quoxcli 0.3.1 → 0.5.0

package/CHANGELOG.md

@@ -0,0 +1,61 @@
+# Changelog
+
+User-visible changes to the `quoxcli` package. Items marked *(unproven)* ship in
+the package and pass their tests, but nobody has run them end to end from the
+published package yet.
+
+## 0.5.0 (unreleased)
+
+### New commands
+- `quox wazuh`: first-class Wazuh commands. `agents`, `fim`, `sca`, `rootcheck`
+  and `coverage` are reads. `vulns --priority` ranks CVEs by CISA KEV, EPSS,
+  CVSS and how many hosts each one hits (driven live across the fleet before
+  this release). Fleet-wide reads cover up to 200 active agents (it was a
+  silent 25 before).
+- `quox wazuh report generate | list | show | verify`: signed vulnerability
+  reports. `verify` works offline against a pinned PEM or a raw key.
+  *(unproven from the package)*
+- `quox wazuh connect`, `quox wazuh hooks create | list | rotate | delete | install`,
+  `quox wazuh incidents [--open] [--since] | show | close | diagnose | escalate`
+  and `quox wazuh triage`. Writes go through one approval per call.
+  *(unproven from the package)*
+- `quox compliance reports list | show` (read): framework, period, score,
+  status per control and sampled evidence ids. `quox compliance jobs list`, and
+  jobs can now be named. *(unproven from the package)*
+- `quox tool installed` and `quox tool uninstall`, to read back and undo a
+  `quox tool install`. *(unproven from the package)*
+- `quox approvals approve | deny | list` by id or short tail, `quox approvals withdraw`
+  (the requester takes its own hold back), and `quox approvals call-me [status|on|off]`
+  (needs the quox-voice licence).
+- `quox connect <url>` with certificate pinning per profile (`--trust-cert`,
+  `--fingerprint`), and `quox server install` (with `--dry-run`, `--yes`, `--json`).
+- `quox notes seal init | status | new | open | edit | print`: ENQRYPT sealed
+  notes. Encryption happens on your machine and the server stores only the
+  envelope. *(unproven from the package)*
+- `quox admin users verify-email <email> --reason` (step-up PIN).
+- `quox memory sync`: Claude file memory is saved to Quox memory too
+  (idempotent; credential-shaped text is refused).
+- `quox inbox unread <id...>`, `quox x whoami | accounts`, `quox linkedin whoami`,
+  `quox workflow create | apply | import-n8n --activate` (a plain create is not armed).
+
+### Terminal UI (quoxon)
+- New approvals and questions open by themselves as the walkthrough card.
+- Approve verbs ask for the step-up PIN on a terminal; destructive approvals
+  need the target name typed.
+- Do not disturb and `/sleep` survive restarts; `/morningreport` gives a grouped
+  digest of what arrived while you were away.
+- `/mail` reads triaged email (read-only), `/outbox` queues `/say` sends that
+  failed on connectivity and sends them in order once you are back online.
+- Other-org approvals show on the bar, with a hint about how many more are waiting.
+- A secret paste guard asks before it sends text that looks like a credential,
+  and redacts it from history.
+- Extensions hot-reload, and extension host contract v1 is out (panels, tabs,
+  settings).
+
+### Fixes
+- An explicit `-p <profile>` with no session now fails, instead of quietly
+  using the service key.
+- `quox workflow update` finds engine workflows. `quox run list` fills in its
+  columns again.
+- Watch and loop streams back off and give up cleanly, instead of polling forever.
+- Docs links point at quox.ai/cli.

package/README.md

@@ -12,7 +12,7 @@ npm install -g quoxcli
 
 Needs Node.js 20 or later. This installs two commands: `quox`, and `quoxon` (an alias that opens the conversation).
 
-Docs: https://cli.quox.ai/docs/start/
+Docs: https://quox.ai/cli/docs/quickstart/
 
 ## Prerequisite: a running QuoxCORE
 
@@ -142,4 +142,4 @@ export NODE_EXTRA_CA_CERTS=/path/to/your-ca.pem
 Quox Community Source Licence 1.0. This is source-available software, not open source. You may self-host and inspect it freely; redistribution and repackaging are restricted. Read the full text in the `LICENSE` file or at https://github.com/quoxai/quoxcore.
 
