@openluxeco/cli 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 OpenLuxe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,83 @@
+# OpenLuxe CLI
+
+The official command-line client for the OpenLuxe v1 API. Built for humans
+and for terminal AI agents (Claude Code, etc.) — sign in once with your
+OpenLuxe web account, then drive the whole API from the shell.
+
+## Install
+
+```bash
+npm install -g @openluxeco/cli
+# or run without installing:
+npx @openluxeco/cli help
+```
+
+Requires Node.js 18+.
+
+## Sign in
+
+```bash
+openluxe auth login
+```
+
+This uses the OAuth 2.0 device flow — exactly like signing in to other
+modern CLIs:
+
+1. The CLI prints a short code and opens your browser.
+2. You sign in to openluxe.co (if not already) and approve the device.
+3. The CLI receives a personal access token and stores it at
+   `~/.openluxe/credentials.json` (chmod 600).
+
+It works headless / over SSH too — the URL + code are printed, so you can
+open them on any device.
+
+```bash
+openluxe auth status     # who am I?
+openluxe auth logout      # forget the local token
+```
+
+Revoke a CLI token anytime from **Settings → Integrations** on the web.
+
+## Use it
+
+Typed resource commands:
+
+```bash
+openluxe contacts list --per_page 5
+openluxe contacts get 42
+openluxe notes create --contact 42 --body "Followed up by phone"
+openluxe render create -d '{"surface":"crm.dashboard","format":"pdf"}'
+openluxe webhooks events
+openluxe me show
+```
+
+Run `openluxe <resource>` to see its commands, or `openluxe help` for the
+full list.
+
+Raw passthrough to any v1 endpoint:
+
+```bash
+openluxe api GET /contacts --per_page 5
+openluxe api POST /notes -d '{"contact_id":1,"body":"hi"}'
+openluxe api DELETE /notes/9
+```
+
+## For AI agents
+
+Point your agent at the binary. Every endpoint is reachable via the typed
+commands or `openluxe api <METHOD> <path>`. Output is always JSON on stdout;
+errors go to stderr with a non-zero exit code, so it composes cleanly in
+scripts and tool-use loops.
+
+```bash
+export OPENLUXE_API_URL=https://openluxe.co   # default; override for staging/local
+```
+
+## Environment
+
+| Var | Purpose |
+|---|---|
+| `OPENLUXE_API_URL` | API base (default `https://openluxe.co`) |
+| `OPENLUXE_INSECURE=1` | Skip TLS verification — only for self-signed local/staging boxes (or pass `--insecure`). Off by default. |
+
+Credentials: `~/.openluxe/credentials.json`

package/bin/openluxe.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+
+// Opt-in escape hatch for self-signed certs (local Herd / staging boxes).
+// Default stays fully secure — only relaxes when explicitly requested.
+if (process.env.OPENLUXE_INSECURE === '1' || process.argv.includes('--insecure')) {
+    process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+}
+
+import { run } from '../src/cli.js';
+
+run(process.argv.slice(2)).catch((e) => {
+    console.error(`\x1b[31m✗ ${e?.message || e}\x1b[0m`);
+    process.exit(1);
+});

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@openluxeco/cli",
+  "version": "0.1.0",
+  "description": "Official OpenLuxe command-line client — drive the OpenLuxe v1 API from your terminal or an AI agent.",
+  "type": "module",
+  "bin": {
+    "openluxe": "bin/openluxe.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "start": "node bin/openluxe.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/OpenLabs-co/openluxe-cli.git"
+  },
+  "bugs": {
+    "url": "https://github.com/OpenLabs-co/openluxe-cli/issues"
+  },
+  "homepage": "https://github.com/OpenLabs-co/openluxe-cli#readme",
+  "author": "OpenLuxe",
+  "keywords": [
+    "openluxe",
+    "cli",
+    "api",
+    "real-estate",
+    "crm",
+    "ai-agent"
+  ],
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/api.js

