quoxcli 0.0.0-stage → 0.2.0

package/lib/api/endpoints/index.js

@@ -0,0 +1,228 @@
+/**
+ * QuoxCLI endpoint map — aggregated from per-domain fragment files.
+ *
+ * Generated as part of WP0.1 (Stream CLI-PARITY, docs/STREAM_CLI_PARITY_PLAN.md §3.2 option C),
+ * refactored into per-domain fragments so parallel command work packages can add endpoints
+ * without colliding on one shared file. This is a PURE, behavior-preserving extraction: every
+ * entry reproduces the exact method + service + path that the corresponding call site used
+ * before migration. Do not "fix" a path here without also verifying the change against the
+ * real route handler — see the plan doc's correctness table (§2.2) for entries that were
+ * already corrected.
+ *
+ * Shape: name -> { method, service, path, tags }
+ *   - method: HTTP verb (or 'STREAM' for SSE via client.stream()).
+ *   - service: one of the SERVICE_PORTS keys in core/config.js (auth, files, memory,
+ *     orchestrator, tasks, collector).
+ *   - path: either a zero-arg function returning a static path, or a function of a params
+ *     object returning the interpolated path (mirrors the original template literal).
+ *   - tags: coarse live-contract tags (WP0.3/WP1.2 refine these).
+ *       'live-safe'  — GET, safe to fire against a live stack with no side effects.
+ *       'live-write' — mutating (POST/PUT/PATCH/DELETE), needs a create/verify/delete
+ *                       cycle or a sandboxed org before it can run live.
+ *       'skip-live'  — /internal/* or otherwise out of scope for the live contract test.
+ *
+ * Naming convention: '<resource>.<action>' (dot-separated for nested resources), where
+ * action is one of list/get/create/update/delete/stream, or the literal trailing verb
+ * segment of the route (e.g. 'vault.rotate', 'assistants.deploy') when the route itself
+ * is an action rather than plain CRUD.
+ *
+ * Anti-drift rule: no new call site may use a raw path literal — resolve it through this
+ * map via resolveEndpoint(name, params) instead. Enforced by test/api/endpoints-lint.test.js.
+ *
+ * FRAGMENT CONVENTION (read this before adding new endpoints):
+ *   Every entry lives in a per-domain fragment file under this directory, named after the
+ *   dot-prefix of its endpoint names (the segment before the first '.', e.g. all 'runs.*'
+ *   entries live in './runs.js', all 'vault.*' entries live in './vault.js'). Each fragment
+ *   exports a single plain object named after its domain (camelCased if the domain contains
+ *   a hyphen, e.g. 'backup-schedules.js' exports 'backupSchedules').
+ *
+ *   To add a brand-new domain: create ONE new file './endpoints/<domain>.js' exporting its
+ *   object, then add ONE import + ONE spread line to this file (index.js). That is the only
+ *   shared file a new command work package needs to touch — no other fragment file changes,
+ *   so parallel work packages adding different domains cannot collide.
+ *
+ *   To add an endpoint to an EXISTING domain: edit only that domain's fragment file.
+ *
+ *   Fragments are merged below with object spread in file order. test/api/endpoints-fragments.test.js
+ *   asserts (a) no duplicate keys across fragments — spreading would otherwise silently let a
+ *   later fragment overwrite an earlier one — and (b) every key exported by a fragment is
+ *   actually prefixed by that fragment's own domain, so a misplaced entry fails loudly instead
+ *   of silently landing in the wrong file.
+ */
+
+import { admin } from './admin.js';
+import { aee } from './aee.js';
+import { agentAttach } from './agent-attach.js';
+import { agents } from './agents.js';
+import { assistants } from './assistants.js';
+import { audit } from './audit.js';
+import { auth } from './auth.js';
+import { awareness } from './awareness.js';
+import { lucid } from './lucid.js';
+import { invites } from './invites.js';
+import { backupSchedules } from './backup-schedules.js';
+import { backups } from './backups.js';
+import { brain } from './brain.js';
+import { budgets } from './budgets.js';
+import { calendarq } from './calendarq.js';
+import { catalog } from './catalog.js';
