@thinkingai/ae-cli 6.0.28 → 6.0.29

package/dist/{te-audience-XMRMVD2V.js → te-audience-ECFS4GF4.js}

@@ -142,14 +142,12 @@ var buildClusterDefinition = createMcpCommand({
   ],
   risk: "read",
   buildArgs: (ctx) => ({
-    request: {
-      projectId: ctx.num("project_id"),
-      type: ctx.str("type"),
-      conditions: optionalJson(ctx, "conditions"),
-      includeFilter: optionalJson(ctx, "include_filter"),
-      excludeFilter: optionalJson(ctx, "exclude_filter"),
-      sql: optionalString(ctx, "sql")
-    },
+    projectId: ctx.num("project_id"),
+    type: ctx.str("type"),
+    conditions: optionalJson(ctx, "conditions"),
+    includeFilter: optionalJson(ctx, "include_filter"),
+    excludeFilter: optionalJson(ctx, "exclude_filter"),
+    sql: optionalString(ctx, "sql"),
     authenticatedOnly: optionalBoolean(ctx, "authenticated_only")
   })
 });
@@ -234,6 +232,7 @@ var createIdCluster = createMcpCommand({
     { name: "main_column_name", type: "string", required: false, desc: "Optional main column name for ID matching" }
   ],
   risk: "write",
+  mcpService: "te_analysis_extend",
   buildArgs: (ctx) => ({
     projectId: ctx.num("project_id"),
     displayName: ctx.str("display_name"),
@@ -248,6 +247,7 @@ var createIdCluster = createMcpCommand({
 // src/commands/te-audience/cluster/update-id-cluster.ts
 var updateIdCluster = createMcpCommand({
   command: "+update_id_cluster",
+  mcpService: "te_analysis_extend",
   description: "Update an existing ID cluster by re-uploading CSV file content as plain text. The cluster is identified by cluster_name. The operation is asynchronous.",
   flags: [
     { name: "project_id", type: "number", required: true, desc: "Project ID", alias: "p" },
@@ -271,13 +271,14 @@ var updateIdCluster = createMcpCommand({
 // src/commands/te-audience/cluster/delete-cluster.ts
 var deleteCluster = createMcpCommand({
   command: "+delete_cluster",
+  mcpService: "te_analysis_extend",
   description: "Delete a cluster by clusterName. If dependencies exist, shows an influence list and requires --confirmed to proceed.",
   flags: [
     { name: "project_id", type: "number", required: true, desc: "Project ID", alias: "p" },
     { name: "cluster_name", type: "string", required: true, desc: "Cluster name to delete" },
     { name: "confirmed", type: "boolean", required: false, desc: "Pass after user explicitly confirms deletion despite listed dependencies" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   buildArgs: (ctx) => ({
     projectId: ctx.num("project_id"),
     clusterName: ctx.str("cluster_name"),
@@ -523,7 +524,7 @@ var deleteTag = createMcpCommand({
     { name: "tag_name", type: "string", required: true, desc: "Tag name to delete" },
     { name: "confirmed", type: "boolean", required: false, desc: "Pass after user explicitly confirms deletion despite listed dependencies" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   buildArgs: (ctx) => ({
     projectId: ctx.num("project_id"),
     tagName: ctx.str("tag_name"),

package/dist/{te-audience-PVMKQAFH.js → te-audience-WO377T2J.js}

@@ -142,14 +142,12 @@ var buildClusterDefinition = createMcpCommand({
   ],
   risk: "read",
   buildArgs: (ctx) => ({
-    request: {
-      projectId: ctx.num("project_id"),
-      type: ctx.str("type"),
-      conditions: optionalJson(ctx, "conditions"),
-      includeFilter: optionalJson(ctx, "include_filter"),
-      excludeFilter: optionalJson(ctx, "exclude_filter"),
-      sql: optionalString(ctx, "sql")
-    },
+    projectId: ctx.num("project_id"),
+    type: ctx.str("type"),
+    conditions: optionalJson(ctx, "conditions"),
+    includeFilter: optionalJson(ctx, "include_filter"),
+    excludeFilter: optionalJson(ctx, "exclude_filter"),
+    sql: optionalString(ctx, "sql"),
     authenticatedOnly: optionalBoolean(ctx, "authenticated_only")
   })
 });
@@ -234,6 +232,7 @@ var createIdCluster = createMcpCommand({
     { name: "main_column_name", type: "string", required: false, desc: "Optional main column name for ID matching" }
   ],
   risk: "write",
+  mcpService: "te_analysis_extend",
   buildArgs: (ctx) => ({
     projectId: ctx.num("project_id"),
     displayName: ctx.str("display_name"),
@@ -248,6 +247,7 @@ var createIdCluster = createMcpCommand({
 // src/commands/te-audience/cluster/update-id-cluster.ts
 var updateIdCluster = createMcpCommand({
   command: "+update_id_cluster",
+  mcpService: "te_analysis_extend",
   description: "Update an existing ID cluster by re-uploading CSV file content as plain text. The cluster is identified by cluster_name. The operation is asynchronous.",
   flags: [
     { name: "project_id", type: "number", required: true, desc: "Project ID", alias: "p" },
@@ -271,13 +271,14 @@ var updateIdCluster = createMcpCommand({
 // src/commands/te-audience/cluster/delete-cluster.ts
 var deleteCluster = createMcpCommand({
   command: "+delete_cluster",
+  mcpService: "te_analysis_extend",
   description: "Delete a cluster by clusterName. If dependencies exist, shows an influence list and requires --confirmed to proceed.",
   flags: [
     { name: "project_id", type: "number", required: true, desc: "Project ID", alias: "p" },
     { name: "cluster_name", type: "string", required: true, desc: "Cluster name to delete" },
     { name: "confirmed", type: "boolean", required: false, desc: "Pass after user explicitly confirms deletion despite listed dependencies" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   buildArgs: (ctx) => ({
     projectId: ctx.num("project_id"),
     clusterName: ctx.str("cluster_name"),
@@ -523,7 +524,7 @@ var deleteTag = createMcpCommand({
     { name: "tag_name", type: "string", required: true, desc: "Tag name to delete" },
     { name: "confirmed", type: "boolean", required: false, desc: "Pass after user explicitly confirms deletion despite listed dependencies" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   buildArgs: (ctx) => ({
     projectId: ctx.num("project_id"),
     tagName: ctx.str("tag_name"),

