aipctl 2026.9.9 → 2026.9.11

package/build/index.cjs

@@ -89670,7 +89670,7 @@ const injectedBuildEnv = "dev".length > 0 ? "dev" : "local";
 if (!isBuildEnv(injectedBuildEnv)) {
   throw new Error(`Invalid AIPCTL_BUILD_ENV: ${injectedBuildEnv}`);
 }
-const VERSION = "2026.9.9".length > 0 ? "2026.9.9" : "0.0.0";
+const VERSION = "2026.9.11".length > 0 ? "2026.9.11" : "0.0.0";
 const BUILD_ENV = injectedBuildEnv;
 const INCLUDE_NATIVE_LOGS = BUILD_ENV !== "prod";
 
@@ -89819,7 +89819,32 @@ const implementedCommandOperationIds = /* @__PURE__ */ new Set([
   "listCliOrganizationMembers",
   "listCliModels",
   "listCliModelExecModels",
-  "createCliModelChatExecution"
+  "createCliModelChatExecution",
+  "listCliSkills",
+  "getCliSkill",
+  "deleteCliSkill",
+  "listCliSkillLibrary",
+  "createCliSkillClones",
+  "listCliBuiltInSkills",
+  "createCliBuiltInSkillClones",
+  "listCliAdminSkills",
+  "getCliAdminSkill",
+  "deleteCliAdminSkill",
+  "updateCliAdminSkill",
+  "listCliAdminBuiltInSkills",
+  "createCliAdminBuiltInSkillClones",
+  "listCliDriveEntries",
+  "getCliDriveUsage",
+  "createCliDriveFolder",
+  "updateCliDriveEntryName",
+  "deleteCliDriveEntries",
+  "listCliChats",
+  "getCliChat",
+  "listCliChatMessages",
+  "listCliIntegrations",
+  "listCliAvailableIntegrations",
+  "getCliAdminIntegration",
+  "listCliIntegrationTools"
 ]);
 const releaseEnabledCommandOperationIds = /* @__PURE__ */ new Set([
   "listCliAgents",
@@ -89836,7 +89861,32 @@ const releaseEnabledCommandOperationIds = /* @__PURE__ */ new Set([
   "getCliOrganizationCapabilities",
   "listCliOrganizationMembers",
   "listCliModels",
-  "listCliModelExecModels"
+  "listCliModelExecModels",
+  "listCliSkills",
+  "getCliSkill",
+  "deleteCliSkill",
+  "listCliSkillLibrary",
+  "createCliSkillClones",
+  "listCliBuiltInSkills",
+  "createCliBuiltInSkillClones",
+  "listCliAdminSkills",
+  "getCliAdminSkill",
+  "deleteCliAdminSkill",
+  "updateCliAdminSkill",
+  "listCliAdminBuiltInSkills",
+  "createCliAdminBuiltInSkillClones",
+  "listCliDriveEntries",
+  "getCliDriveUsage",
+  "createCliDriveFolder",
+  "updateCliDriveEntryName",
+  "deleteCliDriveEntries",
+  "listCliChats",
+  "getCliChat",
+  "listCliChatMessages",
+  "listCliIntegrations",
+  "listCliAvailableIntegrations",
+  "getCliAdminIntegration",
+  "listCliIntegrationTools"
 ]);
 const direct = (commands, operation) => commands.map((command) => ({
   command,
@@ -95046,11 +95096,12 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       }),
       listSkills: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliSkills");
         const params = new URLSearchParams();
         params.set("count", String(options?.count ?? 50));
         if (options?.cursor) params.set("cursor", options.cursor);
         if (options?.search) params.set("search", options.search);
-        const path = `/api/web/organizations/slug/${encodeURIComponent(orgSlug)}/skills?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/skills?${params.toString()}`;
         const response = yield* makeRequest(baseUrl, path, token);
         return {
           ...response,
@@ -95067,11 +95118,12 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       }),
       listAdminSkills: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliAdminSkills");
         const params = new URLSearchParams();
         params.set("pageNumber", String(options?.pageNumber ?? 1));
         params.set("pageSize", String(options?.pageSize ?? 20));
         if (options?.search) params.set("search", options.search);
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/skills?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/skills?${params.toString()}`;
         const response = yield* makeRequest(baseUrl, path, token);
         return {
           ...response,
@@ -95141,12 +95193,14 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       }),
       deleteSkill: (orgSlug, skillId) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/organizations/slug/${encodeURIComponent(orgSlug)}/skills/${encodeURIComponent(skillId)}`;
+        yield* requireReleaseEnabledOperation("deleteCliSkill");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/skills/${encodeURIComponent(skillId)}`;
         return yield* makeRequest(baseUrl, path, token, { method: "DELETE" });
       }),
       deleteAdminSkill: (orgSlug, skillId) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/skills/${encodeURIComponent(skillId)}`;
+        yield* requireReleaseEnabledOperation("deleteCliAdminSkill");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/skills/${encodeURIComponent(skillId)}`;
         return yield* makeRequest(baseUrl, path, token, { method: "DELETE" });
       }),
       getCurrentOrganization: () => gen(function* () {
@@ -95163,10 +95217,11 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       // Phase 1: Skill detail/download/library/clone
       getSkill: (orgSlug, skillId, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("getCliSkill");
         const params = new URLSearchParams();
         if (options?.maxFiles) params.set("maxFiles", String(options.maxFiles));
         const qs = params.toString();
-        const path = `/api/web/organizations/slug/${encodeURIComponent(orgSlug)}/skills/${encodeURIComponent(skillId)}${qs ? `?${qs}` : ""}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/skills/${encodeURIComponent(skillId)}${qs ? `?${qs}` : ""}`;
         const response = yield* makeRequest(baseUrl, path, token);
         return {
           ...response,
@@ -95178,10 +95233,11 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       }),
       getAdminSkill: (orgSlug, skillId, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("getCliAdminSkill");
         const params = new URLSearchParams();
         if (options?.maxFiles) params.set("maxFiles", String(options.maxFiles));
         const qs = params.toString();
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/skills/${encodeURIComponent(skillId)}${qs ? `?${qs}` : ""}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/skills/${encodeURIComponent(skillId)}${qs ? `?${qs}` : ""}`;
         const response = yield* makeRequest(baseUrl, path, token);
         return {
           ...response,