+import { chat } from './chat.js';
+import { consent } from './consent.js';
+import { conversations } from './conversations.js';
+import { customRoles } from './custom-roles.js';
+import { divisions } from './divisions.js';
+import { domains } from './domains.js';
+import { engagement } from './engagement.js';
+import { entity } from './entity.js';
+import { engine } from './engine.js';
+import { executions } from './executions.js';
+import { file } from './file.js';
+import { files } from './files.js';
+import { governance } from './governance.js';
+import { inbox } from './inbox.js';
+import { inboxq } from './inboxq.js';
+import { notesq } from './notesq.js';
+import { contactsq } from './contactsq.js';
+import { x } from './x.js';
+import { llmPolicy } from './llm-policy.js';
+import { hat } from './hat.js';
+import { members } from './members.js';
+import { memory } from './memory.js';
+import { mfa } from './mfa.js';
+import { mon } from './mon.js';
+import { objectives } from './objectives.js';
+import { orgs } from './orgs.js';
+import { plugins } from './plugins.js';
+import { powers } from './powers.js';
+import { prompts } from './prompts.js';
+import { quoxbox } from './quoxbox.js';
+import { quoxchat } from './quoxchat.js';
+import { quoxflow } from './quoxflow.js';
+import { quoxplan } from './quoxplan.js';
+import { qlarity } from './qlarity.js';
+import { quoxseo } from './quoxseo.js';
+import { telephony } from './telephony.js';
+import { voice } from './voice.js';
+import { reach } from './reach.js';
+import { github } from './github.js';
+import { runs } from './runs.js';
+import { scim } from './scim.js';
+import { scopes } from './scopes.js';
+import { security } from './security.js';
+import { setup } from './setup.js';
+import { skills } from './skills.js';
+import { sso } from './sso.js';
+import { tags } from './tags.js';
+import { teams } from './teams.js';
+import { tg } from './tg.js';
+import { tools } from './tools.js';
+import { traces } from './traces.js';
+import { triggers } from './triggers.js';
+import { userLibrary } from './user-library.js';
+import { users } from './users.js';
+import { v1 } from './v1.js';
+import { vault } from './vault.js';
+import { volt } from './volt.js';
+import { safety } from './safety.js';
+import { ward } from './ward.js';
+import { webhooks } from './webhooks.js';
+import { workflows } from './workflows.js';
+
+export const ENDPOINTS = {
+  ...admin,
+  ...aee,
+  ...agentAttach,
+  ...agents,
+  ...assistants,
+  ...audit,
+  ...auth,
+  ...awareness,
+  ...lucid,
+  ...invites,
+  ...backupSchedules,
+  ...backups,
+  ...brain,
+  ...budgets,
+  ...calendarq,
+  ...catalog,
+  ...chat,
+  ...consent,
+  ...conversations,
+  ...customRoles,
+  ...divisions,
+  ...domains,
+  ...engagement,
+  ...entity,
+  ...engine,
+  ...executions,
+  ...file,
+  ...files,
+  ...governance,
+  ...inbox,
+  ...inboxq,
+  ...notesq,
+  ...contactsq,
+  ...x,
+  ...llmPolicy,
+  ...hat,
+  ...members,
+  ...memory,
+  ...mfa,
+  ...mon,
+  ...objectives,
+  ...orgs,
+  ...plugins,
+  ...powers,
+  ...prompts,
+  ...quoxbox,
+  ...quoxchat,
+  ...quoxflow,
+  ...quoxplan,
+  ...qlarity,
+  ...quoxseo,
+  ...telephony,
+  ...voice,
+  ...reach,
+  ...github,
+  ...runs,
+  ...scim,
+  ...scopes,
+  ...security,
+  ...setup,
+  ...skills,
+  ...sso,
+  ...tags,
+  ...teams,
+  ...tg,
+  ...tools,
+  ...traces,
+  ...triggers,
+  ...userLibrary,
+  ...users,
+  ...v1,
+  ...vault,
+  ...volt,
+  ...safety,
+  ...ward,
+  ...webhooks,
+  ...workflows,
+};
+
+/**
+ * Resolve an endpoint by name to its concrete { method, service, path } for this call.
+ *
+ * @param {string} name - key into ENDPOINTS, e.g. 'agents.list'
+ * @param {object} [params] - path params, e.g. { orgId, agentId }
+ * @returns {{ method: string, service: string, path: string }}
+ */
+export function resolveEndpoint(name, params = {}) {
+  const entry = ENDPOINTS[name];
+  if (!entry) {
+    throw new Error(`Unknown endpoint: "${name}" (no entry in cli/lib/api/endpoints/)`);
+  }
+  return {
+    method: entry.method,
+    service: entry.service,
+    path: entry.path(params),
+  };
+}