 Website: https://quox.ai  
-CLI home: https://cli.quox.ai
+CLI home: https://quox.ai/cli

package/bin/quox.js

@@ -11,6 +11,14 @@ if (!process.env.QUOX_SESSION_ID && process.env.QUOX_SESSION_ID_FILE) {
   try { process.env.QUOX_SESSION_ID = (await import('node:fs')).readFileSync(process.env.QUOX_SESSION_ID_FILE, 'utf8').trim(); } catch { /* turn ended: no session */ }
 }
 
+// ONBOARD-P1: a profile that trusts its server's own certificate (quox connect) makes this run trust it too, via a
+// one-time re-run with NODE_EXTRA_CA_CERTS set for this process tree only. Before anything else loads.
+{
+  const { reexecWithProfileTrust } = await import('../lib/core/profileTrust.js');
+  const code = reexecWithProfileTrust(process.argv.slice(2), process.env);
+  if (code !== null) process.exit(code);
+}
+
 // CORTEX-BENCH: Node's fetch parses HTTP with a WebAssembly module, and V8
 // recompiles it at the optimising tier on a background thread; Node waits for
 // that compile before exiting, adding 350-700ms to every short command after
@@ -167,7 +175,17 @@ if (process.argv.includes('--no-color') || process.env.NO_COLOR) {
 const config = loadConfig(resolveProfileFlagFromArgv(process.argv.slice(2)));
 const auth = createAuth(config);
 const client = createClient(config, auth);
-const ctx = { config, auth, client, program };
+// A client on the SAME user's token for another org the user belongs to (minted per org, window scope, never moves the
+// profile's org). Lazy: nothing is minted unless a verb asks (approvals --org, the "more waiting in <org>" hint).
+let _orgClients = null;
+const clientForOrg = async (orgId) => {
+  if (!_orgClients) {
+    const { createWindowClient } = await import('../lib/quoxon/windowOrg.js');
+    _orgClients = createWindowClient({ config, auth, createClient }).clientForOrg;
+  }
+  return _orgClients(orgId);
+};
+const ctx = { config, auth, client, program, clientForOrg };
 
 // Register all command groups
 // Command groups, in registration order. CORTEX-BENCH (quox#7xx CLI startup):

package/bin/quoxon.js

@@ -1,6 +1,11 @@
 #!/usr/bin/env node
 import '../lib/core/prodEnv.js'; // first: production React unless NODE_ENV is set (before anything loads React)
-import { main } from '../lib/quoxon/main.js';
+{
+  const { reexecWithProfileTrust } = await import('../lib/core/profileTrust.js');
+  const code = reexecWithProfileTrust(process.argv.slice(2), process.env);
+  if (code !== null) process.exit(code);
+}
+const { main } = await import('../lib/quoxon/main.js');
 
 main().catch((err) => {
   console.error(err?.message || err);

package/lib/api/endpoints/actions.js

@@ -0,0 +1,15 @@
+/**
+ * 'actions.*' endpoints — Action Tracker items through the collector proxy
+ * (services/collector/server.js /api/v1/actions*, which forwards to the auth
+ * service's org-scoped actions routes with the caller's own bearer token).
+ * No org segment in the URL: the collector takes the org from the verified JWT.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const actions = {
+  'actions.list': { method: 'GET', service: 'collector', path: () => '/api/v1/actions', tags: ['live-safe'] },
+  'actions.create': { method: 'POST', service: 'collector', path: () => '/api/v1/actions', tags: ['live-write'] },
+  'actions.update': { method: 'PATCH', service: 'collector', path: ({ id }) => `/api/v1/actions/${id}`, tags: ['live-write'] },
+  'actions.delete': { method: 'DELETE', service: 'collector', path: ({ id }) => `/api/v1/actions/${id}`, tags: ['live-write'] },
+};

