text or a stack trace if you have one.}
+
+## Environment
+
+- Tool and version: {e.g. ghl-workflow-exporter 1.0.0 — see its manifest.json}
+- Browser: {browser_and_version}
+- HighLevel app domain: {app.gohighlevel.com or your white-labelled domain — never paste tokens}
+
+## Additional context
+
+{Logs, screenshots, or anything else that helps diagnose this. Do not paste secrets, tokens, session JWTs, or signed URLs here: this tracker is public.}

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,25 @@
+---
+name: Feature request
+about: Suggest an idea or enhancement
+title: "feat: "
+labels: enhancement
+assignees: ""
+---
+
+<!-- Reference: raw/get-started--repo-health--community-profiles-official-docs.md -->
+
+## Problem
+
+{What problem does this solve? What can't you do today?}
+
+## Proposed solution
+
+{What you'd like to see happen. Be as concrete as you can.}
+
+## Alternatives considered
+
+{Other approaches you thought about and why you didn't propose them instead. Delete this section if there weren't any.}
+
+## Additional context
+
+{Mockups, links, prior art, or anything else that helps evaluate this request.}

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,40 @@
+<!--
+Fill every section. Delete this comment block before opening the PR.
+Reference: raw/get-started--repo-health--community-profiles-official-docs.md,
+raw/get-started--commits--conventional-commits-1.0.0-official.md
+-->
+
+## What
+
+{One or two sentences describing the change. Not the how, the what.}
+
+## Why
+
+{The problem this solves or the request it satisfies. Link the issue: Closes #{issue_number}}
+
+## How
+
+{Notable implementation decisions a reviewer needs to know before reading the diff. Skip this section if the diff speaks for itself.}
+
+## Type of change
+
+- [ ] `feat`: new feature
+- [ ] `fix`: bug fix
+- [ ] `docs`: documentation only
+- [ ] `refactor`: no behavior change
+- [ ] `test`: test-only change
+- [ ] `chore` / `ci`: tooling, build, or CI change
+- [ ] Breaking change (see Conventional Commits `!` / `BREAKING CHANGE:` footer)
+
+## Testing
+
+{How this was verified: `node scripts/validate-manifests.mjs` output, the sub-account scenario exercised, screenshots for popup UI changes.}
+
+## Checklist
+
+- [ ] I ran `node scripts/validate-manifests.mjs` locally and it passes
+- [ ] I loaded the affected tool via `chrome://extensions` and smoke-tested it against a real sub-account
+- [ ] I updated `CHANGELOG.md` under `Unreleased` if this is a notable change
+- [ ] I updated documentation (README, tool READMEs, guides) if behavior or setup changed
+- [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/)
+- [ ] No secrets, credentials, signed URLs, or `.env` values are included in this diff

.github/dependabot.yml

@@ -0,0 +1,25 @@
+# Dependabot version updates. Zero-config baseline: no external app install,
+# GitHub-native, wired to GitHub Advisories for security PRs automatically.
+# For monorepos, multi-Git-platform needs, or >30 ecosystems, see guide
+# 05-commit-and-release-hygiene.md for the Renovate swap-in.
+# Grounded in: raw/get-started--dependency-updates--dependabot-vs-renovate-jsonic.md
+
+version: 2
+updates:
+  # NOTE: no package-ecosystem entry yet. This repo is dependency-free vanilla
+  # JavaScript with no package.json/lockfile. When a tool introduces one, add:
+  #   - package-ecosystem: "npm"
+  #     directory: "/<tool-folder>"
+  #     schedule: { interval: "weekly" }
+
+  # Keep GitHub Actions themselves current, including SHA-pinned actions.
+  # Dependabot understands SHA pins and updates the SHA plus the version
+  # comment in the same PR. See raw/get-started--ci-security--secure-pipelines-cheat-sheet.md
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "ci"

