quoxcli 0.0.0-stage → 0.3.1

package/lib/api/endpoints/qlarity.js

@@ -0,0 +1,122 @@
+/**
+ * 'qlarity.*' endpoints — Qlarity, governed browser inspection for dev servers
+ * (DEVSUITE-CLARIFY). Proxied through the collector
+ * (services/collector/server.js: app.all('/api/v1/qlarity/*', ...) rewrites to
+ * QLARITY_URL/api/v1/*, port 3109).
+ *
+ * Unlike the quoxplan proxy, this one is org-resolved and licence-gated from
+ * its first commit, so every call here can return 403 for an unlicensed org.
+ * That is the gate working, not a fault, and the command layer says so.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const qlarity = {
+  'qlarity.health': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/qlarity/health`,
+    tags: ['live-safe'],
+  },
+  'qlarity.inspectors.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/qlarity/inspectors`,
+    tags: ['live-safe'],
+  },
+  // NO-ENV-ONLY-CONFIG: the per-ORG allowlist a customer can actually manage.
+  // Distinct from 'qlarity.allowlist' above, which reports the install-wide
+  // env-var list the operator set. These are collector-owned routes, not
+  // proxied to the QLarity service, hence the different path prefix.
+  'qlarity.orgAllowlist.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/qlarity-allowlist`,
+    tags: ['live-safe'],
+  },
+  'qlarity.orgAllowlist.add': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/qlarity-allowlist`,
+  },
+  'qlarity.orgAllowlist.remove': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ origin }) => `/api/v1/qlarity-allowlist?origin=${encodeURIComponent(origin)}`,
+  },
+  'qlarity.allowlist': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/qlarity/allowlist`,
+    tags: ['live-safe'],
+  },
+  'qlarity.sessions.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/qlarity/sessions`,
+    tags: ['live-safe'],
+  },
+  'qlarity.session.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/qlarity/sessions`,
+  },
+  'qlarity.session.close': {
+    method: 'DELETE',
+    service: 'collector',
+    path: (p) => `/api/v1/qlarity/sessions/${p.sessionId}`,
+  },
+  'qlarity.session.open': {
+    method: 'POST',
+    service: 'collector',
+    path: (p) => `/api/v1/qlarity/sessions/${p.sessionId}/open`,
+  },
+  'qlarity.session.inspect': {
+    method: 'POST',
+    service: 'collector',
+    path: (p) => `/api/v1/qlarity/sessions/${p.sessionId}/inspect`,
+  },
+  'qlarity.session.blocked': {
+    method: 'GET',
+    service: 'collector',
+    path: (p) => `/api/v1/qlarity/sessions/${p.sessionId}/blocked`,
+    tags: ['live-safe'],
+  },
+  'qlarity.session.console': {
+    method: 'GET',
+    service: 'collector',
+    path: (p) => `/api/v1/qlarity/sessions/${p.sessionId}/console`,
+    tags: ['live-safe'],
+  },
+  'qlarity.session.network': {
+    method: 'GET',
+    service: 'collector',
+    path: (p) => `/api/v1/qlarity/sessions/${p.sessionId}/network`,
+    tags: ['live-safe'],
+  },
+  'qlarity.session.screenshot': {
+    method: 'POST',
+    service: 'collector',
+    path: (p) => `/api/v1/qlarity/sessions/${p.sessionId}/screenshot`,
+  },
+  /** Always files an approval; never executes inline. */
+  'qlarity.session.eval': {
+    method: 'POST',
+    service: 'collector',
+    path: (p) => `/api/v1/qlarity/sessions/${p.sessionId}/eval`,
+  },
+  /**
+   * Governed authed-session bootstrap (issue #15). Body carries
+   * `credential_id` (a stored `browser_login` vault credential), never a raw
+   * password — the collector resolves it server-side and forwards the
+   * resolved fields to qlarity on the internal network only. See
+   * server.js's resolveQlarityLoginCredential.
+   */
+  'qlarity.session.login': {
+    method: 'POST',
+    service: 'collector',
+    path: (p) => `/api/v1/qlarity/sessions/${p.sessionId}/login`,
+  },
+};
+
+export default qlarity;

