aipctl 2026.10.1 → 2026.10.2

package/build/index.cjs

@@ -89670,7 +89670,7 @@ const injectedBuildEnv = "dev".length > 0 ? "dev" : "local";
 if (!isBuildEnv(injectedBuildEnv)) {
   throw new Error(`Invalid AIPCTL_BUILD_ENV: ${injectedBuildEnv}`);
 }
-const VERSION = "2026.10.1".length > 0 ? "2026.10.1" : "0.0.0";
+const VERSION = "2026.10.2".length > 0 ? "2026.10.2" : "0.0.0";
 const BUILD_ENV = injectedBuildEnv;
 const INCLUDE_NATIVE_LOGS = BUILD_ENV !== "prod";
 
@@ -89878,7 +89878,14 @@ const implementedCommandOperationIds = /* @__PURE__ */ new Set([
   "createCliAutomation",
   "updateCliAutomation",
   "deleteCliAutomation",
-  "updateCliAutomationStatus"
+  "updateCliAutomationStatus",
+  "getCliCreditUsage",
+  "listCliTopUsers",
+  "getCliDailyUsageGraph",
+  "listCliDailyUsers",
+  "listCliTopMcpTools",
+  "listCliAuditLogs",
+  "listCliAuditEventTypes"
 ]);
 const releaseEnabledCommandOperationIds = /* @__PURE__ */ new Set([
   "listCliAgents",
@@ -89928,7 +89935,14 @@ const releaseEnabledCommandOperationIds = /* @__PURE__ */ new Set([
   "createCliAutomation",
   "updateCliAutomation",
   "deleteCliAutomation",
-  "updateCliAutomationStatus"
+  "updateCliAutomationStatus",
+  "getCliCreditUsage",
+  "listCliTopUsers",
+  "getCliDailyUsageGraph",
+  "listCliDailyUsers",
+  "listCliTopMcpTools",
+  "listCliAuditLogs",
+  "listCliAuditEventTypes"
 ]);
 const direct = (commands, operation) => commands.map((command) => ({
   command,
@@ -95522,57 +95536,64 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       }),
       getCreditStatistics: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("getCliCreditUsage");
         const params = new URLSearchParams();
         params.set("startDt", options.startDt);
         params.set("endDt", options.endDt);
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/usage/credit/statistics?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/usage/credit?${params.toString()}`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       getCreditTopUsers: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliTopUsers");
         const params = new URLSearchParams();
         params.set("startDt", options.startDt);
         params.set("endDt", options.endDt);
         params.set("limit", String(options.limit));
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/usage/credit/top-users?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/usage/top-users?${params.toString()}`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       getCreditDailyGraph: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("getCliDailyUsageGraph");
         const params = new URLSearchParams();
         params.set("startDt", options.startDt);
         params.set("endDt", options.endDt);
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/usage/credit/daily-graph?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/usage/daily-graph?${params.toString()}`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       getCreditDailyUsers: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliDailyUsers");
         const params = new URLSearchParams();
         params.set("startDt", options.startDt);
         params.set("endDt", options.endDt);
         params.set("pageNumber", String(options.pageNumber ?? 1));
         params.set("pageSize", String(options.pageSize ?? 20));
         if (options.userId) params.set("userId", options.userId);
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/usage/credit/daily-users?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/usage/daily-users?${params.toString()}`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       getMcpTopTools: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliTopMcpTools");
