quoxcli 0.0.0-stage → 0.2.0

package/lib/api/endpoints/security.js

@@ -0,0 +1,69 @@
+/**
+ * 'security.*' endpoints — WP3.1 (docs/STREAM_CLI_PARITY_PLAN.md §2.3 #6).
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ *
+ * Backend: services/auth/routes/orgSecurity.js, mounted at plain `/api`
+ * (server.js:580 `app.use('/api', orgSecurityRoutes)`) — org-scoped IN the
+ * URL (`/api/orgs/:orgId/security/...`). Gated enterprise-tier +
+ * ORG_MANAGE_SETTINGS. Verified at the handler: session-policy and
+ * ip-allowlist both resolve through `req.org.id`; mfa reads/writes
+ * `req.org.security_flags_json` directly off the already-org-scoped
+ * `req.org` row. No cross-tenant path.
+ *
+ * NAMING NOTE: the source file is `orgSecurity.js` but this fragment is
+ * named `security.js` (not `org-security.js`) so its endpoint keys can use
+ * the `security.*` prefix required by the fragment guard
+ * (test/api/endpoints-fragments.test.js requires key prefix === filename
+ * minus '.js'). A domain of `org-security` would force `org-security.*`
+ * keys instead. `security` does NOT collide with the existing `mfa.js`
+ * fragment — that file covers the PERSONAL user MFA enrollment endpoints
+ * (`/api/mfa/setup|disable|verify-setup|backup-codes`), distinct from this
+ * ORG-LEVEL MFA policy (`/api/orgs/:orgId/security/mfa`, which sets the
+ * org-wide required/optional/disabled mode, not a specific user's MFA
+ * enrollment).
+ */
+
+export const security = {
+  'security.ip-allowlist.add': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/security/ip-allowlist`,
+    tags: ['live-write'],
+  },
+  'security.ip-allowlist.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/security/ip-allowlist`,
+    tags: ['live-safe'],
+  },
+  'security.ip-allowlist.remove': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, entryId }) => `/api/orgs/${orgId}/security/ip-allowlist/${entryId}`,
+    tags: ['live-write'],
+  },
+  'security.mfa.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/security/mfa`,
+    tags: ['live-safe'],
+  },
+  'security.mfa.set': {
+    method: 'PUT',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/security/mfa`,
+    tags: ['live-write'],
+  },
+  'security.session-policy.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/security/session-policy`,
+    tags: ['live-safe'],
+  },
+  'security.session-policy.set': {
+    method: 'PUT',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/security/session-policy`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/setup.js

@@ -0,0 +1,90 @@
+/**
+ * 'setup.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const setup = {
+  'setup.admin': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/setup/admin`,
+    tags: ['live-write'],
+  },
+  'setup.config': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/setup/config`,
+    tags: ['live-write'],
+  },
+  'setup.config.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/setup/config`,
+    tags: ['live-safe'],
+  },
+  'setup.licensing.activate': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/setup/licensing/activate`,
+    tags: ['live-write'],
+  },
+  // LICENSE-LAUNCH LL-8-dash: device-code activation (no key paste). Both are
+  // instance-admin gated on the auth service, which holds the conversation
+  // with the control plane.
+  'setup.licensing.device.start': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/setup/licensing/device/start`,
+    tags: ['live-write'],
+  },
+  'setup.licensing.device.poll': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/setup/licensing/device/poll`,
+    tags: ['live-write'],
+  },
+  'setup.licensing.deactivate': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/setup/licensing/deactivate`,
+    tags: ['live-write'],
+  },
+  'setup.licensing.entitlements.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/setup/licensing/entitlements`,
+    tags: ['live-safe'],
+  },
+  // GRIPE-715: `quox licence` phase 1.
+  'setup.licensing.status': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/setup/licensing/status`,
+    tags: ['live-safe'],
+  },
+  'setup.licensing.refresh': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/setup/licensing/refresh`,
+    tags: ['live-write'],
+  },
+  'setup.licensing.seats.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ pluginId }) => `/api/setup/licensing/seats/${encodeURIComponent(pluginId)}`,
+    tags: ['live-safe'],
+  },
+  'setup.licensing.seats.releaseDead': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ pluginId }) => `/api/setup/licensing/seats/${encodeURIComponent(pluginId)}/release-dead`,
+    tags: ['live-write'],
+  },
+  'setup.status.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/setup/status`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/skills.js