@@ -0,0 +1,67 @@
+import { load } from './config.js';
+
+export class ApiError extends Error {
+    constructor(status, detail, body) {
+        super(detail || `HTTP ${status}`);
+        this.status = status;
+        this.body = body;
+    }
+}
+
+/**
+ * Perform an authenticated v1 API request. `path` is everything after
+ * /api/v1 (e.g. "/contacts"). `query` is an object, `body` is JSON-able.
+ */
+export async function request(method, path, { query, body, token, base } = {}) {
+    const cfg = load();
+    const apiBase = base || cfg.base;
+    const bearer = token || cfg.token;
+
+    const url = new URL(apiBase.replace(/\/$/, '') + '/api/v1' + (path.startsWith('/') ? path : '/' + path));
+    if (query) {
+        for (const [k, v] of Object.entries(query)) {
+            if (v !== undefined && v !== null) url.searchParams.set(k, v);
+        }
+    }
+
+    const headers = { Accept: 'application/json' };
+    if (bearer) headers.Authorization = `Bearer ${bearer}`;
+    const init = { method, headers };
+    if (body !== undefined && body !== null) {
+        headers['Content-Type'] = 'application/json';
+        init.body = typeof body === 'string' ? body : JSON.stringify(body);
+    }
+
+    let res;
+    try {
+        res = await fetch(url, init);
+    } catch (e) {
+        throw new ApiError(0, `Network error: ${e.message}`);
+    }
+
+    const text = await res.text();
+    let parsed;
+    try { parsed = text ? JSON.parse(text) : null; } catch { parsed = text; }
+
+    if (!res.ok) {
+        const detail = parsed && typeof parsed === 'object'
+            ? (parsed.detail || parsed.message || parsed.error || `HTTP ${res.status}`)
+            : `HTTP ${res.status}`;
+        throw new ApiError(res.status, detail, parsed);
+    }
+    return parsed;
+}
+
+/** Unauthenticated POST used only by the device-auth handshake. */
+export async function postPublic(base, path, body) {
+    const url = base.replace(/\/$/, '') + '/api/v1' + path;
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+        body: JSON.stringify(body || {}),
+    });
+    const text = await res.text();
+    let parsed;
+    try { parsed = text ? JSON.parse(text) : null; } catch { parsed = text; }
+    return { ok: res.ok, status: res.status, data: parsed };
+}

package/src/auth.js

@@ -0,0 +1,92 @@
+import { hostname, userInfo } from 'node:os';
+import { spawn } from 'node:child_process';
+import { load, save, clear, credentialsPath } from './config.js';
+import { postPublic } from './api.js';
+
+const DEFAULT_BASE = process.env.OPENLUXE_API_URL || 'https://openluxe.co';
+
+function openBrowser(url) {
+    const cmd = process.platform === 'darwin' ? 'open'
+        : process.platform === 'win32' ? 'cmd' : 'xdg-open';
+    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+    try {
+        const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => {});
+        child.unref();
+    } catch { /* headless / no browser — the printed URL is the fallback */ }
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+export async function login({ base } = {}) {
+    const apiBase = base || process.env.OPENLUXE_API_URL || load().base || DEFAULT_BASE;
+
+    const start = await postPublic(apiBase, '/cli/auth/start', {
+        client_name: 'OpenLuxe CLI',
+        client_hostname: `${userInfo().username}@${hostname()}`,
+    });
+    if (!start.ok) {
+        console.error(`Could not start login: ${start.data?.detail || start.status}`);
+        process.exit(1);
+    }
+
+    const { device_code, user_code, verification_uri_complete, verification_uri, interval, expires_in } = start.data;
+
+    console.log('');
+    console.log('  Authorize this device by visiting:');
+    console.log(`    \x1b[36m${verification_uri_complete || verification_uri}\x1b[0m`);
+    console.log('');
+    console.log(`  Confirm this code:  \x1b[1m${user_code}\x1b[0m`);
+    console.log('');
+    console.log('  Opening your browser… (sign in if prompted, then approve)');
+    console.log('');
+    openBrowser(verification_uri_complete || verification_uri);
+
+    const deadline = Date.now() + expires_in * 1000;
+    let wait = (interval || 5) * 1000;
+
+    while (Date.now() < deadline) {
+        await sleep(wait);
+        const poll = await postPublic(apiBase, '/cli/auth/poll', { device_code });
+
+        if (poll.ok && poll.data?.status === 'authorized') {
+            save({ base: apiBase, token: poll.data.token, user: poll.data.user });
+            const who = poll.data.user?.email || poll.data.user?.name || 'your account';
+            console.log(`\x1b[32m✓ Signed in as ${who}\x1b[0m`);
+            console.log(`  Token stored at ${credentialsPath}`);
+            return;
+        }
+        if (poll.ok && poll.data?.status === 'pending') {
+            continue; // keep waiting
+        }
+        if (poll.status === 429) {
+            wait += 2000; // server asked us to slow down
+            continue;
+        }
+        if (poll.status === 410 || poll.status === 403) {
+            console.error(`\x1b[31m✗ ${poll.data?.detail || 'Authorization failed.'}\x1b[0m`);
+            process.exit(1);
+        }
+    }
+    console.error('\x1b[31m✗ Timed out waiting for authorization.\x1b[0m');
+    process.exit(1);
+}
+
+export function logout() {
+    const { user } = load();
+    clear();
+    console.log('Signed out locally. The token still exists server-side —');
+    console.log('revoke it at Settings → Integrations if this device is compromised.');
+    if (user?.email) console.log(`(was: ${user.email})`);
+}
+
+export function status() {
+    const { base, token, user } = load();
+    if (!token) {
+        console.log('Not signed in. Run:  openluxe auth login');
+        process.exit(1);
+    }
+    console.log(`Signed in:  ${user?.email || user?.name || 'unknown'}`);
+    console.log(`API:        ${base}`);
+    console.log(`Credentials ${credentialsPath}`);
+}