         const params = new URLSearchParams();
         params.set("startDt", options.startDt);
         params.set("endDt", options.endDt);
         params.set("limit", String(options.limit));
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/usage/mcp/top?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/usage/mcp-top?${params.toString()}`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       listAuditLogs: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliAuditLogs");
         const params = new URLSearchParams();
         params.set("page", String(options?.page ?? 1));
         params.set("pageSize", String(options?.pageSize ?? 20));
         if (options?.eventType) params.set("eventType", options.eventType);
-        const path = `/api/web/audit/organization/slug/${encodeURIComponent(orgSlug)}?${params.toString()}`;
-        return yield* makeRequest(baseUrl, path, token);
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/audit?${params.toString()}`;
+        const response = yield* makeRequest(baseUrl, path, token);
+        return { ...response, pagination: normalizePageNumberPagination(response.pagination, response.list.length) };
       }),
       // Phase 5: Drive/Integration
       listDriveEntries: (orgSlug) => gen(function* () {
@@ -95866,9 +95887,11 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         return yield* makeRequest(baseUrl, path, token);
       }),
       // Audit event types
-      listAuditEventTypes: () => gen(function* () {
+      listAuditEventTypes: (orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        return yield* makeRequest(baseUrl, "/api/web/audit/event/types", token);
+        yield* requireReleaseEnabledOperation("listCliAuditEventTypes");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/audit/types`;
+        return yield* makeRequest(baseUrl, path, token);
       }),
       // Org capabilities & user settings
       getOrgCapabilities: (orgSlug) => gen(function* () {
@@ -96390,10 +96413,11 @@ const listCommand$a = make$4(
 
 const typesCommand = make$4(
   "types",
-  {},
-  () => gen(function* () {
+  { org: orgOption },
+  ({ org }) => gen(function* () {
     const api = yield* ApiService;
-    const eventTypes = yield* api.listAuditEventTypes().pipe(
+    const orgSlug = yield* resolveOrgSlug(org, api);
+    const eventTypes = yield* api.listAuditEventTypes(orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {

package/docs/api-contract-inventory.md

@@ -62,10 +62,10 @@
 | P0-MODEL-01 | model | `aipctl model list` | `listModels` | chat | `GET` | `/api/cli/v1/organizations/{orgSlug}/models` | none | `{ models: string[], defaultModel? }` is mapped into `Model[]` and preserves active standard, custom/BYOK, and `etc` catalog IDs | code-first OAS: `chat/packages/chat/src/modules/cli-model-exec/interface/cli-model-exec-v1.interface.controller.ts` | runtime Swagger contract; the existing Web model endpoint remains an independent compatibility reference | `oas-source-only` | `P0` | `migrate` | owner=`Chat CliModelExecV1InterfaceController/ModelInternalService`; rationale=`the dedicated route reuses the existing organization-authorized model domain catalog instead of the narrowed model-exec SharedModel catalog`; removal condition=`none for the CLI route; Web migration is a separate work item`; incorporation plan=`keep the CLI path and capability/registry parity tests aligned with the code-first Chat contract` | `AIP-PUB-05` | `src/core/api.test.ts` verifies the dedicated path, production capability gate, default mapping, and preservation of custom/BYOK and `etc` IDs; Chat service/controller tests verify domain delegation and Swagger extensions |
