aipctl 2026.10.1 → 2026.10.3

package/build/index.cjs

@@ -89670,7 +89670,7 @@ const injectedBuildEnv = "dev".length > 0 ? "dev" : "local";
 if (!isBuildEnv(injectedBuildEnv)) {
   throw new Error(`Invalid AIPCTL_BUILD_ENV: ${injectedBuildEnv}`);
 }
-const VERSION = "2026.10.1".length > 0 ? "2026.10.1" : "0.0.0";
+const VERSION = "2026.10.3".length > 0 ? "2026.10.3" : "0.0.0";
 const BUILD_ENV = injectedBuildEnv;
 const INCLUDE_NATIVE_LOGS = BUILD_ENV !== "prod";
 
@@ -89732,6 +89732,27 @@ const isNativeCommandEnabled = (command, includeLogs = INCLUDE_NATIVE_LOGS) => {
 const FORCED_ARGS_SEPARATOR = "--";
 const NATIVE_ROOT_COMMANDS = new Set(nativeCommandNames);
 const trailingOptionSpecs = [
+  ...["list", "get", "create", "update", "rename", "delete", "set-default", "unset-default"].map((command) => ({
+    command: ["admin", "preset", command],
+    booleanOptions: new Set(command === "delete" ? ["--force", "-f"] : ["list", "get"].includes(command) ? ["--json"] : []),
+    valueOptions: /* @__PURE__ */ new Set(["--org", ...command === "list" ? ["--page", "--pageSize"] : []]),
+    explicitBooleanValues: true,
+    booleanAliases: { "-f": "--force" }
+  })),
+  ...["invite", "remove-member", "update-member-role"].map((command) => ({
+    command: ["admin", "org", command],
+    booleanOptions: new Set(command === "remove-member" ? ["--force", "-f"] : []),
+    valueOptions: /* @__PURE__ */ new Set(["--org", ...command !== "remove-member" ? ["--role"] : []]),
+    explicitBooleanValues: true,
+    booleanAliases: { "-f": "--force" }
+  })),
+  {
+    command: ["org", "exit"],
+    booleanOptions: /* @__PURE__ */ new Set(["--force", "-f"]),
+    valueOptions: /* @__PURE__ */ new Set(["--org"]),
+    explicitBooleanValues: true,
+    booleanAliases: { "-f": "--force" }
+  },
   ...["list", "get"].map((command) => ({
     command: ["automation", command],
     booleanOptions: /* @__PURE__ */ new Set(["--json"]),
@@ -89878,7 +89899,27 @@ const implementedCommandOperationIds = /* @__PURE__ */ new Set([
   "createCliAutomation",
   "updateCliAutomation",
   "deleteCliAutomation",
-  "updateCliAutomationStatus"
+  "updateCliAutomationStatus",
+  "getCliCreditUsage",
+  "listCliTopUsers",
+  "getCliDailyUsageGraph",
+  "listCliDailyUsers",
+  "listCliTopMcpTools",
+  "listCliAuditLogs",
+  "listCliAuditEventTypes",
+  "listCliPresets",
+  "getCliPreset",
+  "createCliPreset",
+  "updateCliPreset",
+  "updateCliPresetName",
+  "deleteCliPreset",
+  "updateCliDefaultPreset",
+  "deleteCliDefaultPreset",
+  "createCliOrganizationMemberInvitations",
+  "deleteCliOrganizationMembers",
+  "updateCliOrganizationMemberRoles",
+  "deleteCliOrganizationMembership",
+  "getCliTunnelStatus"
 ]);
 const releaseEnabledCommandOperationIds = /* @__PURE__ */ new Set([
   "listCliAgents",
@@ -89928,7 +89969,27 @@ const releaseEnabledCommandOperationIds = /* @__PURE__ */ new Set([
   "createCliAutomation",
   "updateCliAutomation",
   "deleteCliAutomation",
-  "updateCliAutomationStatus"
+  "updateCliAutomationStatus",
+  "getCliCreditUsage",
+  "listCliTopUsers",
+  "getCliDailyUsageGraph",
+  "listCliDailyUsers",
+  "listCliTopMcpTools",
+  "listCliAuditLogs",
+  "listCliAuditEventTypes",
+  "listCliPresets",
+  "getCliPreset",
+  "createCliPreset",
+  "updateCliPreset",
+  "updateCliPresetName",
+  "deleteCliPreset",
+  "updateCliDefaultPreset",
+  "deleteCliDefaultPreset",
+  "createCliOrganizationMemberInvitations",
+  "deleteCliOrganizationMembers",
+  "updateCliOrganizationMemberRoles",
+  "deleteCliOrganizationMembership",
+  "getCliTunnelStatus"
 ]);
 const direct = (commands, operation) => commands.map((command) => ({
   command,
@@ -94934,6 +94995,14 @@ const makeApiServiceLive = (buildEnv) => effect$1(
     });
     const requireApiBaseUrlEffect = () => requireConfiguredBaseUrlEffect(loadConfiguredApiBaseUrl);
     const requireChatBaseUrlEffect = () => requireConfiguredBaseUrlEffect(loadConfiguredChatBaseUrl);
+    const presetPath = (presetId, orgSlug) => try_({
+      try: () => {
+        const slug = orgSlug ?? configService.load().currentOrganization?.slug;
+        if (!slug) throw new Error("No organization selected. Use --org or select an organization.");
+        return `/api/cli/v1/organizations/${encodeURIComponent(slug)}/admin/presets/${encodeURIComponent(presetId)}`;
+      },
+      catch: configuredBaseUrlError
+    });
     const toRefreshFailure = (error) => {
       if (error instanceof ApiError || error instanceof NotLoggedInError) {
         return error;
@@ -95522,57 +95591,64 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       }),
       getCreditStatistics: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("getCliCreditUsage");
         const params = new URLSearchParams();
         params.set("startDt", options.startDt);
         params.set("endDt", options.endDt);
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/usage/credit/statistics?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/usage/credit?${params.toString()}`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       getCreditTopUsers: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliTopUsers");
         const params = new URLSearchParams();
         params.set("startDt", options.startDt);
         params.set("endDt", options.endDt);
         params.set("limit", String(options.limit));
