aipctl 2026.9.3 → 2026.9.5

package/build/index.cjs

@@ -778,7 +778,7 @@ const isIterable = input => typeof input === "string" || hasProperty(input, Symb
  * @since 2.0.0
  * @see isObject
  */
-const isRecord$2 = input => isRecordOrArray(input) && !Array.isArray(input);
+const isRecord$3 = input => isRecordOrArray(input) && !Array.isArray(input);
 /**
  * A refinement that checks if a value is `PromiseLike`. It performs a duck-typing
  * check for a `.then` method.
@@ -25158,7 +25158,7 @@ const go = (ast, isDecoding) => {
         const concurrency = getConcurrency(ast);
         const batching = getBatching(ast);
         return (input, options) => {
-          if (!isRecord$2(input)) {
+          if (!isRecord$3(input)) {
             return left(new Type(ast, input));
           }
           const allErrors = options?.errors === "all";
@@ -89666,11 +89666,11 @@ const runMain = runMain$1;
 const BUILD_ENVS = ["local", "dev", "qa", "stage", "prod", "test"];
 const isBuildEnv = (value) => BUILD_ENVS.includes(value);
 
-const injectedBuildEnv = "prod".length > 0 ? "prod" : "local";
+const injectedBuildEnv = "dev".length > 0 ? "dev" : "local";
 if (!isBuildEnv(injectedBuildEnv)) {
   throw new Error(`Invalid AIPCTL_BUILD_ENV: ${injectedBuildEnv}`);
 }
-const VERSION = "2026.9.3".length > 0 ? "2026.9.3" : "0.0.0";
+const VERSION = "2026.9.5".length > 0 ? "2026.9.5" : "0.0.0";
 const BUILD_ENV = injectedBuildEnv;
 const INCLUDE_NATIVE_LOGS = BUILD_ENV !== "prod";
 
@@ -89803,6 +89803,812 @@ const normalizeAipArgs = (args) => {
   ];
 };
 
+const implementedCommandOperationIds = /* @__PURE__ */ new Set([
+  "getCliMe",
+  "getCliUserSettings",
+  "listCliOrganizations",
+  "getCliOrganizationCapabilities",
+  "listCliOrganizationMembers",
+  "listCliModelExecModels",
+  "createCliModelChatExecution"
+]);
+const releaseEnabledCommandOperationIds = /* @__PURE__ */ new Set([
+  "getCliMe",
+  "getCliUserSettings",
+  "listCliOrganizations",
+  "getCliOrganizationCapabilities",
+  "listCliOrganizationMembers",
+  "listCliModelExecModels"
+]);
+const direct = (commands, operation) => commands.map((command) => ({
+  command,
+  tier: "GA_DIRECT",
+  availability: !implementedCommandOperationIds.has(operation.operationId ?? "") ? "PLANNED" : releaseEnabledCommandOperationIds.has(operation.operationId ?? "") ? "IMPLEMENTED" : "GATED",
+  ...operation
+}));
+const candidate = (commands, owner, authBoundary, requiredGates) => commands.map((command) => ({
+  command,
+  tier: "GA_CANDIDATE",
+  owner,
+  authBoundary,
+  quotaClass: "endpoint-guard",
+  availability: "GATED",
+  capability: `cli.${command.replaceAll(" ", ".")}`,
+  requiredGates
+}));
+const fixedBoundary = (commands, tier, owner, authBoundary) => commands.map((command) => ({
+  command,
+  tier,
+  owner,
+  authBoundary,
+  quotaClass: "none",
+  availability: tier === "INTERNAL_HIDDEN" ? "HIDDEN" : "AVAILABLE"
+}));
+const orgPath = "/api/cli/v1/organizations/{organizationSlug}";
+const commandManifest = [
+  ...direct(["auth whoami"], {
+    owner: "backend",
+    authBoundary: "user-oauth",
+    quotaClass: "bootstrap",
+    endpoint: { method: "GET", path: "/api/cli/v1/me" },
+    operationId: "getCliMe",
+    canonicalOperation: "cli.identity.me.read",
+    capability: "cli.identity.me"
+  }),
+  ...direct(["org list", "org use", "org select"], {
+    owner: "backend",
+    authBoundary: "user-oauth",
+    quotaClass: "bootstrap",
+    endpoint: { method: "GET", path: "/api/cli/v1/organizations" },
+    operationId: "listCliOrganizations",
+    canonicalOperation: "cli.organization.list",
+    capability: "cli.organization.discovery"
+  }),
+  ...direct(["org capabilities"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/capabilities` },
+    operationId: "getCliOrganizationCapabilities",
+    canonicalOperation: "cli.organization.capabilities.read",
+    capability: "cli.organization.capabilities"
+  }),
+  ...direct(["org settings"], {
+    owner: "backend",
+    authBoundary: "user-oauth",
+    quotaClass: "bootstrap",
+    endpoint: { method: "GET", path: "/api/cli/v1/me/settings" },
+    operationId: "getCliUserSettings",
+    canonicalOperation: "cli.user.settings.read",
+    capability: "cli.user.settings"
+  }),
+  ...direct(["org members"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/members` },
+    operationId: "listCliOrganizationMembers",
+    canonicalOperation: "cli.organization.members.list",
+    capability: "cli.organization.members.read"
+  }),
+  ...direct(["org exit"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/membership` },
+    operationId: "deleteCliOrganizationMembership",
+    canonicalOperation: "cli.organization.membership.exit",
+    capability: "cli.organization.exit"
+  }),
+  ...direct(["admin org invite"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/members/invitations` },
+    operationId: "createCliOrganizationMemberInvitations",
+    canonicalOperation: "cli.organization.members.invite",
+    capability: "cli.organization.members.write"
+  }),
+  ...direct(["admin org remove-member"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/members` },
+    operationId: "deleteCliOrganizationMembers",
+    canonicalOperation: "cli.organization.members.remove",
+    capability: "cli.organization.members.write"
+  }),
+  ...direct(["admin org update-member-role"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PUT", path: `${orgPath}/members/role` },
+    operationId: "updateCliOrganizationMemberRoles",
+    canonicalOperation: "cli.organization.members.role.update",
+    capability: "cli.organization.members.write"
+  }),
+  ...direct(["model list"], {
+    owner: "chat",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/models` },
+    operationId: "listCliModels",
+    canonicalOperation: "cli.model.catalog.read",
+    capability: "cli.model.catalog"
+  }),
+  ...direct(["model-exec models", "model-exec get", "model-exec sample"], {
+    owner: "chat",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/model-exec/models` },
+    operationId: "listCliModelExecModels",
+    canonicalOperation: "cli.model.catalog.read",
+    capability: "cli.model.catalog"
+  }),
+  ...direct(["model-exec chat"], {
+    owner: "chat",
+    authBoundary: "organization-oauth",
+    quotaClass: "text-execution",
+    endpoint: { method: "POST", path: `${orgPath}/model-exec/chat` },
+    operationId: "createCliModelChatExecution",
+    canonicalOperation: "cli.model.text.execute",
+    capability: "cli.model.text.execute"
+  }),
+  ...direct(["agent list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/agents` },
+    operationId: "listCliAgents",
+    canonicalOperation: "cli.agent.list",
+    capability: "cli.agent.read"
+  }),
+  ...direct(["agent get"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/agents/{installedAgentId}` },
+    operationId: "getCliAgent",
+    canonicalOperation: "cli.agent.get",
+    capability: "cli.agent.read"
+  }),
+  ...direct(["agent enable", "agent disable"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PATCH", path: `${orgPath}/agents/{installedAgentId}/status` },
+    operationId: "updateCliAgentStatus",
+    canonicalOperation: "cli.agent.status.update",
+    capability: "cli.agent.write"
+  }),
+  ...direct(["admin agent templates"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/agents/templates` },
+    operationId: "listCliAgentTemplates",
+    canonicalOperation: "cli.agent.templates.list",
+    capability: "cli.agent.read"
+  }),
+  ...direct(["admin agent create"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/agents` },
+    operationId: "createCliAgent",
+    canonicalOperation: "cli.agent.create",
+    capability: "cli.agent.write"
+  }),
+  ...direct(["admin agent update"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PATCH", path: `${orgPath}/agents/{installedAgentId}` },
+    operationId: "updateCliAgent",
+    canonicalOperation: "cli.agent.update",
+    capability: "cli.agent.write"
+  }),
+  ...direct(["admin agent delete"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/agents/{installedAgentId}` },
+    operationId: "deleteCliAgent",
+    canonicalOperation: "cli.agent.delete",
+    capability: "cli.agent.write"
+  }),
+  ...direct(["admin agent share"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/agents/{installedAgentId}/share` },
+    operationId: "getCliAgentShare",
+    canonicalOperation: "cli.agent.share.read",
+    capability: "cli.agent.read"