package/src/cli.js

@@ -0,0 +1,164 @@
+import { request, ApiError } from './api.js';
+import { RESOURCES } from './resources.js';
+import * as auth from './auth.js';
+import { load } from './config.js';
+
+const C = {
+    dim: (s) => `\x1b[2m${s}\x1b[0m`,
+    bold: (s) => `\x1b[1m${s}\x1b[0m`,
+    cyan: (s) => `\x1b[36m${s}\x1b[0m`,
+    red: (s) => `\x1b[31m${s}\x1b[0m`,
+};
+
+/**
+ * Tokenize argv into { positionals, flags, body }.
+ *   --key value | --key=value | --flag (boolean) | -d '<json>'
+ */
+function parseArgs(argv) {
+    const positionals = [];
+    const flags = {};
+    let body;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === '-d' || a === '--data') {
+            const raw = argv[++i];
+            try { body = JSON.parse(raw); } catch { die(`-d expects valid JSON, got: ${raw}`); }
+        } else if (a.startsWith('--')) {
+            const eq = a.indexOf('=');
+            if (eq !== -1) {
+                flags[a.slice(2, eq)] = a.slice(eq + 1);
+            } else {
+                const key = a.slice(2);
+                const next = argv[i + 1];
+                if (next === undefined || next.startsWith('--')) {
+                    flags[key] = true;
+                } else {
+                    flags[key] = next;
+                    i++;
+                }
+            }
+        } else {
+            positionals.push(a);
+        }
+    }
+    return { positionals, flags, body };
+}
+
+function die(msg) {
+    console.error(C.red(`✗ ${msg}`));
+    process.exit(1);
+}
+
+function out(data) {
+    process.stdout.write(typeof data === 'string' ? data + '\n' : JSON.stringify(data, null, 2) + '\n');
+}
+
+async function callApi(method, path, { positionals = [], flags = {}, body }) {
+    // Fill :placeholders from --flag of the same name, else positionals in order.
+    const used = new Set();
+    let pi = 0;
+    const filled = path.replace(/:([A-Za-z_]+)/g, (_, name) => {
+        if (flags[name] !== undefined) { used.add(name); return encodeURIComponent(flags[name]); }
+        const v = positionals[pi++];
+        if (v === undefined) die(`Missing path argument: ${name}`);
+        return encodeURIComponent(v);
+    });
+
+    const rest = {};
+    for (const [k, v] of Object.entries(flags)) if (!used.has(k)) rest[k] = v;
+
+    let query, payload;
+    if (method === 'GET' || method === 'DELETE') {
+        query = rest;
+    } else {
+        payload = { ...(body || {}), ...rest };
+        if (Object.keys(payload).length === 0) payload = body;
+    }
+
+    try {
+        const res = await request(method, filled, { query, body: payload });
+        out(res);
+    } catch (e) {
+        if (e instanceof ApiError) {
+            console.error(C.red(`✗ ${e.status} ${e.message}`));
+            if (e.body && typeof e.body === 'object') console.error(C.dim(JSON.stringify(e.body, null, 2)));
+            if (e.status === 401) console.error(C.dim('  Run: openluxe auth login'));
+            process.exit(1);
+        }
+        die(e.message);
+    }
+}
+
+function topHelp() {
+    const { token, user, base } = load();
+    console.log(`
+${C.bold('openluxe')} — OpenLuxe API command-line client
+
+${C.bold('USAGE')}
+  openluxe <command> [args] [--flags] [-d '<json>']
+
+${C.bold('AUTH')}
+  auth login                Sign in via your browser (device flow)
+  auth logout               Forget the local token
+  auth status               Show who you're signed in as
+
+${C.bold('RAW')}
+  api <METHOD> <path>       Call any v1 endpoint directly
+                            e.g. openluxe api GET /contacts --per_page 5
+                                 openluxe api POST /notes -d '{"contact_id":1,"body":"hi"}'
+
+${C.bold('RESOURCES')}
+${Object.entries(RESOURCES).map(([g, r]) => `  ${g.padEnd(16)} ${C.dim(r.summary)}`).join('\n')}
+
+  Run ${C.cyan('openluxe <resource>')} to see its commands.
+
+${C.bold('STATE')}
+  ${token ? `signed in as ${user?.email || 'unknown'}` : 'not signed in — run: openluxe auth login'}
+  API: ${base}
+`);
+}
+
+function groupHelp(group) {
+    const r = RESOURCES[group];
+    console.log(`\n${C.bold('openluxe ' + group)} — ${r.summary}\n`);
+    for (const [name, c] of Object.entries(r.commands)) {
+        console.log(`  ${(group + ' ' + name).padEnd(28)} ${C.dim(`${c.method} ${c.path}`)}${c.summary ? '  ' + c.summary : ''}`);
+    }
+    console.log('');
+}
+
+export async function run(argv) {
+    const [cmd, ...rest] = argv;
+
+    if (!cmd || cmd === 'help' || cmd === '--help' || cmd === '-h') return topHelp();
+    if (cmd === '--version' || cmd === '-v') return out('openluxe 0.1.0');
+
+    if (cmd === 'auth') {
+        const sub = rest[0];
+        const { flags } = parseArgs(rest.slice(1));
+        if (sub === 'login') return auth.login({ base: flags.base });
+        if (sub === 'logout') return auth.logout();
+        if (sub === 'status') return auth.status();
+        return die(`Unknown auth command: ${sub || '(none)'} — try login | logout | status`);
+    }
+
+    if (cmd === 'api') {
+        const method = (rest[0] || '').toUpperCase();
+        const path = rest[1];
+        if (!method || !path) return die("usage: openluxe api <METHOD> <path> [-d '<json>'] [--query val]");
+        const { flags, body } = parseArgs(rest.slice(2));
+        return callApi(method, path, { flags, body });
+    }
+
+    const group = RESOURCES[cmd];
+    if (!group) return die(`Unknown command: ${cmd}. Run 'openluxe help'.`);
+
+    const subName = rest[0];
+    if (!subName || subName === '--help' || subName === '-h') return groupHelp(cmd);
+
+    const command = group.commands[subName];
+    if (!command) return die(`Unknown '${cmd}' command: ${subName}. Run 'openluxe ${cmd}' for options.`);
+
+    const { positionals, flags, body } = parseArgs(rest.slice(1));
+    return callApi(command.method, command.path, { positionals, flags, body });
+}

