@thinkingai/ae-cli 6.0.37 → 6.0.39

package/dist/{te-analysis-IWQZO423.js → te-analysis-GJI5FZUL.js}

@@ -1,39 +1,69 @@
 import {
   createCapabilityCommand
-} from "./chunk-PVBYJWC2.js";
+} from "./chunk-7KQWSBSL.js";
 import {
   registerCapabilityGatewayRoute,
   resolveGatewayDomain
 } from "./chunk-PTE56QPL.js";
+import {
+  withOutputMetadata
+} from "./chunk-YTG6Q75E.js";
 import {
   CapabilityGatewayError,
   buildCapabilityGatewayUrl,
   dryRunCapability,
+  executeCapability,
   executeCapabilityWithEnvelope,
   fetchCapabilityGateway,
   requestCapabilityGateway,
   requestCapabilityGatewayWithEnvelope,
   uploadInputFile,
   validateCapability
-} from "./chunk-HQ2A7ITL.js";
+} from "./chunk-RBNKI5ZW.js";
+import "./chunk-Z3OXWCIA.js";
+import "./chunk-YV52FB5G.js";
+import "./chunk-GJJA4CQZ.js";
 import {
-  withOutputMetadata
-} from "./chunk-KTYR3U6D.js";
-import "./chunk-E7UXXHO3.js";
-import "./chunk-IR4ZLVPW.js";
-import "./chunk-V6FR6WTW.js";
-import "./chunk-24BAVOX3.js";
-import "./chunk-LYVNONC4.js";
+  CliValidationError
+} from "./chunk-AXDXJTPC.js";
+import "./chunk-JHENBQ5B.js";
 
 // src/commands/te-analysis/capability-shared.ts
+var ANALYSIS_GATEWAY_CLI_SERVICES = /* @__PURE__ */ new Set(["project", "system"]);
 var analysisDataRunRoutingHelp = "Routing: use run only for analysis data that fits <=1000 inline rows and <=180s; use export for full, unknown-size, >1000-row, or long-running data.";
 var analysisDataExportRoutingHelp = "Routing: use export for full, unknown-size, >1000-row, or long-running analysis data; inspect/download by run_id/artifact_id; use run only for <=1000-row inline previews.";
 function createAnalysisCapabilityCommand(config) {
+  const cliPath = resolveAnalysisGatewayCliPath(config);
   return createCapabilityCommand({
     ...config,
-    cliService: "analysis"
+    ...cliPath,
+    gatewayDomain: "analysis"
   });
 }
+function resolveAnalysisGatewayCliPath(config) {
+  const [capabilityService, capabilityResource, capabilityAction, ...extraSegments] = config.capabilityId.split(".");
+  if (!ANALYSIS_GATEWAY_CLI_SERVICES.has(capabilityService)) {
+    return {
+      cliService: "analysis",
+      resource: config.resource,
+      command: config.command
+    };
+  }
+  if (!capabilityResource || !capabilityAction || extraSegments.length > 0) {
+    throw new Error(
+      `Capability '${config.capabilityId}' must have exactly three segments for direct CLI registration.`
+    );
+  }
+  const resource = capabilityResource.replaceAll("_", "-");
+  const command = capabilityAction.replaceAll("_", "-");
+  const expectedLegacyResource = `${capabilityService} ${resource}`;
+  if (config.resource !== expectedLegacyResource || config.command !== command) {
+    throw new Error(
+      `Capability '${config.capabilityId}' must map to ae-cli ${capabilityService} ${resource} ${command}.`
+    );
+  }
+  return { cliService: capabilityService, resource, command };
+}
 function createAnalysisMetaCapabilityCommand(config) {
   return createCapabilityCommand({
     ...config,
@@ -5038,6 +5068,43 @@ var commands47 = [
 ];
 var function_default = commands47;
 