package/lib/api/endpoints/quoxbox.js

@@ -0,0 +1,55 @@
+/**
+ * 'quoxbox.*' endpoints — QuoxBox governed Mac-mini agent gateway, proxied
+ * through the collector (services/collector/routes/quoxbox-proxy.js,
+ * mounted at /api/quoxbox). Collector-direct, no org segment in the URL —
+ * same shape as `traces.*`/`aee.*`/`mon.*`. requireAuth() is applied to
+ * every route server-side (org-scoped, no anonymous access), but the
+ * gateway itself (and its bearer token) never reach the browser/CLI.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const quoxbox = {
+  'quoxbox.live': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/quoxbox/live`,
+    tags: ['live-safe'],
+  },
+  'quoxbox.workflows.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/quoxbox/workflows`,
+    tags: ['live-safe'],
+  },
+  'quoxbox.task.run': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/quoxbox/task/run`,
+    tags: ['live-write'],
+  },
+  'quoxbox.task.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ taskId }) => `/api/quoxbox/task/${taskId}`,
+    tags: ['live-safe'],
+  },
+  'quoxbox.approve': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ approvalId }) => `/api/quoxbox/approve/${approvalId}`,
+    tags: ['live-write'],
+  },
+  'quoxbox.deny': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ approvalId }) => `/api/quoxbox/deny/${approvalId}`,
+    tags: ['live-write'],
+  },
+  'quoxbox.mode.set': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/quoxbox/mode`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/quoxchat.js

@@ -0,0 +1,54 @@
+/**
+ * 'quoxchat.*' endpoints — QuoxChat website-widget management (auth service,
+ * services/auth/routes/widgets.js, mounted at plain `/api`, requireOrgMembership).
+ *
+ * Covers the QuoxChat Pro operator availability surface: `operator_online` and
+ * `office_hours_json` live on the widget row and are toggled via the widget
+ * PATCH route (plan-gated fields return 402 `plan_upgrade_required`).
+ *
+ * Live-support desk parity (QuoxChat Pro /live-support view): conversations
+ * list/transcript come from services/auth/routes/widgets.js; operator-reply
+ * comes from the separate org-authed router in
+ * services/auth/routes/internal-widget-matrix.js (widgetConversationOrgRouter,
+ * mounted at plain `/api` in server.js), which derives sender identity
+ * server-side and 409s when the conversation isn't `handed_off`.
+ */
+
+export const quoxchat = {
+  'quoxchat.widgets.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, widgetId }) => `/api/orgs/${orgId}/widgets/${widgetId}`,
+    tags: ['live-safe'],
+  },
+  'quoxchat.widgets.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/widgets`,
+    tags: ['live-safe'],
+  },
+  'quoxchat.widgets.update': {
+    method: 'PATCH',
+    service: 'auth',
+    path: ({ orgId, widgetId }) => `/api/orgs/${orgId}/widgets/${widgetId}`,
+    tags: ['live-write'],
+  },
+  'quoxchat.conversations.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, widgetId }) => `/api/orgs/${orgId}/widgets/${widgetId}/conversations`,
+    tags: ['live-safe'],
+  },
+  'quoxchat.conversations.messages.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, widgetId, conversationId }) => `/api/orgs/${orgId}/widgets/${widgetId}/conversations/${conversationId}/messages`,
+    tags: ['live-safe'],
+  },
+  'quoxchat.conversations.reply.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, widgetId, conversationId }) => `/api/orgs/${orgId}/widgets/${widgetId}/conversations/${conversationId}/operator-reply`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/quoxflow.js

@@ -0,0 +1,32 @@
+/**
+ * 'quoxflow.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const quoxflow = {
+  'quoxflow.evidence.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/quoxflow/evidence`,
+    tags: ['live-safe'],
+  },
+  'quoxflow.observations.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/quoxflow/observations`,
+    tags: ['live-safe'],
+  },
+  'quoxflow.skills.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/quoxflow/skills/${id}`,
+    tags: ['live-safe'],
+  },
+  'quoxflow.skills.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/quoxflow/skills`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/quoxplan.js

