quoxcli 0.0.0-stage → 0.2.0

package/lib/api/endpoints/mon.js

@@ -0,0 +1,178 @@
+/**
+ * 'mon.*' endpoints — monitoring queries, added as part of WP4.3
+ * (STREAM_CLI_PARITY_PLAN.md §2.3 #10, the last item in the ranked top-10).
+ *
+ * Four backend surfaces, all `services/collector/server.js`, all
+ * collector-direct (no org segment in the URL — same shape as
+ * `traces.*`/`aee.*`):
+ *
+ *   - Docker fleet (`/docker/*`) — VERIFIED at the handlers (server.js
+ *     ~7232-7401): these routes have NO auth middleware applied at all, and
+ *     no org filtering — a bare fleet-wide scan/cache read across every
+ *     Docker host the collector can reach. The CLI still sends a bearer
+ *     (harmless) and still gates `quox mon docker *` behind
+ *     `auth.requireAuth()` for a consistent logged-in CLI UX, but the
+ *     backend itself would serve these to an unauthenticated caller.
+ *   - Wazuh (`/api/v1/wazuh/*`) — gated by `requireServiceOrUserAuth()`.
+ *     Reads (manager/status, agents, alerts, vulnerabilities,
+ *     deploy-history) are not org-filtered by the Wazuh API itself (the org
+ *     is only used to look up which Wazuh manager token to use); the writes
+ *     (deploy-agent, deploy-bulk, active-response) are HITL-gated — they
+ *     queue an HITL Inbox approval card and return 202, they do not execute
+ *     immediately.
+ *   - AGH-chain leaderboard (`/api/v1/agh-chain/*`) — gated by
+ *     `requireServiceOrUserAuth()` AND org-scoped: the handler reads
+ *     `req.user.org_id` and 403s with `{ error: 'org_id required' }` if
+ *     absent (server.js:3007-3051). This is the one mon.* surface that is
+ *     genuinely tenant-isolated server-side.
+ *   - `/metrics` (Prometheus scrape) — NO auth middleware, plain text
+ *     response (not JSON — `client.get()` returns `{ success: true, text }`
+ *     for non-`application/json` content types).
+ *   - Monitoring config/cache (`/api/v1/monitoring/*`) and Grafana config
+ *     (`/api/v1/grafana/config`) — `monitoring.config` uses
+ *     `requireAuth({ required: false })` (optional auth, works logged-out);
+ *     `monitoring.cache.*` and `grafana.config` use
+ *     `requireServiceOrUserAuth()` (auth required). None of the three are
+ *     org-scoped — single shared config/cache per installation.
+ */
+
+export const mon = {
+  'mon.agh-chain.leaderboard.events.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ agentId }) => `/api/v1/agh-chain/leaderboard/${agentId}/events`,
+    tags: ['live-safe'],
+  },
+  'mon.agh-chain.leaderboard.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ agentId }) => `/api/v1/agh-chain/leaderboard/${agentId}`,
+    tags: ['live-safe'],
+  },
+  'mon.agh-chain.leaderboard.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/agh-chain/leaderboard`,
+    tags: ['live-safe'],
+  },
+  'mon.config.cache.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ service }) => `/api/v1/monitoring/cache/${service}`,
+    tags: ['live-safe'],
+  },
+  'mon.config.get': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/monitoring/config`,
+    tags: ['live-safe'],
+  },
+  'mon.config.grafana.get': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/grafana/config`,
+    tags: ['live-safe'],
+  },
+  'mon.docker.containers.action': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id, action }) => `/docker/containers/${id}/${action}`,
+    tags: ['live-write'],
+  },
+  'mon.docker.containers.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/docker/containers/${id}`,
+    tags: ['live-safe'],
+  },
+  'mon.docker.containers.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/docker/containers`,
+    tags: ['live-safe'],
+  },
+  'mon.docker.containers.logs': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/docker/containers/${id}/logs`,
+    tags: ['live-safe'],
+  },
+  'mon.docker.containers.stats': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/docker/containers/${id}/stats`,
+    tags: ['live-safe'],
+  },
+  'mon.docker.fleet.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/docker/fleet`,
+    tags: ['live-safe'],
+  },
+  'mon.docker.stacks.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/docker/stacks`,
+    tags: ['live-safe'],
+  },
+  'mon.docker.system-df.get': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/docker/system-df`,
+    tags: ['live-safe'],
+  },
+  'mon.metrics.get': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/metrics`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.active-response': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/active-response`,
+    tags: ['live-write'],
+  },
+  'mon.wazuh.agents.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/agents`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.alerts.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/alerts`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.deploy-agent': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/deploy-agent`,
+    tags: ['live-write'],
+  },
+  'mon.wazuh.deploy-bulk': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/deploy-bulk`,
+    tags: ['live-write'],
+  },
+  'mon.wazuh.deploy-history.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/deploy-history`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.manager-status.get': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/manager/status`,
+    tags: ['live-safe'],
+  },
+  'mon.wazuh.vulnerabilities.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/wazuh/vulnerabilities`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/notesq.js