+// src/commands/te-analysis/project/info/create.ts
+var projectInfoCreate = createAnalysisCapabilityCommand({
+  resource: "project info",
+  command: "create",
+  capabilityId: "project.info.create",
+  description: "Create a project without exposing unsupported avatar fields.",
+  flags: [
+    { name: "company-id", type: "number", required: true, min: 1, desc: "Company ID." },
+    { name: "project-name", type: "string", required: true, minLength: 1, maxLength: 80, desc: "Project name." },
+    { name: "load-history", type: "boolean", required: false, desc: "Load historical data. Default: false." },
+    { name: "owner-user-id", type: "number", required: false, min: 1, desc: "Optional owner user ID." },
+    { name: "project-remark", type: "string", required: false, maxLength: 200, desc: "Optional project remark." }
+  ],
+  risk: "write",
+  buildInput: (ctx) => compactInput({
+    company_id: ctx.num("company-id"),
+    project_name: ctx.str("project-name"),
+    load_history: ctx.str("load-history") === "" ? false : ctx.bool("load-history"),
+    owner_user_id: optionalNumber(ctx, "owner-user-id"),
+    project_remark: optionalString(ctx, "project-remark")
+  })
+});
+
+// src/commands/te-analysis/project/info/delete.ts
+var projectInfoDelete = createAnalysisCapabilityCommand({
+  resource: "project info",
+  command: "delete",
+  capabilityId: "project.info.delete",
+  description: "Delete a project and flush its receiver cache.",
+  flags: [projectIdFlag],
+  risk: "high-risk-write",
+  buildInput: (ctx) => compactInput({
+    project_id: ctx.num("project-id"),
+    yes: true
+  })
+});
+
 // src/commands/te-analysis/project/info/get.ts
 var projectInfoGet = createAnalysisCapabilityCommand({
   resource: "project info",
@@ -5095,6 +5162,8 @@ var projectInfoUpdate = createAnalysisCapabilityCommand({
 
 // src/commands/te-analysis/project/info/index.ts
 var commands48 = [
+  projectInfoCreate,
+  projectInfoDelete,
   projectInfoGet,
   projectInfoList,
   projectInfoUpdate
@@ -5860,6 +5929,24 @@ var dataTypeFlag = {
   required: false,
   desc: "Live data type: normal (default) or error."
 };
+var debugDeviceIdFlag = {
+  name: "device-id",
+  type: "string",
+  required: true,
+  desc: "Debug device ID reported by the SDK as #device_id."
+};
+var debugDeviceNameFlag = {
+  name: "device-name",
+  type: "string",
+  required: true,
+  desc: "Human-readable name for the Debug device."
+};
+var eventNameFlag = {
+  name: "event-name",
+  type: "string",
+  required: false,
+  desc: "Optional event name filter."
+};
 var eventNamesFlag = {
   name: "event-names",
   type: "json",
@@ -6086,6 +6173,323 @@ var trackingPlanSyncFromMeta = createTrackingCapabilityCommand({
   buildInput: projectInput2
 });
 