@@ -95193,7 +95249,8 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       }),
       updateAdminSkill: (orgSlug, skillId, body) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/skills/${encodeURIComponent(skillId)}`;
+        yield* requireReleaseEnabledOperation("updateCliAdminSkill");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/skills/${encodeURIComponent(skillId)}`;
         return yield* makeRequest(baseUrl, path, token, {
           method: "PATCH",
           body
@@ -95253,16 +95310,18 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       }),
       listLibrarySkills: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliSkillLibrary");
         const params = new URLSearchParams();
         params.set("count", String(options?.count ?? 50));
         if (options?.cursor) params.set("cursor", options.cursor);
         if (options?.search) params.set("search", options.search);
-        const path = `/api/web/organizations/slug/${encodeURIComponent(orgSlug)}/skills/library?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/skills/library?${params.toString()}`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       cloneSkills: (orgSlug, sourceSkillIds) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/organizations/slug/${encodeURIComponent(orgSlug)}/skills/library/clone`;
+        yield* requireReleaseEnabledOperation("createCliSkillClones");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/skills/library/clone`;
         return yield* makeRequest(baseUrl, path, token, {
           method: "POST",
           body: { sourceSkillIds }
@@ -95481,8 +95540,9 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       // Phase 5: Drive/Integration
       listDriveEntries: (orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliDriveEntries");
         const params = new URLSearchParams({ count: "200" });
-        const path = `/api/web/organizations/slug/${encodeURIComponent(orgSlug)}/drive/entries?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/drive/entries?${params.toString()}`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       getDriveDownloadUrl: (orgSlug, entryId) => gen(function* () {
@@ -95516,27 +95576,32 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       }),
       deleteDriveEntries: (orgSlug, entryIds) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/organizations/slug/${encodeURIComponent(orgSlug)}/drive/entries/delete`;
+        yield* requireReleaseEnabledOperation("deleteCliDriveEntries");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/drive/entries/delete`;
         return yield* makeRequest(baseUrl, path, token, { method: "POST", body: { entryIds } });
       }),
       createDriveFolder: (orgSlug, name) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/organizations/slug/${encodeURIComponent(orgSlug)}/drive/entries`;
+        yield* requireReleaseEnabledOperation("createCliDriveFolder");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/drive/folders`;
         return yield* makeRequest(baseUrl, path, token, { method: "POST", body: { name } });
       }),
       renameDriveEntry: (orgSlug, entryId, newName) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/organizations/slug/${encodeURIComponent(orgSlug)}/drive/entries/${encodeURIComponent(entryId)}`;
+        yield* requireReleaseEnabledOperation("updateCliDriveEntryName");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/drive/entries/${encodeURIComponent(entryId)}`;
         return yield* makeRequest(baseUrl, path, token, { method: "PATCH", body: { newName } });
       }),
       getDriveUsage: (orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/organizations/slug/${encodeURIComponent(orgSlug)}/drive/usage`;
+        yield* requireReleaseEnabledOperation("getCliDriveUsage");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/drive/usage`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       listIntegrations: (orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/integrations/v2?organizationSlug=${encodeURIComponent(orgSlug)}`;
+        yield* requireReleaseEnabledOperation("listCliIntegrations");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/integrations`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       testIntegration: (orgSlug, integrationId) => gen(function* () {
@@ -95558,22 +95623,25 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       listConversations: (orgSlug, options) => gen(function* () {
         yield* requireChatBaseUrlEffect();
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliChats");
         const params = new URLSearchParams();
         if (options?.cursor) params.set("cursor", options.cursor);
         const query = params.toString();
-        const path = `/librechat/api/${encodeURIComponent(orgSlug)}/convos${query ? `?${query}` : ""}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/chats${query ? `?${query}` : ""}`;
         return yield* makeRequest(chatBaseUrl, path, token);
       }),
       getConversation: (orgSlug, conversationId) => gen(function* () {
         yield* requireChatBaseUrlEffect();
         const token = yield* getAccessToken();
-        const path = `/librechat/api/${encodeURIComponent(orgSlug)}/convos/${encodeURIComponent(conversationId)}`;
+        yield* requireReleaseEnabledOperation("getCliChat");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/chats/${encodeURIComponent(conversationId)}`;
         return yield* makeRequest(chatBaseUrl, path, token);
       }),
       listMessages: (orgSlug, conversationId) => gen(function* () {
         yield* requireChatBaseUrlEffect();
         const token = yield* getAccessToken();
-        const path = `/librechat/api/${encodeURIComponent(orgSlug)}/messages/${encodeURIComponent(conversationId)}`;
+        yield* requireReleaseEnabledOperation("listCliChatMessages");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/chats/${encodeURIComponent(conversationId)}/messages`;
         return yield* makeRequest(chatBaseUrl, path, token);
       }),
       sendChatMessage: (orgSlug, body) => gen(function* () {
@@ -95671,16 +95739,37 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       // Built-in skill library