package/src/config.js

@@ -0,0 +1,37 @@
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { mkdirSync, readFileSync, writeFileSync, existsSync, chmodSync, rmSync } from 'node:fs';
+
+const DIR = join(homedir(), '.openluxe');
+const FILE = join(DIR, 'credentials.json');
+
+const DEFAULT_BASE = process.env.OPENLUXE_API_URL || 'https://openluxe.co';
+
+export function load() {
+    if (!existsSync(FILE)) {
+        return { base: DEFAULT_BASE, token: null, user: null };
+    }
+    try {
+        const data = JSON.parse(readFileSync(FILE, 'utf8'));
+        return {
+            base: process.env.OPENLUXE_API_URL || data.base || DEFAULT_BASE,
+            token: data.token || null,
+            user: data.user || null,
+        };
+    } catch {
+        return { base: DEFAULT_BASE, token: null, user: null };
+    }
+}
+
+export function save({ base, token, user }) {
+    mkdirSync(DIR, { recursive: true });
+    writeFileSync(FILE, JSON.stringify({ base, token, user }, null, 2));
+    // Credentials file holds a bearer token — lock it down to the owner.
+    try { chmodSync(FILE, 0o600); } catch { /* best effort (e.g. Windows) */ }
+}
+
+export function clear() {
+    if (existsSync(FILE)) rmSync(FILE);
+}
+
+export const credentialsPath = FILE;