+// src/commands/te-analysis/tracking/plan/sync-display-names.ts
+import { existsSync as existsSync3 } from "fs";
+import { readFile } from "fs/promises";
+
+// src/tracking/plan/display-name-sync.ts
+function buildDisplayNameSyncPlan(draft, metadata) {
+  return {
+    event: buildGroup(
+      "event",
+      eventDefinitions(draft.events),
+      existingDefinitions(metadata.events, "event_name", "event_desc")
+    ),
+    event_property: buildGroup(
+      "event_property",
+      propertyDefinitions([
+        ...draft.common_event_properties,
+        ...draft.event_properties
+      ]),
+      existingDefinitions(metadata.eventProperties, "prop_name", "prop_desc")
+    ),
+    user_property: buildGroup(
+      "user_property",
+      propertyDefinitions(draft.user_properties),
+      existingDefinitions(metadata.userProperties, "prop_name", "prop_desc")
+    )
+  };
+}
+function assertTrackingDraft(value) {
+  if (!isRecord(value)) {
+    throw new Error("Tracking draft must be a JSON object.");
+  }
+  for (const field of [
+    "events",
+    "event_properties",
+    "common_event_properties",
+    "user_properties"
+  ]) {
+    if (!Array.isArray(value[field])) {
+      throw new Error(`Tracking draft field "${field}" must be an array.`);
+    }
+  }
+}
+function eventDefinitions(events) {
+  return definitions(
+    events.map((event) => ({
+      name: event.event_name,
+      displayName: event.display_name
+    })),
+    "event"
+  );
+}
+function propertyDefinitions(properties) {
+  return definitions(
+    properties.map((property) => ({
+      name: property.name,
+      displayName: property.display_name
+    })),
+    "property"
+  );
+}
+function definitions(candidates, kind) {
+  const byName = /* @__PURE__ */ new Map();
+  const missing = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    const name = nonEmptyString(candidate.name);
+    if (!name) continue;
+    const displayName = nonEmptyString(candidate.displayName);
+    if (!displayName) {
+      if (!byName.has(name)) missing.add(name);
+      continue;
+    }
+    const previous = byName.get(name);
+    if (previous && previous !== displayName) {
+      throw new Error(
+        `Tracking draft maps ${kind} "${name}" to conflicting display names: "${previous}" and "${displayName}".`
+      );
+    }
+    byName.set(name, displayName);
+    missing.delete(name);
+  }
+  return {
+    definitions: [...byName.entries()].map(([name, displayName]) => ({
+      name,
+      displayName
+    })),
+    missing: [...missing]
+  };
+}
+function existingDefinitions(value, nameField, displayNameField) {
+  if (!Array.isArray(value)) return [];
+  const rows = [];
+  for (const item of value) {
+    if (!isRecord(item)) continue;
+    const name = nonEmptyString(item[nameField]);
+    if (!name) continue;
+    rows.push({
+      name,
+      displayName: nonEmptyString(item[displayNameField])
+    });
+  }
+  return rows;
+}
+function buildGroup(type, source, existing) {
+  const existingByName = new Map(
+    existing.map((item) => [item.name, item.displayName])
+  );
+  const items = [];
+  const skippedExisting = [];
+  const missingInMetadata = [];
+  for (const definition of source.definitions) {
+    if (!existingByName.has(definition.name)) {
+      missingInMetadata.push(definition.name);
+      continue;
+    }
+    if (existingByName.get(definition.name)) {
+      skippedExisting.push(definition.name);
+      continue;
+    }
+    items.push(
+      type === "event" ? { event_name: definition.name, event_desc: definition.displayName } : { prop_name: definition.name, prop_desc: definition.displayName }
+    );
+  }
+  return {
+    type,
+    items,
+    skippedExisting,
+    missingInMetadata,
+    missingInDraft: source.missing
+  };
+}
+function nonEmptyString(value) {
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : void 0;
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/commands/te-analysis/tracking/plan/sync-display-names.ts
+var GATEWAY_DOMAIN = "analysis";
+var LIST_CAPABILITIES = {
+  events: "metadata.event.list",
+  eventProperties: "metadata.property.list",
+  userProperties: "metadata.property.list"
+};
+var EDIT_CAPABILITY = "metadata.super_metadata.batch_edit";
+var MAX_BATCH_SIZE = 200;
+var trackingPlanSyncDisplayNames = {
+  service: "tracking",
+  resource: "plan",
+  command: "sync-display-names",
+  description: "Fill blank event and property metadata display names from a local tracking-plan draft. Existing non-empty display names are never overwritten.",
+  flags: [
+    projectIdFlag,
+    {
+      name: "draft",
+      type: "string",
+      required: true,
+      desc: "Local tracking-plan draft.json containing event/property display_name values."
+    }
+  ],
+  risk: "write",
+  validate: (ctx) => {
+    if (!existsSync3(ctx.str("draft"))) {
+      throw new Error(