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/usage/credit/top-users?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/usage/top-users?${params.toString()}`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       getCreditDailyGraph: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("getCliDailyUsageGraph");
         const params = new URLSearchParams();
         params.set("startDt", options.startDt);
         params.set("endDt", options.endDt);
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/usage/credit/daily-graph?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/usage/daily-graph?${params.toString()}`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       getCreditDailyUsers: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliDailyUsers");
         const params = new URLSearchParams();
         params.set("startDt", options.startDt);
         params.set("endDt", options.endDt);
         params.set("pageNumber", String(options.pageNumber ?? 1));
         params.set("pageSize", String(options.pageSize ?? 20));
         if (options.userId) params.set("userId", options.userId);
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/usage/credit/daily-users?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/usage/daily-users?${params.toString()}`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       getMcpTopTools: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliTopMcpTools");
         const params = new URLSearchParams();
         params.set("startDt", options.startDt);
         params.set("endDt", options.endDt);
         params.set("limit", String(options.limit));
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/usage/mcp/top?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/usage/mcp-top?${params.toString()}`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       listAuditLogs: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliAuditLogs");
         const params = new URLSearchParams();
         params.set("page", String(options?.page ?? 1));
         params.set("pageSize", String(options?.pageSize ?? 20));
         if (options?.eventType) params.set("eventType", options.eventType);
-        const path = `/api/web/audit/organization/slug/${encodeURIComponent(orgSlug)}?${params.toString()}`;
-        return yield* makeRequest(baseUrl, path, token);
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/audit?${params.toString()}`;
+        const response = yield* makeRequest(baseUrl, path, token);
+        return { ...response, pagination: normalizePageNumberPagination(response.pagination, response.list.length) };
       }),
       // Phase 5: Drive/Integration
       listDriveEntries: (orgSlug) => gen(function* () {
@@ -95866,9 +95942,11 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         return yield* makeRequest(baseUrl, path, token);
       }),
       // Audit event types
-      listAuditEventTypes: () => gen(function* () {
+      listAuditEventTypes: (orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        return yield* makeRequest(baseUrl, "/api/web/audit/event/types", token);
+        yield* requireReleaseEnabledOperation("listCliAuditEventTypes");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/audit/types`;
+        return yield* makeRequest(baseUrl, path, token);
       }),
       // Org capabilities & user settings
       getOrgCapabilities: (orgSlug) => gen(function* () {
@@ -95885,7 +95963,8 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       // Tunnel management
       getTunnelStatus: (orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/edge-tunnel/v2/organizations/slug/${encodeURIComponent(orgSlug)}/status`;
+        yield* requireReleaseEnabledOperation("getCliTunnelStatus");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/tunnel/status`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       getTunnelConfig: (orgSlug) => gen(function* () {
@@ -95899,49 +95978,60 @@ const makeApiServiceLive = (buildEnv) => effect$1(
         return yield* makeRequest(baseUrl, path, token, { method: "POST" });
       }),
       // Preset management
-      listPresets: (orgSlug) => gen(function* () {
+      listPresets: (orgSlug, page = 1, pageSize = 100) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/presets/v2?organizationSlug=${encodeURIComponent(orgSlug)}`;
-        return yield* makeRequest(baseUrl, path, token);
+        yield* requireReleaseEnabledOperation("listCliPresets");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/presets?page=${page}&pageSize=${pageSize}`;
+        const response = yield* makeRequest(baseUrl, path, token);
+        return response.list;
       }),
-      getPreset: (presetId) => gen(function* () {
+      getPreset: (presetId, orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/presets/${encodeURIComponent(presetId)}`;
+        yield* requireReleaseEnabledOperation("getCliPreset");
+        const path = yield* presetPath(presetId, orgSlug);
         return yield* makeRequest(baseUrl, path, token);
       }),
       createPreset: (body) => gen(function* () {
         const token = yield* getAccessToken();
-        return yield* makeRequest(baseUrl, "/api/web/presets/v2", token, {
+        yield* requireReleaseEnabledOperation("createCliPreset");