@@ -0,0 +1,43 @@
+/**
+ * 'notesq.*' endpoints — NotesQ (governed markdown notebook, Qortex layer),
+ * proxied through the collector (services/collector/lib/notesq/api.js:
+ * /api/v1/notesq/* -> quoxbrain /notesq/*, org + user resolved server-side).
+ * No org segment in the URL — same shape as `inboxq.*`.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+const B = '/api/v1/notesq';
+
+export const notesq = {
+  'notesq.notes.list': { method: 'GET', service: 'collector', path: () => `${B}/notes`, tags: ['live-safe'] },
+  'notesq.notes.get': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/notes/${id}`, tags: ['live-safe'] },
+  'notesq.notes.create': { method: 'POST', service: 'collector', path: () => `${B}/notes`, tags: ['live-write'] },
+  'notesq.notes.update': { method: 'PUT', service: 'collector', path: ({ id }) => `${B}/notes/${id}`, tags: ['live-write'] },
+  'notesq.notes.delete': { method: 'DELETE', service: 'collector', path: ({ id }) => `${B}/notes/${id}`, tags: ['live-write'] },
+  'notesq.facets': { method: 'GET', service: 'collector', path: () => `${B}/facets`, tags: ['live-safe'] },
+  'notesq.notes.revisions': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/notes/${id}/revisions`, tags: ['live-safe'] },
+  'notesq.notes.revision': { method: 'GET', service: 'collector', path: ({ id, rev }) => `${B}/notes/${id}/revisions/${rev}`, tags: ['live-safe'] },
+  'notesq.notes.restore': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/notes/${id}/restore`, tags: ['live-write'] },
+  'notesq.import': { method: 'POST', service: 'collector', path: () => `${B}/import`, tags: ['live-write'] },
+  // AQ-9D P4: Action-Q item create (auth, org-scoped), used by `quox notes actions`.
+  'notesq.actionq.create': { method: 'POST', service: 'auth', path: ({ orgId }) => `/api/orgs/${orgId}/actions`, tags: ['live-write'] },
+  'notesq.templates.list': { method: 'GET', service: 'collector', path: () => `${B}/templates`, tags: ['live-safe'] },
+  'notesq.notes.fromTemplate': { method: 'POST', service: 'collector', path: () => `${B}/notes/from-template`, tags: ['live-write'] },
+  'notesq.schedules.list': { method: 'GET', service: 'collector', path: () => `${B}/schedules`, tags: ['live-safe'] },
+  'notesq.schedules.create': { method: 'POST', service: 'collector', path: () => `${B}/schedules`, tags: ['live-write'] },
+  'notesq.schedules.update': { method: 'PATCH', service: 'collector', path: ({ id }) => `${B}/schedules/${id}`, tags: ['live-write'] },
+  'notesq.schedules.delete': { method: 'DELETE', service: 'collector', path: ({ id }) => `${B}/schedules/${id}`, tags: ['live-write'] },
+  'notesq.batch.undo': { method: 'POST', service: 'collector', path: ({ batchId }) => `${B}/batches/${batchId}/undo`, tags: ['live-write'] },
+  // AQ-9D P5: propose a note as a pending-review skill (dry_run in the body previews).
+  'notesq.notes.proposeSkill': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/notes/${id}/propose-skill`, tags: ['live-write'] },
+  'notesq.import.status': { method: 'GET', service: 'collector', path: ({ jobId }) => `${B}/import/${jobId}`, tags: ['live-safe'] },
+  'notesq.notes.related': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/notes/${id}/related`, tags: ['live-safe'] },
+  'notesq.notes.suggestions': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/notes/${id}/suggestions`, tags: ['live-safe'] },
+  'notesq.health': { method: 'GET', service: 'collector', path: () => `${B}/health`, tags: ['live-safe'] },
+  // Attachments live in the AUTH service org file store (namespace 'notesq'),
+  // not behind the collector: notes only hold same-origin links to them.
+  'notesq.files.upload': { method: 'POST', service: 'auth', path: ({ orgId }) => `/api/orgs/${orgId}/files/upload`, tags: ['live-write'] },
+  'notesq.files.meta': { method: 'GET', service: 'auth', path: ({ orgId, fileId }) => `/api/orgs/${orgId}/files/${fileId}/meta`, tags: ['live-safe'] },
+  'notesq.files.get': { method: 'GET', service: 'auth', path: ({ orgId, fileId }) => `/api/orgs/${orgId}/files/${fileId}`, tags: ['live-safe'] },
+};