       listBuiltInSkills: (orgSlug, options) => gen(function* () {
         const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliBuiltInSkills");
         const params = new URLSearchParams();
         params.set("limit", String(options?.limit ?? 50));
         if (options?.cursor) params.set("cursor", options.cursor);
         if (options?.search) params.set("search", options.search);
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/skills/built-in-library?${params.toString()}`;
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/skills/built-in?${params.toString()}`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       cloneBuiltInSkills: (orgSlug, sourceSkillIds) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/skills/built-in-library/clone`;
+        yield* requireReleaseEnabledOperation("createCliBuiltInSkillClones");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/skills/built-in/clone`;
+        return yield* makeRequest(baseUrl, path, token, {
+          method: "POST",
+          body: { sourceSkillIds }
+        });
+      }),
+      listAdminBuiltInSkills: (orgSlug, options) => gen(function* () {
+        const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("listCliAdminBuiltInSkills");
+        const params = new URLSearchParams();
+        params.set("limit", String(options?.limit ?? 50));
+        if (options?.cursor) params.set("cursor", options.cursor);
+        if (options?.search) params.set("search", options.search);
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/skills/built-in?${params.toString()}`;
+        return yield* makeRequest(baseUrl, path, token);
+      }),
+      cloneAdminBuiltInSkills: (orgSlug, sourceSkillIds) => gen(function* () {
+        const token = yield* getAccessToken();
+        yield* requireReleaseEnabledOperation("createCliAdminBuiltInSkillClones");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/skills/built-in/clone`;
         return yield* makeRequest(baseUrl, path, token, {
           method: "POST",
           body: { sourceSkillIds }
@@ -95707,7 +95796,8 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       // Integration CRUD
       getIntegration: (orgSlug, id) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/integrations/${encodeURIComponent(id)}`;
+        yield* requireReleaseEnabledOperation("getCliAdminIntegration");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/integrations/${encodeURIComponent(id)}`;
         const response = yield* makeRequest(baseUrl, path, token);
         return {
           ...response,
@@ -95727,14 +95817,15 @@ const makeApiServiceLive = (buildEnv) => effect$1(
       }),
       listIntegrationTools: (orgSlug, id) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/integrations/${encodeURIComponent(id)}/tools`;
+        yield* requireReleaseEnabledOperation("listCliIntegrationTools");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/integrations/${encodeURIComponent(id)}/tools`;
         return yield* makeRequest(baseUrl, path, token);
       }),
       listConfigurableIntegrations: (orgSlug) => gen(function* () {
         const token = yield* getAccessToken();
-        const path = `/api/web/admin/organizations/slug/${encodeURIComponent(orgSlug)}/configurable-integrations`;
-        const response = yield* makeRequest(baseUrl, path, token);
-        return response.integrations;
+        yield* requireReleaseEnabledOperation("listCliAvailableIntegrations");
+        const path = `/api/cli/v1/organizations/${encodeURIComponent(orgSlug)}/admin/integrations/available`;
+        return yield* makeRequest(baseUrl, path, token);
       }),
       // Audit event types
       listAuditEventTypes: () => gen(function* () {
@@ -97146,14 +97237,14 @@ const searchOption$3 = text("search").pipe(
   withDescription$3("Search built-in skills by name"),
   optional
 );
-const builtInCommand = make$4(
+const makeBuiltInCommand = (listSkills = (api, orgSlug, options) => api.listBuiltInSkills(orgSlug, options), description = "List built-in skills from the library") => make$4(
   "built-in",
   { org: orgOption, search: searchOption$3 },
   ({ org, search }) => gen(function* () {
     const api = yield* ApiService;
     const orgSlug = yield* resolveOrgSlug(org, api);
     const searchValue = search._tag === "Some" ? search.value : void 0;
-    const result = yield* api.listBuiltInSkills(orgSlug, { search: searchValue }).pipe(
+    const result = yield* listSkills(api, orgSlug, { search: searchValue }).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -97191,7 +97282,8 @@ const builtInCommand = make$4(
       yield* log("(More built-in skills available.)");
     }
   })
-).pipe(withDescription("List built-in skills from the library"));
+).pipe(withDescription(description));
+const builtInCommand = makeBuiltInCommand();
 
 const MAX_CLONE_SKILLS$1 = 5;
 const formatCloneBuiltInFailureMessage = maskSensitiveText;
@@ -97199,7 +97291,7 @@ const skillIdsArg$1 = text$2({ name: "id" }).pipe(
   withDescription$5(`Built-in skill ID(s) to clone (max ${MAX_CLONE_SKILLS$1})`),
   repeated
 );
-const cloneBuiltInCommand = make$4(
+const makeCloneBuiltInCommand = (cloneSkills = (api, orgSlug, sourceSkillIds) => api.cloneBuiltInSkills(orgSlug, sourceSkillIds), description = "Clone built-in skills from the library to your organization") => make$4(
   "clone-built-in",
   { skillIds: skillIdsArg$1, org: orgOption },
   ({ skillIds, org }) => gen(function* () {
@@ -97215,7 +97307,7 @@ const cloneBuiltInCommand = make$4(
       return;
     }
     yield* log(`Cloning ${ids.length} built-in skill(s) to organization "${orgSlug}"...`);
-    const result = yield* api.cloneBuiltInSkills(orgSlug, ids).pipe(
+    const result = yield* cloneSkills(api, orgSlug, ids).pipe(
       catchTag(
         "NotLoggedInError",
         (e) => gen(function* () {
@@ -97245,7 +97337,8 @@ const cloneBuiltInCommand = make$4(
       }
     }
   })
-).pipe(withDescription("Clone built-in skills from the library to your organization"));
+).pipe(withDescription(description));
+const cloneBuiltInCommand = makeCloneBuiltInCommand();
 
 const skillIdArg$4 = text$2({ name: "id" }).pipe(withDescription$5("Skill ID to download"));
 const outputOption$2 = text("output").pipe(