@@ -0,0 +1,180 @@
+/**
+ * 'skills.*' endpoints — WP2.3 (docs/STREAM_CLI_PARITY_PLAN.md §2.3 #3).
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ *
+ * Skill execution, the QSKL-SAFETY review queue, and Crystal lifecycle
+ * writes (from-execution / promote-draft / rollback-to-version). All of
+ * these are DIRECT to quoxflow (service: 'quoxflow', port 3200), NOT
+ * proxied by the collector — the collector only hand-mounts three
+ * read-only proxy routes (GET /quoxflow/skills[/:id], evidence,
+ * observations; see endpoints/quoxflow.js), confirmed by grepping
+ * services/collector/server.js for 'quoxflow'. Same access-path
+ * precedent as endpoints/triggers.js and endpoints/workflows.js
+ * ('workflows.activate'/'workflows.deactivate').
+ *
+ * Route provenance (read directly from quoxflow source, not inferred):
+ *
+ *   - skills.run
+ *     POST /api/workflows/:id/execute
+ *     quoxflow/src/api/routes/executions.ts:206 (createWorkflowExecuteRoute),
+ *     mounted at app.route('/api/workflows', workflowExecuteRoutes) (app.ts:243).
+ *     Body: { triggerData?, async?: boolean (default false), orgId?: string }.
+ *     Sync (default): runs to completion, 200/500 with the execution result.
+ *     Async (async:true): fire-and-forget, 202 { executionId, status: 'running' }.
+ *     "Crystals ARE workflows" — running a skill/crystal IS this route with
+ *     the skill's/crystal's sourceWorkflowId as :id.
+ *
+ *   - skills.reviewQueue.list / .get / .approve / .reject
+ *     quoxflow/src/api/routes/quox-skills.ts:392-553 (QSKL-SAFETY.F).
+ *     GET  /api/quox-skills/review-queue?status=pending|approved|rejected
+ *          (defaults to 'pending' if status is omitted/invalid)
+ *     GET  /api/quox-skills/review-queue/:qid
+ *     POST /api/quox-skills/review-queue/:qid/approve  body: { comment?: string }
+ *     POST /api/quox-skills/review-queue/:qid/reject   body: { comment?: string }
+ *     Org-scoped correctly (verified, unlike the triggers.* cross-tenant
+ *     finding): resolveOrgId() takes orgId from the JWT in prod; each row's
+ *     org_id is checked against the caller's orgId, 403 on mismatch, and the
+ *     list query itself is `listByStatus(status, orgId)` — this route does
+ *     NOT reproduce the unscoped-list bug found in quoxflow triggers.
+ *
+ *   - skills.fromExecution / .promoteDraft / .rollbackToVersion
+ *     quoxflow/src/api/routes/skills.ts (legacy Crystal Skill Library,
+ *     mounted at app.route('/api/skills', skillsRoutes), app.ts ~256).
+ *     POST /api/skills/from-execution      body: { workflowId, workflowName? }
+ *       Idempotent: 200 + existing record if one already exists for the
+ *       source workflow, else 201 on fresh crystallisation, 422 NOT_READY
+ *       if the execution history doesn't yet support crystallisation.
+ *     POST /api/skills/promote-draft       body: { executionId, orgTier? }
+ *       orgTier defaults to 'tier_a' (blocked, 402) if omitted — CLI must
+ *       pass --tier tier_b explicitly to succeed.
+ *     POST /api/skills/rollback-to-version body: { sourceWorkflowId, targetVersion: number }
+ *       Writes a NEW version copying the target version's content (201), or
+ *       200 + the unchanged latest if targetVersion is already latest.
+ */
+
+export const skills = {
+  // SKILLRIGHTS #478 Phase 14, sealed execution pilot. Collector routes
+  // (server.js /api/v1/skills/sealed[...]): the sealed content lives at the
+  // collector, encrypted at rest, and is never returned by the read routes
+  // below, only the manifest (name, description, inputContract,
+  // contentSha256, createdAt) comes back. See
+  // docs/SEALED_EXECUTION_PILOT_DESIGN.md for the full contract and the
+  // binding claims language every one of these commands must carry.
+  'skills.sealed.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/skills/sealed`,