package/dist/{te-engage-AGREUOW7.js → te-engage-545HJL6J.js}

@@ -294,7 +294,7 @@ var deleteConfigItem = {
     { name: "config_id", type: "string", required: true, desc: "Config item ID" },
     { name: "open_id", type: "string", required: true, desc: "Operator open ID" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   dryRun: (ctx) => buildMcpDryRun(ctx, serviceName7, toolName7, buildArgs7(ctx)),
   execute: async (ctx) => executeMcpCommand(ctx, serviceName7, toolName7, buildArgs7(ctx))
 };
@@ -426,7 +426,7 @@ var deleteFlow = {
     { name: "project_id", type: "number", required: true, alias: "p", desc: "Project ID" },
     { name: "flow_uuid_list", type: "json", required: true, desc: "Flow UUID list as JSON array" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   validate: (ctx) => {
     readRequiredJsonArray(ctx, "flow_uuid_list");
   },
@@ -1053,7 +1053,7 @@ var deleteChannel = {
     { name: "project_id", type: "number", required: true, alias: "p", desc: "Project ID" },
     { name: "channel_id", type: "string", required: true, desc: "Channel ID" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   dryRun: (ctx) => buildMcpDryRun(ctx, serviceName31, toolName31, buildArgs31(ctx)),
   execute: async (ctx) => executeMcpCommand(ctx, serviceName31, toolName31, buildArgs31(ctx))
 };
@@ -1075,7 +1075,7 @@ var deleteConfigChannel = {
     { name: "project_id", type: "number", required: true, alias: "p", desc: "Project ID" },
     { name: "channel_id", type: "string", required: true, desc: "Config channel ID" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   dryRun: (ctx) => buildMcpDryRun(ctx, serviceName32, toolName32, buildArgs32(ctx)),
   execute: async (ctx) => executeMcpCommand(ctx, serviceName32, toolName32, buildArgs32(ctx))
 };

package/dist/{te-engage-MIIUKY6M.js → te-engage-M7JQSJDP.js}

@@ -294,7 +294,7 @@ var deleteConfigItem = {
     { name: "config_id", type: "string", required: true, desc: "Config item ID" },
     { name: "open_id", type: "string", required: true, desc: "Operator open ID" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   dryRun: (ctx) => buildMcpDryRun(ctx, serviceName7, toolName7, buildArgs7(ctx)),
   execute: async (ctx) => executeMcpCommand(ctx, serviceName7, toolName7, buildArgs7(ctx))
 };
@@ -426,7 +426,7 @@ var deleteFlow = {
     { name: "project_id", type: "number", required: true, alias: "p", desc: "Project ID" },
     { name: "flow_uuid_list", type: "json", required: true, desc: "Flow UUID list as JSON array" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   validate: (ctx) => {
     readRequiredJsonArray(ctx, "flow_uuid_list");
   },
@@ -1053,7 +1053,7 @@ var deleteChannel = {
     { name: "project_id", type: "number", required: true, alias: "p", desc: "Project ID" },
     { name: "channel_id", type: "string", required: true, desc: "Channel ID" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   dryRun: (ctx) => buildMcpDryRun(ctx, serviceName31, toolName31, buildArgs31(ctx)),
   execute: async (ctx) => executeMcpCommand(ctx, serviceName31, toolName31, buildArgs31(ctx))
 };
@@ -1075,7 +1075,7 @@ var deleteConfigChannel = {
     { name: "project_id", type: "number", required: true, alias: "p", desc: "Project ID" },
     { name: "channel_id", type: "string", required: true, desc: "Config channel ID" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   dryRun: (ctx) => buildMcpDryRun(ctx, serviceName32, toolName32, buildArgs32(ctx)),
   execute: async (ctx) => executeMcpCommand(ctx, serviceName32, toolName32, buildArgs32(ctx))
 };

