Add core BBS routes and utilities, update docs

.eslintrc.cjs

@@ -0,0 +1,15 @@
+module.exports = {
+  root: true,
+  env: { node: true, es2022: true },
+  parser: '@typescript-eslint/parser',
+  parserOptions: { sourceType: 'module' },
+  plugins: ['@typescript-eslint'],
+  extends: [
+    'eslint:recommended',
+    'plugin:@typescript-eslint/recommended',
+  ],
+  ignorePatterns: ['.output/**', 'node_modules/**'],
+  rules: {
+    '@typescript-eslint/no-explicit-any': 'off',
+  },
+};

.github/workflows/ci.yml

@@ -0,0 +1,84 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node: [18, 20, 22]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: 'npm'
+
+      - name: Install dependencies (strict)
+        run: npm ci
+      - name: Fallback install on lock mismatch
+        if: failure()
+        run: |
+          echo "npm ci failed; attempting fallback npm install to refresh lockfile"
+          npm install
+      - name: Upload refreshed lockfile artifact
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: refreshed-lockfile-${{ matrix.node }}
+          path: package-lock.json
+
+      - name: Audit dependencies
+        run: npm audit --production --audit-level=moderate
+        continue-on-error: true
+
+      - name: TypeScript compile check
+        run: |
+          npx tsc --noEmit
+
+      - name: Prepare Nitro (generate types)
+        run: npm run prepare
+
+      - name: Build
+        run: npm run build
+
+      - name: Run tests
+        run: npm run test -- --run
+
+      - name: Lint
+        run: npx eslint . --ext .ts
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+      - name: Install dependencies (strict)
+        run: npm ci
+      - name: Fallback install on lock mismatch
+        if: failure()
+        run: |
+          echo "npm ci failed; attempting fallback npm install to refresh lockfile"
+          npm install
+      - name: Upload refreshed lockfile artifact
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: refreshed-lockfile-lint
+          path: package-lock.json
+      - name: OpenAPI validation (Redocly)
+        run: |
+          npx @redocly/cli@latest lint openapi.yaml --max-problems=0

.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [ rewrite, main ]
+  pull_request:
+    branches: [ main ]
+  schedule:
+    - cron: '0 3 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze (JavaScript/TypeScript)
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ 'javascript' ]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: '/language:${{ matrix.language }}'

.github/workflows/dependency-review.yml

@@ -0,0 +1,19 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      contents: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: moderate

.gitignore

@@ -11,3 +11,7 @@ dist
 */.output
 */node_modules
 */.nitro
+old
+old/
+xmoj-script
+xmoj-script/