package/src/resources.js

@@ -0,0 +1,181 @@
+/**
+ * Declarative map of typed resource commands over the OpenLuxe v1 API.
+ *
+ * Each command: { method, path, summary, params? }
+ *   - `path` may contain :placeholders, filled from positional args (in order)
+ *     or a matching --flag.
+ *   - For GET: leftover --flags become query string.
+ *   - For POST/PATCH: --flags + `-d '<json>'` merge into the JSON body.
+ *
+ * This is intentionally data-driven so the CLI mirrors the API surface
+ * without 100+ hand-written command files.
+ */
+export const RESOURCES = {
+    contacts: {
+        summary: 'CRM contacts',
+        commands: {
+            list: { method: 'GET', path: '/contacts', summary: 'List your contacts' },
+            get: { method: 'GET', path: '/contacts/:contact', summary: 'Show one contact' },
+            create: { method: 'POST', path: '/contacts', summary: 'Create a contact' },
+            update: { method: 'PATCH', path: '/contacts/:contact', summary: 'Update a contact' },
+            delete: { method: 'DELETE', path: '/contacts/:contact', summary: 'Delete a contact' },
+        },
+    },
+    notes: {
+        summary: 'CRM notes',
+        commands: {
+            list: { method: 'GET', path: '/notes', summary: 'List notes' },
+            get: { method: 'GET', path: '/notes/:note' },
+            create: { method: 'POST', path: '/notes', summary: 'Create a note' },
+            update: { method: 'PATCH', path: '/notes/:note' },
+            delete: { method: 'DELETE', path: '/notes/:note' },
+        },
+    },
+    reminders: {
+        summary: 'CRM reminders',
+        commands: {
+            list: { method: 'GET', path: '/reminders' },
+            get: { method: 'GET', path: '/reminders/:reminder' },
+            create: { method: 'POST', path: '/reminders' },
+            update: { method: 'PATCH', path: '/reminders/:reminder' },
+            delete: { method: 'DELETE', path: '/reminders/:reminder' },
+        },
+    },
+    tasks: {
+        summary: 'CRM tasks',
+        commands: {
+            list: { method: 'GET', path: '/tasks' },
+            get: { method: 'GET', path: '/tasks/:task' },
+            create: { method: 'POST', path: '/tasks' },
+            update: { method: 'PATCH', path: '/tasks/:task' },
+            delete: { method: 'DELETE', path: '/tasks/:task' },
+        },
+    },
+    deals: {
+        summary: 'CRM deals (read-only in v1)',
+        commands: {
+            list: { method: 'GET', path: '/deals' },
+            get: { method: 'GET', path: '/deals/:deal' },
+        },
+    },
+    'contact-lists': {
+        summary: 'Contact lists',
+        commands: {
+            list: { method: 'GET', path: '/contact-lists' },
+            get: { method: 'GET', path: '/contact-lists/:list' },
+            create: { method: 'POST', path: '/contact-lists' },
+            update: { method: 'PATCH', path: '/contact-lists/:list' },
+            delete: { method: 'DELETE', path: '/contact-lists/:list' },
+        },
+    },
+    listings: {
+        summary: 'Property listings (read-only in v1)',
+        commands: {
+            list: { method: 'GET', path: '/listings' },
+            get: { method: 'GET', path: '/listings/:listing' },
+        },
+    },
+    showings: {
+        summary: 'Listing showings',
+        commands: {
+            list: { method: 'GET', path: '/showings' },
+            get: { method: 'GET', path: '/showings/:showing' },
+            create: { method: 'POST', path: '/showings' },
+            update: { method: 'PATCH', path: '/showings/:showing' },
+            delete: { method: 'DELETE', path: '/showings/:showing' },