package/lib/api/endpoints/admin.js

@@ -17,6 +17,13 @@ export const admin = {
     path: () => '/api/admin/agent-identities',
     tags: ['admin-write'],
   },
+  // ADMIN-VERIFY-EMAIL: instance-admin + human + step-up (scope override). Served by services/auth/routes/admin.js.
+  'admin.users.verify_email': {
+    method: 'POST',
+    service: 'auth',
+    path: () => '/api/admin/users/verify-email',
+    tags: ['admin-write'],
+  },
   // Instance basics after setup (app URL etc). Served by services/auth/routes/admin-instance.js.
   'admin.instance.basics.get': {
     method: 'GET',
@@ -43,6 +50,26 @@ export const admin = {
     path: () => '/api/admin/instance/lan-targets',
     tags: ['admin-write'],
   },
+  // SECURITY containment (2026-10-26): orgs allowed to run QLoop loops in-server (core-local). Served by
+  // services/auth/routes/admin-instance.js; writes are instance-admin only.
+  'admin.instance.core_local_orgs.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => '/api/admin/instance/core-local-orgs',
+    tags: ['live-safe'],
+  },
+  'admin.instance.core_local_orgs.add': {
+    method: 'POST',
+    service: 'auth',
+    path: () => '/api/admin/instance/core-local-orgs',
+    tags: ['admin-write'],
+  },
+  'admin.instance.core_local_orgs.remove': {
+    method: 'DELETE',
+    service: 'auth',
+    path: ({ orgId }) => `/api/admin/instance/core-local-orgs/${orgId}`,
+    tags: ['admin-write'],
+  },
   'admin.config.update': {
     method: 'PATCH',
     service: 'auth',

package/lib/api/endpoints/agent-attach.js

@@ -27,6 +27,13 @@ export const agentAttach = {
     path: ({ leaseId }) => `/api/agent-attach/lease/${encodeURIComponent(leaseId)}/release`,
     tags: ['live-write'],
   },
+  // Org-wide list of live attaches (org owner/admin). Feeds `quox agent attaches` and the quoxon /roster.
+  'agent-attach.list': {
+    method: 'GET',
+    service: 'auth',
+    path: () => '/api/agent-attach',
+    tags: ['live-safe'],
+  },
   'agent-attach.status': {
     method: 'GET',
     service: 'auth',

package/lib/api/endpoints/blog.js

@@ -0,0 +1,16 @@
+/**
+ * 'blog.*' endpoints: BLOG-DRAFT. Blog drafts are NotesQ notes in the blog-drafts collection,
+ * submitted and handed to the blog publisher through the collector
+ * (services/collector/lib/blogDraftRoutes.js). Nothing here publishes.
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+const B = '/api/v1/blog/drafts';
+
+export const blog = {
+  'blog.drafts.submit': { method: 'POST', service: 'collector', path: () => B, tags: ['live-write'] },
+  'blog.drafts.list': { method: 'GET', service: 'collector', path: () => B, tags: ['live-safe'] },
+  'blog.drafts.get': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/${id}`, tags: ['live-safe'] },
+  'blog.drafts.published': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/${id}/published`, tags: ['live-write'] },
+};

package/lib/api/endpoints/chat.js

@@ -11,6 +11,13 @@ export const chat = {
     path: () => `/chat/claude`,
     tags: ['live-write'],
   },
+  // CHAT-TIMEOUTS: poll an async chat turn (POST /chat/claude with Prefer: respond-async) by id.
+  'chat.turn.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/chat/turns/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
   'chat.status.list': {
     method: 'GET',
     service: 'collector',

package/lib/api/endpoints/compliance.js

@@ -0,0 +1,25 @@
+/**
+ * 'compliance.*' endpoints: scheduled compliance report jobs and generated reports.
+ * See cli/lib/api/endpoints/index.js for aggregation + the fragment convention.
+ */
+
+export const compliance = {
+  'compliance.jobs.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/compliance/jobs`,
+    tags: ['live-safe'],
+  },
+  'compliance.reports.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/compliance/reports`,
+    tags: ['live-safe'],
+  },
+  'compliance.reports.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/compliance/reports/${encodeURIComponent(id)}`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/contactsq.js