package/lib/api/endpoints/objectives.js

@@ -0,0 +1,62 @@
+/**
+ * 'objectives.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const objectives = {
+  'objectives.approve-plan': {
+    method: 'POST',
+    service: 'tasks',
+    path: ({ id }) => `/api/objectives/${id}/approve-plan`,
+    tags: ['live-write'],
+  },
+  'objectives.checkpoint-approve': {
+    method: 'POST',
+    service: 'tasks',
+    path: ({ id, checkpointId }) => `/api/objectives/${id}/checkpoints/${checkpointId}/approve`,
+    tags: ['live-write'],
+  },
+  'objectives.checkpoint-reject': {
+    method: 'POST',
+    service: 'tasks',
+    path: ({ id, checkpointId }) => `/api/objectives/${id}/checkpoints/${checkpointId}/reject`,
+    tags: ['live-write'],
+  },
+  'objectives.checkpoints-pending': {
+    method: 'GET',
+    service: 'tasks',
+    path: () => `/api/checkpoints/pending`,
+    tags: ['live-safe'],
+  },
+  'objectives.create': {
+    method: 'POST',
+    service: 'tasks',
+    path: () => `/api/objectives`,
+    tags: ['live-write'],
+  },
+  'objectives.get': {
+    method: 'GET',
+    service: 'tasks',
+    path: ({ id }) => `/api/objectives/${id}`,
+    tags: ['live-safe'],
+  },
+  'objectives.halt': {
+    method: 'POST',
+    service: 'tasks',
+    path: ({ id }) => `/api/objectives/${id}/halt`,
+    tags: ['live-write'],
+  },
+  'objectives.list': {
+    method: 'GET',
+    service: 'tasks',
+    path: () => `/api/objectives`,
+    tags: ['live-safe'],
+  },
+  'objectives.start': {
+    method: 'POST',
+    service: 'tasks',
+    path: ({ id }) => `/api/objectives/${id}/start`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/orgs.js

@@ -0,0 +1,38 @@
+/**
+ * 'orgs.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const orgs = {
+  'orgs.create': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/orgs`,
+    tags: ['live-write'],
+  },
+  'orgs.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}`,
+    tags: ['live-write'],
+  },
+  'orgs.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}`,
+    tags: ['live-safe'],
+  },
+  'orgs.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/orgs`,
+    tags: ['live-safe'],
+  },
+  'orgs.update': {
+    method: 'PATCH',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/plugins.js

