quoxcli 0.0.0-stage → 0.3.1

package/lib/api/endpoints/budgets.js

@@ -0,0 +1,62 @@
+/**
+ * 'budgets.*' endpoints — WP3.2 (docs/STREAM_CLI_PARITY_PLAN.md §2.3 #7).
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ *
+ * Backend: quoxflow (NOT the auth service, NOT proxied by collector) —
+ * quoxflow/src/api/routes/budgets.ts, mounted at `/api/budgets` (see
+ * quoxflow/src/api/app.ts). `service: 'quoxflow'` resolves via the
+ * SERVICE_PORTS.quoxflow=3200 entry (see cli/lib/api/endpoints/triggers.js
+ * header for the full access-path decision this fragment reuses).
+ *
+ * Org scoping is via `?org_id=` QUERY PARAM on GET (list/get/usage), NOT a
+ * path segment — unlike triggers.ts, this route IS org-checked server-side:
+ *   - list requires `org_id` (400 org_id_required if missing) and filters
+ *     `budgetStore.listBudgets({ org_id })` — no cross-tenant leak.
+ *   - get/usage: `org_id` is optional on the query, but if present is
+ *     checked against the budget's own `org_id` (403 forbidden on mismatch).
+ *     Omitting it entirely returns the budget regardless of owner org — the
+ *     CLI always sends org_id here to stay on the safe/scoped path.
+ *   - create: `org_id` required in the POST body.
+ *   - update (PATCH): `org_id` required in the body, checked against the
+ *     existing budget's org_id (403 on mismatch) before applying the patch.
+ *   - delete: `org_id` required in the body, checked the same way.
+ */
+
+export const budgets = {
+  'budgets.list': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: () => `/api/budgets`,
+    tags: ['live-safe'],
+  },
+  'budgets.get': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: ({ id }) => `/api/budgets/${id}`,
+    tags: ['live-safe'],
+  },
+  'budgets.create': {
+    method: 'POST',
+    service: 'quoxflow',
+    path: () => `/api/budgets`,
+    tags: ['live-write'],
+  },
+  'budgets.update': {
+    method: 'PATCH',
+    service: 'quoxflow',
+    path: ({ id }) => `/api/budgets/${id}`,
+    tags: ['live-write'],
+  },
+  'budgets.delete': {
+    method: 'DELETE',
+    service: 'quoxflow',
+    path: ({ id }) => `/api/budgets/${id}`,
+    tags: ['live-write'],
+  },
+  'budgets.usage': {
+    method: 'GET',
+    service: 'quoxflow',
+    path: ({ id }) => `/api/budgets/${id}/usage`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/calendarq.js

@@ -0,0 +1,71 @@
+/**
+ * 'calendarq.*' endpoints — Calendar-Q (governed calendar plugin), proxied
+ * through the collector (services/collector/server.js:
+ * /api/v1/calendarq/* -> Calendar-Q routes, org resolved server-side from
+ * auth). No org segment in the URL — same shape as `inboxq.*`.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const calendarq = {
+  'calendarq.status': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/calendarq/status`,
+    tags: ['live-safe'],
+  },
+  'calendarq.layers': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/calendarq/layers`,
+    tags: ['live-safe'],
+  },
+  'calendarq.agenda': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/calendarq/agenda`,
+    tags: ['live-safe'],
+  },
+  'calendarq.coverage': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/calendarq/coverage`,
+    tags: ['live-safe'],
+  },
+  'calendarq.changes': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/calendarq/changes`,
+    tags: ['live-safe'],
+  },
+  'calendarq.sync': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/calendarq/sync`,
+    tags: ['live-write'],
+  },
+  'calendarq.propose': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/calendarq/proposals`,
+    tags: ['live-safe'],
+  },
+  'calendarq.proposals': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/calendarq/proposals`,
+    tags: ['live-safe'],
+  },
+  'calendarq.reconcile': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ opId }) => `/api/v1/calendarq/reconcile/${encodeURIComponent(opId)}`,
+    tags: ['live-write'],
+  },
+  'calendarq.receipts': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/calendarq/receipts`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/catalog.js