@@ -64,5 +64,9 @@ export const contactsq = {
   'contactsq.policy': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/policy`, tags: ['live-safe'] },
   'contactsq.handoffs.add': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/handoffs` },
   'contactsq.handoffs': { method: 'GET', service: 'collector', path: ({ id }) => `${B}/contacts/${id}/handoffs`, tags: ['live-safe'] },
+  // Scheduled sends: a human send (now or --at), the pending queue, cancel.
+  'contactsq.sends.create': { method: 'POST', service: 'collector', path: () => `${B}/sends`, tags: ['live-write'] },
+  'contactsq.sends.scheduled': { method: 'GET', service: 'collector', path: () => `${B}/sends/scheduled`, tags: ['live-safe'] },
+  'contactsq.sends.cancel': { method: 'POST', service: 'collector', path: ({ id }) => `${B}/sends/scheduled/${id}/cancel`, tags: ['live-write'] },
   'contactsq.settings.update': { method: 'PUT', service: 'collector', path: () => `${B}/settings`, tags: ['live-write'] },
 };

package/lib/api/endpoints/devServerRegistry.js

@@ -0,0 +1,25 @@
+/**
+ * 'devServerRegistry.*' endpoints: the org-scoped dev-server registry behind `quox server list|mark|go`
+ * and the TUI server chip (DEVFLEET). Collector-owned (services/collector/lib/devServerRegistryRoutes.js).
+ *
+ * See cli/lib/api/endpoints/index.js for the fragment convention.
+ */
+
+export const devServerRegistry = {
+  'devServerRegistry.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/dev-server-registry`,
+    tags: ['live-safe'],
+  },
+  'devServerRegistry.put': {
+    method: 'PUT',
+    service: 'collector',
+    path: ({ name }) => `/api/v1/dev-server-registry/${encodeURIComponent(name)}`,
+  },
+  'devServerRegistry.remove': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ name }) => `/api/v1/dev-server-registry/${encodeURIComponent(name)}`,
+  },
+};

package/lib/api/endpoints/engagement.js

@@ -36,6 +36,12 @@ export const engagement = {
     path: ({ id }) => `/api/v1/security/engagements/${id}`,
     tags: ['live-safe'],
   },
+  'engagement.verify': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/security/engagements/${id}/verify`,
+    tags: ['live-safe'],
+  },
   // Per-engagement gripe target: which repo a finding filed from this
   // engagement goes to, and which org's GitHub connector token files it.
   // lib/securityEngagement.js's setEngagementGripeTarget.
@@ -141,6 +147,26 @@ export const engagement = {
     path: ({ findingId }) => `/api/v1/security/findings/${findingId}/resolve`,
     tags: ['live-write'],
   },
+  // SITREP-FINDINGS: reconcile a finding against gathered evidence (issue state, fix commit
+  // landed or deployed). The collector decides; lib/securityFindings.js reconcileFinding.
+  'engagement.findings.reconcile': {
+    method: 'POST',
+    service: 'collector',
+    path: ({ findingId }) => `/api/v1/security/findings/${findingId}/reconcile`,
+    tags: ['live-write'],
+  },
+  'engagement.findings.reconciliations': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ findingId }) => `/api/v1/security/findings/${findingId}/reconciliations`,
+    tags: ['live-safe'],
+  },
+  'engagement.findings.open': {
+    method: 'GET',
+    service: 'collector',
+    path: () => '/api/v1/security/findings/open',
+    tags: ['live-safe'],
+  },
   // Re-grade a finding's severity after it was reported (quox#601). Governed +
   // witnessed; a reason is required. lib/securityFindings.js regradeFinding.
   'engagement.findings.regrade': {