+  }),
+  ...direct(["skill list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/skills` },
+    operationId: "listCliSkills",
+    canonicalOperation: "cli.skill.list",
+    capability: "cli.skill.read"
+  }),
+  ...direct(["skill get"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/skills/{skillId}` },
+    operationId: "getCliSkill",
+    canonicalOperation: "cli.skill.get",
+    capability: "cli.skill.read"
+  }),
+  ...direct(["skill delete"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/skills/{skillId}` },
+    operationId: "deleteCliSkill",
+    canonicalOperation: "cli.skill.delete",
+    capability: "cli.skill.write"
+  }),
+  ...direct(["skill library"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/skills/library` },
+    operationId: "listCliSkillLibrary",
+    canonicalOperation: "cli.skill.library.list",
+    capability: "cli.skill.read"
+  }),
+  ...direct(["skill clone"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/skills/library/clone` },
+    operationId: "createCliSkillClones",
+    canonicalOperation: "cli.skill.library.clone",
+    capability: "cli.skill.write"
+  }),
+  ...direct(["skill built-in"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/skills/built-in` },
+    operationId: "listCliBuiltInSkills",
+    canonicalOperation: "cli.skill.built-in.list",
+    capability: "cli.skill.read"
+  }),
+  ...direct(["skill clone-built-in"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/skills/built-in/clone` },
+    operationId: "createCliBuiltInSkillClones",
+    canonicalOperation: "cli.skill.built-in.clone",
+    capability: "cli.skill.write"
+  }),
+  ...direct(["admin skill list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/skills` },
+    operationId: "listCliAdminSkills",
+    canonicalOperation: "cli.admin.skill.list",
+    capability: "cli.admin.skill.read"
+  }),
+  ...direct(["admin skill get"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/skills/{skillId}` },
+    operationId: "getCliAdminSkill",
+    canonicalOperation: "cli.admin.skill.get",
+    capability: "cli.admin.skill.read"
+  }),
+  ...direct(["admin skill delete"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/admin/skills/{skillId}` },
+    operationId: "deleteCliAdminSkill",
+    canonicalOperation: "cli.admin.skill.delete",
+    capability: "cli.admin.skill.write"
+  }),
+  ...direct(["admin skill publish", "admin skill unpublish"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PATCH", path: `${orgPath}/admin/skills/{skillId}` },
+    operationId: "updateCliAdminSkill",
+    canonicalOperation: "cli.admin.skill.update",
+    capability: "cli.admin.skill.write"
+  }),
+  ...direct(["admin skill built-in"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/skills/built-in` },
+    operationId: "listCliAdminBuiltInSkills",
+    canonicalOperation: "cli.admin.skill.built-in.list",
+    capability: "cli.admin.skill.read"
+  }),
+  ...direct(["admin skill clone-built-in"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/admin/skills/built-in/clone` },
+    operationId: "createCliAdminBuiltInSkillClones",
+    canonicalOperation: "cli.admin.skill.built-in.clone",
+    capability: "cli.admin.skill.write"
+  }),
+  ...direct(["drive list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/drive/entries` },
+    operationId: "listCliDriveEntries",
+    canonicalOperation: "cli.drive.entries.list",
+    capability: "cli.drive.read"
+  }),
+  ...direct(["drive usage"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/drive/usage` },
+    operationId: "getCliDriveUsage",
+    canonicalOperation: "cli.drive.usage.read",
+    capability: "cli.drive.read"
+  }),
+  ...direct(["drive mkdir"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/drive/folders` },
+    operationId: "createCliDriveFolder",
+    canonicalOperation: "cli.drive.folder.create",
+    capability: "cli.drive.write"
+  }),
+  ...direct(["drive rename"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PATCH", path: `${orgPath}/drive/entries/{entryId}` },
+    operationId: "updateCliDriveEntryName",
+    canonicalOperation: "cli.drive.entry.rename",
+    capability: "cli.drive.write"
+  }),
+  ...direct(["drive delete"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/drive/entries/delete` },
+    operationId: "deleteCliDriveEntries",
+    canonicalOperation: "cli.drive.entries.delete",
+    capability: "cli.drive.write"
+  }),
+  ...direct(["chat list"], {
+    owner: "chat",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/chats` },
+    operationId: "listCliChats",
+    canonicalOperation: "cli.chat.list",
+    capability: "cli.chat.read"
+  }),
+  ...direct(["chat get"], {
+    owner: "chat",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/chats/{conversationId}` },
+    operationId: "getCliChat",
+    canonicalOperation: "cli.chat.get",
+    capability: "cli.chat.read"
+  }),
+  ...direct(["chat messages"], {
+    owner: "chat",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/chats/{conversationId}/messages` },
+    operationId: "listCliChatMessages",
+    canonicalOperation: "cli.chat.messages.list",
+    capability: "cli.chat.read"
+  }),
+  ...direct(["integration list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/integrations` },
+    operationId: "listCliIntegrations",
+    canonicalOperation: "cli.integration.list",
+    capability: "cli.integration.read"
+  }),
+  ...direct(["admin integration available"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/integrations/available` },
+    operationId: "listCliAvailableIntegrations",
+    canonicalOperation: "cli.admin.integration.available.list",
+    capability: "cli.admin.integration.read"
+  }),
+  ...direct(["admin integration get"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/integrations/{integrationId}` },
+    operationId: "getCliAdminIntegration",
+    canonicalOperation: "cli.admin.integration.get",
+    capability: "cli.admin.integration.read"
+  }),
+  ...direct(["admin integration tools"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/integrations/{integrationId}/tools` },
+    operationId: "listCliIntegrationTools",
+    canonicalOperation: "cli.admin.integration.tools.list",
+    capability: "cli.admin.integration.read"
+  }),
+  ...direct(["automation list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/automations` },
+    operationId: "listCliAutomations",
+    canonicalOperation: "cli.automation.list",
+    capability: "cli.automation.read"
+  }),
+  ...direct(["automation get"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/automations/{automationId}` },
+    operationId: "getCliAutomation",
+    canonicalOperation: "cli.automation.get",
+    capability: "cli.automation.read"
+  }),
+  ...direct(["automation triggers"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/automations/triggers` },
+    operationId: "listCliAutomationTriggers",
+    canonicalOperation: "cli.automation.triggers.list",
+    capability: "cli.automation.read"
+  }),
+  ...direct(["automation history"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/automations/{automationId}/history` },
+    operationId: "listCliAutomationHistory",
+    canonicalOperation: "cli.automation.history.list",
+    capability: "cli.automation.read"
+  }),
+  ...direct(["automation create"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/automations` },
+    operationId: "createCliAutomation",
+    canonicalOperation: "cli.automation.create",
+    capability: "cli.automation.write"
+  }),
+  ...direct(["automation update"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PUT", path: `${orgPath}/automations/{automationId}` },
+    operationId: "updateCliAutomation",
+    canonicalOperation: "cli.automation.update",
+    capability: "cli.automation.write"
+  }),
+  ...direct(["automation delete"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/automations/{automationId}` },
+    operationId: "deleteCliAutomation",
+    canonicalOperation: "cli.automation.delete",
+    capability: "cli.automation.write"
+  }),
+  ...direct(["automation enable", "automation disable"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PATCH", path: `${orgPath}/automations/{automationId}/status` },
+    operationId: "updateCliAutomationStatus",
+    canonicalOperation: "cli.automation.status.update",
+    capability: "cli.automation.write"
+  }),
+  ...direct(["admin usage credit"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/usage/credit` },