+        "--draft must reference a readable tracking-plan JSON file."
+      );
+    }
+  },
+  dryRun: async (ctx) => {
+    const draft = await readDraft(ctx.str("draft"));
+    return {
+      project_id: ctx.num("project-id"),
+      draft: ctx.str("draft"),
+      source_counts: sourceCounts(draft),
+      behavior: "Fill blank metadata display names only; preserve all existing non-empty display names.",
+      steps: [
+        ...Object.values(LIST_CAPABILITIES).map((capabilityId) => ({
+          method: "POST",
+          url: buildCapabilityGatewayUrl(
+            ctx.host(),
+            GATEWAY_DOMAIN,
+            `capabilities/${capabilityId}/execute`
+          )
+        })),
+        {
+          method: "POST",
+          url: buildCapabilityGatewayUrl(
+            ctx.host(),
+            GATEWAY_DOMAIN,
+            `capabilities/${EDIT_CAPABILITY}/execute`
+          ),
+          note: "Called only for non-empty update groups, in batches of at most 200 items."
+        }
+      ]
+    };
+  },
+  execute: async (ctx) => {
+    const projectId = ctx.num("project-id");
+    const draftPath = ctx.str("draft");
+    const draft = await readDraft(draftPath);
+    const [eventResult, eventPropertyResult, userPropertyResult] = await Promise.all([
+      executeCapability(
+        ctx.host(),
+        GATEWAY_DOMAIN,
+        LIST_CAPABILITIES.events,
+        {
+          project_id: projectId,
+          fields: ["event_name", "event_desc"]
+        }
+      ),
+      executeCapability(
+        ctx.host(),
+        GATEWAY_DOMAIN,
+        LIST_CAPABILITIES.eventProperties,
+        {
+          project_id: projectId,
+          table_type: "event",
+          fields: ["prop_name", "prop_desc"]
+        }
+      ),
+      executeCapability(
+        ctx.host(),
+        GATEWAY_DOMAIN,
+        LIST_CAPABILITIES.userProperties,
+        {
+          project_id: projectId,
+          table_type: "user",
+          fields: ["prop_name", "prop_desc"]
+        }
+      )
+    ]);
+    const plan = buildDisplayNameSyncPlan(draft, {
+      events: eventResult?.events,
+      eventProperties: eventPropertyResult?.properties,
+      userProperties: userPropertyResult?.properties
+    });
+    const updateResults = {};
+    for (const group of Object.values(plan)) {
+      updateResults[group.type] = await executeUpdates(ctx, projectId, group);
+    }
+    return {
+      project_id: projectId,
+      draft: draftPath,
+      policy: "blank_only",
+      updated: counts(plan, (group) => group.items.length),
+      skipped_existing: counts(plan, (group) => group.skippedExisting.length),
+      missing_in_metadata: counts(
+        plan,
+        (group) => group.missingInMetadata.length
+      ),
+      missing_display_name_in_draft: counts(
+        plan,
+        (group) => group.missingInDraft.length
+      ),
+      details: {
+        missing_in_metadata: Object.fromEntries(
+          Object.values(plan).map((group) => [
+            group.type,
+            group.missingInMetadata
+          ])
+        ),
+        missing_display_name_in_draft: Object.fromEntries(
+          Object.values(plan).map((group) => [
+            group.type,
+            group.missingInDraft
+          ])
+        )
+      },
+      batches: updateResults
+    };
+  }
+};
+async function readDraft(filePath) {
+  let value;
+  try {
+    value = JSON.parse(await readFile(filePath, "utf8"));
+  } catch (error) {
+    throw new Error(
+      `Unable to read tracking draft "${filePath}": ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  assertTrackingDraft(value);
+  return value;
+}
+async function executeUpdates(ctx, projectId, group) {
+  const results = [];
+  for (let offset = 0; offset < group.items.length; offset += MAX_BATCH_SIZE) {
+    const items = group.items.slice(offset, offset + MAX_BATCH_SIZE);
+    results.push(
+      await executeCapability(ctx.host(), GATEWAY_DOMAIN, EDIT_CAPABILITY, {
+        project_id: projectId,
+        type: group.type,
+        items
+      })
+    );
+  }
+  return results;
+}
+function sourceCounts(draft) {
+  return {
+    event: draft.events.length,
+    event_property: new Set(
+      [...draft.common_event_properties, ...draft.event_properties].map(
+        (property) => property.name
+      )
+    ).size,
+    user_property: draft.user_properties.length
+  };
+}
+function counts(plan, value) {
+  return Object.fromEntries(
+    Object.values(plan).map((group) => [group.type, value(group)])
+  );
+}
+
 // src/commands/te-analysis/tracking/plan/index.ts
 var commands63 = [
   trackingPlanGet,
@@ -6094,7 +6498,8 @@ var commands63 = [
   trackingPlanGenerate,
   trackingPlanExport,
   trackingPlanImportExcel,
-  trackingPlanSyncFromMeta
+  trackingPlanSyncFromMeta,
+  trackingPlanSyncDisplayNames
 ];
 var plan_default = commands63;
 