package/lib/api/endpoints/invites.js

@@ -0,0 +1,19 @@
+/**
+ * 'invites.*' endpoints (GRIPE-712): caller-scoped invitations.
+ */
+
+export const invites = {
+  // GRIPE-712: caller-scoped invitations, matched server-side on verified email.
+  'invites.mine.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/invites/mine`,
+    tags: ['live-safe'],
+  },
+  'invites.mine.accept': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ inviteId }) => `/api/invites/mine/${encodeURIComponent(inviteId)}/accept`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/llm-policy.js

@@ -0,0 +1,43 @@
+/**
+ * 'llm-policy.*' endpoints — WP3.2 (docs/STREAM_CLI_PARITY_PLAN.md §2.3 #7).
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ *
+ * Backend: services/auth/routes/llm-routing-policies.js, mounted at plain
+ * `/api` (server.js:546 — mounted BEFORE the requireAuth-router block on
+ * purpose, per that file's own header comment, so it can carry a
+ * service-key-gated /internal route; the three routes used here still apply
+ * requireAuth + requireOrgMembership per-route). Real paths are org-scoped
+ * in the URL: `/api/orgs/:orgId/llm-routing-policy[/test]`.
+ *
+ * - GET  returns `{ source: 'org'|'seed', policy, record }` directly (no
+ *   `{ success, data }` envelope) — getEffectiveLlmRoutingPolicy().
+ * - PUT  requires `{ policy: {...} }` in the body (400 if missing/not an
+ *   object) and additionally 403s unless the caller has
+ *   ORG_MANAGE_SETTINGS. Returns `{ saved: true, policy }` or
+ *   `{ error: 'invalid_policy', validation_errors: [...] }` (400) on a
+ *   policy that fails validateLlmRoutingPolicy().
+ * - POST .../test also requires `{ policy: {...} }` and returns the raw
+ *   validation result `{ valid, errors }` — it does NOT persist anything,
+ *   it's a dry-run validator only.
+ */
+
+export const llmPolicy = {
+  'llm-policy.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/llm-routing-policy`,
+    tags: ['live-safe'],
+  },
+  'llm-policy.set': {
+    method: 'PUT',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/llm-routing-policy`,
+    tags: ['live-write'],
+  },
+  'llm-policy.test': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/llm-routing-policy/test`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/lucid.js