@@ -0,0 +1,134 @@
+/**
+ * 'plugins.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const plugins = {
+  // Plugins (WP2.1, auth/routes/plugins.js) — org-scoped install registry.
+  // Install/update/uninstall + all secrets writes are admin-only; reads
+  // require org membership only. assignments.delete's assigneeId path
+  // segment is optional (the route is `.../assignments/:assigneeType/:assigneeId?`).
+  'plugins.assignments.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, pluginId }) => `/api/orgs/${orgId}/plugins/${pluginId}/assignments`,
+    tags: ['live-write'],
+  },
+  'plugins.assignments.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, pluginId, assigneeType, assigneeId }) => assigneeId
+      ? `/api/orgs/${orgId}/plugins/${pluginId}/assignments/${assigneeType}/${assigneeId}`
+      : `/api/orgs/${orgId}/plugins/${pluginId}/assignments/${assigneeType}`,
+    tags: ['live-write'],
+  },
+  'plugins.assignments.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, pluginId }) => `/api/orgs/${orgId}/plugins/${pluginId}/assignments`,
+    tags: ['live-safe'],
+  },
+  'plugins.data.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, pluginId, key }) => `/api/orgs/${orgId}/plugins/${pluginId}/data/${key}`,
+    tags: ['live-write'],
+  },
+  'plugins.data.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, pluginId, key }) => `/api/orgs/${orgId}/plugins/${pluginId}/data/${key}`,
+    tags: ['live-safe'],
+  },
+  'plugins.data.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, pluginId }) => `/api/orgs/${orgId}/plugins/${pluginId}/data`,
+    tags: ['live-safe'],
+  },
+  'plugins.data.set': {
+    method: 'PUT',
+    service: 'auth',
+    path: ({ orgId, pluginId, key }) => `/api/orgs/${orgId}/plugins/${pluginId}/data/${key}`,
+    tags: ['live-write'],
+  },
+  'plugins.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, pluginId }) => `/api/orgs/${orgId}/plugins/${pluginId}`,
+    tags: ['live-safe'],
+  },
+  'plugins.install': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/plugins`,
+    tags: ['live-write'],
+  },
+  'plugins.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/plugins`,
+    tags: ['live-safe'],
+  },
+  'plugins.mine.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/me/plugins`,
+    tags: ['live-safe'],
+  },
+  'plugins.secrets.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, pluginId, name }) => `/api/orgs/${orgId}/plugins/${pluginId}/secrets/${name}`,
+    tags: ['live-write'],
+  },
+  'plugins.secrets.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, pluginId }) => `/api/orgs/${orgId}/plugins/${pluginId}/secrets`,
+    tags: ['live-safe'],
+  },
+  'plugins.secrets.reveal': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, pluginId, name }) => `/api/orgs/${orgId}/plugins/${pluginId}/secrets/${name}/reveal`,
+    tags: ['live-write'],
+  },
+  'plugins.secrets.set': {
+    method: 'PUT',
+    service: 'auth',
+    path: ({ orgId, pluginId, name }) => `/api/orgs/${orgId}/plugins/${pluginId}/secrets/${name}`,
+    tags: ['live-write'],
+  },
+  'plugins.trusted-keys.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/trusted-keys`,
+    tags: ['live-write'],
+  },
+  'plugins.trusted-keys.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, keyId }) => `/api/orgs/${orgId}/trusted-keys/${keyId}`,
+    tags: ['live-write'],
+  },
+  'plugins.trusted-keys.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/trusted-keys`,
+    tags: ['live-safe'],
+  },
+  'plugins.uninstall': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, pluginId }) => `/api/orgs/${orgId}/plugins/${pluginId}`,
+    tags: ['live-write'],
+  },
+  'plugins.update': {
+    method: 'PATCH',
+    service: 'auth',
+    path: ({ orgId, pluginId }) => `/api/orgs/${orgId}/plugins/${pluginId}`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/powers.js