@@ -6329,8 +6734,116 @@ var commands70 = [
 ];
 var event_blacklist_default = commands70;
 
-// src/commands/te-analysis/tracking/index.ts
+// src/commands/te-analysis/tracking/debug-device/add.ts
+var trackingDebugDeviceAdd = createTrackingCapabilityCommand({
+  resource: "debug-device",
+  command: "add",
+  capabilityId: "tracking.debug_device.add",
+  description: "Create or update a Debug device for an AE project.",
+  flags: [projectIdFlag, debugDeviceIdFlag, debugDeviceNameFlag],
+  risk: "write",
+  buildInput: (ctx) => ({
+    ...projectInput2(ctx),
+    device_id: ctx.str("device-id"),
+    device_name: ctx.str("device-name")
+  })
+});
+
+// src/commands/te-analysis/tracking/debug-device/list.ts
+var trackingDebugDeviceList = createTrackingCapabilityCommand({
+  resource: "debug-device",
+  command: "list",
+  capabilityId: "tracking.debug_device.list",
+  description: "List Debug devices and the device selected by the current CLI user.",
+  flags: [projectIdFlag],
+  risk: "read",
+  buildInput: projectInput2
+});
+
+// src/commands/te-analysis/tracking/debug-device/select.ts
+var trackingDebugDeviceSelect = createTrackingCapabilityCommand({
+  resource: "debug-device",
+  command: "select",
+  capabilityId: "tracking.debug_device.select",
+  description: "Select the active Debug device for the current CLI user.",
+  flags: [projectIdFlag, debugDeviceIdFlag],
+  risk: "write",
+  buildInput: (ctx) => ({
+    ...projectInput2(ctx),
+    device_id: ctx.str("device-id")
+  })
+});
+
+// src/commands/te-analysis/tracking/debug-device/index.ts
 var commands71 = [
+  trackingDebugDeviceList,
+  trackingDebugDeviceAdd,
+  trackingDebugDeviceSelect
+];
+var debug_device_default = commands71;
+
+// src/commands/te-analysis/tracking/debug-data/list.ts
+var debugStartTimeFlag = {
+  name: "start-time",
+  type: "string",
+  required: false,
+  desc: "Query start time in YYYY-MM-DD HH:mm:ss local time. Defaults to one hour ago."
+};
+var trackingDebugDataList = createTrackingCapabilityCommand({
+  resource: "debug-data",
+  command: "list",
+  capabilityId: "tracking.debug_data.list",
+  description: "List Debug data received from one device.",
+  flags: [projectIdFlag, debugDeviceIdFlag, debugStartTimeFlag, eventNameFlag],
+  risk: "read",
+  buildInput: (ctx) => compactInput({
+    ...projectInput2(ctx),
+    device_id: ctx.str("device-id"),
+    start_time: optionalString(ctx, "start-time") ?? formatLocalTime(new Date(Date.now() - 60 * 60 * 1e3)),
+    event_name: optionalString(ctx, "event-name")
+  }),
+  postProcess: (result, input) => {
+    const data = isRecord2(result) ? result : {};
+    const eventList = Array.isArray(data.event_list) ? data.event_list : [];
+    const deviceDataList = Array.isArray(data.device_data_list) ? data.device_data_list : [];
+    return {
+      device_id: input.device_id,
+      start_time: input.start_time,
+      ...input.event_name ? { event_name: input.event_name } : {},
+      has_data: deviceDataList.length > 0,
+      event_count: eventList.length,
+      data_count: deviceDataList.length,
+      event_list: eventList,
+      device_data_list: deviceDataList
+    };
+  }
+});
+function formatLocalTime(value) {
+  const pad = (part) => String(part).padStart(2, "0");
+  return [
+    value.getFullYear(),
+    "-",
+    pad(value.getMonth() + 1),
+    "-",
+    pad(value.getDate()),
+    " ",
+    pad(value.getHours()),
+    ":",
+    pad(value.getMinutes()),
+    ":",
+    pad(value.getSeconds())
+  ].join("");
+}
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/commands/te-analysis/tracking/debug-data/index.ts
+var commands72 = [trackingDebugDataList];
+var debug_data_default = commands72;
+
+// src/commands/te-analysis/tracking/index.ts
+var commands73 = [
   ...plan_default,
   ...sdk_sample_default,
   ...plan_change_log_default,
@@ -6338,9 +6851,11 @@ var commands71 = [
   ...ingest_default,
   ...ingest_error_default,
   ...live_data_default,
-  ...event_blacklist_default
+  ...event_blacklist_default,
+  ...debug_device_default,
+  ...debug_data_default
 ];
-var tracking_default = commands71;
+var tracking_default = commands73;
 