+        },
+    },
+    'open-houses': {
+        summary: 'Open houses',
+        commands: {
+            list: { method: 'GET', path: '/open-houses' },
+            get: { method: 'GET', path: '/open-houses/:openHouse' },
+            attendees: { method: 'GET', path: '/open-houses/:openHouse/attendees' },
+            create: { method: 'POST', path: '/open-houses' },
+            update: { method: 'PATCH', path: '/open-houses/:openHouse' },
+            delete: { method: 'DELETE', path: '/open-houses/:openHouse' },
+        },
+    },
+    'store-products': {
+        summary: 'Store products (read-only in v1)',
+        commands: {
+            list: { method: 'GET', path: '/store/products' },
+            get: { method: 'GET', path: '/store/products/:product' },
+        },
+    },
+    webinars: {
+        summary: 'Webinars',
+        commands: {
+            list: { method: 'GET', path: '/webinars' },
+            get: { method: 'GET', path: '/webinars/:webinar' },
+            registrations: { method: 'GET', path: '/webinars/:webinar/registrations' },
+        },
+    },
+    travel: {
+        summary: 'Travel bookings (read-only)',
+        commands: {
+            flights: { method: 'GET', path: '/travel/flights' },
+            stays: { method: 'GET', path: '/travel/stays' },
+            cars: { method: 'GET', path: '/travel/cars' },
+        },
+    },
+    escrow: {
+        summary: 'Escrow transactions (read-only)',
+        commands: {
+            list: { method: 'GET', path: '/escrow' },
+            get: { method: 'GET', path: '/escrow/:escrow' },
+        },
+    },
+    courses: {
+        summary: 'Courses',
+        commands: {
+            list: { method: 'GET', path: '/courses' },
+            get: { method: 'GET', path: '/courses/:course' },
+            enrollments: { method: 'GET', path: '/course-enrollments' },
+        },
+    },
+    credits: {
+        summary: 'Credit balance & ledger',
+        commands: {
+            balance: { method: 'GET', path: '/credits/balance' },
+            ledger: { method: 'GET', path: '/credits/ledger' },
+        },
+    },
+    webhooks: {
+        summary: 'Outbound webhook subscriptions',
+        commands: {
+            list: { method: 'GET', path: '/webhooks' },
+            events: { method: 'GET', path: '/webhooks/events', summary: 'List subscribable event types' },
+            get: { method: 'GET', path: '/webhooks/:webhook' },
+            create: { method: 'POST', path: '/webhooks', summary: 'Create a subscription (secret shown once)' },
+            update: { method: 'PATCH', path: '/webhooks/:webhook' },
+            delete: { method: 'DELETE', path: '/webhooks/:webhook' },
+        },
+    },
+    render: {
+        summary: 'Headless PNG/PDF render of a UI surface',
+        commands: {
+            create: { method: 'POST', path: '/render', summary: 'Queue a render (surface=, format=)' },
+            get: { method: 'GET', path: '/render/:render', summary: 'Poll render status / get URL' },
+        },
+    },
+    skills: {
+        summary: 'Skills library (read-only)',
+        commands: {
+            list: { method: 'GET', path: '/skills' },
+            get: { method: 'GET', path: '/skills/:slug' },
+        },
+    },
+    search: {
+        summary: 'Universal record search',
+        commands: {
+            query: { method: 'GET', path: '/search', summary: 'Search (q=...)' },
+        },
+    },
+    me: {
+        summary: 'Your token / identity',
+        commands: {
+            show: { method: 'GET', path: '/me', summary: 'Who am I + token scopes' },
+        },
+    },
+};