fix: align integration access guidance and SDK dependency

README.md

@@ -90,7 +90,7 @@ flashduty integration list --fields integration_id,name,plugin_type
 flashduty channel integration-list --channel-id 20001 --fields integration_id,channel_id,name,plugin_type
 ```
 
-Public integrations require integration permissions; dedicated integrations require channel permissions and access to the owning channel. Choose by ownership, not by the numeric ID. Both use the management App Key, and a permission failure never switches command families. The bundled Agent Skill explains selection, discovery, and confirmed changes.
+Public integration instances require integration permissions. Dedicated reads accept Channels Read, Channels Manage, or Integrations Read and require visibility of the owning channel; dedicated writes require Channels Manage and management access to that channel. The shared `integration type-list` catalog accepts these three read permissions; scoped App Keys must allow `integration.api:read:typeList`. Choose by ownership, not by the numeric ID. Both use the management App Key, and a permission failure never switches command families. The bundled Agent Skill explains selection, discovery, and confirmed changes.
 
 ### Request bodies
 

README_zh.md

@@ -90,7 +90,7 @@ flashduty integration list --fields integration_id,name,plugin_type
 flashduty channel integration-list --channel-id 20001 --fields integration_id,channel_id,name,plugin_type
 ```
 
-公共集成需要集成中心权限；专属集成需要协作空间权限以及对目标空间的访问或管理权限。按实际归属选择，不能只凭数字 ID 判断类型。两类命令均使用管理用的 App Key，权限失败时不会自动切换接口。随 CLI 分发的 Agent Skill 提供类型选择、查询和经确认后修改配置的指引。
+公共集成实例需要集成中心权限。专属集成读取允许协作空间查看、协作空间管理或集成中心查看权限，同时要求目标空间可见；写入须有协作空间管理权限以及目标空间的管理资格。共用的 `integration type-list` 类型目录允许这三项读取权限；限制了接口范围的 App Key 须允许 `integration.api:read:typeList`。按实际归属选择，不能只凭数字 ID 判断类型。两类命令均使用管理用的 App Key，权限失败时不会自动切换接口。随 CLI 分发的 Agent Skill 提供类型选择、查询和经确认后修改配置的指引。
 
 ### 请求体
 

go.mod

@@ -3,7 +3,7 @@ module github.com/flashcatcloud/flashduty-cli
 go 1.26.0
 
 require (
-	github.com/flashcatcloud/go-flashduty v0.15.21
+	github.com/flashcatcloud/go-flashduty v0.15.22
 	github.com/mattn/go-runewidth v0.0.30
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10

go.sum

@@ -1,8 +1,8 @@
 github.com/clipperhouse/uax29/v2 v2.2.0 h1:ChwIKnQN3kcZteTXMgb1wztSgaU+ZemkgWdohwgs8tY=
 github.com/clipperhouse/uax29/v2 v2.2.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/flashcatcloud/go-flashduty v0.15.21 h1:GLXsWw55BKm0xodjnYrA4Q32G5nmCm6PW+qkVLZPT8M=
-github.com/flashcatcloud/go-flashduty v0.15.21/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk=
+github.com/flashcatcloud/go-flashduty v0.15.22 h1:blLlBLFzZxhjGzma9u7l3kZBWjmNTM5tg9FJdKkd9Lg=
+github.com/flashcatcloud/go-flashduty v0.15.22/go.mod h1:YpHiTYXR5NXBI/rGRZfUy537XMkhdCkwA8NW1QoRHwk=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/mattn/go-runewidth v0.0.30 h1:+KUuiDA4fF0R1p5FeueHefjDm+GIM+kWfFnDjybOPgk=

skills/flashduty/reference/integration.md

@@ -7,12 +7,14 @@ Prereq: read `SKILL.md`. Choose the command family from the integration's owners
 | User intent or existing ownership | Command family | Permission boundary |
 |---|---|---|
 | Public integration managed in the integration center; shared ingestion connected to channels through subscriptions or routing | `integration *` | Integrations Read/Manage plus the integration's object permissions |
-| Dedicated alert integration owned by one collaboration space (协作空间专属集成) | `channel integration-*` | Channels Read/Manage plus visibility or management of the owning channel; no integration-center permission required |
+| Dedicated alert integration owned by one collaboration space (协作空间专属集成) | `channel integration-*` | Reads: Channels Read/Manage or Integrations Read plus channel visibility. Writes: Channels Manage plus channel management access |
 
 For an existing integration, use its known ownership; an ID alone does not identify the scope. A target channel receiving alerts does not by itself mean the integration is dedicated: public integrations can also route there. For creation, use a dedicated integration when ingestion belongs to that one channel, or a public integration when the user wants shared ingestion managed in the integration center. If ownership or intended scope is unclear, ask before creating or changing configuration.
 
 Never retry a failed call through the other integration family, including on access denied or not found. Public does not mean anonymous: both families use the management App Key and its owner's permissions. An integration key is a separate credential for inbound events.
 
+`integration type-list` is a shared catalog for both families. It accepts Channels Read, Channels Manage, or Integrations Read. Scoped App Keys must allow `integration.api:read:typeList`; a `channel.integration:*:*` scope does not include this endpoint. Catalog access does not grant access to public integration instances.
+
 ## Public integrations
 
 ### Read before changing configuration