package/dist/{te-kb-KQJ53M3A.js → te-kb-NT33UHAE.js}

@@ -315,7 +315,7 @@ var remove = {
   flags: [
     { name: "name", type: "string", required: true, desc: "Knowledge base name to delete" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   dryRun: (ctx) => ({
     method: "DELETE",
     url: `${ctx.host().replace(/\/$/, "")}${API_PATH4}`,

package/dist/{te-meta-QLANJ4B4.js → te-meta-FADFLTDM.js}

@@ -304,7 +304,7 @@ var deleteMetric = createMcpCommand({
     { name: "project_id", type: "number", required: true, desc: "Project ID", alias: "p" },
     { name: "metric_id", type: "number", required: true, desc: "Metric ID to delete" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   mcpService: "te_analysis_extend",
   buildArgs: (ctx) => ({
     projectId: ctx.num("project_id"),
@@ -392,7 +392,7 @@ var deleteTrackItems = createMcpCommand({
     { name: "project_id", type: "number", required: true, alias: "p", desc: "Project ID" },
     { name: "delete_data", type: "json", required: true, desc: "Delete payload JSON object with events/eventPropNames/userPropNames/commonEventPropNames" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   mcpService: "te_analysis_extend",
   buildArgs: (ctx) => ({
     projectId: ctx.num("project_id"),
@@ -512,7 +512,7 @@ var deleteProjectMarkTimes = createMcpCommand({
     { name: "project_id", type: "number", required: true, alias: "p", desc: "Project ID" },
     { name: "mark_time_ids", type: "json", required: true, desc: "Marker ID list JSON array" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   mcpService: "te_analysis_extend",
   buildArgs: (ctx) => ({
     projectId: ctx.num("project_id"),

package/dist/{te-meta-TOA6FWDE.js → te-meta-PKT27OTN.js}

@@ -304,7 +304,7 @@ var deleteMetric = createMcpCommand({
     { name: "project_id", type: "number", required: true, desc: "Project ID", alias: "p" },
     { name: "metric_id", type: "number", required: true, desc: "Metric ID to delete" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   mcpService: "te_analysis_extend",
   buildArgs: (ctx) => ({
     projectId: ctx.num("project_id"),
@@ -392,7 +392,7 @@ var deleteTrackItems = createMcpCommand({
     { name: "project_id", type: "number", required: true, alias: "p", desc: "Project ID" },
     { name: "delete_data", type: "json", required: true, desc: "Delete payload JSON object with events/eventPropNames/userPropNames/commonEventPropNames" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   mcpService: "te_analysis_extend",
   buildArgs: (ctx) => ({
     projectId: ctx.num("project_id"),
@@ -512,7 +512,7 @@ var deleteProjectMarkTimes = createMcpCommand({
     { name: "project_id", type: "number", required: true, alias: "p", desc: "Project ID" },
     { name: "mark_time_ids", type: "json", required: true, desc: "Marker ID list JSON array" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   mcpService: "te_analysis_extend",
   buildArgs: (ctx) => ({
     projectId: ctx.num("project_id"),

package/dist/{te-team-TQGMNHQQ.js → te-team-RG75PR5D.js}

@@ -120,7 +120,7 @@ var deleteTeam = {
   flags: [
     { name: "id", type: "string", required: true, desc: "Team ID" }
   ],
-  risk: "write",
+  risk: "high-risk-write",
   dryRun: (ctx) => ({
     method: "DELETE",
     url: `${ctx.host().replace(/\/$/, "")}${BASE_TEAM_PATH}/${ctx.str("id")}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thinkingai/ae-cli",
-  "version": "6.0.28",
+  "version": "6.0.29",
   "description": "CLI tool for ThinkingAI (AE) analytics platform",
   "type": "module",
   "bin": {
@@ -20,6 +20,7 @@
     "build": "tsup src/index.ts --format esm --outDir dist && node scripts/copy-tracking-assets.mjs",
     "verify:config": "node test/config-commands.test.mjs",
     "verify:analysis-tools": "tsx scripts/verify-te-analysis-tools.mjs",
+    "verify:analysis-contract-regressions": "node test/analysis-contract-regressions.test.mjs",
     "verify:analysis-cluster-routing": "node scripts/verify-analysis-cluster-routing.mjs",
     "verify:multi-cluster-mode": "node test/multi-cluster-mode.test.mjs",
     "verify:metadata-capability": "node test/metadata-capability-commands.test.mjs",