+    operationId: "getCliCreditUsage",
+    canonicalOperation: "cli.admin.usage.credit.read",
+    capability: "cli.admin.usage.read"
+  }),
+  ...direct(["admin usage top-users"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/usage/top-users` },
+    operationId: "listCliTopUsers",
+    canonicalOperation: "cli.admin.usage.top-users.read",
+    capability: "cli.admin.usage.read"
+  }),
+  ...direct(["admin usage daily-graph"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/usage/daily-graph` },
+    operationId: "getCliDailyUsageGraph",
+    canonicalOperation: "cli.admin.usage.daily-graph.read",
+    capability: "cli.admin.usage.read"
+  }),
+  ...direct(["admin usage daily-users"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/usage/daily-users` },
+    operationId: "listCliDailyUsers",
+    canonicalOperation: "cli.admin.usage.daily-users.read",
+    capability: "cli.admin.usage.read"
+  }),
+  ...direct(["admin usage mcp-top"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/usage/mcp-top` },
+    operationId: "listCliTopMcpTools",
+    canonicalOperation: "cli.admin.usage.mcp-top.read",
+    capability: "cli.admin.usage.read"
+  }),
+  ...direct(["admin audit list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/audit` },
+    operationId: "listCliAuditLogs",
+    canonicalOperation: "cli.admin.audit.list",
+    capability: "cli.admin.audit.read"
+  }),
+  ...direct(["admin audit types"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/audit/types` },
+    operationId: "listCliAuditEventTypes",
+    canonicalOperation: "cli.admin.audit.types.list",
+    capability: "cli.admin.audit.read"
+  }),
+  ...direct(["admin preset list"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/presets` },
+    operationId: "listCliPresets",
+    canonicalOperation: "cli.admin.preset.list",
+    capability: "cli.admin.preset.read"
+  }),
+  ...direct(["admin preset get"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/presets/{presetId}` },
+    operationId: "getCliPreset",
+    canonicalOperation: "cli.admin.preset.get",
+    capability: "cli.admin.preset.read"
+  }),
+  ...direct(["admin preset create"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "POST", path: `${orgPath}/admin/presets` },
+    operationId: "createCliPreset",
+    canonicalOperation: "cli.admin.preset.create",
+    capability: "cli.admin.preset.write"
+  }),
+  ...direct(["admin preset update"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PUT", path: `${orgPath}/admin/presets/{presetId}` },
+    operationId: "updateCliPreset",
+    canonicalOperation: "cli.admin.preset.update",
+    capability: "cli.admin.preset.write"
+  }),
+  ...direct(["admin preset rename"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PATCH", path: `${orgPath}/admin/presets/{presetId}` },
+    operationId: "updateCliPresetName",
+    canonicalOperation: "cli.admin.preset.rename",
+    capability: "cli.admin.preset.write"
+  }),
+  ...direct(["admin preset delete"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/admin/presets/{presetId}` },
+    operationId: "deleteCliPreset",
+    canonicalOperation: "cli.admin.preset.delete",
+    capability: "cli.admin.preset.write"
+  }),
+  ...direct(["admin preset set-default"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "PUT", path: `${orgPath}/admin/presets/{presetId}/default` },
+    operationId: "updateCliDefaultPreset",
+    canonicalOperation: "cli.admin.preset.default.set",
+    capability: "cli.admin.preset.write"
+  }),
+  ...direct(["admin preset unset-default"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "DELETE", path: `${orgPath}/admin/presets/{presetId}/default` },
+    operationId: "deleteCliDefaultPreset",
+    canonicalOperation: "cli.admin.preset.default.unset",
+    capability: "cli.admin.preset.write"
+  }),
+  ...direct(["admin tunnel status"], {
+    owner: "backend",
+    authBoundary: "organization-oauth",
+    quotaClass: "metadata",
+    endpoint: { method: "GET", path: `${orgPath}/admin/tunnel/status` },
+    operationId: "getCliTunnelStatus",
+    canonicalOperation: "cli.admin.tunnel.status.read",
+    capability: "cli.admin.tunnel.read"
+  }),
+  ...candidate(["agent chat"], "chat", "organization-oauth", [
+    "streaming-performance",
+    "execution-permit-lifetime",
+    "disconnect-cancel-recovery"
+  ]),
+  ...candidate(["admin agent export"], "backend", "organization-oauth", [
+    "bounded-download",
+    "partial-file-cleanup",
+    "authorization-audit"
+  ]),
+  ...candidate(["skill upload", "skill download", "admin skill upload", "admin skill download"], "backend", "organization-oauth", [
+    "archive-size-mime-validation",
+    "presigned-host-policy",
+    "abort-complete-recovery"
+  ]),
+  ...candidate([
+    "admin skill github inspect",
+    "admin skill github import",
+    "admin skill github sync"
+  ], "backend", "organization-oauth", [
+    "external-timeout",
+    "repository-size-limit",
+    "duplicate-import-protection",
+    "credential-redaction"
+  ]),
+  ...candidate([
+    "admin skill github credentials set",
+    "admin skill github credentials clear"
+  ], "backend", "organization-oauth", [
+    "secret-redaction",
+    "rotation-revoke-audit"
+  ]),
+  ...candidate(["drive upload", "drive download"], "backend", "organization-oauth", [
+    "byte-timeout-bound",
+    "presigned-host-policy",
+    "storage-quota",
+    "partial-file-cleanup"
+  ]),
+  ...candidate(["chat send"], "chat", "organization-oauth", [
+    "conversation-idempotency",
+    "paid-execution-deduplication",
+    "timeout-cancel-recovery"
+  ]),
+  ...candidate(["integration test"], "backend", "organization-oauth", [
+    "external-timeout",
+    "credential-redaction"
+  ]),
+  ...candidate(["admin integration update", "admin integration delete"], "backend", "organization-oauth", [
+    "typed-contract",
+    "credential-redaction",
+    "mutation-idempotency"
+  ]),
+  ...candidate(["automation run", "automation cancel", "automation webhook-regen"], "backend", "organization-oauth", [
+    "operation-idempotency",
+    "state-transition-validation",
+    "execution-quota",
+    "secret-rotation"
+  ]),
+  ...candidate(["admin preset regen-key", "admin preset regen-static-key"], "backend", "organization-oauth", [
+    "key-redaction",
+    "rotation-audit",
+    "retry-rollback-safety"
+  ]),
+  ...candidate(["admin tunnel config", "admin tunnel token"], "backend", "organization-oauth", [
+    "sensitive-output-policy",
+    "token-ttl-redaction",
+    "audit"
+  ]),
+  {
+    command: "model-exec image generate",
+    tier: "DEFERRED",
+    owner: "chat",
+    authBoundary: "organization-oauth",
+    quotaClass: "endpoint-guard",
+    availability: "DEFERRED",
+    capability: "cli.model.image.generate",
+    requiredGates: ["async-job-lifecycle", "artifact-ttl", "my-drive-output", "cost-reservation"]
+  },
+  ...fixedBoundary(["auth login", "auth refresh"], "STANDARD_OAUTH", "backend", "standard-oauth"),
+  ...fixedBoundary([
+    "auth status",
+    "auth logout",
+    "config set",
+    "config status",
+    "org current"
+  ], "LOCAL_ONLY", "desktop", "local"),
+  ...fixedBoundary(["install", "run", "tunnel"], "EXISTING_NATIVE", "native", "native"),
+  ...fixedBoundary(["logs"], "INTERNAL_HIDDEN", "native", "hidden")
+];
+
+const CUSTOMER_AVAILABILITIES = /* @__PURE__ */ new Set([
+  "IMPLEMENTED",
+  "AVAILABLE"
+]);
+const isCustomerAvailable = (entry) => CUSTOMER_AVAILABILITIES.has(entry.availability);
+const normalizeCliArgCase = (arg) => arg.toLowerCase();
+const commandSegments = (command) => command.split(" ");
+const PROD_DISABLED_BUILT_INS = /* @__PURE__ */ new Set(["--completions", "--wizard"]);
+const isCommandPrefix = (entry, args) => {
+  const segments = commandSegments(entry.command);
+  return segments.length <= args.length && segments.every((segment, index) => args[index] === segment);
+};
+const commandPathBeforeOptions = (args) => args.slice(0, args.findIndex((arg) => arg.startsWith("-")) === -1 ? args.length : args.findIndex((arg) => arg.startsWith("-")));
+const formatUnavailableMessage = (command) => `Command "aipctl ${command}" is not available in this aipctl release. Run "aipctl --help" to see supported commands.`;
+const formatUnavailableOptionMessage = (option) => `Option "aipctl ${option}" is not available in this aipctl release. Run "aipctl --help" to see supported commands.`;
+const commandArgsForAvailability = (args) => {