+        const { organizationSlug, ...request } = body;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(organizationSlug)}/admin/presets`;
+        return yield* makeRequest(baseUrl, path, token, {
           method: "POST",
-          body
+          body: request
         });
       }),
-      updatePreset: (presetId, body) => gen(function* () {
+      updatePreset: (presetId, body, orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/presets/${encodeURIComponent(presetId)}`;
+        yield* requireReleaseEnabledOperation("updateCliPreset");
+        const path = yield* presetPath(presetId, orgSlug);
         return yield* makeRequest(baseUrl, path, token, { method: "PUT", body });
       }),
-      renamePreset: (presetId, name) => gen(function* () {
+      renamePreset: (presetId, name, orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/presets/${encodeURIComponent(presetId)}`;
+        yield* requireReleaseEnabledOperation("updateCliPresetName");
+        const path = yield* presetPath(presetId, orgSlug);
         return yield* makeRequest(baseUrl, path, token, {
           method: "PATCH",
           body: { name }
         });
       }),
-      deletePreset: (presetId) => gen(function* () {
+      deletePreset: (presetId, orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/presets/${encodeURIComponent(presetId)}`;
+        yield* requireReleaseEnabledOperation("deleteCliPreset");
+        const path = yield* presetPath(presetId, orgSlug);
         return yield* makeRequest(baseUrl, path, token, { method: "DELETE", skipJsonParse: true });
       }),
-      setPresetAsDefault: (presetId) => gen(function* () {
+      setPresetAsDefault: (presetId, orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/presets/${encodeURIComponent(presetId)}/default`;
-        return yield* makeRequest(baseUrl, path, token, { method: "POST" });
+        yield* requireReleaseEnabledOperation("updateCliDefaultPreset");
+        const path = `${yield* presetPath(presetId, orgSlug)}/default`;
+        return yield* makeRequest(baseUrl, path, token, { method: "PUT" });
       }),
-      unsetPresetAsDefault: (presetId) => gen(function* () {
+      unsetPresetAsDefault: (presetId, orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/presets/${encodeURIComponent(presetId)}/default`;
+        yield* requireReleaseEnabledOperation("deleteCliDefaultPreset");
+        const path = `${yield* presetPath(presetId, orgSlug)}/default`;
         return yield* makeRequest(baseUrl, path, token, { method: "DELETE" });
       }),
       regenPresetKey: (presetId) => gen(function* () {
@@ -95957,29 +96047,33 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       // Org member management
       inviteOrgMembers: (req) => gen(function* () {
         const token = yield* getAccessToken();
-        return yield* makeRequest(baseUrl, `/api/web/organizations/slug/${encodeURIComponent(req.organizationSlug)}/invite`, token, {
+        yield* requireReleaseEnabledOperation("createCliOrganizationMemberInvitations");
+        return yield* makeRequest(baseUrl, `/api/cli/v1/organizations/${encodeURIComponent(req.organizationSlug)}/members/invitations`, token, {
           method: "POST",
           body: { emails: req.emails, role: req.role }
         });
       }),
       removeOrgMembers: (req) => gen(function* () {
         const token = yield* getAccessToken();
-        yield* makeRequest(baseUrl, `/api/web/organizations/slug/${encodeURIComponent(req.organizationSlug)}/members`, token, {
+        yield* requireReleaseEnabledOperation("deleteCliOrganizationMembers");
+        yield* makeRequest(baseUrl, `/api/cli/v1/organizations/${encodeURIComponent(req.organizationSlug)}/members`, token, {
           method: "DELETE",
           body: { members: req.members }
         });
       }),
       updateOrgMemberRoles: (req) => gen(function* () {
         const token = yield* getAccessToken();
-        yield* makeRequest(baseUrl, `/api/web/organizations/slug/${encodeURIComponent(req.organizationSlug)}/members`, token, {
+        yield* requireReleaseEnabledOperation("updateCliOrganizationMemberRoles");
+        yield* makeRequest(baseUrl, `/api/cli/v1/organizations/${encodeURIComponent(req.organizationSlug)}/members/role`, token, {
           method: "PUT",
           body: { members: req.members, role: req.role }
         });
       }),
       exitOrg: (slug) => gen(function* () {
         const token = yield* getAccessToken();
-        yield* makeRequest(baseUrl, `/api/web/organizations/slug/${encodeURIComponent(slug)}/exit`, token, {
-          method: "POST"
+        yield* requireReleaseEnabledOperation("deleteCliOrganizationMembership");
+        yield* makeRequest(baseUrl, `/api/cli/v1/organizations/${encodeURIComponent(slug)}/membership`, token, {
+          method: "DELETE"
         });
       }),
       // Agent headless chat
@@ -96390,10 +96484,11 @@ const listCommand$a = make$4(
 
 const typesCommand = make$4(
   "types",
-  {},
-  () => gen(function* () {
+  { org: orgOption },
+  ({ org }) => gen(function* () {
     const api = yield* ApiService;
-    const eventTypes = yield* api.listAuditEventTypes().pipe(
+    const orgSlug = yield* resolveOrgSlug(org, api);
+    const eventTypes = yield* api.listAuditEventTypes(orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -96935,13 +97030,13 @@ const deleteCommand$4 = make$4(