package/skills/ae-agent/SKILL.md

@@ -28,8 +28,9 @@ ae-cli agent +create-automation --help
 
 - Use this skill for Agent platform resource management: Agents, automations, models, MCP servers, Skills, attachments, the MCP/Skill market, and Skill copy/approval/share flows.
 - **Read operations** (`+list-*`) can run directly once required IDs are known.
-- **Write operations** require explicit user intent and keep the confirmation prompt by default. Pass `--yes` only in fully automated pipelines.
-- Prefer `--dry-run` before destructive writes to inspect the request shape without executing.
+- **Write operations** (`risk: write`) can run directly once required IDs and references are verified.
+- **Delete operations** (`risk: high-risk-write`) require explicit user authorization. Pass `--yes` only after the user confirms.
+- Prefer `--dry-run` before delete operations to inspect the request shape without executing.
 - Personal and company scope resources can be created/updated/deleted; company scope requires root/agent_admin role; system resources are read-only (exception: root users can approve/reject submissions and set company-scope meta).
 - Toggle operations on company/system resources only affect the current user's preference, not the global state.
 - Never invent record IDs. Discover them with `+list-*` commands or accept them from the user.
@@ -41,7 +42,7 @@ ae-cli agent +create-automation --help
 |---|---|
 | `--format <json\|table>` | Output format. Default is JSON. |
 | `--host <url>` | Override the active AE host. Available on every command and may be placed after the subcommand, e.g. `ae-cli agent +<command> --host <url>`. |
-| `--yes` | Skip confirmation for write operations. |
+| `--yes` | Skip confirmation for `high-risk-write` (delete) operations. |
 | `--dry-run` | Show request details (method + URL + body) without executing. |
 
 ### Output and Errors

package/skills/ae-analysis/SKILL.md

@@ -10,7 +10,9 @@ description: "AE/TE/ThinkingEngine/ThinkingAI ae-cli manual for analysis-side ta
 > **CRITICAL - For all commands that require `project_id`, you MUST satisfy `PROJECT_ID_GATE` first (no guessing): verify the project by ID/name with `analysis_common +list_projects` only when there is no valid project context yet, when the user switches project/host/environment, or when the supplied project is ambiguous. Reuse a project already verified in the same continuous conversation and same host/environment.**
 > **CRITICAL - For write operations in this skill, you MUST complete the post-write link loop when applicable:** after success and extractable `resource_id`, call `analysis_common +get_resource_url` and return the main result + resource link (or explicit link-failure reason).
 > **CRITICAL - Before running any `+<tool_name>` command, you MUST first read the corresponding `references/<tool_name>.md`.** The reference filename always equals the command name without the leading `+`, for example `+query_adhoc` -> `references/query_adhoc.md`.
-> **CRITICAL - Before running any capability-gateway asset command such as `ae-cli analysis dashboard list`, `ae-cli analysis bi-panel get`, `ae-cli analysis project-space create`, or `ae-cli analysis public-link list`, read the matching `references/<resource>_<action>.md` file. Replace hyphens with underscores, for example `analysis dashboard list` -> `references/dashboard_list.md`, `analysis bi-panel get` -> `references/bi_panel_get.md`. Use [`references/analysis_gateway_assets.md`](references/analysis_gateway_assets.md) only as the overview matrix.**
+> **CRITICAL - Before running any capability-gateway L2 command such as `ae-cli analysis dashboard list`, `ae-cli analysis bi-panel get`, `ae-cli analysis project-space list`, or `ae-cli analysis public-link list`, read the matching `references/<resource>_<action>.md` file. Replace hyphens with underscores, for example `analysis dashboard list` -> `references/dashboard_list.md`, `analysis bi-panel get` -> `references/bi_panel_get.md`. Use [`references/analysis_gateway_assets.md`](references/analysis_gateway_assets.md) as the overview matrix.**
+> **CRITICAL - Project-space and folder create/delete/share are L3 capabilities only.** Do not use `ae-cli analysis project-space create` or `ae-cli analysis folder create`. Read the matching `references/<resource>_<action>.md` file and invoke via `ae-cli capability inspect/dry-run/run`. For `*.members` read capabilities, use `capability search/inspect/run` per [`ae-capability`](../../ae-capability/SKILL.md) and the L3 matrix in `analysis_gateway_assets.md` — no standalone reference file (see `te-cli/docs/capability-command-admission.md` §10).
+> **CRITICAL - L3 delete capabilities:** user intent is not execution authorization. For `risk=high-risk-write`, dry-run first, summarize in chat, ask for confirmation, and call `capability run ... --yes` only in a later turn after the user explicitly confirms. For `risk=write`, run directly after dry-run. Follow [`ae-capability`](../../ae-capability/SKILL.md) High-Risk Confirmation Workflow.
 