package/lib/api/endpoints/evidence.js

@@ -0,0 +1,20 @@
+/**
+ * 'evidence.*' endpoints (DEVFLEET EV-1): read-only status of the evidence stores.
+ * Collector route, instance admin only (enforced server-side).
+ */
+
+export const evidence = {
+  'evidence.status': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/admin/evidence/status`,
+    tags: ['live-safe'],
+  },
+  // The signed zip for one conversation (collector GET /aee/conversation/:corr/bundle?format=zip), org-scoped server-side.
+  'evidence.bundle': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ corr }) => `/aee/conversation/${encodeURIComponent(corr)}/bundle`,
+    tags: ['live-safe'],
+  },
+};

package/lib/api/endpoints/hat.js

@@ -63,4 +63,18 @@ export const hat = {
     service: 'auth',
     path: ({ orgId, hatId }) => `/api/orgs/${orgId}/quoxhat/hats/${encodeURIComponent(hatId)}/reset-to-template`,
   },
+  // Merge-upgrade (2026-10-19): 3-way merge of an org-edited built-in onto the current
+  // template. Preview is a dry run (writes nothing); upgrade appends one system-authored
+  // revision (audited quoxhat.hat.template_merged) and refuses a stale preview (409).
+  'hat.upgrade.preview': {
+    method: 'GET',
+    service: 'auth',
+    path: ({ orgId, hatId }) => `/api/orgs/${orgId}/quoxhat/hats/${encodeURIComponent(hatId)}/upgrade-preview`,
+    tags: ['live-safe'],
+  },
+  'hat.upgrade': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, hatId }) => `/api/orgs/${orgId}/quoxhat/hats/${encodeURIComponent(hatId)}/upgrade`,
+  },
 };

package/lib/api/endpoints/inbox.js

@@ -30,6 +30,12 @@ export const inbox = {
     path: ({ orgId, itemId }) => `/api/orgs/${orgId}/inbox/${itemId}/respond`,
     tags: ['live-write'],
   },
+  'inbox.withdraw': {
+    method: 'POST',
+    service: 'auth',
+    path: ({ orgId, itemId }) => `/api/orgs/${orgId}/inbox/${itemId}/withdraw`,
+    tags: ['live-write'],
+  },
   // quox ask: a session files a decision request (one inbox item) and waits for the human's answer.
   'inbox.decision.create': {
     method: 'POST',

package/lib/api/endpoints/inboxq.js

@@ -26,6 +26,19 @@ export const inboxq = {
     path: ({ accountId }) => `/api/v1/inboxq/accounts/${accountId}`,
     tags: ['live-write'],
   },
+  // quox#1504: per-account TLS certificate pin (human org admin only).
+  'inboxq.accounts.tlsPin': {
+    method: 'PUT',
+    service: 'collector',
+    path: ({ accountId }) => `/api/v1/inboxq/accounts/${encodeURIComponent(accountId)}/tls-pin`,
+    tags: ['live-write'],
+  },
+  'inboxq.syncStatus': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/inboxq/sync-status`,
+    tags: ['live-safe'],
+  },
   'inboxq.messages.get': {
     method: 'GET',
     service: 'collector',
@@ -99,6 +112,12 @@ export const inboxq = {
     path: ({ watchId }) => `/api/v1/inboxq/watches/${watchId}/active`,
     tags: ['live-write'],
   },
+  'inboxq.watches.delete': {
+    method: 'DELETE',
+    service: 'collector',
+    path: ({ watchId }) => `/api/v1/inboxq/watches/${watchId}`,
+    tags: ['live-write'],
+  },
   'inboxq.proposals.list': {
     method: 'GET',
     service: 'collector',