@@ -97822,6 +97915,14 @@ const unpublishCommand = make$4(
     yield* log(`Organization skill "${skillId}" was removed from the shared library.`);
   })
 ).pipe(withDescription("Remove an organization skill from the shared library"));
+const adminBuiltInCommand = makeBuiltInCommand(
+  (api, orgSlug, options) => api.listAdminBuiltInSkills(orgSlug, options),
+  "List built-in skills available to an AI operator"
+);
+const adminCloneBuiltInCommand = makeCloneBuiltInCommand(
+  (api, orgSlug, sourceSkillIds) => api.cloneAdminBuiltInSkills(orgSlug, sourceSkillIds),
+  "Clone built-in skills as an AI operator"
+);
 const adminSkillCommandDescription = "Admin skill management (list, get, upload, download, delete, publish, unpublish, built-in, clone-built-in, github)";
 const adminSkillSubcommands = [
   listCommand$8,
@@ -97831,8 +97932,8 @@ const adminSkillSubcommands = [
   deleteCommand$3,
   publishCommand,
   unpublishCommand,
-  builtInCommand,
-  cloneBuiltInCommand,
+  adminBuiltInCommand,
+  adminCloneBuiltInCommand,
   githubSkillCommand
 ];
 const adminSkillCommand = make$4("skill", {}).pipe(

package/docs/api-contract-inventory.md

@@ -43,10 +43,10 @@
 | ORG-02 | org | `aipctl org capabilities`, `aipctl org settings`, `aipctl org exit` | `getOrgCapabilities`, `getUserSettings`, `exitOrg` | api | `GET`, `GET`, `POST` | organization v1 `/api/cli/v1/organizations/{organizationSlug}/capabilities`; user-global v1 `/api/cli/v1/me/settings`; legacy `/api/web/organizations/slug/{organizationSlug}/exit` | none | local `OrgCapabilities`, `UserSettings`, `void` | read paths: `resource/oas/modules/backend/cli/openapi.yaml`; exit: `resource/oas/duplo-web.yaml` | read generated `CliOrganizationApi`/`CliV1Api`; exit legacy generated | `legacy-generated` | N/A | `migrate` | owner=`backend`; rationale=`capabilities is organization-owned, settings remains user-global, and exit remains a Wave B mutation`; removal condition=`exit receives its dedicated v1 mutation contract`; incorporation plan=`preserve current membership authorization and non-replay behavior` | task 3.3 | `src/core/api.test.ts` verifies v1 read paths and settings ownership; org tests cover response/error behavior |
 | P0-ORG-01 | org-member | `aipctl org members`; `aipctl admin org invite`, `aipctl admin org remove-member`, `aipctl admin org update-member-role` | `listOrgMembers`, `inviteOrgMembers`, `removeOrgMembers`, `updateOrgMemberRoles` | api | `GET`, `POST`, `DELETE`, `PUT` | list v1 `/api/cli/v1/organizations/{organizationSlug}/members`; mutations remain legacy `/invite`; `/members` | list uses stable CLI member response; mutation bodies preserve `{ emails, role }` and `{ members, role? }` | local `ListMembersResponse`, `InviteOrgMembersResponse`, `void` | list: `resource/oas/modules/backend/cli/openapi.yaml`; mutation: `resource/oas/duplo-web.yaml` | list generated `CliOrganizationApi`; mutation legacy generated | `legacy-generated` | `P0` | `legacy-exception` | owner=`backend`; rationale=`member read is migrated while admin mutations remain Wave B`; removal condition=`invite/remove/role receive dedicated v1 contracts`; incorporation plan=`reuse current admin authorization, audit, stale target validation, and non-replay semantics` | task 3.3 | `src/core/api.test.ts`, `commands/org/members.test.ts`, `commands/org/org-member.test.ts`; covers v1 member read and legacy mutation bodies |
 | P0-ORG-02 | org-admin | hidden from public beta (`aipctl admin org invite-link`, `gen-invite-link`, `revoke-invite-link` removed from command tree) | removed from public surface | api | `GET`, `POST`, `DELETE` | previously `/api/web/organizations/slug/{organizationSlug}/invite/link` | none | hidden | latest: `resource/oas/modules/backend/organization/openapi.yaml` (`/invite/link/v2`); legacy: `resource/oas/duplo-web.yaml` (`/invite/link`) | latest `frontend/packages/api/src/out/modules/organization-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/invite/link/v2"]`; legacy `frontend/packages/api/src/out/user-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/invite/link"]` | `oas-source-only` | `P0` | `hide` | owner=`backend organization module`; rationale=`v2 exists but current CLI UX contract for GET/DELETE parity is not approved for public beta`; removal condition=`public beta continues hiding until a reviewed v2 CLI UX contract exists`; incorporation plan=`reintroduce only after independent organization contract/build and public UX review` | N/A | updated admin org help smoke + command-tree regression to ensure trio is absent |
-| SKILL-01 | skill | `aipctl skill list`, `aipctl skill get`, `aipctl skill delete` | `listSkills`, `getSkill`, `deleteSkill` | api | `GET`, `GET`, `DELETE` | `/api/web/organizations/slug/{organizationSlug}/skills`; `/skills/{skillId}` | query `{ count,cursor,search }`; detail query `{ maxFiles }` | local `ListSkillsResponse`, `SkillDetail`, `void` | `resource/oas/modules/backend/organization/skills/openapi.yaml` | `frontend/packages/api/src/out/modules/organization-skills-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/skills"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/skills/{skillId}"]` | `generated-ready` | N/A | `keep` | none | N/A | existing `commands/skill/*.test.ts`; needed path/type snapshot once independent generation exists |
+| SKILL-01 | skill | `aipctl skill list`, `aipctl skill get`, `aipctl skill delete` | `listSkills`, `getSkill`, `deleteSkill` | api | `GET`, `GET`, `DELETE` | `/api/cli/v1/organizations/{organizationSlug}/skills`; `/api/cli/v1/organizations/{organizationSlug}/skills/{skillId}` | query `{ count,cursor,search }`; detail query `{ maxFiles }` | local `ListSkillsResponse`, `SkillDetail`, `void` | `resource/oas/modules/backend/cli/openapi.yaml` → `v1_skills*.yaml` (DTO aliases to organization Skills OAS) | `backend/api/.../cli/generated/api/CliSkillApi.kt`; domain DTOs remain `com.querypie.duplo.api.skills.generated.model.*` | `generated-ready` | `P0` | `migrate` | none; `CliSkillApiController` delegates to the existing member authorization/audit controller | `AI-6344` | `src/core/api.test.ts`, `CliSkillDriveApiControllerTest`, Gateway registry/contract parity; production CLI and local 403/404 checks (401/429 remain common gates) |
