quoxcli 0.0.0-stage → 0.2.0

package/lib/api/endpoints/voice.js

@@ -0,0 +1,22 @@
+/**
+ * 'voice.*' endpoints: QuoxVoice Console call history + aggregate insights
+ * (org-scoped reads). Split out of telephony.js so every key matches its
+ * fragment's domain.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const voice = {
+  'voice.calls.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/voice/calls`,
+    tags: ['live-safe'],
+  },
+  'voice.insights.get': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/voice/insights`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/volt.js

@@ -0,0 +1,84 @@
+/**
+ * 'volt.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const volt = {
+  'volt.cert.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ certId }) => `/volt/cert/${certId}`,
+    tags: ['live-safe'],
+  },
+  'volt.cert.run.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ runId }) => `/volt/cert/run/${runId}`,
+    tags: ['live-safe'],
+  },
+  'volt.certify': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/volt/certify`,
+    tags: ['live-write'],
+  },
+  'volt.certs.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/volt/certs`,
+    tags: ['live-safe'],
+  },
+  'volt.certs.stats.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/volt/certs/stats`,
+    tags: ['live-safe'],
+  },
+  // 2026-08-19 (proof-loop): these two routes existed on the collector with no
+  // CLI verb reaching them, so `quox volt verify` — which only accepts a local
+  // FILE — could not be pointed at real product evidence. The chain
+  // run -> bundle -> verify was broken at exactly the step a customer needs to
+  // check a receipt themselves, which is the whole "keep the receipt" pitch.
+  'volt.run.bundle.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ runId }) => `/volt/runs/${runId}/bundle`,
+    tags: ['live-safe'],
+  },
+  'volt.bundle.download': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ bundleId }) => `/volt/bundles/${bundleId}/download`,
+    tags: ['live-safe'],
+  },
+  // fleet #447: the bundle persisted per-run at completion is manifest_only
+  // (no events_ndjson, see voltContentStore.js), so `quox volt fetch` writing
+  // it straight to disk gave `quox volt verify` a file it could never
+  // chain-verify (bare MISSING_EVENTS). This is the missing verb: build the
+  // full bundle (manifest + events_ndjson) from the run's stored events on
+  // demand, then `volt.bundle.download` above fetches it.
+  'volt.bundle.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/volt/bundles/create`,
+    tags: ['live-write'],
+  },
+  // SEO-MOAT (owner ruling 2026-09-03): minimal witnessed acceptance verdict.
+  // The evidence chain proves what happened; this records whether it WORKED —
+  // an attestation by a human or calling system, witnessed as its own VOLT
+  // run pinning the target's head_hash. actor_type is credential-derived
+  // server-side, never self-asserted.
+  'volt.run.acceptance.post': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ runId }) => `/volt/runs/${runId}/acceptance`,
+    tags: ['live-write'],
+  },
+  'volt.run.acceptance.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ runId }) => `/volt/runs/${runId}/acceptance`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/ward.js

@@ -0,0 +1,40 @@
+/**
+ * 'ward.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const ward = {
+  'ward.chains.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/ward/chains`,
+    tags: ['live-safe'],
+  },
+  'ward.entries.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/ward/entries`,
+    tags: ['live-safe'],
+  },
+  'ward.stats.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/ward/stats`,
+    tags: ['live-safe'],
+  },
+  'ward.verify': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/ward/verify`,
+    tags: ['live-write'],
+  },
+  // #622: bounded single-action receipt verification (entry → covering signed
+  // tip only). Safe on the production chain where 'ward.verify' is not.
+  'ward.verify_receipt': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/ward/verify-receipt`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/webhooks.js

@@ -0,0 +1,46 @@
+/**
+ * 'webhooks.*' endpoints — WP2.2 (docs/STREAM_CLI_PARITY_PLAN.md §2.3 #2).
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ *
+ * Backend: services/auth/routes/webhooks.js, mounted at plain `/api`
+ * (server.js:641 `app.use('/api', webhooksRoutes)`) — routes are org-scoped
+ * IN the URL (`/api/orgs/:orgId/webhooks...`), unlike prompts.js. Gated
+ * enterprise-tier + ORG_MANAGE_SETTINGS (requirePlan('enterprise') +
+ * resolveCap(Capabilities.ORG_MANAGE_SETTINGS) — services/auth/routes/webhooks.js
+ * `chain`). Expect 402/403 on non-enterprise orgs; that's a real route, not
+ * a phantom.
+ *
+ * These are org WEBHOOK SUBSCRIBERS (team_event fan-out targets), distinct
+ * from quoxflow's workflow-trigger webhooks in ./triggers.js — the latter
+ * are inbound webhook paths registered by an activated workflow node; these
+ * are outbound subscriptions this org owns for receiving team_event
+ * notifications. SCIM tokens + team-events reads on the same router file
+ * are explicitly out of scope for this WP (separate work packages).
+ */
+
+export const webhooks = {
+  'webhooks.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/webhooks`,
+    tags: ['live-write'],
+  },
+  'webhooks.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, id }) => `/api/orgs/${orgId}/webhooks/${id}`,
+    tags: ['live-write'],
+  },
+  'webhooks.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/webhooks`,
+    tags: ['live-safe'],
+  },
+  'webhooks.rotate': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, id }) => `/api/orgs/${orgId}/webhooks/${id}/rotate`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/workflows.js