+  const commandArgs = [];
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--log-level") {
+      index += 1;
+      continue;
+    }
+    commandArgs.push(arg);
+  }
+  return commandArgs;
+};
+const getUnavailableCommandMessage = (args, buildEnv) => {
+  if (buildEnv !== "prod" || args.length === 0) {
+    return null;
+  }
+  const normalizedArgs = args.map(normalizeCliArgCase);
+  const disabledBuiltIn = normalizedArgs.find((arg) => PROD_DISABLED_BUILT_INS.has(arg));
+  if (disabledBuiltIn) {
+    return formatUnavailableOptionMessage(disabledBuiltIn);
+  }
+  const commandArgs = commandArgsForAvailability(normalizedArgs);
+  const entry = commandManifest.filter((candidate) => isCommandPrefix(candidate, commandArgs)).sort((left, right) => commandSegments(right.command).length - commandSegments(left.command).length).at(0);
+  if (entry) {
+    return isCustomerAvailable(entry) ? null : formatUnavailableMessage(entry.command);
+  }
+  const path = commandPathBeforeOptions(commandArgs).join(" ");
+  if (!path) {
+    return null;
+  }
+  const descendants = commandManifest.filter(({ command }) => command.startsWith(`${path} `));
+  if (descendants.length > 0 && descendants.every((candidate) => !isCustomerAvailable(candidate))) {
+    return formatUnavailableMessage(path);
+  }
+  return null;
+};
+
 const NOT_LOGGED_IN_MESSAGE = 'Not logged in. Please run "aipctl auth login" first.';
 const SESSION_EXPIRED_MESSAGE = 'Session expired. Run "aipctl auth login" to continue.';
 
@@ -89826,14 +90632,14 @@ class InvalidAppUrlError extends Error {
     this.rawValue = rawValue;
   }
 }
-function isRecord$1(value) {
+function isRecord$2(value) {
   return typeof value === "object" && value !== null;
 }
 function optionalString$1(value) {
   return typeof value === "string" ? value : void 0;
 }
 function parseCurrentOrganization(value) {
-  if (!isRecord$1(value)) {
+  if (!isRecord$2(value)) {
     return void 0;
   }
   const id = optionalString$1(value["id"]);
@@ -89845,7 +90651,7 @@ function parseCurrentOrganization(value) {
   return { id, slug, name };
 }
 function normalizeLoadedConfig(value) {
-  if (!isRecord$1(value)) {
+  if (!isRecord$2(value)) {
     return {};
   }
   return {
@@ -92079,11 +92885,11 @@ const CREDENTIALS_FILE = path__namespace.join(CONFIG_DIR$1, "credentials.json");
 const CREDENTIALS_LOCK_FILE = path__namespace.join(CONFIG_DIR$1, "credentials.lock");
 class CredentialServiceTag extends Tag$1("CredentialService")() {
 }
-function isNonEmptyString(value) {
+function isNonEmptyString$1(value) {
   return typeof value === "string" && value.length > 0;
 }
 function hasOAuthClient(credentials) {
-  return isNonEmptyString(credentials?.clientId);
+  return isNonEmptyString$1(credentials?.clientId);
 }
 function isAccessTokenExpired(credentials, bufferMs = 0, now = Date.now()) {
   if (!credentials?.expiresAt) {
@@ -92092,13 +92898,13 @@ function isAccessTokenExpired(credentials, bufferMs = 0, now = Date.now()) {
   return credentials.expiresAt - bufferMs <= now;
 }
 function hasValidRefreshToken(credentials, now) {
-  return isNonEmptyString(credentials.refreshToken) && (credentials.refreshExpiresAt === void 0 || credentials.refreshExpiresAt > now);
+  return isNonEmptyString$1(credentials.refreshToken) && (credentials.refreshExpiresAt === void 0 || credentials.refreshExpiresAt > now);
 }
 function getCredentialAuthStatus(credentials, now = Date.now(), options = {}) {
   if (!hasOAuthClient(credentials)) {
     return "missing";
   }
-  const needsAccessRefresh = options.forceRefresh || !isNonEmptyString(credentials.accessToken) || isAccessTokenExpired(credentials, options.accessExpiryBufferMs ?? 0, now);
+  const needsAccessRefresh = options.forceRefresh || !isNonEmptyString$1(credentials.accessToken) || isAccessTokenExpired(credentials, options.accessExpiryBufferMs ?? 0, now);
   if (!needsAccessRefresh) {
     return "authenticated";
   }
@@ -93094,7 +93900,7 @@ function trimTrailingSlash(value) {
 function toError$1(error, fallbackMessage) {
   return error instanceof Error ? new Error(maskSensitiveText(error.message)) : new Error(maskSensitiveText(fallbackMessage));
 }
-function isRecord(value) {
+function isRecord$1(value) {
   return typeof value === "object" && value !== null;
 }
 function optionalString(value) {
@@ -93104,7 +93910,7 @@ function optionalNumber(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : void 0;
 }
 function parseOAuthTokenResponse(value) {
-  if (!isRecord(value)) {
+  if (!isRecord$1(value)) {
     throw new OAuthRequestError("OAuth token response was not a JSON object", void 0, "invalid_token_response");
   }
   const accessToken = optionalString(value["access_token"]);
@@ -93633,6 +94439,55 @@ async function acquire() {
   }
 }
 
+const SERVER_CAPABILITY_SCHEMA_VERSION = 1;
+class ServerCapabilityError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "ServerCapabilityError";
+    this.code = code;
+  }
+}
+function parseEnabledServerOperations(value) {
+  if (!isRecord(value) || value["schemaVersion"] !== SERVER_CAPABILITY_SCHEMA_VERSION) {
+    throw new ServerCapabilityError(
+      "CLI_CAPABILITIES_INCOMPATIBLE",
+      "The server returned an unsupported CLI capability schema."
+    );
+  }
+  const enabledOperations = value["enabledOperations"];
+  if (!Array.isArray(enabledOperations)) {
+    throw new ServerCapabilityError(
+      "CLI_CAPABILITIES_INCOMPATIBLE",
+      "The server returned an invalid CLI capability operation list."
+    );
+  }
+  const operationIds = /* @__PURE__ */ new Set();
+  for (const operation of enabledOperations) {
+    if (!isRecord(operation) || !isNonEmptyString(operation["operationId"]) || !isNonEmptyString(operation["capability"]) || operationIds.has(operation["operationId"])) {
+      throw new ServerCapabilityError(
+        "CLI_CAPABILITIES_INCOMPATIBLE",
+        "The server returned an invalid CLI capability operation."
+      );
+    }
+    operationIds.add(operation["operationId"]);
+  }
+  return operationIds;
+}
+function requireEnabledServerOperation(enabledOperations, operationId) {
+  if (enabledOperations.has(operationId)) return;
+  throw new ServerCapabilityError(
+    "CLI_OPERATION_NOT_ENABLED",
+    `CLI operation "${operationId}" is not enabled by the server.`
+  );
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.length > 0;
+}
+
 class ApiError extends TaggedError$1("ApiError") {
 }
 class NotLoggedInError extends TaggedError$1("NotLoggedInError") {
@@ -93939,7 +94794,7 @@ const parseSseStream = async (body) => {
   }
   throw new AgentChatStreamIncompleteError(hasDataEvent && sawOnlyTerminalEnvelope);
 };
-const ApiServiceLive = effect$1(
+const makeApiServiceLive = (buildEnv) => effect$1(
   ApiServiceTag,
   gen(function* () {
     const configService = yield* ConfigService;
@@ -94056,6 +94911,34 @@ const ApiServiceLive = effect$1(
     });
     const baseUrl = () => loadConfiguredApiBaseUrl();
     const chatBaseUrl = () => loadConfiguredChatBaseUrl();
+    const requireServerOperation = (operationId, token) => {
+      if (buildEnv !== "prod") return _void;
+      if (!releaseEnabledCommandOperationIds.has(operationId)) {
+        return fail$3(createApiError({
+          message: `CLI operation "${operationId}" is not enabled in this aipctl release.`,
+          statusCode: 404,
+          code: "CLI_OPERATION_NOT_ENABLED"
+        }));
+      }
+      return gen(function* () {
+        const response = yield* makeRequest(
+          baseUrl,
+          "/api/cli/v1/capabilities",
+          token
+        );
+        yield* try_({
+          try: () => {
+            const enabledOperations = parseEnabledServerOperations(response);
+            requireEnabledServerOperation(enabledOperations, operationId);
+          },
+          catch: (error) => createApiError({
+            message: error instanceof Error ? error.message : "CLI server capability validation failed",
+            statusCode: error instanceof ServerCapabilityError && error.code === "CLI_OPERATION_NOT_ENABLED" ? 404 : 503,
+            code: error instanceof ServerCapabilityError ? error.code : "CLI_CAPABILITIES_INCOMPATIBLE"
+          })
+        });
+      });
+    };
     const subscribeAgentChatStream = (orgSlug, conversationId, token) => gen(function* () {
       const resolvedChatBaseUrl = yield* requireChatBaseUrlEffect();
       const path = `/api/${encodeURIComponent(orgSlug)}/conversations/${encodeURIComponent(conversationId)}/stream`;