 ## Global AE CLI Rules
 
@@ -31,9 +33,9 @@ Output and errors:
 
 Safety constraints:
 
-- Read commands can execute directly after required IDs and references are verified.
-- Write commands require explicit user intent and normally keep the confirmation prompt.
-- Never invent command names, flags, JSON payloads, `project_id`, resource IDs, field names, event names, property names, metric definitions, or date formats. For builder-supported ad-hoc models (`event`, `retention`, `funnel`, `prop_analysis`), do not pre-discover metadata; pass the user's event/property/metric wording to the matching QP builder and let the builder resolve metadata or return clarification. For non-builder/manual workflows, read the matching command reference and discover real project metadata first.
+- Read and write commands can execute directly after required IDs and references are verified.
+- Delete commands (`high-risk-write`) require explicit user authorization. For L3 `capability run` with `risk=high-risk-write`, dry-run first, then chat confirmation, then `--yes` only after the user authorizes execution in a follow-up message.
+- Never invent command names, flags, JSON payloads, `project_id`, resource IDs, field names, event names, property names, metric definitions, or date formats. For every non-SQL ad-hoc model, do not pre-discover metadata; pass the user's intent to the matching QP builder and let the builder resolve metadata or return clarification. For the SQL manual workflow, read the matching command reference and verify the real project definition first.
 - **NEVER fabricate or guess resource names** (reports, dashboards, events, properties, metrics, clusters, tags, alerts). Always use list commands to discover real resources first. If a resource is not found after fuzzy search and full list fallback, explicitly tell the user "resource not found" and stop - do not proceed with fabricated names.
 
 ## When to Use
@@ -41,6 +43,7 @@ Safety constraints:
 Use `ae-analysis` for all AE analysis-side work below:
 
 - Domain `analysis`: alerts, reports/dashboards, ad-hoc model analysis, drilldown, entity/event details, schema helpers.
+- Domain `analysis-meta`: capability-gateway metadata assets, events, properties, virtual metadata, metrics, data tables, exchange rules, and super metadata.
 - Domain `analysis_audience`: clusters/tags and definition schemas.
 - Domain `analysis_meta`: metadata governance, metrics, virtual metadata, project config, tracking plans, mark times, entity catalog (MCP). For **single** super-event / super-property **detail** on the capability gateway, switch to **`ae-metadata`** skill (`metadata event get`, `metadata property get`).
 - Domain `analysis_common`: project listing and post-write resource links.
@@ -53,7 +56,9 @@ If user intent is Engage/DataOps/Community/metadata gateway detail, switch to `a
 - `ae-cli analysis_audience +<tool_name> [options]`
 - `ae-cli analysis_meta +<tool_name> [options]`
 - `ae-cli analysis_common +<tool_name> [options]`
-- `ae-cli analysis <resource> <action> [options]` for capability-gateway dashboard, BI panel, project-space, folder, favorite, public-link, dashboard-definition, dashboard-daily-report, and async asset data commands.
+- `ae-cli analysis-meta <resource> <action> [options]` for capability-gateway metadata assets, events, properties, virtual metadata, metrics, data tables, exchange rules, and super metadata.
+- `ae-cli analysis <resource> <action> [options]` for curated capability-gateway dashboard, BI panel, project-space list/get, favorite, public-link, dashboard-definition, dashboard-daily-report, and async asset data commands.
+- `ae-cli capability inspect/dry-run/run <capability-id>` for L3 project-space and folder create/delete/share/members capabilities.
 
 Conventions:
 
@@ -61,7 +66,12 @@ Conventions:
 - Capability-gateway command flags use kebab-case, e.g. `--project-id`, `--dashboard-id`, `--request-id`. The CLI sends snake_case JSON to the gateway.
 - MCP params map automatically to camelCase.
 - JSON args pass as JSON string literals.
-- Write operations require confirmation unless `--yes`.
+- Write operations require chat confirmation before `--yes`. User describing the desired action does not count as authorization to skip confirmation.
+
+Credential lifecycle:
+
+- Use `ae-cli auth login`, `ae-cli auth status`, and `ae-cli auth logout` for authentication. There is no separate MCP-token command.
+- After login, the CLI automatically mints, stores, and refreshes the CLI token used by MCP and capability-gateway commands. Never ask the user to set an `mcp-token` manually.
 
 ## Capability Gateway Asset Commands
 
@@ -87,7 +97,8 @@ Use capability-gateway asset commands when the user wants to manage or inspect:
 - Dashboard definition export/import. Use `dashboard-definition import --validate-only true` for import pre-checks; do not look for a separate import-check command.
 - Dashboard daily report update or immediate send.
 - BI panel list/detail/create/update/delete/share/copy, BI panel release/draft version get/publish, and BI page data. Prefer `bi-panel-page-data export` for large results.
-- Project spaces, folders, favorites, and public links.
+- Project spaces and folders: use `project-space list/get` for discovery; use L3 capability run for create/delete/share/members.
+- Favorites and public links.
 
 Do **not** use these commands for:
 
@@ -103,7 +114,7 @@ Capability-gateway output:
 - Export commands return `run_id`, `artifact_id`, status fields, and expiration fields. Use `--artifact-format jsonl` for the artifact format; `--format` is reserved for CLI output formatting. Poll with `ae-cli analysis run inspect --run-id <run_id>` until the run and artifact are complete, then download with `ae-cli analysis artifact download --run-id <run_id> --artifact-id <artifact_id> --output <file>`. Do not call raw inspect/download API paths directly. Cancel with `ae-cli analysis query cancel --run-id <run_id>`.
 - Unknown input fields and camelCase external fields are rejected by the gateway; use kebab-case CLI flags only.
 