 | SKILL-02 | skill | `aipctl skill upload` | `createUploadUrl` → `uploadToS3` → `completeUpload` (`abortUpload` on failure) | api + external | `POST` → `PUT` → `POST` | `/skills/upload-url`; external presigned `uploadUrl`; `/skills/{skillId}/complete` | local upload request `{ filename,fileSize,mimeType }`, file buffer, complete body `{ overwrite }` | `CreateSkillUploadUrlResponse`, external `void`, `CompleteSkillUploadResponse` | `resource/oas/modules/backend/organization/skills/openapi.yaml` | `frontend/packages/api/src/out/modules/organization-skills-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/skills/upload-url"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/skills/{skillId}/complete"]` | `external-presigned` | N/A | `keep` | none | N/A | existing skill upload tests; needed presigned URL + complete path snapshot |
-| SKILL-03 | skill | `aipctl skill library`, `aipctl skill clone`, `aipctl skill built-in`, `aipctl skill clone-built-in`; `aipctl admin skill built-in`, `aipctl admin skill clone-built-in` | `listLibrarySkills`, `cloneSkills`, `listBuiltInSkills`, `cloneBuiltInSkills` | api | `GET`, `POST`, `GET`, `POST` | `/skills/library`; `/skills/library/clone`; `/admin/.../skills/built-in-library`; `/built-in-library/clone` | list query `{ count,cursor,search/limit }`; clone body `{ sourceSkillIds[] }` | local list/clone DTOs | `resource/oas/modules/backend/organization/skills/openapi.yaml` | `frontend/packages/api/src/out/modules/organization-skills-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/skills/library"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/skills/library/clone"]`, `#paths["/api/web/admin/organizations/slug/{organizationSlug}/skills/built-in-library"]`, `#paths["/api/web/admin/organizations/slug/{organizationSlug}/skills/built-in-library/clone"]` | `generated-ready` | N/A | `keep` | none | N/A | existing skill extended tests; needed built-in/library path snapshot |
-| SKILL-04 | skill-admin | `aipctl admin skill list`, `get`, `delete`, `publish`, `unpublish` | `listAdminSkills`, `getAdminSkill`, `deleteAdminSkill`, `updateAdminSkill` | api | `GET`, `GET`, `DELETE`, `PATCH` | `/api/web/admin/organizations/slug/{organizationSlug}/skills`; `/skills/{skillId}` | list query `{ pageNumber,pageSize,search }`; publish toggle body `{ availableInLibrary: boolean }` | local `ListAdminSkillsResponse`, `SkillDetail`, `void` | `resource/oas/modules/backend/organization/skills/openapi.yaml` | `frontend/packages/api/src/out/modules/organization-skills-types.ts#paths["/api/web/admin/organizations/slug/{organizationSlug}/skills"]`, `#paths["/api/web/admin/organizations/slug/{organizationSlug}/skills/{skillId}"]` | `generated-ready` | N/A | `keep` | none | N/A | existing `commands/admin/skill.test.ts`; needed admin list/detail/update path snapshot |
+| SKILL-03 | skill | `aipctl skill library`, `aipctl skill clone`, `aipctl skill built-in`, `aipctl skill clone-built-in`; `aipctl admin skill built-in`, `aipctl admin skill clone-built-in` | `listLibrarySkills`, `cloneSkills`, `listBuiltInSkills`, `cloneBuiltInSkills`, `listAdminBuiltInSkills`, `cloneAdminBuiltInSkills` | api | `GET`, `POST`, `GET`, `POST`, `GET`, `POST` | `/api/cli/v1/organizations/{organizationSlug}/skills/library`; `/skills/library/clone`; `/skills/built-in`; `/skills/built-in/clone`; `/admin/skills/built-in`; `/admin/skills/built-in/clone` | list query `{ count,cursor,search/limit }`; clone body `{ sourceSkillIds[] }` | local list/clone DTOs | `resource/oas/modules/backend/cli/openapi.yaml` → `v1_skills_library*`, `v1_skills_built-in*`, `v1_admin_skills_built-in*` (aliases to organization Skills OAS) | `backend/api/.../cli/generated/api/CliSkillApi.kt`; domain DTOs remain `com.querypie.duplo.api.skills.generated.model.*` | `generated-ready` | `P0` | `migrate` | none; built-in execution reuses the existing AI-operator authorization owner while CLI API methods preserve general/admin operation identity | `AI-6344` | existing skill extended/admin tests, API path tests, adapter test, Gateway registry/contract parity and production CLI clone/list checks |
+| SKILL-04 | skill-admin | `aipctl admin skill list`, `get`, `delete`, `publish`, `unpublish` | `listAdminSkills`, `getAdminSkill`, `deleteAdminSkill`, `updateAdminSkill` | api | `GET`, `GET`, `DELETE`, `PATCH` | `/api/cli/v1/organizations/{organizationSlug}/admin/skills`; `/admin/skills/{skillId}` | list query `{ pageNumber,pageSize,search }`; publish toggle body `{ availableInLibrary: boolean }` | local `ListAdminSkillsResponse`, `SkillDetail`, `void` | `resource/oas/modules/backend/cli/openapi.yaml` → `v1_admin_skills*.yaml` (DTO aliases to organization Skills OAS) | `backend/api/.../cli/generated/api/CliSkillApi.kt`; domain DTOs remain `com.querypie.duplo.api.skills.generated.model.*` | `generated-ready` | `P0` | `migrate` | none; `CliSkillApiController` delegates AI-operator authorization, workflow and audit owner | `AI-6344` | existing `commands/admin/skill.test.ts`, adapter test, Gateway parity; production admin list/publish/delete and 403/429 checks |
 | SKILL-05 | skill-admin | `aipctl skill download`; `aipctl admin skill upload`, `aipctl admin skill download`, `aipctl admin skill github inspect/import/sync/credentials set/clear` | `createAdminUploadUrl` → `uploadToS3` → `completeAdminUpload` (`abortAdminUpload` on failure); `getSkillDownloadUrl` → `downloadFromUrl`; `inspectGitHubSkillSource`, `prepareGitHubSkill`, `syncPrepareGitHubSkill`, `updateGitHubSkillCredentials` | api + external | `POST`/`PUT`/`POST`; `POST`/`GET`; `POST`, `POST`, `POST`, `PATCH` | `/admin/.../skills/upload-url`; `/admin/.../skills/download-url`; `/admin/.../skills/github-repo-inspect`; `/github-prepare`; `/{skillId}/sync-prepare`; `/{skillId}/github-credentials` | upload/download local bodies; GitHub inspect/prepare `{ url, pat? }`; credentials `{ pat or null }` | upload/download/GitHub admin skill DTOs | `resource/oas/modules/backend/organization/skills/openapi.yaml` | `frontend/packages/api/src/out/modules/organization-skills-types.ts#paths["/api/web/admin/organizations/slug/{organizationSlug}/skills/upload-url"]`, `#paths["/api/web/admin/organizations/slug/{organizationSlug}/skills/download-url"]`, `#paths["/api/web/admin/organizations/slug/{organizationSlug}/skills/github-repo-inspect"]`, `#paths["/api/web/admin/organizations/slug/{organizationSlug}/skills/github-prepare"]`, `#paths["/api/web/admin/organizations/slug/{organizationSlug}/skills/{skillId}/sync-prepare"]`, `#paths["/api/web/admin/organizations/slug/{organizationSlug}/skills/{skillId}/github-credentials"]` | `external-presigned` | N/A | `keep` | none | N/A | existing `commands/admin/skill.test.ts`, `commands/skill/skill-extended.test.ts`; needed GitHub admin skill contract fixtures |