@@ -0,0 +1,162 @@
+/**
+ * 'workflows.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ *
+ * WP2.5 (docs/STREAM_CLI_PARITY_PLAN.md §2.3 #5 — `quox workflow apply/validate/import`):
+ * the 'workflows.apply*'/'workflows.importN8n'/'workflows.importObjective'/'workflows.validate'
+ * entries below are DIRECT to quoxflow (service: 'quoxflow'), same access-path precedent as
+ * 'workflows.activate'/'workflows.deactivate' above. They are DELIBERATELY separate keys from
+ * 'workflows.create'/'workflows.update' (which hit the AUTH service's org-scoped, lightweight
+ * workflows table used by the pre-existing `workflow create`/`workflow update` commands) — the
+ * quoxflow store is a completely different backend (full Workflow/DAG execution schema, no
+ * orgId in the path) and reusing the same key names would have silently overwritten the auth
+ * entries in this object literal (no error — endpoints-fragments.test.js's duplicate-key guard
+ * only checks ACROSS fragment files, not within one file's own object literal).
+ *
+ * Route provenance (quoxflow/src/api/routes/workflows.ts, mounted at app.route('/api/workflows', ...)):
+ *   - applyCreate: POST /api/workflows — body validated by WorkflowSchema (core/workflow.ts),
+ *     which requires `id` as a non-optional field — i.e. even "create" needs a caller-supplied
+ *     id; the store's save() is an upsert (`ON CONFLICT (id) DO UPDATE`), so POSTing an id that
+ *     already exists silently updates it instead of erroring.
+ *   - applyGet: GET /api/workflows/:id — used internally by `workflow apply`'s diff-preview to
+ *     fetch the current stored definition before a PUT.
+ *   - applyUpdate: PUT /api/workflows/:id — partial merge (name/description/notes/definition, or
+ *     top-level nodes/edges/variables/metadata/tags), NOT validated against WorkflowSchema.
+ *   - validate: POST /api/workflows/:id/validate — validates the ALREADY-STORED workflow by id;
+ *     takes no body at all (no validateBody on this route). It does NOT validate arbitrary local
+ *     file content — only whatever is currently persisted under that id.
+ *   - importN8n: POST /api/workflows/import-n8n — body { workflow: unknown, options?: { generateIds?, includePositions? } }.
+ *   - importObjective: POST /api/workflows/import-objective — body { template: {...}, schedule?: { cron, timezone? }, options?: { activate?, includeApprovalGate? } }.
+ *
+ * BACKEND FINDING (not fixed here — flagged for triage, see also the identical finding
+ * documented in endpoints/triggers.js): GET /api/workflows (list, quoxflow) does NOT filter by
+ * org at all — `createWorkflowRoutes`'s `app.get('/', ...)` calls `deps.workflowStore.list({
+ * limit, offset, active })` with no orgId, and neither `InMemoryWorkflowStore.list()` nor
+ * `PostgresWorkflowStore.list()` (workflow-store.ts) accept or filter on one — `ListOptions`
+ * has no orgId field. Worse than triggers.*: `PostgresWorkflowStore.save()` doesn't even INSERT
+ * an org_id value (relies on the column's DB-level `DEFAULT 'default'`), so every workflow
+ * created via this quoxflow-direct path is invisible to any per-org filtering that might be
+ * bolted on later unless a migration backfills it. Same cross-tenant-leak shape as the
+ * triggers.* finding — every org's workflows are visible to every other org's caller via this
+ * endpoint today. Not seeded as a CLI endpoint in this file (no CLI command reads it), so it
+ * isn't reachable via `quox workflow ...` — flagged here purely because WP2.5 was asked to
+ * check it while reading this route file for the apply/validate/import work.
+ */
+
+export const workflows = {
+  // WP2.2: lifecycle routes live in QUOXFLOW (not auth), unlike every other
+  // 'workflows.*' entry in this file. quoxflow/src/api/routes/workflows-lifecycle.ts
+  // mounts at /api/workflows (app.ts), registering/unregistering triggers on
+  // activate/deactivate. org_id travels in the body (optional tenant-ownership
+  // check — see route handler), NOT the URL, so no orgId path param here.
+  'workflows.activate': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ workflowId }) => `/api/workflows/${workflowId}/activate`,
+    tags: ['live-write'],
+  },
+  'workflows.applyCreate': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: () => `/api/workflows`,
+    tags: ['live-write'],
+  },
+  'workflows.applyGet': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: ({ workflowId }) => `/api/workflows/${workflowId}`,
+    tags: ['live-safe'],
+  },
+  // fleet #465: GET /api/workflows (list), same quoxflow-direct precedent as
+  // 'workflows.applyGet' above. Added so `workflow list` can read the engine
+  // store's own list route instead of only the auth-service store, which
+  // quoxflow's write paths (activate/applyCreate/applyUpdate) never touch.
+  'workflows.applyList': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: () => `/api/workflows`,
+    tags: ['live-safe'],
+  },
+  // quoxflow#7: execute an engine-store workflow directly (the auth-service
+  // runs route only knows auth-store workflows). Org comes from the caller's
+  // auth context server-side, like the other quoxflow-direct entries.
+  'workflows.applyExecute': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ workflowId }) => `/api/workflows/${workflowId}/execute`,
+    tags: ['live-write'],
+  },
+  'workflows.applyUpdate': {
+    method: 'PUT',
+    service: 'quoxflow',
+    path: ({ workflowId }) => `/api/workflows/${workflowId}`,
+    tags: ['live-write'],
+  },
+  'workflows.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/workflows`,
+    tags: ['live-write'],
+  },
+  'workflows.deactivate': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ workflowId }) => `/api/workflows/${workflowId}/deactivate`,
+    tags: ['live-write'],
+  },
+  'workflows.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, workflowId }) => `/api/orgs/${orgId}/workflows/${workflowId}`,
+    tags: ['live-write'],
+  },
+  'workflows.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, workflowId }) => `/api/orgs/${orgId}/workflows/${workflowId}`,
+    tags: ['live-safe'],
+  },
+  'workflows.importN8n': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: () => `/api/workflows/import-n8n`,
+    tags: ['live-write'],
+  },
+  'workflows.importObjective': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: () => `/api/workflows/import-objective`,
+    tags: ['live-write'],
+  },
+  'workflows.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/workflows`,
+    tags: ['live-safe'],
+  },
+  'workflows.publish': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, workflowId }) => `/api/orgs/${orgId}/workflows/${workflowId}/publish`,
+    tags: ['live-write'],
+  },
+  'workflows.steps': {
+    method: 'PUT',
+    service: 'auth',
+    path: ({ orgId, workflowId }) => `/api/orgs/${orgId}/workflows/${workflowId}/steps`,
+    tags: ['live-write'],
+  },
+  'workflows.update': {
+    method: 'PATCH',
+    service: 'auth',
+    path: ({ orgId, workflowId }) => `/api/orgs/${orgId}/workflows/${workflowId}`,
+    tags: ['live-write'],
+  },
+  'workflows.validate': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ workflowId }) => `/api/workflows/${workflowId}/validate`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/x.js