package/lib/api/endpoints/index.js

@@ -50,6 +50,7 @@
  *   of silently landing in the wrong file.
  */
 
+import { actions } from './actions.js';
 import { admin } from './admin.js';
 import { aee } from './aee.js';
 import { agentAttach } from './agent-attach.js';
@@ -61,6 +62,7 @@ import { awareness } from './awareness.js';
 import { router } from './router.js';
 import { mind } from './mind.js';
 import { lucid } from './lucid.js';
+import { loops } from './loops.js';
 import { away } from './away.js';
 import { presence } from './presence.js';
 import { invites } from './invites.js';
@@ -72,6 +74,7 @@ import { budgets } from './budgets.js';
 import { calendarq } from './calendarq.js';
 import { catalog } from './catalog.js';
 import { chat } from './chat.js';
+import { compliance } from './compliance.js';
 import { consent } from './consent.js';
 import { conversations } from './conversations.js';
 import { customRoles } from './custom-roles.js';
@@ -83,10 +86,12 @@ import { engine } from './engine.js';
 import { executions } from './executions.js';
 import { file } from './file.js';
 import { files } from './files.js';
+import { evidence } from './evidence.js';
 import { governance } from './governance.js';
 import { inbox } from './inbox.js';
 import { inboxq } from './inboxq.js';
 import { notesq } from './notesq.js';
+import { blog } from './blog.js';
 import { contactsq } from './contactsq.js';
 import { x } from './x.js';
 import { llmPolicy } from './llm-policy.js';
@@ -106,6 +111,7 @@ import { quoxflow } from './quoxflow.js';
 import { quoxplan } from './quoxplan.js';
 import { qlarity } from './qlarity.js';
 import { fetchAllowlist } from './fetchAllowlist.js';
+import { devServerRegistry } from './devServerRegistry.js';
 import { quoxseo } from './quoxseo.js';
 import { telephony } from './telephony.js';
 import { voice } from './voice.js';
@@ -115,6 +121,7 @@ import { runs } from './runs.js';
 import { scim } from './scim.js';
 import { scopes } from './scopes.js';
 import { security } from './security.js';
+import { server } from './server.js';
 import { setup } from './setup.js';
 import { skills } from './skills.js';
 import { sso } from './sso.js';
@@ -136,6 +143,7 @@ import { webhooks } from './webhooks.js';
 import { workflows } from './workflows.js';
 
 export const ENDPOINTS = {
+  ...actions,
   ...admin,
   ...aee,
   ...agentAttach,
@@ -147,6 +155,7 @@ export const ENDPOINTS = {
   ...router,
   ...mind,
   ...lucid,
+  ...loops,
   ...away,
   ...presence,
   ...invites,
@@ -158,6 +167,7 @@ export const ENDPOINTS = {
   ...calendarq,
   ...catalog,
   ...chat,
+  ...compliance,
   ...consent,
   ...conversations,
   ...customRoles,
@@ -169,10 +179,12 @@ export const ENDPOINTS = {
   ...executions,
   ...file,
   ...files,
+  ...evidence,
   ...governance,
   ...inbox,
   ...inboxq,
   ...notesq,
+  ...blog,
   ...contactsq,
   ...x,
   ...llmPolicy,
@@ -192,6 +204,7 @@ export const ENDPOINTS = {
   ...quoxplan,
   ...qlarity,
   ...fetchAllowlist,
+  ...devServerRegistry,
   ...quoxseo,
   ...telephony,
   ...voice,
@@ -201,6 +214,7 @@ export const ENDPOINTS = {
   ...scim,
   ...scopes,
   ...security,
+  ...server,
   ...setup,
   ...skills,
   ...sso,

package/lib/api/endpoints/loops.js

@@ -0,0 +1,26 @@
+/**
+ * 'loops.*' endpoints: QLOOP-LIVE, observe a loop as it runs.
+ * Served by the collector (/api/v1/loops/*), which forwards the caller's identity to the tasks
+ * service that owns the durable per-loop event log. Contract: ~/quoxon-work/qloop-live-design.md section 1.
+ */
+
+export const loops = {
+  'loops.list': {
+    method: 'GET',
+    service: 'collector',
+    path: () => `/api/v1/loops`,
+    tags: ['live-safe'],
+  },
+  'loops.get': {
+    method: 'GET',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/loops/${id}`,
+    tags: ['live-safe'],
+  },
+  'loops.events': {
+    method: 'STREAM',
+    service: 'collector',
+    path: ({ id }) => `/api/v1/loops/${id}/events`,
+    tags: ['live-safe'],
+  },
+};