@@ -0,0 +1,121 @@
+/**
+ * 'quoxplan.*' endpoints — QuoxPlan (the productised planning suite,
+ * STREAM_QUOXPLAN_PLAN.md), proxied through the collector
+ * (services/collector/server.js: app.all('/api/v1/quoxplan/*', ...) rewrites
+ * to QUOXPLAN_URL/api/v1/*, port 3107). Collector-direct, no org segment in
+ * the URL — same shape as `quoxbox.*`/`traces.*`/`aee.*`/`mon.*`: the proxy
+ * applies requireServiceOrUserAuth() server-side, no per-org scoping yet
+ * (QuoxPlan is dummy-data-only until the P5 multi-tenant phase).
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const quoxplan = {
+  'quoxplan.roadmaps.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/quoxplan/roadmaps`,
+    tags: ['live-safe'],
+  },
+  // Roadmap-create primitive (ONBOARD step 0): there was no `roadmap create`
+  // verb, only list. The wizard needs a governed way to give a fresh tenant
+  // its own roadmap. Collector proxies POST /api/v1/quoxplan/roadmaps to the
+  // QuoxPlan server, same governed path as every other quoxplan.* entry.
+  'quoxplan.roadmaps.create': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/quoxplan/roadmaps`,
+    tags: ['live-write'],
+  },
+  // Read-only free-text search over streams (id, name, summary, notes, plan, phase titles).
+  'quoxplan.search': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/quoxplan/search`,
+    tags: ['live-safe'],
+  },
+  'quoxplan.roadmap.streams.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/streams`,
+    tags: ['live-safe'],
+  },
+  'quoxplan.roadmap.timeline.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/timeline`,
+    tags: ['live-safe'],
+  },
+  'quoxplan.roadmap.reprioritise': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/reprioritise`,
+    tags: ['live-write'],
+  },
+  'quoxplan.roadmap.streams.create': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/streams`,
+    tags: ['live-write'],
+  },
+  'quoxplan.roadmap.export.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ roadmapId }) => `/api/v1/quoxplan/roadmaps/${roadmapId}/export`,
+    tags: ['live-safe'],
+  },
+  'quoxplan.stream.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxplan/streams/${id}`,
+    tags: ['live-safe'],
+  },
+  'quoxplan.stream.update': {
+    method: 'PATCH',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxplan/streams/${id}`,
+    tags: ['live-write'],
+  },
+  'quoxplan.stream.rename': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxplan/streams/${id}/rename`,
+    tags: ['live-write'],
+  },
+  'quoxplan.stream.notes.create': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxplan/streams/${id}/notes`,
+    tags: ['live-write'],
+  },
+  'quoxplan.stream.phases.create': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxplan/streams/${id}/phases`,
+    tags: ['live-write'],
+  },
+  'quoxplan.phase.update': {
+    method: 'PATCH',
+    service: 'collector',
+    path: ({ phaseId }) => `/api/v1/quoxplan/phases/${phaseId}`,
+    tags: ['live-write'],
+  },
+  'quoxplan.phase.delete': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ phaseId }) => `/api/v1/quoxplan/phases/${phaseId}`,
+    tags: ['live-write'],
+  },
+  'quoxplan.stream.plan.put': {
+    method: 'PUT',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxplan/streams/${id}/plan`,
+    tags: ['live-write'],
+  },
+  'quoxplan.stream.plan.versions.list': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxplan/streams/${id}/plan/versions`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/quoxseo.js