@@ -0,0 +1,14 @@
+/**
+ * 'catalog.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const catalog = {
+  'catalog.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/catalog`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/chat.js

@@ -0,0 +1,61 @@
+/**
+ * 'chat.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const chat = {
+  'chat.claude': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/chat/claude`,
+    tags: ['live-write'],
+  },
+  'chat.status.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/chat/status`,
+    tags: ['live-safe'],
+  },
+  'chat.stream': {
+    method: 'STREAM',
+    service: 'collector',
+    path: () => `/chat/stream`,
+    tags: ['live-write'],
+  },
+  // CLI-QUOX B3: probe an Ollama URL server side (human org admin; GET <url>/api/tags; stores
+  // nothing) and list the saved Ollama connection's installed models.
+  'chat.providers.ollama.probe': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/providers/ollama/probe`,
+    tags: ['live-safe'],
+  },
+  // QUOXON-MODEL: live model list for the hosted providers (openai | anthropic), server cached 1 h.
+  'chat.providers.models': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ provider }) => `/api/v1/providers/${encodeURIComponent(provider)}/models`,
+    tags: ['live-safe'],
+  },
+  'chat.providers.ollama.models': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/providers/ollama/models`,
+    tags: ['live-safe'],
+  },
+  // CLI-QUOX B5: OpenAI-compatible presets. Probe a self-hosted or custom base URL server side
+  // (human org admin; stores nothing) and list the saved connection's models (key stays server side).
+  'chat.providers.compat.probe': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ preset }) => `/api/v1/providers/compat/${encodeURIComponent(preset)}/probe`,
+    tags: ['live-safe'],
+  },
+  'chat.providers.compat.models': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ preset }) => `/api/v1/providers/compat/${encodeURIComponent(preset)}/models`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/consent.js

@@ -0,0 +1,26 @@
+/**
+ * 'consent.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const consent = {
+  'consent.create': {
+    method: 'POST',
+    service: 'auth',
+    path: () => `/api/consent`,
+    tags: ['live-write'],
+  },
+  'consent.history.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/consent/history`,
+    tags: ['live-safe'],
+  },
+  'consent.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => `/api/consent`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/contactsq.js