   { id: idArg$7, org: orgOption, force: forceOption$5 },
   ({ id, org, force }) => gen(function* () {
     const api = yield* ApiService;
-    yield* resolveOrgSlug(org, api);
+    const orgSlug = yield* resolveOrgSlug(org, api);
     if (!force) {
       yield* log(`Warning: This will permanently delete preset "${id}".`);
       yield* log("Use --force (-f) to skip this confirmation.");
       return;
     }
-    yield* api.deletePreset(id).pipe(
+    yield* api.deletePreset(id, orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -96974,8 +97069,8 @@ const getCommand$6 = make$4(
   { id: idArg$6, org: orgOption, json: jsonOption$h },
   ({ id, org, json }) => gen(function* () {
     const api = yield* ApiService;
-    yield* resolveOrgSlug(org, api);
-    const preset = yield* api.getPreset(id).pipe(
+    const orgSlug = yield* resolveOrgSlug(org, api);
+    const preset = yield* api.getPreset(id, orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -97030,11 +97125,19 @@ function formatPresetListPrompt(prompt) {
 }
 const listCommand$9 = make$4(
   "list",
-  { org: orgOption, json: jsonOption$g },
-  ({ org, json }) => gen(function* () {
+  {
+    org: orgOption,
+    json: jsonOption$g,
+    page: integer("page").pipe(withDescription$3("Page number, starting at 1"), withDefault(1)),
+    pageSize: integer("pageSize").pipe(withDescription$3("Presets per page (1\u2013100)"), withDefault(100))
+  },
+  ({ org, json, page, pageSize }) => gen(function* () {
+    if (page < 1 || pageSize < 1 || pageSize > 100) {
+      return yield* fail$3(new ApiError({ message: "Use --page 1 or higher and --pageSize between 1 and 100." }));
+    }
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
-    const result = yield* api.listPresets(orgSlug).pipe(
+    const result = yield* api.listPresets(orgSlug, page, pageSize).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -97055,10 +97158,10 @@ const listCommand$9 = make$4(
       return;
     }
     if (result.length === 0) {
-      yield* log("No presets found.");
+      yield* log(`No presets found on page ${page}.`);
       return;
     }
-    yield* log(`Presets in organization "${orgSlug}":
+    yield* log(`Presets in organization "${orgSlug}" (page ${page}):
 `);
     for (const preset of result) {
       const defaultMark = preset.isDefault ? " (default)" : "";
@@ -97134,8 +97237,8 @@ const renameCommand$1 = make$4(
   { id: idArg$3, name: nameArg$1, org: orgOption },
   ({ id, name, org }) => gen(function* () {
     const api = yield* ApiService;
-    yield* resolveOrgSlug(org, api);
-    yield* api.renamePreset(id, name).pipe(
+    const orgSlug = yield* resolveOrgSlug(org, api);
+    yield* api.renamePreset(id, name, orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -97161,8 +97264,8 @@ const setDefaultCommand = make$4(
   { id: idArg$2, org: orgOption },
   ({ id, org }) => gen(function* () {
     const api = yield* ApiService;
-    yield* resolveOrgSlug(org, api);
-    yield* api.setPresetAsDefault(id).pipe(
+    const orgSlug = yield* resolveOrgSlug(org, api);
+    yield* api.setPresetAsDefault(id, orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -97188,8 +97291,8 @@ const unsetDefaultCommand = make$4(
   { id: idArg$1, org: orgOption },
   ({ id, org }) => gen(function* () {
     const api = yield* ApiService;
-    yield* resolveOrgSlug(org, api);
-    yield* api.unsetPresetAsDefault(id).pipe(
+    const orgSlug = yield* resolveOrgSlug(org, api);
+    yield* api.unsetPresetAsDefault(id, orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -97218,7 +97321,7 @@ const updateCommand$1 = make$4(
   { id: idArg, jsonFile: jsonFileArg$2, org: orgOption },
   ({ id, jsonFile, org }) => gen(function* () {
     const api = yield* ApiService;
-    yield* resolveOrgSlug(org, api);
+    const orgSlug = yield* resolveOrgSlug(org, api);
     const body = yield* try_({
       try: () => {
         const content = fs__namespace.readFileSync(jsonFile, "utf-8");
@@ -97233,7 +97336,7 @@ const updateCommand$1 = make$4(
         })
       )
     );
-    yield* api.updatePreset(id, body).pipe(
+    yield* api.updatePreset(id, body, orgSlug).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {

package/docs/api-contract-inventory.md

@@ -40,8 +40,8 @@
 | AUTH-02 | auth | `aipctl auth refresh` | `ApiService.refreshToken` → `refreshAccessToken` → `src/core/oauth.ts#refreshOAuthToken` | api | `POST` | `/oauth2/token` | refresh token form body | refreshed local `Credentials` | not found in current `resource/oas` for `/oauth2/token` | none | `oas-missing` | N/A | `legacy-exception` | owner=`backend/api OAuth server`; rationale=`token refresh is required for session continuity but token endpoint is outside current OAS`; removal condition=`official OAuth token contract exists in resource/oas and independent generated contract`; incorporation plan=`same OAuth server contract as AUTH-01, plus refresh fixture` | `AIP-PUB-05` | existing `src/core/oauth.test.ts`, `src/core/api.test.ts`; needed token refresh path snapshot |
 | AUTH-03 | auth | `aipctl auth whoami` | `ApiService.getMe` | api | `GET` | `/api/cli/v1/me` | none | local `UserProfile` | `resource/oas/modules/backend/cli/openapi.yaml` | `backend/api/.../cli/generated/api/CliV1Api.kt#getCliMe` | `generated-ready` | N/A | `migrate` | none | N/A | `src/core/api.test.ts` verifies the dedicated path and bearer request; `commands/auth/auth.test.ts` covers command behavior |