@@ -94122,11 +95005,13 @@ const ApiServiceLive = effect$1(
     return {
       listOrganizations: () => gen(function* () {
         const token = yield* getAccessToken();
-        return yield* makeRequest(baseUrl, "/api/web/organizations", token);
+        yield* requireServerOperation("listCliOrganizations", token);
+        return yield* makeRequest(baseUrl, "/api/cli/v1/organizations", token);
       }),
       getOrganization: (slug) => gen(function* () {
         const token = yield* getAccessToken();
-        const orgs = yield* makeRequest(baseUrl, "/api/web/organizations", token);
+        yield* requireServerOperation("listCliOrganizations", token);
+        const orgs = yield* makeRequest(baseUrl, "/api/cli/v1/organizations", token);
         const org = orgs.find((o) => o.slug === slug);
         if (!org) {
           return yield* fail$3(
@@ -94465,7 +95350,8 @@ const ApiServiceLive = effect$1(
       // Phase 4: Monitoring
       listOrgMembers: (orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/organizations/slug/${encodeURIComponent(orgSlug)}/members/detail`;
+        yield* requireServerOperation("listCliOrganizationMembers", token);
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/members`;
         const raw = yield* makeRequest(baseUrl, path, token);
         return {
           members: raw.members.map((member) => ({
@@ -94481,22 +95367,24 @@ const ApiServiceLive = effect$1(
         yield* requireChatBaseUrlEffect();
         const token = yield* getAccessToken();
         const path = `/api/${encodeURIComponent(orgSlug)}/models`;
-        const res = yield* makeRequest(chatBaseUrl, path, token);
-        return res.models.map((id) => ({
+        const response = yield* makeRequest(chatBaseUrl, path, token);
+        return response.models.map((id) => ({
           id,
-          ...res.defaultModel === id ? { isDefault: true } : {}
+          ...response.defaultModel === id ? { isDefault: true } : {}
         }));
       }),
       listModelExecModels: (orgSlug) => gen(function* () {
         yield* requireChatBaseUrlEffect();
         const token = yield* getAccessToken();
-        const path = `/api/${encodeURIComponent(orgSlug)}/cli/model-exec/models`;
+        yield* requireServerOperation("listCliModelExecModels", token);
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/model-exec/models`;
         return yield* makeRequest(chatBaseUrl, path, token);
       }),
       executeModelExecChat: (orgSlug, body) => gen(function* () {
         yield* requireChatBaseUrlEffect();
         const token = yield* getAccessToken();
-        const path = `/api/${encodeURIComponent(orgSlug)}/cli/model-exec/chat`;
+        yield* requireServerOperation("createCliModelChatExecution", token);
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/model-exec/chat`;
         return yield* makeRequest(chatBaseUrl, path, token, {
           method: "POST",
           body
@@ -94637,7 +95525,8 @@ const ApiServiceLive = effect$1(
       // Phase 6: Auth enhancements
       getMe: () => gen(function* () {
         const token = yield* getAccessToken();
-        return yield* makeRequest(baseUrl, "/api/web/me", token);
+        yield* requireServerOperation("getCliMe", token);
+        return yield* makeRequest(baseUrl, "/api/cli/v1/me", token);
       }),
       refreshToken: () => refreshAccessToken({ force: true }),
       // Phase 7: Chat (read-only)
@@ -94818,12 +95707,14 @@ const ApiServiceLive = effect$1(
       // Org capabilities & user settings
       getOrgCapabilities: (orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/organizations/slug/${encodeURIComponent(orgSlug)}/capabilities`;
+        yield* requireServerOperation("getCliOrganizationCapabilities", token);
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/capabilities`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       getUserSettings: () => gen(function* () {
         const token = yield* getAccessToken();
-        return yield* makeRequest(baseUrl, "/api/web/user/settings", token);
+        yield* requireServerOperation("getCliUserSettings", token);
+        return yield* makeRequest(baseUrl, "/api/cli/v1/me/settings", token);
       }),
       // Tunnel management
       getTunnelStatus: (orgSlug) => gen(function* () {
@@ -94940,6 +95831,7 @@ const ApiServiceLive = effect$1(
     };
   })
 );
+const ApiServiceLive = makeApiServiceLive(BUILD_ENV);
 const ApiService = ApiServiceTag;
 
 const orgOption = text("org").pipe(
@@ -99713,9 +100605,11 @@ const generateCommand = make$4(
     "Generate an image once and save the first output artifact (5-minute timeout)"
   )
 );
+const imageCommandDescription = "Run image-generation model-exec commands";
+const imageSubcommands = [generateCommand];
 const imageCommand = make$4("image", {}).pipe(
-  withDescription("Run image-generation model-exec commands"),
-  withSubcommands([generateCommand])
+  withDescription(imageCommandDescription),
+  withSubcommands(imageSubcommands)
 );
 const resolveImageRequest = (model, prompt, input) => gen(function* () {
   if (isSome(input)) {
@@ -100567,6 +101461,8 @@ const HELP_GROUPS = [
   { path: ["drive"], description: driveCommandDescription, subcommands: driveSubcommands },
   { path: ["integration"], description: integrationCommandDescription, subcommands: integrationSubcommands },
   { path: ["model"], description: modelCommandDescription, subcommands: modelSubcommands },
+  { path: ["model-exec"], description: modelExecCommandDescription, subcommands: modelExecSubcommands },
+  { path: ["model-exec", "image"], description: imageCommandDescription, subcommands: imageSubcommands },
   { path: ["org"], description: orgCommandDescription, subcommands: orgSubcommands },
   { path: ["skill"], description: skillCommandDescription, subcommands: skillSubcommands },
   { path: ["admin", "org"], description: adminOrgCommandDescription, subcommands: adminOrgSubcommands },
@@ -100593,16 +101489,22 @@ const getCommandName = (command) => {
   }
   return name;
 };
-const formatCommandList = (path, subcommands) => subcommands.map((command) => `  - ${formatCanonicalPath([...path, getCommandName(command)])}`).join("\n");
+const hasCustomerAvailableCommand = (path) => {
+  const commandPath = path.join(" ");
+  return commandManifest.some(
+    (entry) => isCustomerAvailable(entry) && (entry.command === commandPath || entry.command.startsWith(`${commandPath} `))
+  );
+};
+const formatCommandList = (path, subcommands, options) => subcommands.map((command) => [...path, getCommandName(command)]).filter((commandPath) => !options.customerOnly || hasCustomerAvailableCommand(commandPath)).map((commandPath) => `  - ${formatCanonicalPath(commandPath)}`).join("\n");
 const getHelpPath = (args) => {
   const lastArg = args.at(-1);
-  if (!lastArg || !HELP_FLAGS$1.has(lastArg)) {
+  if (!lastArg || !HELP_FLAGS$1.has(normalizeCliArgCase(lastArg))) {
     return null;
   }
-  const path = args.slice(0, -1);
+  const path = args.slice(0, -1).map(normalizeCliArgCase);
   return path.every((segment) => !segment.startsWith("-")) ? path : null;
 };
-const renderGroupHelp = ({ path, description, subcommands }) => {
+const renderGroupHelp = ({ path, description, subcommands }, options) => {
   const canonicalPath = formatCanonicalPath(path);
   const usageTarget = path.length === 0 ? "$ aipctl <command>" : `$ ${canonicalPath} <command>`;
   return [
@@ -100618,7 +101520,7 @@ const renderGroupHelp = ({ path, description, subcommands }) => {
     "",
     "COMMANDS",
     "",
-    formatCommandList(path, subcommands),
+    formatCommandList(path, subcommands, options),
     "",
     "OPTIONS",
     "",
@@ -100628,13 +101530,13 @@ const renderGroupHelp = ({ path, description, subcommands }) => {
     ""
   ].join("\n");
 };
-const renderPublicHelpForArgs = (args) => {
+const renderPublicHelpForArgs = (args, options = {}) => {
   const helpPath = getHelpPath(args);
   if (!helpPath) {
     return null;
   }
   const group = HELP_GROUPS.find(({ path }) => isSamePath(path, helpPath));
-  return group ? renderGroupHelp(group) : null;
+  return group ? renderGroupHelp(group, options) : null;
 };
 
 const HELP_FLAGS = /* @__PURE__ */ new Set(["--help", "-h"]);
@@ -100665,7 +101567,13 @@ const runNativeHelpIfRequested = (args, options = {}) => {
 };
 
 const args = process.argv.slice(2);
-const helpOutput = renderPublicHelpForArgs(args);
+const unavailableMessage = getUnavailableCommandMessage(args, BUILD_ENV);