+    tags: ['skip-live'], // uploads real skill content; never in a live-contract sweep
+  },
+  'skills.sealed.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/skills/sealed`,
+    tags: ['live-safe'],
+  },
+  'skills.sealed.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ sealedId }) => `/api/v1/skills/sealed/${sealedId}`,
+    tags: ['live-safe'],
+  },
+  'skills.sealed.invoke': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ sealedId }) => `/api/v1/skills/sealed/${sealedId}/invoke`,
+    tags: ['skip-live'], // executes real methodology with real side effects
+  },
+  // SKILLRIGHTS #478 Phase 10 — governed skill protection. Unlike every
+  // other fragment here these two ARE collector routes (server.js
+  // /api/v1/skills/protect + /protections): the collector owns the org
+  // signing call, the open-registry registration and the AEE/WARD witness.
+  'skills.protect': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/skills/protect`,
+    tags: ['skip-live'], // registers in the real public registry; never in a live-contract sweep
+  },
+  'skills.protections': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/skills/protections`,
+    tags: ['live-safe'],
+  },
+  // SKILLRIGHTS #478 Phase 11 — affirmative acceptance (collector). The offer
+  // presents the exact artefact hash, declared rights, terms bytes and a
+  // single-use challenge; the POST records assent to exactly that, before any
+  // download under the 'require-acceptance' policy is authorized. Both are
+  // USER-only server-side: a service key is refused with user_assent_required,
+  // so neither belongs in a service-credentialled live sweep.
+  'skills.acceptance.offer': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ packId } = {}) => `/api/v1/skills/acceptance/offer${packId ? `?packId=${encodeURIComponent(packId)}` : ''}`,
+    tags: ['skip-live'],
+  },
+  'skills.acceptance.record': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/skills/acceptance`,
+    tags: ['skip-live'], // records a real, append-only acceptance of licence terms
+  },
+  // Phase 12: the org rights disclosure ledger (read-model, collector).
+  'skills.rightsLedger': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/skills/rights-ledger`,
+    tags: ['live-safe'],
+  },
+  'skills.fromExecution': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: () => `/api/skills/from-execution`,
+    tags: ['live-write'],
+  },
+  'skills.promoteDraft': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: () => `/api/skills/promote-draft`,
+    tags: ['live-write'],
+  },
+  'skills.reviewQueue.approve': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ qid }) => `/api/quox-skills/review-queue/${qid}/approve`,
+    tags: ['live-write'],
+  },
+  'skills.reviewQueue.get': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: ({ qid }) => `/api/quox-skills/review-queue/${qid}`,
+    tags: ['live-safe'],
+  },
+  'skills.reviewQueue.list': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: () => `/api/quox-skills/review-queue`,
+    tags: ['live-safe'],
+  },
+  'skills.reviewQueue.reject': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ qid }) => `/api/quox-skills/review-queue/${qid}/reject`,
+    tags: ['live-write'],
+  },
+  'skills.rollbackToVersion': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: () => `/api/skills/rollback-to-version`,
+    tags: ['live-write'],
+  },
+  // POST /api/workflows/:id/execute — deliberately NOT tagged 'live-write'.
+  // It actually runs a workflow/crystal (side effects beyond a rejected
+  // write); 'skip-live' keeps it out of the live-contract harness entirely
+  // per the WP2.3 brief ("Do NOT seed execute as live").
+  'skills.run': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: ({ id }) => `/api/workflows/${id}/execute`,
+    tags: ['skip-live'],
+  },
+};