 | P1-MODEL-EXEC-01 | model-exec | `aipctl model-exec models`, `get`, `sample`, `chat` | `listModelExecModels`, `executeModelExecChat` | chat | `GET`, `POST` | `/api/cli/v1/organizations/{orgSlug}/model-exec/models`; `/chat` | local `ModelExecChatRequest`; Chat Zod/Swagger DTO source `chat/packages/chat/src/modules/cli-model-exec/interface/dto/cli-model-exec.dto.ts` | local `ModelExecModelCatalog`, `ModelExecChatResponse` | code-first OAS: `chat/packages/chat/src/modules/cli-model-exec/interface/cli-model-exec-v1.interface.controller.ts` | runtime Swagger contract | `oas-source-only` | `P1` | `migrate` | none | `AIP-PUB-05` | `src/core/api.test.ts` verifies both v1 paths; Chat controller contract test verifies operation IDs, request/response schemas, delegation to the existing service, and absence of a v1 image route |
 | P1-MODEL-EXEC-02 | model-exec-image | `aipctl model-exec image generate` | `executeModelExecImageGeneration`; output uses `downloadFromUrl` | chat + external artifact URL | `POST`, external `GET` | legacy `/api/{orgSlug}/cli/model-exec/images/generations`; response `downloadUrl` | local `ModelExecImageGenerationRequest`; Chat DTO source `chat/packages/chat/src/modules/cli-model-exec/interface/dto/cli-model-exec.dto.ts` | local `ModelExecImageGenerationResponse`; image bytes from external URL | no GA OAS; legacy controller only | none | `oas-missing` | deferred | `hide` | owner=`chat CLI Model Exec API`; rationale=`synchronous image execution, external artifact lifetime, and cost recovery require the deferred async design`; removal condition=`image job/artifact/TTL/My Drive/cost gates pass`; incorporation plan=`publish a separate v1 image job contract only after the deferred design is implemented` | follow-up image hardening | existing image request/path test remains on the legacy route; customer capability must stay disabled |
-| USAGE-01 | usage | `aipctl admin usage credit`, `top-users`, `daily-graph`, `daily-users`, `mcp-top` | `getCreditStatistics`, `getCreditTopUsers`, `getCreditDailyGraph`, `getCreditDailyUsers`, `getMcpTopTools` | api | `GET` | `/api/web/admin/organizations/slug/{organizationSlug}/usage/...` | query `{ startDt,endDt,limit,pageNumber,pageSize,userId }` | local usage DTOs, `DailyUsageDetailsResponse.pagination { page,pageSize,total }` | `resource/oas/modules/backend/usage/openapi.yaml` | `frontend/packages/api/src/out/modules/usage-types.ts#paths[...]` | `generated-ready` | N/A | `keep` | none | N/A | existing `commands/usage/usage.test.ts`; needed generated path snapshots |
-| AUDIT-01 | audit | `aipctl admin audit list`, `types` | `listAuditLogs`, `listAuditEventTypes` | api | `GET` | `/api/web/audit/organization/slug/{organizationSlug}`; `/api/web/audit/event/types` | query `{ eventType,page,pageSize }` | local `ListAuditResponse`, `AuditEventType[]` | `resource/oas/modules/backend/audit/openapi.yaml` | `frontend/packages/api/src/out/modules/backend-audit-types.ts#paths[...]` | `generated-ready` | N/A | `keep` | none | N/A | existing `commands/audit/audit.test.ts`; needed generated path snapshots |
-| TUNNEL-01 | tunnel | `aipctl admin tunnel status`, `config`, `token` | `getTunnelStatus`, `getTunnelConfig`, `createTunnelToken` | api | `GET`, `GET`, `POST` | `/api/web/edge-tunnel/v2/organizations/slug/{organizationSlug}/status`; `/config`; `/token` | none | local `TunnelStatus`, `TunnelConfig`, `void` | `resource/oas/modules/backend/tunnel/openapi.yaml` | `frontend/packages/api/src/out/modules/tunnel-types.ts#paths[...]` | `generated-ready` | N/A | `keep` | none | N/A | existing `commands/tunnel/tunnel.test.ts`; needed v2 path snapshot |