@@ -0,0 +1,114 @@
+/**
+ * 'quoxseo.*' endpoints — QuoxSEO, the witnessed SEO warehouse (QUOXSEO S2).
+ * Proxied through the collector (services/collector/server.js:
+ * app.all('/api/v1/quoxseo/*', ...) rewrites to QUOXSEO_URL/api/v1/*, port
+ * 3110, repo quoxai/quox-seo). Entitlement-gated from the first commit; a
+ * 403 is the licence gate working. The surface is read-only by design bar
+ * ONE governed mutation, site registration (quox#583): ingest and witnessing
+ * run on a server-side timer, never through HTTP.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const quoxseo = {
+  'quoxseo.health': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/quoxseo/health`,
+    tags: ['live-safe'],
+  },
+  'quoxseo.summary': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/quoxseo/summary`,
+    tags: ['live-safe'],
+  },
+  'quoxseo.urls': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ query = '' }) => `/api/v1/quoxseo/urls${query}`,
+    tags: ['live-safe'],
+  },
+  'quoxseo.url.detail': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ path: urlPath }) => `/api/v1/quoxseo/urls/detail?path=${encodeURIComponent(urlPath)}`,
+    tags: ['live-safe'],
+  },
+  'quoxseo.crawls': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/quoxseo/crawls`,
+    tags: ['live-safe'],
+  },
+  'quoxseo.changes': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ query = '' }) => `/api/v1/quoxseo/changes${query}`,
+    tags: ['live-safe'],
+  },
+  'quoxseo.verify': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/quoxseo/verify`,
+    tags: ['live-safe'],
+  },
+  'quoxseo.trends': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ query = '' }) => `/api/v1/quoxseo/trends${query}`,
+    tags: ['live-safe'],
+  },
+  'quoxseo.inspection': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ query = '' }) => `/api/v1/quoxseo/inspection${query}`,
+    tags: ['live-safe'],
+  },
+  // quox#583: the org's registered properties, and the one governed write.
+  'quoxseo.sites': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/quoxseo/properties`,
+    tags: ['live-safe'],
+  },
+  'quoxseo.sites.add': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/quoxseo/sites`,
+  },
+  // Symmetric removal (quoxwebsite#63); org-scoped at the collector proxy.
+  'quoxseo.sites.remove': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/quoxseo/sites/${encodeURIComponent(id)}`,
+  },
+  // quox#676: governed report delivery (email via instance SMTP and/or the HITL
+  // inbox, AEE-witnessed at the collector).
+  'quoxseo.report.deliver': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/quoxseo/report/deliver`,
+  },
+  // Paid layer (DataForSEO), read-only over data already bought and persisted
+  // by the CLI/scheduler; these three never trigger a paid DataForSEO call
+  // themselves. See quox-seo/server/src/server.mjs for the route handlers.
+  'quoxseo.keywords': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ query = '' }) => `/api/v1/quoxseo/keywords${query}`,
+    tags: ['live-safe'],
+  },
+  'quoxseo.gaps': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ query = '' }) => `/api/v1/quoxseo/gaps${query}`,
+    tags: ['live-safe'],
+  },
+  'quoxseo.backlinks': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ query = '' }) => `/api/v1/quoxseo/backlinks${query}`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/reach.js

@@ -0,0 +1,47 @@
+/**
+ * 'reach.*' endpoints — an agent's governed blast radius (BLAST-RADIUS-P0/P1/P2).
+ * Proxied straight through to the collector route:
+ * services/collector/server.js: GET /orgs/:orgId/agents/:agentId/reach
+ * (requireServiceOrUserAuth: JWT or service key).
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const reach = {
+  'reach.agent.get': {
+    method: 'GET',
+    service: 'collector',
+    path: (p) => `/orgs/${p.orgId}/agents/${p.agentId}/reach`,
+    tags: ['live-safe'],
+  },
+  // BLAST-RADIUS-P4: predicted-vs-actual least-privilege report.
+  // services/collector/server.js: GET /orgs/:orgId/agents/:agentId/reach/least-privilege
+  'reach.agent.leastPrivilege': {
+    method: 'GET',
+    service: 'collector',
+    path: (p) => `/orgs/${p.orgId}/agents/${p.agentId}/reach/least-privilege${p.days ? `?days=${encodeURIComponent(p.days)}` : ''}`,
+    tags: ['live-safe'],
+  },
+  // OPGOV quox#573: org-wide rollup of the same grant graph (the agent CMDB).
+  // services/collector/server.js: GET /orgs/:orgId/inventory
+  // OPGOV quox#573 phase 3: witnessed drift vs the last stored snapshot.
+  // services/collector/server.js: GET /orgs/:orgId/inventory/drift
+  'reach.org.inventory.drift': {
+    method: 'GET',
+    service: 'collector',
+    path: (p) => `/orgs/${p.orgId}/inventory/drift`,
+  },
+  'reach.org.inventory': {
+    method: 'GET',
+    service: 'collector',
+    path: (p) => {
+      const q = [];
+      if (p.days) q.push(`days=${encodeURIComponent(p.days)}`);
+      if (p.unused === true) q.push('unused=true');
+      return `/orgs/${p.orgId}/inventory${q.length ? `?${q.join('&')}` : ''}`;
+    },
+    tags: ['live-safe'],
+  },
+};
+
+export default reach;