@@ -0,0 +1,24 @@
+/**
+ * 'x.*' endpoints — the X (Twitter) plugin's governed REST surface on the
+ * collector (services/collector/routes/xRoutes.js, mounted at /x with
+ * requireServiceOrUserAuth + requirePluginEntitlement('x')).
+ *
+ * Most `quox x` verbs go through the agent tool path (v1.tools.execute) and
+ * need no fragment here. This one is the exception: media upload is a
+ * multipart REST route, so the CLI posts a FormData body straight to it
+ * (quox#592 — the media-upload gap: the endpoint existed for the dashboard
+ * Compose UI but had no CLI reach).
+ *
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const x = {
+  'x.media.upload': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/x/media`,
+    tags: ['live-write'],
+  },
+};
+
+export default x;

package/lib/api/endpoints.js

@@ -0,0 +1,15 @@
+/**
+ * QuoxCLI endpoint map — thin re-export shim.
+ *
+ * The endpoint map was split into per-domain fragment files under
+ * ./endpoints/ (see ./endpoints/index.js for the aggregation + fragment
+ * convention doc). This file is kept as a stable import path so the ~50
+ * existing call sites across lib/commands, lib/tui/views, lib/tui/hooks,
+ * and lib/core don't need to change: `import { ... } from '../../api/endpoints.js'`
+ * keeps working unchanged.
+ *
+ * Do not add new endpoints here — add them to the appropriate fragment
+ * file under ./endpoints/ (or create a new one) instead.
+ */
+
+export { ENDPOINTS, resolveEndpoint } from './endpoints/index.js';