@@ -0,0 +1,68 @@
+/**
+ * 'contactsq.*' endpoints — ContactsQ (governed contacts for people and agents),
+ * served by the collector at /api/v1/contactsq/*. Org is resolved server-side
+ * from auth; no org segment in the URL (same shape as `notesq.*`).
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+const B = '/api/v1/contactsq';
+
+export const contactsq = {
+  'contactsq.contacts.create': { method: 'POST', service: 'collector', path: () => `${B}/contacts`, tags: ['live-write'] },
+  'contactsq.contacts.list': { method: 'GET', service: 'collector', path: () => `${B}/contacts`, tags: ['live-safe'] },
+  'contactsq.contacts.get': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/contacts/${id}`, tags: ['live-safe'] },
+  'contactsq.contacts.update': { method: 'PUT', service: 'collector', path: ({ id }) => `${B}/contacts/${id}`, tags: ['live-write'] },
+  'contactsq.contacts.archive': { method: 'DELETE', service: 'collector', path: ({ id }) => `${B}/contacts/${id}`, tags: ['live-write'] },
+  'contactsq.identifiers.add': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/identifiers`, tags: ['live-write'] },
+  'contactsq.resolve': { method: 'POST', service: 'collector', path: () => `${B}/resolve`, tags: ['live-safe'] },
+  'contactsq.suppressions.create': { method: 'POST', service: 'collector', path: () => `${B}/suppressions`, tags: ['live-write'] },
+  'contactsq.suppressions.check': { method: 'POST', service: 'collector', path: () => `${B}/suppressions/check`, tags: ['live-safe'] },
+  'contactsq.search': { method: 'GET', service: 'collector', path: () => `${B}/search`, tags: ['live-safe'] },
+  'contactsq.focus.get': { method: 'GET', service: 'collector', path: () => `${B}/focus`, tags: ['live-safe'] },
+  'contactsq.leases.create': { method: 'POST', service: 'collector', path: () => `${B}/leases`, tags: ['live-write'] },
+  'contactsq.leases.list': { method: 'GET', service: 'collector', path: () => `${B}/leases`, tags: ['live-safe'] },
+  'contactsq.leases.revoke': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/leases/${id}/revoke`, tags: ['live-write'] },
+  'contactsq.grants.list': { method: 'GET', service: 'collector', path: () => `${B}/grants`, tags: ['live-safe'] },
+  'contactsq.grants.create': { method: 'POST', service: 'collector', path: () => `${B}/grants`, tags: ['live-write'] },
+  'contactsq.grants.revoke': { method: 'DELETE', service: 'collector', path: ({ id }) => `${B}/grants/${id}`, tags: ['live-write'] },
+  'contactsq.settings.get': { method: 'GET', service: 'collector', path: () => `${B}/settings`, tags: ['live-safe'] },
+  'contactsq.contacts.erase': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/erase`, tags: ['live-write'] },
+  'contactsq.contacts.dsar': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/dsar`, tags: ['live-safe'] },
+  'contactsq.contacts.noticeSent': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/notice-sent`, tags: ['live-write'] },
+  'contactsq.erasures.certificate': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/erasures/${id}/certificate`, tags: ['live-safe'] },
+  'contactsq.retention.status': { method: 'GET', service: 'collector', path: () => `${B}/retention/status`, tags: ['live-safe'] },
+  'contactsq.retention.run': { method: 'POST', service: 'collector', path: () => `${B}/retention/run`, tags: ['live-write'] },
+  'contactsq.compliance': { method: 'GET', service: 'collector', path: () => `${B}/compliance`, tags: ['live-safe'] },
+  'contactsq.processingRecord': { method: 'GET', service: 'collector', path: () => `${B}/processing-record`, tags: ['live-safe'] },
+  'contactsq.admin.rewrap': { method: 'POST', service: 'collector', path: () => `${B}/admin/rewrap`, tags: ['live-write'] },
+  'contactsq.admin.reindex': { method: 'POST', service: 'collector', path: () => `${B}/admin/reindex`, tags: ['live-write'] },
+  'contactsq.admin.strictNamesApply': { method: 'POST', service: 'collector', path: () => `${B}/admin/strict-names/apply`, tags: ['live-write'] },
+  'contactsq.suppressions.tombstoneLift': { method: 'POST', service: 'collector', path: () => `${B}/suppressions/tombstones/lift`, tags: ['live-write'] },
+  // P5: import (multipart), merge / unmerge, duplicates, facts.
+  'contactsq.import': { method: 'POST', service: 'collector', path: () => `${B}/import`, tags: ['live-write'] },
+  'contactsq.imports.list': { method: 'GET', service: 'collector', path: () => `${B}/imports`, tags: ['live-safe'] },
+  'contactsq.duplicates': { method: 'GET', service: 'collector', path: () => `${B}/duplicates`, tags: ['live-safe'] },
+  'contactsq.contacts.merge': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/merge`, tags: ['live-write'] },
+  'contactsq.merges.list': { method: 'GET', service: 'collector', path: () => `${B}/merges`, tags: ['live-safe'] },
+  'contactsq.merges.undo': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/merges/${id}/undo`, tags: ['live-write'] },
+  'contactsq.facts.list': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/facts`, tags: ['live-safe'] },
+  'contactsq.facts.add': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/facts`, tags: ['live-write'] },
+  'contactsq.facts.update': { method: 'PUT', service: 'collector', path: ({ id, factId }) => `${B}/contacts/${id}/facts/${factId}`, tags: ['live-write'] },
+  // P7: CardDAV pull sync (one way, org admin, human only).
+  'contactsq.sync.list': { method: 'GET', service: 'collector', path: () => `${B}/sync/sources`, tags: ['live-safe'] },
+  'contactsq.sync.add': { method: 'POST', service: 'collector', path: () => `${B}/sync/sources`, tags: ['live-write'] },
+  'contactsq.sync.update': { method: 'PATCH', service: 'collector', path: ({ id }) => `${B}/sync/sources/${id}`, tags: ['live-write'] },
+  'contactsq.sync.run': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/sync/sources/${id}/run`, tags: ['live-write'] },
+  'contactsq.sync.remove': { method: 'DELETE', service: 'collector', path: ({ id }) => `${B}/sync/sources/${id}`, tags: ['live-write'] },
+  // P8a: morning brief, timeline / touchpoints / policy (selftest), handoff notes.
+  'contactsq.brief': { method: 'GET', service: 'collector', path: () => `${B}/brief`, tags: ['live-safe'] },
+  'contactsq.count': { method: 'GET', service: 'collector', path: () => `${B}/count`, tags: ['live-safe'] },
+  'contactsq.timeline': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/timeline`, tags: ['live-safe'] },
+  'contactsq.touchpoints.add': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/touchpoints`, tags: ['live-write'] },
+  'contactsq.best_channel': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/best-channel`, tags: ['live-safe'] },
+  'contactsq.policy': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/policy`, tags: ['live-safe'] },
+  'contactsq.handoffs.add': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/handoffs` },
+  'contactsq.handoffs': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/handoffs`, tags: ['live-safe'] },
+  'contactsq.settings.update': { method: 'PUT', service: 'collector', path: () => `${B}/settings`, tags: ['live-write'] },
+};