package/lib/api/endpoints/sso.js

@@ -0,0 +1,67 @@
+/**
+ * 'sso.*' endpoints — WP3.1 (docs/STREAM_CLI_PARITY_PLAN.md §2.3 #6).
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ *
+ * Backend: services/auth/routes/sso.js, mounted at plain `/api`
+ * (server.js:639 `app.use('/api', ssoRoutes)`). The admin CRUD routes below
+ * are org-scoped IN the URL (`/api/orgs/:orgId/sso/providers...`) and gated
+ * enterprise-tier + ORG_MANAGE_SSO (`chain` in sso.js). Verified at the
+ * handler: GET/POST/PATCH/DELETE all resolve the provider through
+ * `req.org.id`, so cross-org access is not possible via these routes.
+ *
+ * The OIDC/SAML browser-flow routes (`/sso/discover`, `/sso/providers/:id/
+ * login`, `/callback`, `/saml-login`, `/acs`) are intentionally OUT OF SCOPE
+ * for this work package — they are 302-redirect / form-post handshake
+ * endpoints, not CLI-shaped.
+ *
+ * BACKEND FINDING: `sso.providers.samlMetadata` is NOT org-scoped in the
+ * URL, unlike the admin CRUD routes. The handler (sso.js:315,
+ * `GET /sso/providers/:providerId/saml-metadata`) is grouped with the
+ * public SAML user-flow section — no auth/org/plan/capability chain at
+ * all, by design ("Public — no PII in metadata" per the route's own
+ * docstring). It looks up the provider by `providerId` alone and 400s if
+ * that provider's protocol isn't 'saml'. The plan's endpoint list assumed
+ * an `/orgs/:orgId/...` shape for this route; the real route has no orgId
+ * segment. Reproduced faithfully here — do not add an orgId param to this
+ * path without changing the backend route first.
+ */
+
+export const sso = {
+  'sso.providers.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/sso/providers`,
+    tags: ['live-write'],
+  },
+  'sso.providers.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, providerId }) => `/api/orgs/${orgId}/sso/providers/${providerId}`,
+    tags: ['live-write'],
+  },
+  'sso.providers.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, providerId }) => `/api/orgs/${orgId}/sso/providers/${providerId}`,
+    tags: ['live-safe'],
+  },
+  'sso.providers.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/sso/providers`,
+    tags: ['live-safe'],
+  },
+  // Public route — no orgId segment. See the BACKEND FINDING above.
+  'sso.providers.saml-metadata': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ providerId }) => `/api/sso/providers/${providerId}/saml-metadata`,
+    tags: ['live-safe'],
+  },
+  'sso.providers.update': {
+    method: 'PATCH',
+    service: 'auth',
+    path: ({ orgId, providerId }) => `/api/orgs/${orgId}/sso/providers/${providerId}`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/tags.js

@@ -0,0 +1,32 @@
+/**
+ * 'tags.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const tags = {
+  'tags.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/tags`,
+    tags: ['live-write'],
+  },
+  'tags.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, tagId }) => `/api/orgs/${orgId}/tags/${tagId}`,
+    tags: ['live-write'],
+  },
+  'tags.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/tags`,
+    tags: ['live-safe'],
+  },
+  'tags.update': {
+    method: 'PATCH',
+    service: 'auth',
+    path: ({ orgId, tagId }) => `/api/orgs/${orgId}/tags/${tagId}`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/teams.js

@@ -0,0 +1,56 @@
+/**
+ * 'teams.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const teams = {
+  'teams.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/teams`,
+    tags: ['live-write'],
+  },
+  'teams.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, teamId }) => `/api/orgs/${orgId}/teams/${teamId}`,
+    tags: ['live-write'],
+  },
+  'teams.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, teamId }) => `/api/orgs/${orgId}/teams/${teamId}`,
+    tags: ['live-safe'],
+  },
+  'teams.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/teams`,
+    tags: ['live-safe'],
+  },
+  'teams.members.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, teamId }) => `/api/orgs/${orgId}/teams/${teamId}/members`,
+    tags: ['live-write'],
+  },
+  'teams.members.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, teamId, user }) => `/api/orgs/${orgId}/teams/${teamId}/members/${user}`,
+    tags: ['live-write'],
+  },
+  'teams.provisionRoom': {
+    method: 'POST',
+    service: 'tasks',
+    path: ({ teamId }) => `/api/teams/${teamId}/provision-room`,
+    tags: ['live-write'],
+  },
+  'teams.update': {
+    method: 'PATCH',
+    service: 'auth',
+    path: ({ orgId, teamId }) => `/api/orgs/${orgId}/teams/${teamId}`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/telephony.js