 | P1-SKILL-01 | skill-docs | `aipctl skill get --json`, `aipctl admin skill get --json`, `aipctl admin skill github import/sync --json` | same owners as `SKILL-01`/`SKILL-05` | api | same as upstream rows | same as upstream rows | runtime/JSON/help/docs now align on `source`, `origin`, `updateAvailable`, `secretsAvailable`, GitHub metadata, `secretKeys`; stale `version` and file `size` removed | JSON/help/docs contract for skill objects | `resource/oas/modules/backend/organization/skills/openapi.yaml` | `frontend/packages/api/src/out/modules/organization-skills-types.ts#components[...]` | `generated-ready` | `P1` | `keep` | none | N/A | updated `src/core/api.test.ts`, `commands/skill/skill.test.ts`, `commands/skill/skill-extended.test.ts`, `commands/admin/skill.test.ts`, `commands/json-format.test.ts`, `../docs/how-to/aip-cli-usage.md`; covers JSON/help/docs field sync |
 | P0-AGENT-01 | agent-user | `aipctl agent list`, `aipctl agent get` | `listInstalledAgents`, `getInstalledAgent` | api | `GET`, `GET` | `/api/cli/v1/organizations/{organizationSlug}/agents`; `/{installedAgentId}` | preserves user read semantics and maps `list`/`installedAgentId` to local `data`/`id` | local `ListInstalledAgentsResponse`, `{ data: InstalledAgentDetail }` | `resource/oas/modules/backend/cli/openapi.yaml`; shared DTO refs from `resource/oas/duplo.yaml` | `backend/api/.../cli/generated/api/CliAgentApi.kt` | `generated-ready` | `P0` | `migrate` | none; dedicated adapter delegates to the working `AgentsApiController` bean | `AI-6344` | `src/core/api.test.ts`, `CliAgentApiControllerTest`, Gateway registry/admission parity; real local production CLI list/get JSON |
@@ -54,10 +54,10 @@
 | P0-AGENT-03 | agent-export | `aipctl admin agent export` (GA-CANDIDATE, production gated) | `exportInstalledAgent` | api | `GET` | `/web/admin/organizations/slug/{organizationSlug}/installed-agents/{installedAgentId}/export` | existing direct controller request | YAML `Buffer` | `backend/api/.../app/controller/AgentExportController.kt`; intentionally OAS-codegen excluded | none | `legacy-generated` | `P0` | `legacy-exception` | owner=`AgentExportController`; dedicated transfer contract, size/timeout/partial-file/authorization/audit gates remain | `AI-6380` | existing direct export path/Buffer/404 tests; production help remains hidden |
 | P1-CHAT-01 | agent-chat | `aipctl agent chat` | `agentNewChat`, `agentChat`, local `parseSseStream` | chat | `POST` + SSE | `/librechat/api/{orgSlug}/agent/new-chat`; `/librechat/api/{orgSlug}/agent/chat` | request body `{ agentInstallationId or conversationId, text, files: [] }` | local `AgentChatResult { text, conversationId }` parsed from SSE event fields `final`, `conversation.conversationId`, `responseMessage` | path source: `resource/oas/chat.yaml` | `frontend/packages/api/src/out/chat-types.ts#paths["/librechat/api/{orgSlug}/agent/new-chat"]`, `#paths["/librechat/api/{orgSlug}/agent/chat"]` | `stream-exception` | `P1` | `legacy-exception` | owner=`chat backend agent SSE stream contract`; rationale=`path exists in OpenAPI but final SSE event payload is still out-of-band`; removal condition=`official SSE event schema or versioned fixture is published with the chat contract`; incorporation plan=`bind CLI parser/tests to the published SSE fixture and drop local-only stream assumptions` | N/A | updated `src/core/api.test.ts`; covers content[] text, fallback text, malformed event skip, and no-final-event failure |
 | P1-AUTO-01 | automation | `aipctl automation list`, `get`, `create`, `update`, `delete`, `run`, `enable`, `disable`, `history`, `cancel`, `webhook-regen`, `triggers` | `listAutomations`, `getAutomation`, `createAutomation`, `updateAutomation`, `deleteAutomation`, `runAutomation`, `updateAutomationStatus`, `listAutomationHistories`, `cancelAutomationHistory`, `regenerateWebhookUrl`, `getTriggerProviderMetadata` | api | `GET`, `POST`, `PUT`, `DELETE` mix | `/api/web/organizations/slug/{organizationSlug}/automations...`; `/automation-trigger-providers/.../metadata` | automation pagination normalized to `{ page, pageSize, total }`; metadata calls now use provider-specific OAS paths and required args (`accountId`, `folderId`, `serviceType`) | local automation DTOs + webhook URL DTO | `resource/oas/modules/backend/automation/user/openapi.yaml` | `frontend/packages/api/src/out/modules/automation-user-types.ts#paths[...]` | `generated-ready` | `P1` | `keep` | none | N/A | updated `src/core/api.test.ts`, `commands/automation/automation.test.ts`, `commands/json-format.test.ts`; covers official pagination fields, provider-specific metadata routes, and unsupported-provider preflight failure |
-| CHAT-01 | chat-readonly | `aipctl chat list`, `aipctl chat get`, `aipctl chat messages` | `listConversations`, `getConversation`, `listMessages` | chat | `GET` | `/librechat/api/{orgSlug}/convos`; `/convos/{conversationId}`; `/messages/{conversationId}` | list sends no default query; optional cursor only (`?cursor=...`). `pageSize`/`sortBy`/`sortDirection` defaults removed due deployed Chat validation drift | local `ListConversationsResponse`, `ConversationDetail`, `ChatMessage[]` | `resource/oas/chat.yaml` | `frontend/packages/api/src/out/chat-types.ts#paths["/librechat/api/{orgSlug}/convos"]`, `#paths["/librechat/api/{orgSlug}/convos/{conversationId}"]`, `#paths["/librechat/api/{orgSlug}/messages/{conversationId}"]` | `legacy-generated` | N/A | `keep` | owner=`chat backend`; rationale=`PROD rejects CLI default pageSize/sort query while no-query and cursor-only read path are safe`; removal condition=`chat deployed contract publishes and accepts explicit pagination query for public CLI`; incorporation plan=`reintroduce explicit pagination only after OAS/source/deployed validation align` | N/A | updated `src/core/api.test.ts`, existing `commands/chat/chat.test.ts`; covers default no-query and cursor-only URL |