-| P1-PRESET-01 | preset | `aipctl admin preset list`, `get`, `create`, `update`, `rename`, `delete`, `set-default`, `unset-default`, `regen-key`, `regen-static-key` | `listPresets`, `getPreset`, `createPreset`, `updatePreset`, `renamePreset`, `deletePreset`, `setPresetAsDefault`, `unsetPresetAsDefault`, `regenPresetKey`, `regenPresetStaticKey` | api | `GET`, `POST`, `PUT`, `PATCH`, `DELETE` mix | `/api/web/presets/v2`; `/api/web/presets/{presetId}`; `/key`; `/static-key`; `/default` | legacy preset API kept; delete response is contract-aligned to 204 No Content and CLI treats delete as endpoint-specific void response to tolerate deployed 200 empty drift | local preset DTOs with installation/json command fields; delete returns `void` | `resource/oas/duplo-web.yaml` | `frontend/packages/api/src/out/user-types.ts#paths["/api/web/presets/v2"]`, `#paths["/api/web/presets/{presetId}"]`, `#paths["/api/web/presets/{presetId}/default"]` | `legacy-generated` | `P1` | `keep` | owner=`backend app PresetsApiController`; rationale=`runtime returned 200 empty while generated/OAS says 204, causing JSON parse false failure`; removal condition=`204 is deployed everywhere and CLI no longer needs 200-empty tolerance`; incorporation plan=`keep endpoint-specific void mode, do not add global 200-empty fallback` | N/A | updated `src/core/api.test.ts`, `commands/admin/preset/preset.test.ts`, `../docs/how-to/aip-cli-usage.md`, `backend/api/src/test/kotlin/.../PresetsApiControllerTest.kt`; covers admin namespace docs, `/v2`, `/{id}`, `/default`, `/key`, `/static-key`, delete 200-empty tolerance, and JSON endpoint 200-empty failure |
+| USAGE-01 | usage | `aipctl admin usage credit`, `top-users`, `daily-graph`, `daily-users`, `mcp-top` | `getCreditStatistics`, `getCreditTopUsers`, `getCreditDailyGraph`, `getCreditDailyUsers`, `getMcpTopTools` | api | `GET` | `/api/cli/v1/organizations/{organizationSlug}/admin/usage/credit`; `/admin/usage/top-users`; `/admin/usage/daily-graph`; `/admin/usage/daily-users`; `/admin/usage/mcp-top` | query `{ startDt,endDt,limit,pageNumber,pageSize,userId }`; daily-users uses one-based page/pageSize 1..100 | existing usage DTOs; `DailyUsageDetailsResponse.pagination { page,pageSize,total }` normalized to CLI output | `resource/oas/modules/backend/cli/openapi.yaml` → `paths/v1_admin_usage_*.yaml`; response aliases reuse `resource/oas/modules/backend/usage/components/schemas/*` | `backend/api/.../cli/generated/api/CliUsageApi.kt`; domain DTOs remain `com.querypie.duplo.api.usage.generated.model.*` | `generated-ready` | `P0` | `migrate` | none; dedicated adapter preserves organization admin authorization, three-month/future-date validation, and existing aggregation service | `AI-6344`; query/page workload bounds remain `AI-6413` | `src/core/usage-audit-contract.test.ts`, usage command tests, `CliUsageAuditApiControllerTest`, Gateway registry/contract parity; real production CLI verifies all five paths, 401/403/404/400 and future-date clamp |
+| AUDIT-01 | audit | `aipctl admin audit list`, `types` | `listAuditLogs`, `listAuditEventTypes` | api | `GET` | `/api/cli/v1/organizations/{organizationSlug}/admin/audit`; `/api/cli/v1/organizations/{organizationSlug}/admin/audit/types` | query `{ eventType,page,pageSize }`; page is one-based and pageSize is 1..100 | existing `ListAuditResponse`/`AuditEventType[]`; page/total is normalized for CLI pagination output | `resource/oas/modules/backend/cli/openapi.yaml` → `paths/v1_admin_audit*.yaml`; response aliases reuse `resource/oas/modules/backend/audit/components/schemas/*` | `backend/api/.../cli/generated/api/CliAuditApi.kt`; domain DTOs remain `com.querypie.duplo.api.generated.models.*` | `generated-ready` | `P0` | `migrate` | none; dedicated adapter preserves AUDIT_LOGS capability, plan/retention/viewable-period and organization filters | `AI-6344`; audit volume/query workload bounds remain `AI-6413` | `src/core/usage-audit-contract.test.ts`, `commands/admin/audit/*.test.ts`, `CliUsageAuditApiControllerTest`, Gateway registry/contract parity; real production CLI verifies page 2/3, types, 401/403/404/400 |