@@ -0,0 +1,46 @@
+/**
+ * 'telephony.*' endpoints: per-number org binding for QuoxVoice (quox#695).
+ * Collector routes: GET/PUT/DELETE /api/v1/telephony/numbers[/:number],
+ * org-scoped (org_id query), PUT/DELETE are org-admin only.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const telephony = {
+  'telephony.numbers.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/telephony/numbers`,
+    tags: ['live-safe'],
+  },
+  'telephony.numbers.set': {
+    method: 'PUT',
+    service: 'collector',
+    path: ({ number }) => `/api/v1/telephony/numbers/${encodeURIComponent(number)}`,
+    tags: ['live-write'],
+  },
+  'telephony.numbers.remove': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ number }) => `/api/v1/telephony/numbers/${encodeURIComponent(number)}`,
+    tags: ['live-write'],
+  },
+  'telephony.identities.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/telephony/identities`,
+    tags: ['live-safe'],
+  },
+  'telephony.identities.set': {
+    method: 'PUT',
+    service: 'collector',
+    path: ({ number }) => `/api/v1/telephony/identities/${encodeURIComponent(number)}`,
+    tags: ['live-write'],
+  },
+  'telephony.identities.remove': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ number }) => `/api/v1/telephony/identities/${encodeURIComponent(number)}`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/tg.js

@@ -0,0 +1,56 @@
+/**
+ * 'tg.*' endpoints — Telegram Pro (QTG-PRO P0), collector-direct
+ * (services/collector/server.js), no org segment in the URL — same shape
+ * as `quoxbox.*`/`quoxplan.*`/`traces.*`/`aee.*`/`mon.*`. Every route below
+ * is `requireServiceOrUserAuth()` server-side (X-Service-Key /
+ * INTERNAL_SERVICE_KEY or a user JWT), not org-scoped.
+ *
+ * - tg.status: GET /telegram-pro/onboarding/status (server.js, thin wrapper
+ *   around services/collector/lib/telegramPro/onboardingService.js
+ *   getOnboardingStatus()). Optional ?bot_id= query param.
+ * - tg.bindOwner: POST /telegram-pro/onboarding/bind-owner (onboardingService
+ *   bindOwner()) — 409 when a primary owner binding already exists for the
+ *   bot/chat, body carries the existing binding.
+ * - tg.leases.list: GET /session-leases (sessionLeaseStore.list()) — terminal
+ *   identity leases for parallel Claude Code sessions on this dev box.
+ * - tg.webhook.info: GET /webhook/telegram/info — bot_id is NOT yet honored
+ *   server-side (single-bot lookup only); passed through here so the CLI is
+ *   forward-compatible once the backend adds per-bot support.
+ * - tg.webhook.setup: POST /webhook/telegram/setup — registers the webhook
+ *   with Telegram and persists config via the auth service.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const tg = {
+  'tg.status': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/telegram-pro/onboarding/status`,
+    tags: ['live-safe'],
+  },
+  'tg.bindOwner': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/telegram-pro/onboarding/bind-owner`,
+    tags: ['live-write'],
+  },
+  'tg.leases.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/session-leases`,
+    tags: ['live-safe'],
+  },
+  'tg.webhook.info': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/webhook/telegram/info`,
+    tags: ['live-safe'],
+  },
+  'tg.webhook.setup': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/webhook/telegram/setup`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/tools.js

@@ -0,0 +1,50 @@
+/**
+ * 'tools.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const tools = {
+  'tools.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/tools`,
+    tags: ['live-write'],
+  },
+  'tools.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, toolId }) => `/api/orgs/${orgId}/tools/${toolId}`,
+    tags: ['live-write'],
+  },
+  'tools.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, toolId }) => `/api/orgs/${orgId}/tools/${toolId}`,
+    tags: ['live-safe'],
+  },
+  'tools.install-to-scope': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/tools/install-to-scope`,
+    tags: ['live-write'],
+  },
+  'tools.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/tools`,
+    tags: ['live-safe'],
+  },
+  'tools.publish': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, toolId }) => `/api/orgs/${orgId}/tools/${toolId}/publish`,
+    tags: ['live-write'],
+  },
+  'tools.update': {
+    method: 'PATCH',
+    service: 'auth',
+    path: ({ orgId, toolId }) => `/api/orgs/${orgId}/tools/${toolId}`,
+    tags: ['live-write'],
+  },
+};