package/lib/api/endpoints/conversations.js

@@ -0,0 +1,46 @@
+/**
+ * 'conversations.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const conversations = {
+  // #1016: chat conversations (the collector's chat_session_turns, what chat writes). The memory-service
+  // routes below are the IMPORTED conversation archive, reached with --archive.
+  'conversations.chat.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/conversations`,
+    tags: ['live-safe'],
+  },
+  'conversations.chat.turns': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/conversations/${encodeURIComponent(id)}/turns`,
+    tags: ['live-safe'],
+  },
+  'conversations.get': {
+    method: 'GET',
+    service: 'memory',
+    path: ({ id }) => `/api/conversations/${id}`,
+    tags: ['live-safe'],
+  },
+  'conversations.list': {
+    method: 'GET',
+    service: 'memory',
+    path: () => `/api/conversations`,
+    tags: ['live-safe'],
+  },
+  'conversations.search.list': {
+    method: 'GET',
+    service: 'memory',
+    path: () => `/api/conversations/search`,
+    tags: ['live-safe'],
+  },
+  'conversations.stats.list': {
+    method: 'GET',
+    service: 'memory',
+    path: () => `/api/conversations/stats`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/custom-roles.js

@@ -0,0 +1,92 @@
+/**
+ * 'custom-roles.*' endpoints — WP3.1 (docs/STREAM_CLI_PARITY_PLAN.md §2.3 #6).
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ *
+ * Backend: services/auth/routes/customRoles.js, mounted at plain `/api`
+ * (server.js:578 `app.use('/api', customRolesRoutes)`) — org-scoped IN the
+ * URL (`/api/orgs/:orgId/custom-roles...`). Gated enterprise-tier +
+ * ORG_MANAGE_ROLES. Verified at the handler: every route resolves the role
+ * through `getCustomRole(db, req.org.id, roleId)` first, so a roleId from
+ * another org 404s rather than leaking; no cross-tenant read/write path.
+ *
+ * The capabilities/agents/tools DELETE routes take their identifying
+ * fields (`capability`/`agent_id`/`tool_id`, plus optional `scope_id`) as
+ * EITHER query params or a body field (`req.query.x || req.body?.x`,
+ * customRoles.js:199,246,283) — we send them as query params here to match
+ * the other DELETE-with-filter routes in this CLI (e.g. plugins.data.delete).
+ */
+
+export const customRoles = {
+  'custom-roles.agents.clear': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, roleId }) => `/api/orgs/${orgId}/custom-roles/${roleId}/agents`,
+    tags: ['live-write'],
+  },
+  'custom-roles.agents.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, roleId }) => `/api/orgs/${orgId}/custom-roles/${roleId}/agents`,
+    tags: ['live-safe'],
+  },
+  'custom-roles.agents.set': {
+    method: 'PUT',
+    service: 'auth',
+    path: ({ orgId, roleId }) => `/api/orgs/${orgId}/custom-roles/${roleId}/agents`,
+    tags: ['live-write'],
+  },
+  'custom-roles.capabilities.add': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, roleId }) => `/api/orgs/${orgId}/custom-roles/${roleId}/capabilities`,
+    tags: ['live-write'],
+  },
+  'custom-roles.capabilities.remove': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, roleId }) => `/api/orgs/${orgId}/custom-roles/${roleId}/capabilities`,
+    tags: ['live-write'],
+  },
+  'custom-roles.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/custom-roles`,
+    tags: ['live-write'],
+  },
+  'custom-roles.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, roleId }) => `/api/orgs/${orgId}/custom-roles/${roleId}`,
+    tags: ['live-write'],
+  },
+  'custom-roles.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, roleId }) => `/api/orgs/${orgId}/custom-roles/${roleId}`,
+    tags: ['live-safe'],
+  },
+  'custom-roles.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/custom-roles`,
+    tags: ['live-safe'],
+  },
+  'custom-roles.tools.clear': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, roleId }) => `/api/orgs/${orgId}/custom-roles/${roleId}/tools`,
+    tags: ['live-write'],
+  },
+  'custom-roles.tools.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, roleId }) => `/api/orgs/${orgId}/custom-roles/${roleId}/tools`,
+    tags: ['live-safe'],
+  },
+  'custom-roles.tools.set': {
+    method: 'PUT',
+    service: 'auth',
+    path: ({ orgId, roleId }) => `/api/orgs/${orgId}/custom-roles/${roleId}/tools`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/divisions.js