+if (unavailableMessage) {
+  process.stderr.write(`${unavailableMessage}
+`);
+  process.exit(2);
+}
+const helpOutput = renderPublicHelpForArgs(args, { customerOnly: BUILD_ENV === "prod" });
 if (helpOutput) {
   process.stdout.write(`${helpOutput}
 `);

package/docs/api-contract-inventory.md

@@ -38,10 +38,10 @@
 | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
 | AUTH-01 | auth | `aipctl auth login` | `src/core/oauth.ts`: `discoverOAuthMetadata` → `registerCliOAuthClient` → `exchangeAuthorizationCode` | api + external browser | `GET /.well-known` → `POST /oauth2/register` → browser `GET /oauth2/authorize` → `POST /oauth2/token` | `/.well-known/oauth-authorization-server`, `/oauth2/register`, `/oauth2/authorize`, `/oauth2/token` | PKCE state/challenge, dynamic client registration body, auth code exchange form | `OAuthMetadata`, `OAuthClientRegistration`, `OAuthTokenResponse` → local `Credentials` | not found in current `resource/oas` for `oauth-authorization-server` / `/oauth2/register` / `/oauth2/token` | none | `oas-missing` | N/A | `legacy-exception` | owner=`backend/api OAuth server`; rationale=`login is required public auth flow but OAuth authorization-server/DCR/token contract is not in current OAS`; removal condition=`official OAuth server contract exists in resource/oas and independent generated contract`; incorporation plan=`add OAuth server metadata/register/token paths or dedicated auth contract fixture, then bind CLI parser/tests` | `AIP-PUB-05` | existing auth tests cover login helpers; needed contract snapshot for OAuth metadata/register/token paths |
 | AUTH-02 | auth | `aipctl auth refresh` | `ApiService.refreshToken` → `refreshAccessToken` → `src/core/oauth.ts#refreshOAuthToken` | api | `POST` | `/oauth2/token` | refresh token form body | refreshed local `Credentials` | not found in current `resource/oas` for `/oauth2/token` | none | `oas-missing` | N/A | `legacy-exception` | owner=`backend/api OAuth server`; rationale=`token refresh is required for session continuity but token endpoint is outside current OAS`; removal condition=`official OAuth token contract exists in resource/oas and independent generated contract`; incorporation plan=`same OAuth server contract as AUTH-01, plus refresh fixture` | `AIP-PUB-05` | existing `src/core/oauth.test.ts`, `src/core/api.test.ts`; needed token refresh path snapshot |
-| AUTH-03 | auth | `aipctl auth whoami` | `ApiService.getMe` | api | `GET` | `/api/web/me` | none | local `UserProfile` | `resource/oas/duplo-web.yaml` | `frontend/packages/api/src/out/user-types.ts#paths["/api/web/me"]` | `legacy-generated` | N/A | `keep` | none | N/A | existing `commands/auth/auth.test.ts`; needed user-types ref note only |
-| ORG-01 | org | `aipctl org list`, `aipctl org use` | `listOrganizations`, `getOrganization` | api | `GET` | `/api/web/organizations`; CLI `use` filters locally by slug after list call | none | local `Organization[]` / `Organization` | `resource/oas/duplo-web.yaml` | `frontend/packages/api/src/out/user-types.ts#paths["/api/web/organizations"]`, `#paths["/api/web/organizations/slug/{organizationSlug}"]` | `legacy-generated` | N/A | `keep` | none | N/A | existing `commands/org/org.test.ts`; needed slug lookup contract snapshot |
-| ORG-02 | org | `aipctl org capabilities`, `aipctl org settings`, `aipctl org exit` | `getOrgCapabilities`, `getUserSettings`, `exitOrg` | api | `GET`, `GET`, `POST` | `/api/web/organizations/slug/{organizationSlug}/capabilities`; `/api/web/user/settings`; `/api/web/organizations/slug/{organizationSlug}/exit` | none | local `OrgCapabilities`, `UserSettings`, `void` | capabilities: `resource/oas/modules/backend/organization/openapi.yaml`; settings/exit: `resource/oas/duplo-web.yaml` | capabilities `frontend/packages/api/src/out/modules/organization-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/capabilities"]`; settings/exit legacy `frontend/packages/api/src/out/user-types.ts#paths[...]` | `legacy-generated` | N/A | `keep` | none | N/A | existing org tests partial; needed capability/settings/exit smoke coverage |
-| P0-ORG-01 | org-member | `aipctl org members`; `aipctl admin org invite`, `aipctl admin org remove-member`, `aipctl admin org update-member-role` | `listOrgMembers`, `inviteOrgMembers`, `removeOrgMembers`, `updateOrgMemberRoles` | api | `GET`, `POST`, `DELETE`, `PUT` | `/api/web/organizations/slug/{organizationSlug}/members/detail`; `/invite`; `/members` | list uses detail status shape; invite body `{ emails, role: 'owner' | 'admin' | 'aiOperator' | 'member' }`; remove/update bodies `{ members: [{ email, status, userId? }] }` + update `role` | local `ListMembersResponse`, `InviteOrgMembersResponse`, `void`; mutation commands preload `listOrgMembers` for selection UX | latest role enum source: `resource/oas/modules/backend/_/components/schemas/OrganizationRoleEnum.yaml`; member status source: `resource/oas/modules/backend/organization/openapi.yaml`; legacy member list/mutation paths: `resource/oas/duplo-web.yaml` | latest refs: `frontend/packages/api/src/out/modules/backend-common-types.ts#OrganizationRoleEnum`, `frontend/packages/api/src/out/modules/organization-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/members/status"]`; legacy refs: `frontend/packages/api/src/out/user-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/invite"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/members"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/members/detail"]` | `legacy-generated` | `P0` | `legacy-exception` | owner=`backend app Organization API / duplo-web legacy OAS`; rationale=`public member list/admin flow kept for beta; role/status now align with current enum/status source while invite/remove/update still rely on legacy duplo-web member mutation contract`; removal condition=`independent contract includes member detail list plus invite/remove/update member mutations`; incorporation plan=`add resource/oas-based organization member admin contract, then remove legacy duplo-web refs and local fallback mapping` | `AIP-PUB-05` | updated `src/core/api.test.ts`, `commands/org/members.test.ts`, `commands/org/org-member.test.ts`; covers detail path, lower-case role enum, failedInvitations, member mutation body |
+| AUTH-03 | auth | `aipctl auth whoami` | `ApiService.getMe` | api | `GET` | `/api/cli/v1/me` | none | local `UserProfile` | `resource/oas/modules/backend/cli/openapi.yaml` | `backend/api/.../cli/generated/api/CliV1Api.kt#getCliMe` | `generated-ready` | N/A | `migrate` | none | N/A | `src/core/api.test.ts` verifies the dedicated path and bearer request; `commands/auth/auth.test.ts` covers command behavior |
+| ORG-01 | org | `aipctl org list`, `aipctl org use`, `aipctl org select` | `listOrganizations`, `getOrganization` | api | `GET` | `/api/cli/v1/organizations`; `use/select` resolve locally from the returned list | none | local `Organization[]` / `Organization` | `resource/oas/modules/backend/cli/openapi.yaml` | `backend/api/.../cli/generated/api/CliV1Api.kt#listCliOrganizations` | `generated-ready` | N/A | `migrate` | none | N/A | `src/core/api.test.ts`, `commands/org/org.test.ts`; covers dedicated path, local slug selection, default/IP-blocked fields |
+| ORG-02 | org | `aipctl org capabilities`, `aipctl org settings`, `aipctl org exit` | `getOrgCapabilities`, `getUserSettings`, `exitOrg` | api | `GET`, `GET`, `POST` | organization v1 `/api/cli/v1/organizations/{organizationSlug}/capabilities`; user-global v1 `/api/cli/v1/me/settings`; legacy `/api/web/organizations/slug/{organizationSlug}/exit` | none | local `OrgCapabilities`, `UserSettings`, `void` | read paths: `resource/oas/modules/backend/cli/openapi.yaml`; exit: `resource/oas/duplo-web.yaml` | read generated `CliOrganizationApi`/`CliV1Api`; exit legacy generated | `legacy-generated` | N/A | `migrate` | owner=`backend`; rationale=`capabilities is organization-owned, settings remains user-global, and exit remains a Wave B mutation`; removal condition=`exit receives its dedicated v1 mutation contract`; incorporation plan=`preserve current membership authorization and non-replay behavior` | task 3.3 | `src/core/api.test.ts` verifies v1 read paths and settings ownership; org tests cover response/error behavior |