-See [`references/analysis_gateway_assets.md`](references/analysis_gateway_assets.md) for the command matrix. Before running one command, read its dedicated reference file named as `<resource>_<action>.md`.
+See [`references/analysis_gateway_assets.md`](references/analysis_gateway_assets.md) for the command matrix. Before running an L2 command, read its dedicated reference file named as `<resource>_<action>.md`. L3 capabilities without a dedicated reference use dynamic discovery per [`ae-capability`](../../ae-capability/SKILL.md).
 
 ## Mandatory Constraints
 
@@ -170,7 +181,7 @@ Before executing ad-hoc queries (`query_adhoc`), MUST check for existing reports
 2. **Search existing reports** - Use `list_reports --query <keyword>` to find matching reports
 3. **Search existing dashboards** - Use `analysis dashboard list --query <keyword>` to find matching dashboards
 4. **If found** - Use `query_report_data` or `analysis dashboard-report-data run/export` to get data from existing assets
-5. **If not found** - For QP builder-supported models (`event`, `retention`, `funnel`, `prop_analysis`), call the matching builder first and then call `query_adhoc` with builder `qp`; do not call schema or metadata tools between the report/dashboard miss and the builder. For all other `query_adhoc` models, use the legacy schema/metadata path.
+5. **If not found** - For every non-SQL model (`event`, `retention`, `funnel`, `prop_analysis`, `attribution`, `distribution`, `heat_map`, `interval`, `path`, `rank_list`), call the matching builder first and then call `query_adhoc` with builder `qp`; do not call schema or metadata tools between the report/dashboard miss and the builder. Only SQL uses the manual schema/verified-definition path.
 
 **Rationale:**
 
@@ -195,14 +206,20 @@ Before executing ad-hoc queries (`query_adhoc`), MUST check for existing reports
 
 ### E. QP_BUILDER_SUPPORTED_MODELS_ONLY
 
-QP builder supports exactly four ad-hoc model types: `event`, `retention`, `funnel`, and `prop_analysis`.
+QP builder supports ten ad-hoc model types: `event`, `retention`, `funnel`, `prop_analysis`, `attribution`, `distribution`, `heat_map`, `interval`, `path`, and `rank_list`.
 
-For these four model types, QP builder is mandatory before `query_adhoc`. Do not handcraft QP from `get_analysis_query_schema`, examples, or prior knowledge.
+For these ten model types, QP builder is mandatory before `query_adhoc`. Do not handcraft QP from `get_analysis_query_schema`, examples, or prior knowledge.
 
 1. `event` -> `+build_event_analysis_qp`
 2. `retention` -> `+build_retention_analysis_qp`
 3. `funnel` -> `+build_funnel_analysis_qp`
 4. `prop_analysis` -> `+build_prop_analysis_qp`
+5. `attribution` -> `+build_attribution_analysis_qp`
+6. `distribution` -> `+build_distribution_analysis_qp`
+7. `heat_map` -> `+build_heat_map_analysis_qp`
+8. `interval` -> `+build_interval_analysis_qp`
+9. `path` -> `+build_path_analysis_qp`
+10. `rank_list` -> `+build_rank_list_analysis_qp`
 
 Builder-supported model routing is:
 
@@ -237,7 +254,7 @@ Execution rule:
 
 - If builder result `status=generated`, call `+query_adhoc` with the same `model_type` and the returned `qp`.
 - If builder returns non-generated status (`need_clarification`, `invalid_argument`, `unsupported_feature`, `validation_error`), stop and ask the user for clarification instead of calling `query_adhoc`.
-- Never bypass a failed builder by manually assembling QP for `event`, `retention`, `funnel`, or `prop_analysis`.
+- Never bypass a failed builder by manually assembling QP for any non-SQL model.
 
 Builder payload rules:
 
@@ -362,8 +379,7 @@ After outputting attribution results, verify that dimension contributions sum to
 
 ## Tool Groups (100)
 
-### analysis (108)
-
+### analysis-meta (47)
 
 Metadata Capabilities (47):
 
@@ -415,6 +431,8 @@ Metadata Capabilities (47):
 - `virtual-property sql-rule-delete` ([doc](references/virtual_property_sql_rule_delete.md))
 - `virtual-property sql-rule-update` ([doc](references/virtual_property_sql_rule_update.md))
 
+### analysis
+
 Alerts (6):
 - `+get_alert_definition_schema` ([doc](references/get_alert_definition_schema.md))
 - `+list_alerts` ([doc](references/list_alerts.md))
@@ -431,7 +449,7 @@ Reports:
 - `+update_report` ([doc](references/update_report.md))
 - `+delete_report` ([doc](references/delete_report.md))
 
-Dashboard, BI panel, project-space, folder, favorite, public-link, dashboard-definition, dashboard-daily-report, run, artifact, and dashboard/BI data commands are capability-gateway commands. Use `ae-cli analysis <resource> <action>` after reading [`references/analysis_gateway_assets.md`](references/analysis_gateway_assets.md); do not use old `+` dashboard/space/BI/public-link command names.
+Dashboard, BI panel, project-space list/get, favorite, public-link, dashboard-definition, dashboard-daily-report, run, artifact, and dashboard/BI data commands are curated capability-gateway commands. Use `ae-cli analysis <resource> <action>` after reading [`references/analysis_gateway_assets.md`](references/analysis_gateway_assets.md). Project-space and folder create/delete/share are L3 only; use `ae-cli capability ...` after reading the matching reference. `*.members` read capabilities use L3 dynamic discovery via the gateway matrix (no standalone reference). Do not use old `+` dashboard/space/BI/public-link command names.
 