package/lib/api/endpoints/router.js

@@ -0,0 +1,17 @@
+/**
+ * 'router.*' endpoints: RouterOS identity (quoxai/quox#1236).
+ * Collector route: GET /api/v1/mikrotik/tls-fingerprint (requireServiceOrUserAuth).
+ * Handshake only: the collector reads the certificate the configured router
+ * endpoint presents and sends NO credentials. Nothing is stored or pinned.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const router = {
+  'router.tlsFingerprint': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/mikrotik/tls-fingerprint`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/runs.js

@@ -0,0 +1,38 @@
+/**
+ * 'runs.*' endpoints — extracted from the former monolithic
+ * cli/lib/api/endpoints.js as part of the per-domain fragment split.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const runs = {
+  'runs.cancel': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, runId }) => `/api/orgs/${orgId}/runs/${runId}/cancel`,
+    tags: ['live-write'],
+  },
+  'runs.create': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/runs`,
+    tags: ['live-write'],
+  },
+  'runs.get': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, pollRunId }) => `/api/orgs/${orgId}/runs/${pollRunId}`,
+    tags: ['live-safe'],
+  },
+  'runs.list': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId }) => `/api/orgs/${orgId}/runs`,
+    tags: ['live-safe'],
+  },
+  'runs.resume': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, runId }) => `/api/orgs/${orgId}/runs/${runId}/resume`,
+    tags: ['live-write'],
+  },
+};

package/lib/api/endpoints/safety.js

@@ -0,0 +1,53 @@
+/**
+ * 'safety.*' endpoints — kill switch / DEFCON (quox#503/#505/#506/#507).
+ * Collector routes/safetyGate.js, mounted at /api/v1/safety behind
+ * requireServiceOrUserAuth(); mutations additionally require a HUMAN admin
+ * server-side (requireHumanAdmin rejects agent/resident/service tokens BY
+ * DESIGN — an agent must never flip its own kill switch).
+ */
+
+export const safety = {
+  'safety.status': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/safety/status`,
+    tags: ['live-safe'],
+  },
+  'safety.gate': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ agentId }) => `/api/v1/safety/gate?agent_id=${encodeURIComponent(agentId)}`,
+    tags: ['live-safe'],
+  },
+  'safety.estop': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ agentId }) => `/api/v1/safety/kill-switch/${encodeURIComponent(agentId)}`,
+    tags: ['live-write'],
+  },
+  'safety.release': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ agentId }) => `/api/v1/safety/kill-switch/${encodeURIComponent(agentId)}`,
+    tags: ['live-write'],
+  },
+  'safety.defcon': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/safety/defcon`,
+    tags: ['live-write'],
+  },
+  'safety.history': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/safety/history`,
+    tags: ['live-safe'],
+  },
+  // QUOXON-STEPUP: a human with a live step-up token overrides ONE blocked action (collector routes/overrides.js).
+  'safety.override': {
+    method: 'POST',
+    service: 'collector',
+    path: () => `/api/v1/overrides`,
+    tags: ['live-write'],
+  },
+};