-| P0-DRIVE-01 | drive | `aipctl drive list`, `download`, `delete`, `mkdir`, `rename`, `usage` | `listDriveEntries`, `getDriveDownloadUrl`, `deleteDriveEntries`, `createDriveFolder`, `renameDriveEntry`, `getDriveUsage`, `downloadFromUrl` | api + external | `GET`, `POST`, `POST`, `POST`, `PATCH`, `GET`, external `GET` | `/drive/entries?count=200`; `/drive/entries/download-url`; `/drive/entries/delete`; `/drive/entries/{entryId}`; `/drive/usage` | official list `{ path, hasNext, nextCursor, items }`; delete body `{ entryIds[] }`; rename body `{ newName }`; download body `{ entryIds: [id] }` | official drive list/download DTOs + external file buffer | `resource/oas/modules/backend/organization/storage/openapi.yaml` | `frontend/packages/api/src/out/modules/organization-storage-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/drive/entries"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/drive/entries/download-url"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/drive/entries/{entryId}"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/drive/entries/delete"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/drive/usage"]` | `generated-ready` | `P0` | `migrate` | none | `AIP-PUB-05` | updated `src/core/api.test.ts`, `commands/drive/drive.test.ts`; covers paged list shape, batch download-url request, DTO field rename (`sizeBytes`, `modifiedAt`) |
+| CHAT-01 | chat-readonly | `aipctl chat list`, `aipctl chat get`, `aipctl chat messages` | `listConversations`, `getConversation`, `listMessages` | chat | `GET` | `/api/cli/v1/organizations/{orgSlug}/chats`; `/chats/{conversationId}`; `/chats/{conversationId}/messages` | list sends optional cursor; server fixes bounded `updatedAt desc` page size; detail/messages preserve organization and user ownership | local `ListConversationsResponse`, `ConversationDetail`, `ChatMessage[]` | `chat/packages/chat/src/modules/cli-chat/interface/cli-chat-read-v1.interface.controller.ts` | code-first controller contract with `operationId`/quota/capability extensions; no generated backend artifact | `oas-source-only` | `P0` | `migrate` | none; `CliChatReadInterfaceService` reuses the existing conversation/message ownership services and returns CLI-safe fields only | `AI-6344` | updated `src/core/api.test.ts`, Chat read service spec, Gateway registry/contract parity; local CLI/Chat verification covers cursor and no legacy fallback |
+| P0-DRIVE-01 | drive | `aipctl drive list`, `download`, `delete`, `mkdir`, `rename`, `usage` | `listDriveEntries`, `getDriveDownloadUrl`, `deleteDriveEntries`, `createDriveFolder`, `renameDriveEntry`, `getDriveUsage`, `downloadFromUrl` | api + external | `GET`, `POST`, `POST`, `POST`, `PATCH`, `GET`, external `GET` | CLI-managed basic CRUD: `/api/cli/v1/organizations/{organizationSlug}/drive/entries?count=200`, `/drive/entries/delete`, `/drive/folders`, `/drive/entries/{entryId}`, `/drive/usage`; download/upload remain Web/presigned | official list `{ path, hasNext, nextCursor, items }`; delete body `{ entryIds[] }`; mkdir optional `parentId`; rename body `{ newName }`; download body `{ entryIds: [id] }` | official drive list/download DTOs + external file buffer | `resource/oas/modules/backend/cli/openapi.yaml` → `v1_drive_*.yaml` (DTO aliases to organization Storage OAS); download/upload remain `resource/oas/modules/backend/organization/storage/openapi.yaml` | `backend/api/.../cli/generated/api/CliDriveApi.kt`; domain DTOs remain `com.querypie.duplo.api.drive.controller.generated.model.*` | `generated-ready` | `P0` | `migrate` | none; `CliDriveApiController` delegates membership, capacity and audit owner | `AI-6344` | `src/core/api.test.ts`, `CliSkillDriveApiControllerTest`, Gateway registry/contract parity; production CRUD/usage and local 403/404 checks (401/429 remain common gates) |
 | P0-DRIVE-02 | drive | `aipctl drive upload` | `createDriveUploadUrl` → `uploadToS3` → `completeDriveUpload` | api + external | `POST` → `PUT` → `POST` | `/drive/entries/upload-url`; external presigned `uploadUrl`; `/drive/entries/{entryId}/complete` | official upload request `{ parentId: null, filename, fileSize, mimeType }` | official `CreateDriveUploadUrlResponse { id, filename, uploadUrl, headers }` then `void` | `resource/oas/modules/backend/organization/storage/openapi.yaml` | `frontend/packages/api/src/out/modules/organization-storage-types.ts#paths["/api/web/organizations/slug/{organizationSlug}/drive/entries/upload-url"]`, `#paths["/api/web/organizations/slug/{organizationSlug}/drive/entries/{entryId}/complete"]` | `generated-ready` | `P0` | `migrate` | none | `AIP-PUB-05` | updated `src/core/api.test.ts`, `commands/drive/drive.test.ts`; covers `parentId: null` request and response `id`/`filename` usage |
-| P1-INT-01 | integration | `aipctl integration list`, `test`; `aipctl admin integration get`, `update`, `delete`, `tools`, `available` | `listIntegrations`, `testIntegration`, `getIntegration`, `updateIntegration`, `deleteIntegration`, `listIntegrationTools`, `listConfigurableIntegrations` | api | `GET`, `POST`, `GET`, `PUT`, `DELETE`, `GET`, `GET` | `/api/web/integrations/v2`; `/api/web/integration/{integrationId}/test`; `/api/web/admin/organizations/slug/{organizationSlug}/integrations/{integrationId}`; `/{integrationId}/tools`; `/configurable-integrations` | top-level list/test and admin detail/available now follow current/legacy OAS path+body+DTO where available; admin update/delete still accept untyped legacy mutation body/path until admin mutation contract lands | local `Integration`, `IntegrationDetail`, `IntegrationToolsResponse`, `ConfigurableIntegration[]` | legacy admin paths: `resource/oas/duplo-web.yaml`; partial modern source: `resource/oas/modules/backend/integration/openapi.yaml` (does not cover these admin list/CRUD/tools paths) | legacy `frontend/packages/api/src/out/user-types.ts#paths["/api/web/admin/organizations/slug/{organizationSlug}/integrations"]`, `#paths["/api/web/admin/organizations/slug/{organizationSlug}/configurable-integrations"]`; partial current `frontend/packages/api/src/out/modules/integration-types.ts` lacks these admin list/CRUD/tools paths | `legacy-generated` | `P1` | `legacy-exception` | owner=`backend app Integrations / duplo-web legacy OAS`; rationale=`public beta keeps integration list/test/admin detail/tools/available, but admin update/delete still lack an approved current contract outside legacy duplo-web`; removal condition=`independent contract covers user list/test plus admin CRUD/tools/available`; incorporation plan=`extend integration module or independent contract for list/test/admin CRUD/tools/available, then retire legacy path/body mappings and delete/update exception` | N/A | updated `src/core/api.test.ts`, `commands/integration/integration.test.ts`; covers v2 list query, test body `{ organizationSlug }`, admin detail/tools DTO fields, configurable wrapper unwrap, and pinned update/delete legacy paths |