 Model Analysis (17):
 - `+build_event_analysis_qp` ([doc](references/build_event_analysis_qp.md))
@@ -539,6 +557,7 @@ Entity Catalog (2):
 
 ```bash
 ae-cli analysis --help
+ae-cli analysis-meta --help
 ae-cli analysis_audience --help
 ae-cli analysis_meta --help
 ae-cli analysis_common --help
@@ -550,4 +569,4 @@ npm run verify:analysis-common-tools
 
 ## Reference Docs
 
-See the unified `references/` directory (126 command docs total).
+See the unified `references/` directory (124 command docs total).

package/skills/ae-analysis/references/analysis_gateway_assets.md

@@ -10,7 +10,7 @@ ae-cli analysis <resource> <action> [options]
 
 Flags use kebab-case. The gateway input JSON uses snake_case. Do not pass camelCase flags or payload keys unless a nested backend DTO explicitly requires them inside `--payload`.
 
-This file is an overview only. Before running one command, read the dedicated command reference named `references/<resource>_<action>.md` with hyphens converted to underscores, for example `dashboard_report_data_export.md`.
+This file is an overview only. Before running an L2 command, read the dedicated command reference named `references/<resource>_<action>.md` with hyphens converted to underscores, for example `dashboard_report_data_export.md`. L3 capabilities without a dedicated reference use dynamic discovery per [`ae-capability`](../../ae-capability/SKILL.md) and the L3 section below.
 
 ## When to use
 
@@ -104,14 +104,6 @@ Prefer the run/artifact commands over hand-written HTTP, Python, or curl. The de
 | `bi-panel-page-data export` | `analysis.bi_panel_page_data.export` | Large/long BI page data | same as run, optional `--artifact-format jsonl` | Async artifact descriptor |
 | `project-space list` | `analysis.project_space.list` | Find accessible project spaces | `--project-id`, optional list filters | Paginated project spaces |
 | `project-space get` | `analysis.project_space.get` | Inspect one project space | `--project-id`, `--space-id` | Project space detail |
-| `project-space create` | `analysis.project_space.create` | Create a project space; `avatar_type` defaults to 1 when omitted | `--space-name` or `--payload` | Created space |
-| `project-space delete` | `analysis.project_space.delete` | Delete project spaces | `--space-id` or `--space-ids` | Delete result |
-| `project-space share` | `analysis.project_space.share` | Modify project-space members | `--space-id`, `--payload` | Share update result |
-| `project-space members` | `analysis.project_space.members` | Read project-space members | `--space-id` | Members |
-| `folder create` | `analysis.folder.create` | Create personal/project-space folder | `--folder-name`, optional `--space-id`, `--parent-folder-id` | Created folder |
-| `folder delete` | `analysis.folder.delete` | Delete folders | `--folder-id` or `--folder-ids`, optional `--space-id` | Delete result |
-| `folder share` | `analysis.folder.share` | Modify folder members | `--folder-id`, `--payload` | Share update result |
-| `folder members` | `analysis.folder.members` | Read folder members | `--folder-id` | Members |
 | `favorite add` | `analysis.favorite.add` | Favorite dashboard/BI/folder | `--asset-id`, `--asset-type`, optional `--payload` | Favorite result |
 | `favorite remove` | `analysis.favorite.remove` | Remove favorite | same as add | Remove result |
 | `public-link create` | `analysis.public_link.create` | Generate public link | `--resource-type`, `--resource-id`, `--effective-at`, `--expires-at` | Link result |
@@ -120,6 +112,47 @@ Prefer the run/artifact commands over hand-written HTTP, Python, or curl. The de
 | `public-link offline` | `analysis.public_link.offline` | Take links offline | `--link-id` or `--link-ids` | Offline result |
 | `public-link delete` | `analysis.public_link.delete` | Delete public links | `--link-id` or `--link-ids` | Delete result |
 
+## L3 project-space and folder capabilities
+
+Per [`capability-command-admission` §10](../../../docs/capability-command-admission.md): new gateway capabilities default to **dynamic discovery** (`capability search` → `inspect` → `dry-run` → `run`); standalone skill references are **exceptions only** (L2 bar, confusion, high-risk delete, multi-step orchestration).
+
+For **create / delete / share**, read the linked reference before `capability inspect/dry-run/run`. For **`*.members` read**, use this matrix only — no separate `references/*.md` (pilot).
+
+| Capability ID | Use for | Reference / discovery |
+| --- | --- | --- |
+| `analysis.project_space.create` | Create a project space | [`project_space_create.md`](project_space_create.md) |
+| `analysis.project_space.delete` | Delete project spaces | [`project_space_delete.md`](project_space_delete.md) |
+| `analysis.project_space.share` | Modify project-space members | [`project_space_share.md`](project_space_share.md) |
+| `analysis.project_space.members` | Read project-space members | Matrix only (see below) |
+| `analysis.folder.create` | Create personal/project-space folder | [`folder_create.md`](folder_create.md) |
+| `analysis.folder.delete` | Delete folders | [`folder_delete.md`](folder_delete.md) |
+| `analysis.folder.share` | Modify folder members | [`folder_share.md`](folder_share.md) |
+| `analysis.folder.members` | Read folder members | Matrix only (see below) |
+
+### L3 members (matrix-only pilot)
+
+Read-only member lists; `risk=read`. Do not use to modify members — use the matching `*.share` capability.
+
+**When to use:** inspect who has access to a project space or folder.
+
+**When not to use:** modify members → `analysis.project_space.share` or `analysis.folder.share`.
+
+```bash
+ae-cli capability inspect analysis.project_space.members
+ae-cli capability run analysis.project_space.members --input '{"project_id":1,"space_id":10}'
+
+ae-cli capability inspect analysis.folder.members
+ae-cli capability run analysis.folder.members --input '{"project_id":1,"folder_id":1001}'
+```
+
+| field | type | required | capability |
+| --- | --- | --- | --- |
+| `project_id` | integer | yes | both |
+| `space_id` | integer | yes | `project_space.members` |
+| `folder_id` | integer | yes | `folder.members` |
+
+Output is the gateway envelope; `data` contains members.
+
 ## Examples
 