+| P0-ORG-01 | org-member | `aipctl org members`; `aipctl admin org invite`, `aipctl admin org remove-member`, `aipctl admin org update-member-role` | `listOrgMembers`, `inviteOrgMembers`, `removeOrgMembers`, `updateOrgMemberRoles` | api | `GET`, `POST`, `DELETE`, `PUT` | list v1 `/api/cli/v1/organizations/{organizationSlug}/members`; mutations remain legacy `/invite`; `/members` | list uses stable CLI member response; mutation bodies preserve `{ emails, role }` and `{ members, role? }` | local `ListMembersResponse`, `InviteOrgMembersResponse`, `void` | list: `resource/oas/modules/backend/cli/openapi.yaml`; mutation: `resource/oas/duplo-web.yaml` | list generated `CliOrganizationApi`; mutation legacy generated | `legacy-generated` | `P0` | `legacy-exception` | owner=`backend`; rationale=`member read is migrated while admin mutations remain Wave B`; removal condition=`invite/remove/role receive dedicated v1 contracts`; incorporation plan=`reuse current admin authorization, audit, stale target validation, and non-replay semantics` | task 3.3 | `src/core/api.test.ts`, `commands/org/members.test.ts`, `commands/org/org-member.test.ts`; covers v1 member read and legacy mutation bodies |
 | P0-ORG-02 | org-admin | hidden from public beta (`aipctl admin org invite-link`, `gen-invite-link`, `revoke-invite-link` removed from command tree) | removed from public surface | api | `GET`, `POST`, `DELETE` | previously `/api/web/organizations/slug/{organizationSlug}/invite/link` | none | hidden | latest: `resource/oas/modules/backend/organization/openapi.yaml` (`/invite/link/v2`); legacy: `resource/oas/duplo-web.yaml` (`/invite/link`) | latest `frontend/packages/api/src/out/modules/organization-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/invite/link/v2"]`; legacy `frontend/packages/api/src/out/user-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/invite/link"]` | `oas-source-only` | `P0` | `hide` | owner=`backend organization module`; rationale=`v2 exists but current CLI UX contract for GET/DELETE parity is not approved for public beta`; removal condition=`public beta continues hiding until a reviewed v2 CLI UX contract exists`; incorporation plan=`reintroduce only after independent organization contract/build and public UX review` | N/A | updated admin org help smoke + command-tree regression to ensure trio is absent |
 | SKILL-01 | skill | `aipctl skill list`, `aipctl skill get`, `aipctl skill delete` | `listSkills`, `getSkill`, `deleteSkill` | api | `GET`, `GET`, `DELETE` | `/api/web/organizations/slug/{organizationSlug}/skills`; `/skills/{skillId}` | query `{ count,cursor,search }`; detail query `{ maxFiles }` | local `ListSkillsResponse`, `SkillDetail`, `void` | `resource/oas/modules/backend/organization/skills/openapi.yaml` | `frontend/packages/api/src/out/modules/organization-skills-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/skills"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/skills/{skillId}"]` | `generated-ready` | N/A | `keep` | none | N/A | existing `commands/skill/*.test.ts`; needed path/type snapshot once independent generation exists |
 | SKILL-02 | skill | `aipctl skill upload` | `createUploadUrl` → `uploadToS3` → `completeUpload` (`abortUpload` on failure) | api + external | `POST` → `PUT` → `POST` | `/skills/upload-url`; external presigned `uploadUrl`; `/skills/{skillId}/complete` | local upload request `{ filename,fileSize,mimeType }`, file buffer, complete body `{ overwrite }` | `CreateSkillUploadUrlResponse`, external `void`, `CompleteSkillUploadResponse` | `resource/oas/modules/backend/organization/skills/openapi.yaml` | `frontend/packages/api/src/out/modules/organization-skills-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/skills/upload-url"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/skills/{skillId}/complete"]` | `external-presigned` | N/A | `keep` | none | N/A | existing skill upload tests; needed presigned URL + complete path snapshot |
@@ -57,8 +57,9 @@
 | P0-DRIVE-01 | drive | `aipctl drive list`, `download`, `delete`, `mkdir`, `rename`, `usage` | `listDriveEntries`, `getDriveDownloadUrl`, `deleteDriveEntries`, `createDriveFolder`, `renameDriveEntry`, `getDriveUsage`, `downloadFromUrl` | api + external | `GET`, `POST`, `POST`, `POST`, `PATCH`, `GET`, external `GET` | `/drive/entries?count=200`; `/drive/entries/download-url`; `/drive/entries/delete`; `/drive/entries/{entryId}`; `/drive/usage` | official list `{ path, hasNext, nextCursor, items }`; delete body `{ entryIds[] }`; rename body `{ newName }`; download body `{ entryIds: [id] }` | official drive list/download DTOs + external file buffer | `resource/oas/modules/backend/organization/storage/openapi.yaml` | `frontend/packages/api/src/out/modules/organization-storage-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/drive/entries"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/drive/entries/download-url"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/drive/entries/{entryId}"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/drive/entries/delete"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/drive/usage"]` | `generated-ready` | `P0` | `migrate` | none | `AIP-PUB-05` | updated `src/core/api.test.ts`, `commands/drive/drive.test.ts`; covers paged list shape, batch download-url request, DTO field rename (`sizeBytes`, `modifiedAt`) |
 | P0-DRIVE-02 | drive | `aipctl drive upload` | `createDriveUploadUrl` → `uploadToS3` → `completeDriveUpload` | api + external | `POST` → `PUT` → `POST` | `/drive/entries/upload-url`; external presigned `uploadUrl`; `/drive/entries/{entryId}/complete` | official upload request `{ parentId: null, filename, fileSize, mimeType }` | official `CreateDriveUploadUrlResponse { id, filename, uploadUrl, headers }` then `void` | `resource/oas/modules/backend/organization/storage/openapi.yaml` | `frontend/packages/api/src/out/modules/organization-storage-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/drive/entries/upload-url"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/drive/entries/{entryId}/complete"]` | `generated-ready` | `P0` | `migrate` | none | `AIP-PUB-05` | updated `src/core/api.test.ts`, `commands/drive/drive.test.ts`; covers `parentId: null` request and response `id`/`filename` usage |
 | P1-INT-01 | integration | `aipctl integration list`, `test`; `aipctl admin integration get`, `update`, `delete`, `tools`, `available` | `listIntegrations`, `testIntegration`, `getIntegration`, `updateIntegration`, `deleteIntegration`, `listIntegrationTools`, `listConfigurableIntegrations` | api | `GET`, `POST`, `GET`, `PUT`, `DELETE`, `GET`, `GET` | `/api/web/integrations/v2`; `/api/web/integration/{integrationId}/test`; `/api/web/admin/organizations/slug/{organizationSlug}/integrations/{integrationId}`; `/{integrationId}/tools`; `/configurable-integrations` | top-level list/test and admin detail/available now follow current/legacy OAS path+body+DTO where available; admin update/delete still accept untyped legacy mutation body/path until admin mutation contract lands | local `Integration`, `IntegrationDetail`, `IntegrationToolsResponse`, `ConfigurableIntegration[]` | legacy admin paths: `resource/oas/duplo-web.yaml`; partial modern source: `resource/oas/modules/backend/integration/openapi.yaml` (does not cover these admin list/CRUD/tools paths) | legacy `frontend/packages/api/src/out/user-types.ts#paths["/api/web/admin/organizations/slug/{organizationSlug}/integrations"]`, `#paths["/api/web/admin/organizations/slug/{organizationSlug}/configurable-integrations"]`; partial current `frontend/packages/api/src/out/modules/integration-types.ts` lacks these admin list/CRUD/tools paths | `legacy-generated` | `P1` | `legacy-exception` | owner=`backend app Integrations / duplo-web legacy OAS`; rationale=`public beta keeps integration list/test/admin detail/tools/available, but admin update/delete still lack an approved current contract outside legacy duplo-web`; removal condition=`independent contract covers user list/test plus admin CRUD/tools/available`; incorporation plan=`extend integration module or independent contract for list/test/admin CRUD/tools/available, then retire legacy path/body mappings and delete/update exception` | N/A | updated `src/core/api.test.ts`, `commands/integration/integration.test.ts`; covers v2 list query, test body `{ organizationSlug }`, admin detail/tools DTO fields, configurable wrapper unwrap, and pinned update/delete legacy paths |