+| TUNNEL-01 | tunnel | `aipctl admin tunnel status`, `config`, `token` | `getTunnelStatus`, `getTunnelConfig`, `createTunnelToken` | api | `GET`, `GET`, `POST` | status target: `/api/cli/v1/organizations/{organizationSlug}/admin/tunnel/status`; current legacy `/api/web/edge-tunnel/v2/organizations/slug/{organizationSlug}/status`; `/config`; `/token` | none | local `TunnelStatus`, `TunnelConfig`, `void` | current: `resource/oas/modules/backend/tunnel/openapi.yaml`; target status: Backend CLI OAS | current tunnel generated reference; target CLI generated interface pending | `legacy-generated` | N/A | `migrate` | owner=`backend tunnel domain`; rationale=`status is safe GA-DIRECT but config/token expose sensitive material`; removal condition=`status receives its dedicated v1 contract`; incorporation plan=`migrate status only and keep config/token capability-disabled until --show-sensitive, TTL, redaction, and audit gates pass` | `AI-6344` task 3.3d; sensitive gate `AI-6380` | existing tunnel command tests; needed v1 status path/registry/permission/redaction and real CLI verification |
+| P1-PRESET-01 | preset | `aipctl admin preset list`, `get`, `create`, `update`, `rename`, `delete`, `set-default`, `unset-default`; key rotation commands remain candidates | `listPresets`, `getPreset`, `createPreset`, `updatePreset`, `renamePreset`, `deletePreset`, `setPresetAsDefault`, `unsetPresetAsDefault`; `regenPresetKey`, `regenPresetStaticKey` | api | `GET`, `POST`, `PUT`, `PATCH`, `DELETE` mix | target `/api/cli/v1/organizations/{organizationSlug}/admin/presets/**`; current legacy `/api/web/presets/v2`; `/api/web/presets/{presetId}`; `/key`; `/static-key`; `/default` | dedicated v1 basic-management contract pending; current delete is contract-aligned to 204 and CLI tolerates deployed 200 empty only for that legacy void endpoint | local preset DTOs with installation/json command fields; delete returns `void`; key values must not enter the GA-DIRECT response | current `resource/oas/duplo-web.yaml`; target Backend CLI OAS | current legacy generated reference; target CLI generated interface pending | `legacy-generated` | `P1` | `migrate` | owner=`backend app PresetsApiController`/preset domain; rationale=`basic management is GA-DIRECT while key/static-key rotation requires a separate secret/rollback gate`; removal condition=`eight basic operations receive dedicated v1 contracts and actual CLI verification`; incorporation plan=`reuse domain authorization/audit, preserve endpoint-specific void handling, and keep key rotation gated` | `AI-6344` task 3.3b; key gate `AI-6380` | existing legacy tests plus needed v1 OAS/adapter/registry/manifest, permission/audit/idempotency/destructive UX and real mise CLI lifecycle |
 
 ## 공통 CLI request quota 오류 계약
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aipctl",
-  "version": "2026.10.1",
+  "version": "2026.10.2",
   "description": "QueryPie AIP and MCP CLI tool",
   "author": "QueryPie",
   "license": "UNLICENSED",
@@ -22,8 +22,8 @@
     "node": ">=24.18.0"
   },
   "metadata": {
-    "contentHash": "ea5c348d28e6d1e64655c97b08350c4e9b14572c4474243a654e18c2b6bb7917",
-    "wrapperHash": "03b7520e6526fd395045d78d3a17ba20bf875e10cd352306b5417a3b63ed384c",
+    "contentHash": "866cf35ffc9e44ebc83327f46bc0f77d229aec2f7b688bbdf0074ae937d41e7e",
+    "wrapperHash": "2081868ac4d9ac9204f9f168fc0f33afb220ce17fdaeceb1060e9376ed3b138f",
     "nativeHash": "006b08c3e391f4571d9b7c0f12d684fe2448106259e7e0581b10f9be362452e9"
   },
   "optionalDependencies": {