@@ -0,0 +1,75 @@
+/**
+ * 'powers.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const powers = {
+  // Powers (WP2.1, auth/routes/powers.js) — org-scoped MCP tool deploys.
+  // The whole deploy pipeline (detect/deploy/deploy-repo/finalize/update/
+  // archive/restore/config/delete) is tagged skip-live: deploy-repo kicks
+  // off a REAL powers-host container build, finalize/archive/restore/config
+  // mutate that real deployed resource, and detect/deploy call out to a live
+  // MCP URL — none of this is safe to fire unattended against a live stack.
+  // Only the build-status GET is a pure read (live-safe).
+  'powers.deploy': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/powers/deploy`,
+    tags: ['skip-live'],
+  },
+  'powers.deploy-repo': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/powers/deploy/repo`,
+    tags: ['skip-live'],
+  },
+  'powers.deploy-repo.archive': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, toolDefId }) => `/api/orgs/${orgId}/powers/deploy/repo/${toolDefId}/archive`,
+    tags: ['skip-live'],
+  },
+  'powers.deploy-repo.config': {
+    method: 'PATCH',
+    service: 'auth',
+    path: ({ orgId, toolDefId }) => `/api/orgs/${orgId}/powers/deploy/repo/${toolDefId}/config`,
+    tags: ['skip-live'],
+  },
+  'powers.deploy-repo.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, toolDefId }) => `/api/orgs/${orgId}/powers/deploy/repo/${toolDefId}`,
+    tags: ['skip-live'],
+  },
+  'powers.deploy-repo.finalize': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, toolDefId }) => `/api/orgs/${orgId}/powers/deploy/repo/${toolDefId}/finalize`,
+    tags: ['skip-live'],
+  },
+  'powers.deploy-repo.restore': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, toolDefId }) => `/api/orgs/${orgId}/powers/deploy/repo/${toolDefId}/restore`,
+    tags: ['skip-live'],
+  },
+  'powers.deploy-repo.status': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, toolDefId }) => `/api/orgs/${orgId}/powers/deploy/repo/${toolDefId}/status`,
+    tags: ['live-safe'],
+  },
+  'powers.deploy-repo.update': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, toolDefId }) => `/api/orgs/${orgId}/powers/deploy/repo/${toolDefId}/update`,
+    tags: ['skip-live'],
+  },
+  'powers.detect': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/powers/detect`,
+    tags: ['skip-live'],
+  },
+};

package/lib/api/endpoints/prompts.js

@@ -0,0 +1,69 @@
+/**
+ * 'prompts.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const prompts = {
+  // Prompts library (WP2.4, auth/routes/prompts.js) — NOT org-scoped in the URL
+  // (mounted at plain `/api/prompts`, server.js:726); org_id travels as a query
+  // param on GETs and a body field on writes. Verified at the handler: the
+  // DELETE route's `req.body || req.query` fallback never actually reaches
+  // req.query in practice because express.json() always leaves req.body as a
+  // truthy `{}` on a bodyless request — so org_id MUST be sent in the body
+  // for prompts.delete, not the query string.
+  'prompts.create': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/prompts`,
+    tags: ['live-write'],
+  },
+  'prompts.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ id }) => `/api/prompts/${id}`,
+    tags: ['live-write'],
+  },
+  'prompts.export': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/prompts/export`,
+    tags: ['live-safe'],
+  },
+  'prompts.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ id }) => `/api/prompts/${id}`,
+    tags: ['live-safe'],
+  },
+  'prompts.import': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/prompts/import`,
+    tags: ['live-write'],
+  },
+  'prompts.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/prompts`,
+    tags: ['live-safe'],
+  },
+  'prompts.restore': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ id, version }) => `/api/prompts/${id}/restore/${version}`,
+    tags: ['live-write'],
+  },
+  'prompts.update': {
+    method: 'PATCH',
+    service: 'auth',
+    path: ({ id }) => `/api/prompts/${id}`,
+    tags: ['live-write'],
+  },
+  'prompts.versions': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ id }) => `/api/prompts/${id}/versions`,
+    tags: ['live-safe'],
+  },
+};