-| P0-MODEL-01 | model | `aipctl model list` | `listModels` | chat | `GET` | `/api/{orgSlug}/models` | none | CLI maps official `{ models: string[], defaultModel? }` into `Model[]` with optional `isDefault` | `resource/oas/chat.yaml` | `frontend/packages/api/src/out/chat-types.ts#paths["/api/{orgSlug}/models"]` | `legacy-generated` | `P0` | `migrate` | none | `AIP-PUB-05` | updated `src/core/api.test.ts`, `commands/model/model.test.ts`; covers official path and string-array response mapping |
-| P1-MODEL-EXEC-01 | model-exec | `aipctl model-exec models`, `get`, `sample`, `chat`, `image generate` | `listModelExecModels`, `executeModelExecChat`, `executeModelExecImageGeneration`; image output uses `downloadFromUrl` | chat + external artifact URL | `GET`, `POST`, `POST`, external `GET` | `/api/{orgSlug}/cli/model-exec/models`; `/chat`; `/images/generations`; response `downloadUrl` | local `ModelExecChatRequest`, `ModelExecImageGenerationRequest`; Chat DTO source `chat/packages/chat/src/modules/cli-model-exec/interface/dto/cli-model-exec.dto.ts` | local `ModelExecModelCatalog`, `ModelExecChatResponse`, `ModelExecImageGenerationResponse`; image bytes from external URL | not found in current `resource/oas`; implemented by `chat/packages/chat/src/modules/cli-model-exec/interface/cli-model-exec.interface.controller.ts` | none | `oas-missing` | `P1` | `legacy-exception` | owner=`chat CLI Model Exec API`; rationale=`experimental public command is implemented with Chat zod DTOs but no current OAS path`; removal condition=`CLI model-exec paths and DTOs are published in the Chat contract`; incorporation plan=`add the three paths and schemas to the Chat OAS, generate an independent reference, then bind CLI DTO/tests` | `AIP-PUB-05` | existing `src/core/api.test.ts`, `commands/model-exec/model-exec.test.ts`, `commands/model-exec/progress.test.ts`; covers three paths, request bodies, required Chat DTO response fields, helper/progress behavior. Needed: image command response → external download → file write regression test |
+| P0-MODEL-01 | model | `aipctl model list` | `listModels` | chat | `GET` | legacy `/api/{orgSlug}/models`; target `/api/cli/v1/organizations/{orgSlug}/models` | none | legacy `{ models: string[], defaultModel? }` is mapped into `Model[]` and preserves active standard, custom/BYOK, and `etc` catalog IDs | legacy source: `resource/oas/chat.yaml`; target CLI source not implemented | `frontend/packages/api/src/out/chat-types.ts#paths["/api/{orgSlug}/models"]` | `legacy-generated` | `P0` | `keep legacy until parity` | owner=`Chat ModelV1Controller/ModelInternalService`; rationale=`the current model-exec v1 catalog is backed by SharedModel and omits active custom/BYOK and etc models`; removal condition=`the dedicated CLI model catalog preserves legacy visible-model and default semantics with authorization and regression tests`; incorporation plan=`implement GET /api/cli/v1/organizations/{orgSlug}/models from the existing model domain, then mark model list IMPLEMENTED and retire the legacy path` | `AIP-PUB-05` | `src/core/api.test.ts` verifies the legacy path and preserves custom/BYOK and etc IDs; availability tests keep dev/local usable and prod disabled until parity |
+| P1-MODEL-EXEC-01 | model-exec | `aipctl model-exec models`, `get`, `sample`, `chat` | `listModelExecModels`, `executeModelExecChat` | chat | `GET`, `POST` | `/api/cli/v1/organizations/{orgSlug}/model-exec/models`; `/chat` | local `ModelExecChatRequest`; Chat Zod/Swagger DTO source `chat/packages/chat/src/modules/cli-model-exec/interface/dto/cli-model-exec.dto.ts` | local `ModelExecModelCatalog`, `ModelExecChatResponse` | code-first OAS: `chat/packages/chat/src/modules/cli-model-exec/interface/cli-model-exec-v1.interface.controller.ts` | runtime Swagger contract | `oas-source-only` | `P1` | `migrate` | none | `AIP-PUB-05` | `src/core/api.test.ts` verifies both v1 paths; Chat controller contract test verifies operation IDs, request/response schemas, delegation to the existing service, and absence of a v1 image route |
+| P1-MODEL-EXEC-02 | model-exec-image | `aipctl model-exec image generate` | `executeModelExecImageGeneration`; output uses `downloadFromUrl` | chat + external artifact URL | `POST`, external `GET` | legacy `/api/{orgSlug}/cli/model-exec/images/generations`; response `downloadUrl` | local `ModelExecImageGenerationRequest`; Chat DTO source `chat/packages/chat/src/modules/cli-model-exec/interface/dto/cli-model-exec.dto.ts` | local `ModelExecImageGenerationResponse`; image bytes from external URL | no GA OAS; legacy controller only | none | `oas-missing` | deferred | `hide` | owner=`chat CLI Model Exec API`; rationale=`synchronous image execution, external artifact lifetime, and cost recovery require the deferred async design`; removal condition=`image job/artifact/TTL/My Drive/cost gates pass`; incorporation plan=`publish a separate v1 image job contract only after the deferred design is implemented` | follow-up image hardening | existing image request/path test remains on the legacy route; customer capability must stay disabled |
 | USAGE-01 | usage | `aipctl admin usage credit`, `top-users`, `daily-graph`, `daily-users`, `mcp-top` | `getCreditStatistics`, `getCreditTopUsers`, `getCreditDailyGraph`, `getCreditDailyUsers`, `getMcpTopTools` | api | `GET` | `/api/web/admin/organizations/slug/{organizationSlug}/usage/...` | query `{ startDt,endDt,limit,pageNumber,pageSize,userId }` | local usage DTOs, `DailyUsageDetailsResponse.pagination { page,pageSize,total }` | `resource/oas/modules/backend/usage/openapi.yaml` | `frontend/packages/api/src/out/modules/usage-types.ts#paths[...]` | `generated-ready` | N/A | `keep` | none | N/A | existing `commands/usage/usage.test.ts`; needed generated path snapshots |
 | AUDIT-01 | audit | `aipctl admin audit list`, `types` | `listAuditLogs`, `listAuditEventTypes` | api | `GET` | `/api/web/audit/organization/slug/{organizationSlug}`; `/api/web/audit/event/types` | query `{ eventType,page,pageSize }` | local `ListAuditResponse`, `AuditEventType[]` | `resource/oas/modules/backend/audit/openapi.yaml` | `frontend/packages/api/src/out/modules/backend-audit-types.ts#paths[...]` | `generated-ready` | N/A | `keep` | none | N/A | existing `commands/audit/audit.test.ts`; needed generated path snapshots |
 | TUNNEL-01 | tunnel | `aipctl admin tunnel status`, `config`, `token` | `getTunnelStatus`, `getTunnelConfig`, `createTunnelToken` | api | `GET`, `GET`, `POST` | `/api/web/edge-tunnel/v2/organizations/slug/{organizationSlug}/status`; `/config`; `/token` | none | local `TunnelStatus`, `TunnelConfig`, `void` | `resource/oas/modules/backend/tunnel/openapi.yaml` | `frontend/packages/api/src/out/modules/tunnel-types.ts#paths[...]` | `generated-ready` | N/A | `keep` | none | N/A | existing `commands/tunnel/tunnel.test.ts`; needed v2 path snapshot |
@@ -83,7 +84,7 @@
 - `P1-PRESET-01` preset admin namespace/docs + legacy path tests done
 - `P1-SKILL-01` skill JSON/help/docs field sync done
 - `P1-CHAT-01` chat SSE fixture tests added for final/fallback/error cases
-- `P1-MODEL-EXEC-01` experimental CLI model-exec contract remains OAS-missing; current Chat controller/DTO and CLI path tests are recorded
+- `P1-MODEL-EXEC-01` catalog/text moved to the dedicated v1 code-first OAS and CLI path; `P1-MODEL-EXEC-02` image remains deferred on the legacy route
 
 ## Manual notes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aipctl",
-  "version": "2026.9.3",
+  "version": "2026.9.5",
   "description": "QueryPie AIP and MCP CLI tool",
   "author": "QueryPie",
   "license": "UNLICENSED",
@@ -22,16 +22,16 @@
     "node": ">=24.18.0"
   },
   "metadata": {
-    "contentHash": "5a3ddc0e9f4e7c9f5f7d034823c81d8de10b538b61bdf6f0b39dfd8d0b9d2669",
-    "wrapperHash": "bf67d4c747818e036614ed04e2e492ba4d5c1f125ee2a4f73d1329a63a5c32a8",
-    "nativeHash": "21a6d81389d87cc5729f7521c0c8abc753cc922638bc0044290a32ec229b2d51"
+    "contentHash": "41009029ba4ff1bb3ad17157d8af3499f5545ddf860fb1ea4803005b6a6ca026",
+    "wrapperHash": "15330253c506008f0676946c51659e0dfc616d42e8931180f47080a03b966203",
+    "nativeHash": "006b08c3e391f4571d9b7c0f12d684fe2448106259e7e0581b10f9be362452e9"
   },
   "optionalDependencies": {
-    "aipctl-darwin-x64": "2026.9.3",
-    "aipctl-darwin-arm64": "2026.9.3",
-    "aipctl-linux-x64": "2026.9.3",
-    "aipctl-linux-arm64": "2026.9.3",
-    "aipctl-windows-x64": "2026.9.3",
-    "aipctl-windows-arm64": "2026.9.3"
+    "aipctl-darwin-x64": "2026.9.1",
+    "aipctl-darwin-arm64": "2026.9.1",
+    "aipctl-linux-x64": "2026.9.1",
+    "aipctl-linux-arm64": "2026.9.1",
+    "aipctl-windows-x64": "2026.9.1",
+    "aipctl-windows-arm64": "2026.9.1"
   }
 }