 | ORG-01 | org | `aipctl org list`, `aipctl org use`, `aipctl org select` | `listOrganizations`, `getOrganization` | api | `GET` | `/api/cli/v1/organizations`; `use/select` resolve locally from the returned list | none | local `Organization[]` / `Organization` | `resource/oas/modules/backend/cli/openapi.yaml` | `backend/api/.../cli/generated/api/CliV1Api.kt#listCliOrganizations` | `generated-ready` | N/A | `migrate` | none | N/A | `src/core/api.test.ts`, `commands/org/org.test.ts`; covers dedicated path, local slug selection, default/IP-blocked fields |
-| ORG-02 | org | `aipctl org capabilities`, `aipctl org settings`, `aipctl org exit` | `getOrgCapabilities`, `getUserSettings`, `exitOrg` | api | `GET`, `GET`, `POST` | organization v1 `/api/cli/v1/organizations/{organizationSlug}/capabilities`; user-global v1 `/api/cli/v1/me/settings`; legacy `/api/web/organizations/slug/{organizationSlug}/exit` | none | local `OrgCapabilities`, `UserSettings`, `void` | read paths: `resource/oas/modules/backend/cli/openapi.yaml`; exit: `resource/oas/duplo-web.yaml` | read generated `CliOrganizationApi`/`CliV1Api`; exit legacy generated | `legacy-generated` | N/A | `migrate` | owner=`backend`; rationale=`capabilities is organization-owned, settings remains user-global, and exit remains a Wave B mutation`; removal condition=`exit receives its dedicated v1 mutation contract`; incorporation plan=`preserve current membership authorization and non-replay behavior` | task 3.3 | `src/core/api.test.ts` verifies v1 read paths and settings ownership; org tests cover response/error behavior |
-| P0-ORG-01 | org-member | `aipctl org members`; `aipctl admin org invite`, `aipctl admin org remove-member`, `aipctl admin org update-member-role` | `listOrgMembers`, `inviteOrgMembers`, `removeOrgMembers`, `updateOrgMemberRoles` | api | `GET`, `POST`, `DELETE`, `PUT` | list v1 `/api/cli/v1/organizations/{organizationSlug}/members`; mutations remain legacy `/invite`; `/members` | list uses stable CLI member response; mutation bodies preserve `{ emails, role }` and `{ members, role? }` | local `ListMembersResponse`, `InviteOrgMembersResponse`, `void` | list: `resource/oas/modules/backend/cli/openapi.yaml`; mutation: `resource/oas/duplo-web.yaml` | list generated `CliOrganizationApi`; mutation legacy generated | `legacy-generated` | `P0` | `legacy-exception` | owner=`backend`; rationale=`member read is migrated while admin mutations remain Wave B`; removal condition=`invite/remove/role receive dedicated v1 contracts`; incorporation plan=`reuse current admin authorization, audit, stale target validation, and non-replay semantics` | task 3.3 | `src/core/api.test.ts`, `commands/org/members.test.ts`, `commands/org/org-member.test.ts`; covers v1 member read and legacy mutation bodies |
+| ORG-02 | org | `aipctl org capabilities`, `aipctl org settings`, `aipctl org exit` | `getOrgCapabilities`, `getUserSettings`, `exitOrg` | api | `GET`, `GET`, `DELETE` | organization v1 `/api/cli/v1/organizations/{organizationSlug}/capabilities`; user-global v1 `/api/cli/v1/me/settings`; exit v1 `/api/cli/v1/organizations/{organizationSlug}/membership` | none | local `OrgCapabilities`, `UserSettings`, `void` | `resource/oas/modules/backend/cli/openapi.yaml` | `CliOrganizationApi`/`CliV1Api`; exit `deleteCliOrganizationMembership` | `generated-ready` | N/A | `migrate` | none; exit delegates existing member authorization, owner protection and audit | `AI-6344`; common error/deadline gate `AI-6378` | `src/core/api.test.ts`, `src/core/remaining-direct-contract.test.ts`, org tests, Backend controller test; actual CLI member exit/owner rejection |
+| P0-ORG-01 | org-member | `aipctl org members`; `aipctl admin org invite`, `aipctl admin org remove-member`, `aipctl admin org update-member-role` | `listOrgMembers`, `inviteOrgMembers`, `removeOrgMembers`, `updateOrgMemberRoles` | api | `GET`, `POST`, `DELETE`, `PUT` | prefix `/api/cli/v1/organizations/{organizationSlug}`; `/members`; `/members/invitations`; `/members`; `/members/role` | `{ emails, role }` or `{ members, role? }`; 1..100 unique targets, email/userId/status checked against current membership | local `ListMembersResponse`, `InviteOrgMembersResponse`, `void` | `resource/oas/modules/backend/cli/openapi.yaml` | `backend/api/.../cli/generated/api/CliOrganizationApi.kt` | `generated-ready` | `P0` | `migrate` | none; preserves existing admin authorization, audit, pending/active/inactive semantics, skipped owner/self removal and invite partial failure; stale/missing target returns 409 before mutation | `AI-6344`; operational gates remain separate | API/command and Backend controller tests; actual CLI invite with LocalStack SES, role/remove for three statuses, non-admin 403, stale 409, owner protection, persisted audit |