@@ -0,0 +1,56 @@
+/**
+ * 'divisions.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const divisions = {
+  'divisions.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/divisions`,
+    tags: ['live-write'],
+  },
+  'divisions.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, divId }) => `/api/orgs/${orgId}/divisions/${divId}`,
+    tags: ['live-write'],
+  },
+  'divisions.departments.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, division }) => `/api/orgs/${orgId}/divisions/${division}/departments`,
+    tags: ['live-write'],
+  },
+  'divisions.departments.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, division, deptId }) => `/api/orgs/${orgId}/divisions/${division}/departments/${deptId}`,
+    tags: ['live-write'],
+  },
+  'divisions.departments.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, division }) => `/api/orgs/${orgId}/divisions/${division}/departments`,
+    tags: ['live-safe'],
+  },
+  'divisions.departments.update': {
+    method: 'PATCH',
+    service: 'auth',
+    path: ({ orgId, division, deptId }) => `/api/orgs/${orgId}/divisions/${division}/departments/${deptId}`,
+    tags: ['live-write'],
+  },
+  'divisions.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/divisions`,
+    tags: ['live-safe'],
+  },
+  'divisions.update': {
+    method: 'PATCH',
+    service: 'auth',
+    path: ({ orgId, divId }) => `/api/orgs/${orgId}/divisions/${divId}`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/domains.js

@@ -0,0 +1,38 @@
+/**
+ * 'domains.*' endpoints — WP3.1 (docs/STREAM_CLI_PARITY_PLAN.md §2.3 #6).
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ *
+ * Backend: services/auth/routes/domains.js, mounted at plain `/api`
+ * (server.js:640 `app.use('/api', domainsRoutes)`) — org-scoped IN the URL
+ * (`/api/orgs/:orgId/domains...`). Gated team-tier+ + ORG_MANAGE_SETTINGS.
+ * Verified at the handler: list/create/verify/delete all operate through
+ * `req.org.id` (domainVerification.js helpers take orgId as an explicit
+ * param on every query), so a domainId from another org is not reachable.
+ */
+
+export const domains = {
+  'domains.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/domains`,
+    tags: ['live-write'],
+  },
+  'domains.delete': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId, domainId }) => `/api/orgs/${orgId}/domains/${domainId}`,
+    tags: ['live-write'],
+  },
+  'domains.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/domains`,
+    tags: ['live-safe'],
+  },
+  'domains.verify': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, domainId }) => `/api/orgs/${orgId}/domains/${domainId}/verify`,
+    tags: ['live-write'],
+  },
+};