@@ -0,0 +1,89 @@
+/**
+ * 'lucid.*' endpoints: LUCID situational-awareness journal (`quox lucid`).
+ * Collector routes under /api/v1/lucid (org-scoped, requireServiceOrUserAuth).
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const lucid = {
+  'lucid.situation': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/lucid/situation`,
+    tags: ['live-safe'],
+  },
+  'lucid.ack': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/lucid/ack`,
+    tags: ['live-write'],
+  },
+  'lucid.subjects': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/lucid/subjects`,
+    tags: ['live-safe'],
+  },
+  'lucid.feeds': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/lucid/feeds`,
+    tags: ['live-safe'],
+  },
+  'lucid.journal': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/lucid/journal`,
+    tags: ['live-safe'],
+  },
+  'lucid.replay': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/replay`, tags: ['live-safe'] },
+  'lucid.told': { method: 'GET', service: 'collector', path: () => `/api/v1/lucid/told`, tags: ['live-safe'] },
+  'lucid.item': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/lucid/item`,
+    tags: ['live-safe'],
+  },
+  'lucid.measure': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/lucid/measure`,
+    tags: ['live-write'],
+  },
+  'lucid.lessons': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/lucid/lessons`,
+    tags: ['live-safe'],
+  },
+  'lucid.teach': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/lucid/teach`,
+    tags: ['live-write'],
+  },
+  'lucid.lessons.delete': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/lucid/lessons/${encodeURIComponent(id)}`,
+    tags: ['live-write'],
+  },
+  'lucid.herald': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/lucid/herald`,
+    tags: ['live-safe'],
+  },
+  'lucid.herald.settings': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/lucid/herald/settings`,
+    tags: ['live-write'],
+  },
+  'lucid.herald.test': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/lucid/herald/test`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/members.js

@@ -0,0 +1,32 @@
+/**
+ * 'members.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const members = {
+  'members.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/members`,
+    tags: ['live-write'],
+  },
+  'members.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, userId }) => `/api/orgs/${orgId}/members/${userId}`,
+    tags: ['live-write'],
+  },
+  'members.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/members`,
+    tags: ['live-safe'],
+  },
+  'members.update': {
+    method: 'PATCH',
+    service: 'auth',
+    path: ({ orgId, userId }) => `/api/orgs/${orgId}/members/${userId}`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/memory.js

@@ -0,0 +1,75 @@
+/**
+ * 'memory.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const memory = {
+  'memory.create': {
+    method: 'POST',
+    service: 'memory',
+    path: () => `/api/memory`,
+    tags: ['live-write'],
+  },
+  'memory.delete': {
+    method: 'DELETE',
+    service: 'memory',
+    path: ({ id }) => `/api/memory/${id}`,
+    tags: ['live-write'],
+  },
+  'memory.export.list': {
+    method: 'GET',
+    service: 'memory',
+    path: () => `/api/memory/export`,
+    tags: ['live-safe'],
+  },
+  'memory.get': {
+    method: 'GET',
+    service: 'memory',
+    path: ({ id }) => `/api/memory/${id}`,
+    tags: ['live-safe'],
+  },
+  'memory.list': {
+    method: 'GET',
+    service: 'memory',
+    path: () => `/api/memory`,
+    tags: ['live-safe'],
+  },
+  'memory.search.list': {
+    method: 'GET',
+    service: 'memory',
+    path: () => `/api/memory/search`,
+    tags: ['live-safe'],
+  },
+  'memory.stats.list': {
+    method: 'GET',
+    service: 'memory',
+    path: () => `/api/memory/stats`,
+    tags: ['live-safe'],
+  },
+  // Codex cycle 4 #10: decision timeline + correction queue.
+  'memory.history': {
+    method: 'GET',
+    service: 'memory',
+    path: ({ id }) => `/api/memory/${id}/history`,
+    tags: ['live-safe'],
+  },
+  'memory.timeline': {
+    method: 'GET',
+    service: 'memory',
+    path: () => `/api/memory/timeline`,
+    tags: ['live-safe'],
+  },
+  'memory.reinstate': {
+    method: 'POST',
+    service: 'memory',
+    path: ({ id }) => `/api/memory/${id}/reinstate`,
+    tags: ['live-write'],
+  },
+  'memory.update': {
+    method: 'PATCH',
+    service: 'memory',
+    path: ({ id }) => `/api/memory/${id}`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/mfa.js

@@ -0,0 +1,32 @@
+/**
+ * 'mfa.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const mfa = {
+  'mfa.backup-codes.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/mfa/backup-codes`,
+    tags: ['live-safe'],
+  },
+  'mfa.disable': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/mfa/disable`,
+    tags: ['live-write'],
+  },
+  'mfa.setup': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/mfa/setup`,
+    tags: ['live-write'],
+  },
+  'mfa.verify-setup': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/mfa/verify-setup`,
+    tags: ['live-write'],
+  },
+};