 | P0-ORG-02 | org-admin | hidden from public beta (`aipctl admin org invite-link`, `gen-invite-link`, `revoke-invite-link` removed from command tree) | removed from public surface | api | `GET`, `POST`, `DELETE` | previously `/api/web/organizations/slug/{organizationSlug}/invite/link` | none | hidden | latest: `resource/oas/modules/backend/organization/openapi.yaml` (`/invite/link/v2`); legacy: `resource/oas/duplo-web.yaml` (`/invite/link`) | latest `frontend/packages/api/src/out/modules/organization-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/invite/link/v2"]`; legacy `frontend/packages/api/src/out/user-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/invite/link"]` | `oas-source-only` | `P0` | `hide` | owner=`backend organization module`; rationale=`v2 exists but current CLI UX contract for GET/DELETE parity is not approved for public beta`; removal condition=`public beta continues hiding until a reviewed v2 CLI UX contract exists`; incorporation plan=`reintroduce only after independent organization contract/build and public UX review` | N/A | updated admin org help smoke + command-tree regression to ensure trio is absent |
 | SKILL-01 | skill | `aipctl skill list`, `aipctl skill get`, `aipctl skill delete` | `listSkills`, `getSkill`, `deleteSkill` | api | `GET`, `GET`, `DELETE` | `/api/cli/v1/organizations/{organizationSlug}/skills`; `/api/cli/v1/organizations/{organizationSlug}/skills/{skillId}` | query `{ count,cursor,search }`; detail query `{ maxFiles }` | local `ListSkillsResponse`, `SkillDetail`, `void` | `resource/oas/modules/backend/cli/openapi.yaml` → `v1_skills*.yaml` (DTO aliases to organization Skills OAS) | `backend/api/.../cli/generated/api/CliSkillApi.kt`; domain DTOs remain `com.querypie.duplo.api.skills.generated.model.*` | `generated-ready` | `P0` | `migrate` | none; `CliSkillApiController` delegates to the existing member authorization/audit controller | `AI-6344` | `src/core/api.test.ts`, `CliSkillDriveApiControllerTest`, Gateway registry/contract parity; production CLI and local 403/404 checks (401/429 remain common gates) |
 | SKILL-02 | skill | `aipctl skill upload` | `createUploadUrl` → `uploadToS3` → `completeUpload` (`abortUpload` on failure) | api + external | `POST` → `PUT` → `POST` | `/skills/upload-url`; external presigned `uploadUrl`; `/skills/{skillId}/complete` | local upload request `{ filename,fileSize,mimeType }`, file buffer, complete body `{ overwrite }` | `CreateSkillUploadUrlResponse`, external `void`, `CompleteSkillUploadResponse` | `resource/oas/modules/backend/organization/skills/openapi.yaml` | `frontend/packages/api/src/out/modules/organization-skills-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/skills/upload-url"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/skills/{skillId}/complete"]` | `external-presigned` | N/A | `keep` | none | N/A | existing skill upload tests; needed presigned URL + complete path snapshot |
@@ -62,10 +62,10 @@
 | P0-MODEL-01 | model | `aipctl model list` | `listModels` | chat | `GET` | `/api/cli/v1/organizations/{orgSlug}/models` | none | `{ models: string[], defaultModel? }` is mapped into `Model[]` and preserves active standard, custom/BYOK, and `etc` catalog IDs | code-first OAS: `chat/packages/chat/src/modules/cli-model-exec/interface/cli-model-exec-v1.interface.controller.ts` | runtime Swagger contract; the existing Web model endpoint remains an independent compatibility reference | `oas-source-only` | `P0` | `migrate` | owner=`Chat CliModelExecV1InterfaceController/ModelInternalService`; rationale=`the dedicated route reuses the existing organization-authorized model domain catalog instead of the narrowed model-exec SharedModel catalog`; removal condition=`none for the CLI route; Web migration is a separate work item`; incorporation plan=`keep the CLI path and capability/registry parity tests aligned with the code-first Chat contract` | `AIP-PUB-05` | `src/core/api.test.ts` verifies the dedicated path, production capability gate, default mapping, and preservation of custom/BYOK and `etc` IDs; Chat service/controller tests verify domain delegation and Swagger extensions |
 | P1-MODEL-EXEC-01 | model-exec | `aipctl model-exec models`, `get`, `sample`, `chat` | `listModelExecModels`, `executeModelExecChat` | chat | `GET`, `POST` | `/api/cli/v1/organizations/{orgSlug}/model-exec/models`; `/chat` | local `ModelExecChatRequest`; Chat Zod/Swagger DTO source `chat/packages/chat/src/modules/cli-model-exec/interface/dto/cli-model-exec.dto.ts` | local `ModelExecModelCatalog`, `ModelExecChatResponse` | code-first OAS: `chat/packages/chat/src/modules/cli-model-exec/interface/cli-model-exec-v1.interface.controller.ts` | runtime Swagger contract | `oas-source-only` | `P1` | `migrate` | none | `AIP-PUB-05` | `src/core/api.test.ts` verifies both v1 paths; Chat controller contract test verifies operation IDs, request/response schemas, delegation to the existing service, and absence of a v1 image route |
 | P1-MODEL-EXEC-02 | model-exec-image | `aipctl model-exec image generate` | `executeModelExecImageGeneration`; output uses `downloadFromUrl` | chat + external artifact URL | `POST`, external `GET` | legacy `/api/{orgSlug}/cli/model-exec/images/generations`; response `downloadUrl` | local `ModelExecImageGenerationRequest`; Chat DTO source `chat/packages/chat/src/modules/cli-model-exec/interface/dto/cli-model-exec.dto.ts` | local `ModelExecImageGenerationResponse`; image bytes from external URL | no GA OAS; legacy controller only | none | `oas-missing` | deferred | `hide` | owner=`chat CLI Model Exec API`; rationale=`synchronous image execution, external artifact lifetime, and cost recovery require the deferred async design`; removal condition=`image job/artifact/TTL/My Drive/cost gates pass`; incorporation plan=`publish a separate v1 image job contract only after the deferred design is implemented` | follow-up image hardening | existing image request/path test remains on the legacy route; customer capability must stay disabled |