 ```bash

package/skills/ae-analysis/references/asset_abnormal_get.md

@@ -1,4 +1,4 @@
-# analysis asset abnormal-get
+# analysis-meta asset abnormal-get
 
 Use when the user needs to get abnormal reason for one asset.
 
@@ -7,8 +7,8 @@ Do not use this command for unrelated analysis queries, ad-hoc query constructio
 Command:
 
 ```bash
-ae-cli analysis asset abnormal-get --project-id <project_id> --resource-type <resource_type> --resource-id <resource_id> --resource-name <resource_name> --table-type <table_type>
-ae-cli analysis asset abnormal-get --dry-run
+ae-cli analysis-meta asset abnormal-get --project-id <project_id> --resource-type <resource_type> --resource-id <resource_id> --resource-name <resource_name> --table-type <table_type>
+ae-cli analysis-meta asset abnormal-get --dry-run
 ```
 
 Capability id: `metadata.asset_abnormal.get`.

package/skills/ae-analysis/references/asset_abnormal_list.md

@@ -1,4 +1,4 @@
-# analysis asset abnormal-list
+# analysis-meta asset abnormal-list
 
 Use when the user needs to list abnormal assets by resource type.
 
@@ -7,8 +7,8 @@ Do not use this command for unrelated analysis queries, ad-hoc query constructio
 Command:
 
 ```bash
-ae-cli analysis asset abnormal-list --project-id <project_id> --resource-types <resource_types>
-ae-cli analysis asset abnormal-list --dry-run
+ae-cli analysis-meta asset abnormal-list --project-id <project_id> --resource-types <resource_types>
+ae-cli analysis-meta asset abnormal-list --dry-run
 ```
 
 Capability id: `metadata.asset_abnormal.list`.

package/skills/ae-analysis/references/asset_authentication_list.md

@@ -1,4 +1,4 @@
-# analysis asset authentication-list
+# analysis-meta asset authentication-list
 
 Use when the user needs to list authenticatable project assets and authentication status.
 
@@ -7,8 +7,8 @@ Do not use this command for unrelated analysis queries, ad-hoc query constructio
 Command:
 
 ```bash
-ae-cli analysis asset authentication-list --project-id <project_id>
-ae-cli analysis asset authentication-list --dry-run
+ae-cli analysis-meta asset authentication-list --project-id <project_id>
+ae-cli analysis-meta asset authentication-list --dry-run
 ```
 
 Capability id: `metadata.asset_authentication.list`.

package/skills/ae-analysis/references/asset_authentication_update.md

@@ -1,4 +1,4 @@
-# analysis asset authentication-update
+# analysis-meta asset authentication-update
 
 Use when the user needs to batch authenticate or unauthenticate assets.
 
@@ -7,8 +7,8 @@ Do not use this command for unrelated analysis queries, ad-hoc query constructio
 Command:
 
 ```bash
-ae-cli analysis asset authentication-update --project-id <project_id> --payload '{}'
-ae-cli analysis asset authentication-update --dry-run
+ae-cli analysis-meta asset authentication-update --project-id <project_id> --payload '{}'
+ae-cli analysis-meta asset authentication-update --dry-run
 ```
 
 Capability id: `metadata.asset_authentication.update`.