chore: establish BeatAPI CLI release baseline

Author: erickkkyt

.env.example

@@ -0,0 +1,3 @@
+BEATAPI_API_KEY=sk_your_key
+BEATAPI_BASE_URL=https://api.beatapi.io
+

.gitattributes

@@ -0,0 +1,5 @@
+* text=auto eol=lf
+*.png binary
+*.jpg binary
+*.jpeg binary
+*.webp binary

.gitignore

@@ -0,0 +1,7 @@
+node_modules/
+.env
+.env.*
+!.env.example
+coverage/
+dist/
+.worktrees/

CONTRIBUTING.md

@@ -0,0 +1,10 @@
+# Contributing
+
+1. Fork the repository and create a focused branch.
+2. Write a failing test before changing runtime behavior.
+3. Treat `contract/beatapi.openapi.yaml` as generated from the official public
+   contract.
+4. Keep machine-readable output on stdout and progress on stderr.
+5. Run `npm run verify` before opening a pull request.
+6. Never use real API keys or private user media in tests.
+

LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 BeatAPI
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

README.md

@@ -0,0 +1,44 @@
+# BeatAPI CLI
+
+A dependency-free Node.js command-line client for BeatAPI's public asynchronous
+video workflows.
+
+This is an MVP scaffold. It is local-only and marked `private` until command
+behavior, package naming, authentication UX, and release ownership are reviewed.
+
+## Requirements
+
+- Node.js 20 or newer
+- `BEATAPI_API_KEY` for authenticated commands
+
+```bash
+export BEATAPI_API_KEY="sk_your_key"
+npm link
+beatapi --help
+```
+
+## Commands
+
+```bash
+beatapi workflows
+beatapi usage
+beatapi file upload ./input.mp3
+beatapi music-video create --json ./music-video.json
+beatapi ecommerce-video create --json ./ecommerce-video.json
+beatapi task get task_123
+beatapi task wait task_123 --interval 7000 --attempts 120
+```
+
+Task creation JSON follows the canonical public contract at
+`../beatapi-examples/openapi/beatapi.yaml`.
+
+The CLI writes machine-readable result JSON to stdout. Polling progress and
+errors go to stderr so commands can be used in scripts.
+
+## Development
+
+```bash
+npm run check
+npm test
+```
+

SECURITY.md

@@ -0,0 +1,11 @@
+# Security policy
+
+Never pass a BeatAPI key as a command-line argument or include it in issue
+reports, logs, shell transcripts, fixtures, or screenshots.
+
+Use GitHub's private vulnerability reporting feature for security reports. If a
+credential may have been exposed, revoke it immediately in the
+[BeatAPI dashboard](https://beatapi.io/dashboard/apikeys).
+
+The latest minor release is the supported release line.
+

bin/beatapi.mjs

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+
+import { run } from "../src/cli.mjs";
+
+run(process.argv.slice(2)).catch((error) => {
+  if (error?.name === "BeatAPIError") {
+    const requestId = error.requestId
+      ? ` request_id=${error.requestId}`
+      : "";
+    console.error(
+      `BeatAPI error: ${error.code || error.status || "request_failed"}: ${error.message}${requestId}`,
+    );
+  } else {
+    console.error(error instanceof Error ? error.message : String(error));
+  }
+  process.exitCode = 1;
+});
+