-| USAGE-01 | usage | `aipctl admin usage credit`, `top-users`, `daily-graph`, `daily-users`, `mcp-top` | `getCreditStatistics`, `getCreditTopUsers`, `getCreditDailyGraph`, `getCreditDailyUsers`, `getMcpTopTools` | api | `GET` | `/api/web/admin/organizations/slug/{organizationSlug}/usage/...` | query `{ startDt,endDt,limit,pageNumber,pageSize,userId }` | local usage DTOs, `DailyUsageDetailsResponse.pagination { page,pageSize,total }` | `resource/oas/modules/backend/usage/openapi.yaml` | `frontend/packages/api/src/out/modules/usage-types.ts#paths[...]` | `generated-ready` | N/A | `keep` | none | N/A | existing `commands/usage/usage.test.ts`; needed generated path snapshots |
-| AUDIT-01 | audit | `aipctl admin audit list`, `types` | `listAuditLogs`, `listAuditEventTypes` | api | `GET` | `/api/web/audit/organization/slug/{organizationSlug}`; `/api/web/audit/event/types` | query `{ eventType,page,pageSize }` | local `ListAuditResponse`, `AuditEventType[]` | `resource/oas/modules/backend/audit/openapi.yaml` | `frontend/packages/api/src/out/modules/backend-audit-types.ts#paths[...]` | `generated-ready` | N/A | `keep` | none | N/A | existing `commands/audit/audit.test.ts`; needed generated path snapshots |
-| TUNNEL-01 | tunnel | `aipctl admin tunnel status`, `config`, `token` | `getTunnelStatus`, `getTunnelConfig`, `createTunnelToken` | api | `GET`, `GET`, `POST` | `/api/web/edge-tunnel/v2/organizations/slug/{organizationSlug}/status`; `/config`; `/token` | none | local `TunnelStatus`, `TunnelConfig`, `void` | `resource/oas/modules/backend/tunnel/openapi.yaml` | `frontend/packages/api/src/out/modules/tunnel-types.ts#paths[...]` | `generated-ready` | N/A | `keep` | none | N/A | existing `commands/tunnel/tunnel.test.ts`; needed v2 path snapshot |
-| P1-PRESET-01 | preset | `aipctl admin preset list`, `get`, `create`, `update`, `rename`, `delete`, `set-default`, `unset-default`, `regen-key`, `regen-static-key` | `listPresets`, `getPreset`, `createPreset`, `updatePreset`, `renamePreset`, `deletePreset`, `setPresetAsDefault`, `unsetPresetAsDefault`, `regenPresetKey`, `regenPresetStaticKey` | api | `GET`, `POST`, `PUT`, `PATCH`, `DELETE` mix | `/api/web/presets/v2`; `/api/web/presets/{presetId}`; `/key`; `/static-key`; `/default` | legacy preset API kept; delete response is contract-aligned to 204 No Content and CLI treats delete as endpoint-specific void response to tolerate deployed 200 empty drift | local preset DTOs with installation/json command fields; delete returns `void` | `resource/oas/duplo-web.yaml` | `frontend/packages/api/src/out/user-types.ts#paths["/api/web/presets/v2"]`, `#paths["/api/web/presets/{presetId}"]`, `#paths["/api/web/presets/{presetId}/default"]` | `legacy-generated` | `P1` | `keep` | owner=`backend app PresetsApiController`; rationale=`runtime returned 200 empty while generated/OAS says 204, causing JSON parse false failure`; removal condition=`204 is deployed everywhere and CLI no longer needs 200-empty tolerance`; incorporation plan=`keep endpoint-specific void mode, do not add global 200-empty fallback` | N/A | updated `src/core/api.test.ts`, `commands/admin/preset/preset.test.ts`, `../docs/how-to/aip-cli-usage.md`, `backend/api/src/test/kotlin/.../PresetsApiControllerTest.kt`; covers admin namespace docs, `/v2`, `/{id}`, `/default`, `/key`, `/static-key`, delete 200-empty tolerance, and JSON endpoint 200-empty failure |
+| USAGE-01 | usage | `aipctl admin usage credit`, `top-users`, `daily-graph`, `daily-users`, `mcp-top` | `getCreditStatistics`, `getCreditTopUsers`, `getCreditDailyGraph`, `getCreditDailyUsers`, `getMcpTopTools` | api | `GET` | `/api/cli/v1/organizations/{organizationSlug}/admin/usage/credit`; `/admin/usage/top-users`; `/admin/usage/daily-graph`; `/admin/usage/daily-users`; `/admin/usage/mcp-top` | query `{ startDt,endDt,limit,pageNumber,pageSize,userId }`; daily-users uses one-based page/pageSize 1..100 | existing usage DTOs; `DailyUsageDetailsResponse.pagination { page,pageSize,total }` normalized to CLI output | `resource/oas/modules/backend/cli/openapi.yaml` → `paths/v1_admin_usage_*.yaml`; response aliases reuse `resource/oas/modules/backend/usage/components/schemas/*` | `backend/api/.../cli/generated/api/CliUsageApi.kt`; domain DTOs remain `com.querypie.duplo.api.usage.generated.model.*` | `generated-ready` | `P0` | `migrate` | none; dedicated adapter preserves organization admin authorization, three-month/future-date validation, and existing aggregation service | `AI-6344`; query/page workload bounds remain `AI-6413` | `src/core/usage-audit-contract.test.ts`, usage command tests, `CliUsageAuditApiControllerTest`, Gateway registry/contract parity; real production CLI verifies all five paths, 401/403/404/400 and future-date clamp |