.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: CI
+
+# Validates every tool's Chrome extension manifest on push and pull request
+# against main. This repo is dependency-free vanilla JavaScript, so there is
+# no install step, no lockfile, and nothing to cache; lint/typecheck/test jobs
+# arrive when a tool introduces a build system.
+# Grounded in least-privilege GITHUB_TOKEN guidance:
+# raw/get-started--ci-security--actions-secure-use-official-docs.md
+# raw/get-started--ci-security--secure-pipelines-cheat-sheet.md
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+# Default every job to read-only. Jobs that need more must grant it themselves.
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  validate:
+    name: Validate extension manifests
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      # Pin third-party actions to a full commit SHA, not a tag, and keep the
+      # version comment for readability. Resolve the SHA for your installed
+      # major version with: gh api repos/actions/checkout/git/ref/tags/vX.Y.Z --jq '.object.sha'
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Validate manifests
+        run: node scripts/validate-manifests.mjs

.github/workflows/codeql.yml

@@ -0,0 +1,65 @@
+name: CodeQL
+
+# Advanced-setup CodeQL scan, portable as a committed workflow file.
+# GitHub's own recommendation is native "default setup" (Settings > Advanced
+# Security > CodeQL analysis > Set up > Default), which needs no workflow file
+# at all. Use this workflow when the project wants scanning defined as code,
+# or when default setup isn't available for the plan/visibility in use.
+# Grounded in: raw/get-started--codeql--configuring-default-setup-official-docs.md
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly scan of the default branch, catches newly disclosed query rules
+    # against unchanged code. Adjust the cron to your own quiet hours.
+    - cron: "0 6 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    # Code scanning uploads require Code Security (GHAS) enabled on private
+    # repositories — this repo has it off, and turning it on is a paid org
+    # decision. This job therefore skips (neutral on PRs) until a repository
+    # variable CODEQL_ENABLED=true is set:
+    #   Settings > Secrets and variables > Actions > Variables > CODEQL_ENABLED=true
+    if: vars.CODEQL_ENABLED == 'true'
+    # Static name: a skipped job renders a matrix-templated name literally.
+    name: Analyze (CodeQL)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # List every CodeQL-supported language actually present in the repo.
+        language: [javascript-typescript]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1
+        with:
+          languages: ${{ matrix.language }}
+          # default is precision-tuned; security-extended adds queries at
+          # some precision cost. See the distilled research for the tradeoff.
+          queries: security-extended
+
+      # No build step: this repo ships plain ES modules loaded directly by
+      # Chrome, so autobuild has nothing to do and JS/TS needs no config.
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@f1f6e5f6af878fb37288ce1c627459e94dbf7d01 # v3.30.1
+        with:
+          category: "/language:${{ matrix.language }}"

.gitignore

@@ -0,0 +1,81 @@
+# TypeScript / Node baseline. Grounded in:
+# raw/get-started--gitignore--github-gitignore-node-template.md
+# Extend the "Project-specific" section at the bottom; don't edit the rest
+# unless your stack genuinely differs from Node/TypeScript.
+
+# ---- Environment / secrets ----
+# Never commit real .env files. .env.example is the one exception, since it
+# documents required variables without holding real values.
+.env
+.env.*
+!.env.example
+
+# ---- Dependencies ----
+node_modules/
+jspm_packages/
+
+# ---- Build output ----
+dist/
+build/
+out/
+*.tsbuildinfo
+
+# ---- Coverage / test artifacts ----
+coverage/
+*.lcov
+.nyc_output/
+
+# ---- Logs ----
+logs/
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+# ---- Caches ----
+.npm
+.eslintcache
+.stylelintcache
+.cache/
+.parcel-cache/
+
+# ---- Yarn v2+ ----
+.yarn/cache
+.yarn/unplugged
+.yarn/build-state.yml
+.yarn/install-state.gz
+.pnp.*
+
+# ---- Framework build dirs ----
+.next/
+.nuxt/
+.svelte-kit/
+.vercel/
+.turbo/
+.serverless/
+
+# ---- Editor / IDE ----
+.vscode/*
+!.vscode/extensions.json
+.idea/
+*.swp
+*.swo
+
+# ---- OS cruft ----
+.DS_Store
+Thumbs.db
+Desktop.ini
+
+# ---- Project-specific ----
+# Local tool state (security-scanner hooks); never belongs in the repo.
+.mimosa/
+
+# Exported backups produced by the tools themselves.
+*.zip
+
+# Chrome packaging artifacts. A .pem here would be the Web Store upload key:
+# a real secret that must never be committed.
+*.crx
+*.pem

.nvmrc

@@ -0,0 +1 @@
+22