+| P1-INT-01 | integration | `aipctl integration list`, `test`; `aipctl admin integration get`, `update`, `delete`, `tools`, `available` | `listIntegrations`, `testIntegration`, `getIntegration`, `updateIntegration`, `deleteIntegration`, `listIntegrationTools`, `listConfigurableIntegrations` | api | `GET`, `POST`, `GET`, `PUT`, `DELETE`, `GET`, `GET` | read operations use `/api/cli/v1/organizations/{organizationSlug}/integrations`; `/admin/integrations/available`; `/admin/integrations/{integrationId}`; `/tools`; mutations/test remain legacy candidate paths | read responses use dedicated CLI DTOs; admin detail maps only metadata and configured boolean, never property descriptors or credential values; update/delete/test remain unchanged | local `Integration`, `IntegrationDetail`, `IntegrationToolsResponse`, `ConfigurableIntegration[]` | `resource/oas/modules/backend/cli/openapi.yaml` → `v1_integrations*.yaml` | `backend/api/.../cli/generated/api/CliIntegrationApi.kt`; generated `Cli*Integration*` models | `generated-ready` | `P1` | `migrate` | owner=`backend CLI integration adapter`; rationale=`read-only operations now have a stable v1 contract while external test and mutations retain candidate gates`; removal condition=`dedicated test/mutation contracts pass timeout, redaction and idempotency gates`; incorporation plan=`follow AI-6380 candidate work` | `AI-6344` | updated `src/core/api.test.ts`, Backend adapter/security tests, Gateway registry/contract parity; local CLI read verification and legacy mutation path regression |
 | P0-MODEL-01 | model | `aipctl model list` | `listModels` | chat | `GET` | `/api/cli/v1/organizations/{orgSlug}/models` | none | `{ models: string[], defaultModel? }` is mapped into `Model[]` and preserves active standard, custom/BYOK, and `etc` catalog IDs | code-first OAS: `chat/packages/chat/src/modules/cli-model-exec/interface/cli-model-exec-v1.interface.controller.ts` | runtime Swagger contract; the existing Web model endpoint remains an independent compatibility reference | `oas-source-only` | `P0` | `migrate` | owner=`Chat CliModelExecV1InterfaceController/ModelInternalService`; rationale=`the dedicated route reuses the existing organization-authorized model domain catalog instead of the narrowed model-exec SharedModel catalog`; removal condition=`none for the CLI route; Web migration is a separate work item`; incorporation plan=`keep the CLI path and capability/registry parity tests aligned with the code-first Chat contract` | `AIP-PUB-05` | `src/core/api.test.ts` verifies the dedicated path, production capability gate, default mapping, and preservation of custom/BYOK and `etc` IDs; Chat service/controller tests verify domain delegation and Swagger extensions |
 | P1-MODEL-EXEC-01 | model-exec | `aipctl model-exec models`, `get`, `sample`, `chat` | `listModelExecModels`, `executeModelExecChat` | chat | `GET`, `POST` | `/api/cli/v1/organizations/{orgSlug}/model-exec/models`; `/chat` | local `ModelExecChatRequest`; Chat Zod/Swagger DTO source `chat/packages/chat/src/modules/cli-model-exec/interface/dto/cli-model-exec.dto.ts` | local `ModelExecModelCatalog`, `ModelExecChatResponse` | code-first OAS: `chat/packages/chat/src/modules/cli-model-exec/interface/cli-model-exec-v1.interface.controller.ts` | runtime Swagger contract | `oas-source-only` | `P1` | `migrate` | none | `AIP-PUB-05` | `src/core/api.test.ts` verifies both v1 paths; Chat controller contract test verifies operation IDs, request/response schemas, delegation to the existing service, and absence of a v1 image route |
 | P1-MODEL-EXEC-02 | model-exec-image | `aipctl model-exec image generate` | `executeModelExecImageGeneration`; output uses `downloadFromUrl` | chat + external artifact URL | `POST`, external `GET` | legacy `/api/{orgSlug}/cli/model-exec/images/generations`; response `downloadUrl` | local `ModelExecImageGenerationRequest`; Chat DTO source `chat/packages/chat/src/modules/cli-model-exec/interface/dto/cli-model-exec.dto.ts` | local `ModelExecImageGenerationResponse`; image bytes from external URL | no GA OAS; legacy controller only | none | `oas-missing` | deferred | `hide` | owner=`chat CLI Model Exec API`; rationale=`synchronous image execution, external artifact lifetime, and cost recovery require the deferred async design`; removal condition=`image job/artifact/TTL/My Drive/cost gates pass`; incorporation plan=`publish a separate v1 image job contract only after the deferred design is implemented` | follow-up image hardening | existing image request/path test remains on the legacy route; customer capability must stay disabled |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aipctl",
-  "version": "2026.9.9",
+  "version": "2026.9.11",
   "description": "QueryPie AIP and MCP CLI tool",
   "author": "QueryPie",
   "license": "UNLICENSED",
@@ -22,8 +22,8 @@
     "node": ">=24.18.0"
   },
   "metadata": {
-    "contentHash": "95bfb896d5e0e21910685b39eff86f3d35ee5c1b0ef28854912f78fdbc7bee58",
-    "wrapperHash": "a4ef2565f44cb9eb4a3706246f59427bf40a5275dc7bea030fb30024be6f5ab8",
+    "contentHash": "3ba1c423da1af4ecb2cfea8ed116569d9a97e579727ca173bd87fd17a77cdd32",
+    "wrapperHash": "40c7bf7e201612bd3435325d09cd6eebe577f5e56184f8e2c0f0a0b0bfa58368",
     "nativeHash": "006b08c3e391f4571d9b7c0f12d684fe2448106259e7e0581b10f9be362452e9"
   },
   "optionalDependencies": {