+| AUDIT-01 | audit | `aipctl admin audit list`, `types` | `listAuditLogs`, `listAuditEventTypes` | api | `GET` | `/api/cli/v1/organizations/{organizationSlug}/admin/audit`; `/api/cli/v1/organizations/{organizationSlug}/admin/audit/types` | query `{ eventType,page,pageSize }`; page is one-based and pageSize is 1..100 | existing `ListAuditResponse`/`AuditEventType[]`; page/total is normalized for CLI pagination output | `resource/oas/modules/backend/cli/openapi.yaml` → `paths/v1_admin_audit*.yaml`; response aliases reuse `resource/oas/modules/backend/audit/components/schemas/*` | `backend/api/.../cli/generated/api/CliAuditApi.kt`; domain DTOs remain `com.querypie.duplo.api.generated.models.*` | `generated-ready` | `P0` | `migrate` | none; dedicated adapter preserves AUDIT_LOGS capability, plan/retention/viewable-period and organization filters | `AI-6344`; audit volume/query workload bounds remain `AI-6413` | `src/core/usage-audit-contract.test.ts`, `commands/admin/audit/*.test.ts`, `CliUsageAuditApiControllerTest`, Gateway registry/contract parity; real production CLI verifies page 2/3, types, 401/403/404/400 |
+| TUNNEL-01 | tunnel | `aipctl admin tunnel status`; `config`/`token` remain gated | `getTunnelStatus`; candidate `getTunnelConfig`, `createTunnelToken` | api | `GET`; candidate `GET`/`POST` | status `/api/cli/v1/organizations/{organizationSlug}/admin/tunnel/status`; candidates retain Web `/config`/`/token` | none | status `{ connected: boolean }` only | status `resource/oas/modules/backend/cli/openapi.yaml`; candidates Tunnel OAS | `backend/api/.../cli/generated/api/CliTunnelApi.kt#getCliTunnelStatus` | `generated-ready` | N/A | `migrate` | none for status; existing personal Tunnel service checks current user/org; token/config secret gates remain | `AI-6344`; sensitive gate `AI-6380` | status contract/adapter/registry tests; actual CLI + Go Tunnel server disconnected/Redis session connected/user isolation, token count unchanged; actual edge handshake not verified |
+| P1-PRESET-01 | preset | `aipctl admin preset list`, `get`, `create`, `update`, `rename`, `delete`, `set-default`, `unset-default`; key rotation commands remain gated | `listPresets`, `getPreset`, `createPreset`, `updatePreset`, `renamePreset`, `deletePreset`, `setPresetAsDefault`, `unsetPresetAsDefault` | api | list/get `GET`; create `POST`; update/default set `PUT`; rename `PATCH`; delete/default unset `DELETE` | `/api/cli/v1/organizations/{organizationSlug}/admin/presets`; `/{presetId}`; `/{presetId}/default` | bounded one-based page/pageSize 1..100; default pageSize 100; existing basic mutation bodies, explicit org in path | dedicated safe `CliPreset` metadata; no installation/json commands, auth, keys or MCP URL; list CLI JSON remains a page array; delete `void` | `resource/oas/modules/backend/cli/openapi.yaml` | `backend/api/.../cli/generated/api/CliPresetApi.kt`; `CliPreset` DTOs | `generated-ready` | `P1` | `migrate` | none for basic operations; user-owned resources require member+owner+org checks despite admin namespace; read service does not mint keys/enrich remotely; domain mutation/audit reused | `AI-6344`; key gate `AI-6380`; larger workload gate `AI-6413` | `src/core/remaining-direct-contract.test.ts`, Backend safe-read/controller tests, registry/manifest/help, trailing argv tests; actual production CLI eight-operation lifecycle, ownership/accessible integration/pagination/quota/key-count/DB/audit checks |
 
 ## 공통 CLI request quota 오류 계약
 
@@ -86,7 +86,7 @@ CLI `ApiError`는 위 여섯 code에서 allowlist된 quota detail만 보존하
 
 ### P0 queue
 
-- `P0-ORG-01` org member list/mutation legacy-exception aligned (done in `AIP-PUB-04`, independent contract follow-up remains)
+- `P0-ORG-01` member list and invite/remove/role mutations use dedicated CLI v1 contracts (`AI-6344`); `ORG-02` exit uses DELETE membership
 - `P0-ORG-02` org invite-link trio hidden from public beta (done in `AIP-PUB-04`)
 - `P0-AGENT-01` / `P0-AGENT-02` moved to dedicated CLI lifecycle endpoints with metadata quota and capability checks (`AI-6344`)
 - `P0-AGENT-03` export remains a gated transfer candidate (`AI-6380`)
@@ -98,7 +98,7 @@ CLI `ApiError`는 위 여섯 code에서 allowlist된 quota detail만 보존하
 
 - `P1-INT-01` integration legacy-exception documented; current/legacy path+DTO tests added
 - `P1-AUTO-01` Automation management uses eight dedicated v1 operations; Schedule/Webhook/My Drive lifecycle and stored safe reads are implemented. External provider metadata/mutations and `P1-AUTO-02` remain gated.
-- `P1-PRESET-01` preset admin namespace/docs + legacy path tests done
+- `P1-PRESET-01` eight basic operations use dedicated CLI v1 contracts and safe metadata DTOs (`AI-6344`); key rotation stays gated
 - `P1-SKILL-01` skill JSON/help/docs field sync done
 - `P1-CHAT-01` chat SSE fixture tests added for final/fallback/error cases
 - `P1-MODEL-EXEC-01` catalog/text moved to the dedicated v1 code-first OAS and CLI path; `P1-MODEL-EXEC-02` image remains deferred on the legacy route

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aipctl",
-  "version": "2026.10.1",
+  "version": "2026.10.3",
   "description": "QueryPie AIP and MCP CLI tool",
   "author": "QueryPie",
   "license": "UNLICENSED",
@@ -22,8 +22,8 @@
     "node": ">=24.18.0"
   },
   "metadata": {
-    "contentHash": "ea5c348d28e6d1e64655c97b08350c4e9b14572c4474243a654e18c2b6bb7917",
-    "wrapperHash": "03b7520e6526fd395045d78d3a17ba20bf875e10cd352306b5417a3b63ed384c",
+    "contentHash": "cd3e1d96a6c80cca1c9594573468ecac8876ea644f388d0d53950cc063451a72",
+    "wrapperHash": "1f9932e5f826496deb9203873e0e543319d84afda6610a78305ffa034fd665c0",
     "nativeHash": "006b08c3e391f4571d9b7c0f12d684fe2448106259e7e0581b10f9be362452e9"
   },
   "optionalDependencies": {