 // src/commands/te-analysis/alert/shared.ts
 var alertIdFlag = {
@@ -6460,7 +6975,7 @@ var analysisAlertStop = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/alert/index.ts
-var commands72 = [
+var commands74 = [
   analysisAlertList,
   analysisAlertGet,
   analysisAlertCreate,
@@ -6469,7 +6984,7 @@ var commands72 = [
   analysisAlertStart,
   analysisAlertStop
 ];
-var alert_default = commands72;
+var alert_default = commands74;
 
 // src/commands/te-analysis/alert-detail/list.ts
 var analysisAlertDetailList = createAnalysisCapabilityCommand({
@@ -6483,10 +6998,10 @@ var analysisAlertDetailList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/alert-detail/index.ts
-var commands73 = [
+var commands75 = [
   analysisAlertDetailList
 ];
-var alert_detail_default = commands73;
+var alert_detail_default = commands75;
 
 // src/commands/te-analysis/alert-job/list.ts
 var analysisAlertJobList = createAnalysisCapabilityCommand({
@@ -6500,10 +7015,10 @@ var analysisAlertJobList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/alert-job/index.ts
-var commands74 = [
+var commands76 = [
   analysisAlertJobList
 ];
-var alert_job_default = commands74;
+var alert_job_default = commands76;
 
 // src/commands/te-analysis/alert-notice-config/list.ts
 var analysisAlertNoticeConfigList = createAnalysisCapabilityCommand({
@@ -6517,13 +7032,1083 @@ var analysisAlertNoticeConfigList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/alert-notice-config/index.ts
-var commands75 = [
+var commands77 = [
   analysisAlertNoticeConfigList
 ];
-var alert_notice_config_default = commands75;
+var alert_notice_config_default = commands77;
+
+// src/commands/te-analysis/system/shared.ts
+import { readFileSync, statSync as statSync2 } from "fs";
+var secretValues = /* @__PURE__ */ new WeakMap();
+var companyIdField = {
+  flag: "company-id",
+  input: "company_id",
+  type: "number",
+  required: true,
+  min: 1,
+  desc: "Company ID."
+};
+var queryField = {
+  flag: "query",
+  type: "string",
+  desc: "Optional keyword filter."
+};
+var limitField = {
+  flag: "limit",
+  type: "number",
+  min: 1,
+  max: 200,
+  desc: "Page size. Default and maximum depend on the capability schema."
+};
+var offsetField = {
+  flag: "offset",
+  type: "number",
+  min: 0,
+  desc: "Zero-based result offset."
+};
+var fieldsField = {
+  flag: "fields",
+  type: "json",
+  array: true,
+  desc: "Optional snake_case result field projection JSON array."
+};
+function defineSystemCommand(spec) {
+  const fields = [companyIdField, ...spec.fields ?? []];
+  const secrets = spec.secrets ?? [];
+  return createAnalysisCapabilityCommand({
+    resource: `system ${spec.resource}`,
+    command: spec.command,
+    capabilityId: spec.capabilityId,
+    description: spec.description,
+    flags: [
+      ...fields.map(fieldFlag),
+      ...secrets.flatMap(secretFlags)
+    ],
+    risk: spec.risk,
+    validate: (ctx) => {
+      validateSecretSources(ctx, secrets);
+      const input = buildSystemInput(ctx, fields, [], spec.risk);
+      for (const secret of secrets) {
+        if (ctx.str(`${secret.flag}-file`) || ctx.bool(`${secret.flag}-stdin`)) {
+          input[secret.input] = "<provided>";
+        }
+      }
+      validateFields(fields, input);
+      spec.validate?.(ctx, input);
+    },
+    buildInput: (ctx) => {
+      const input = buildSystemInput(ctx, fields, secrets, spec.risk);
+      validateFields(fields, input);
+      validateSecretSources(ctx, secrets);
+      spec.validate?.(ctx, input);
+      return input;
+    }
+  });
+}
+function fieldFlag(field) {
+  return {
+    name: field.flag,
+    type: field.type,
+    required: field.required,
+    desc: field.desc,
+    min: field.min,
+    max: field.max,
+    pattern: field.pattern
+  };
+}
+function secretFlags(secret) {
+  const requirement = secret.required ? ` One of --${secret.flag}-file or --${secret.flag}-stdin is required.` : "";
+  return [
+    {
+      name: `${secret.flag}-file`,
+      type: "string",
+      required: false,
+      desc: `${secret.desc} Read from a local permission-protected file; the value is never accepted directly on argv.${requirement}`
+    },
+    {
+      name: `${secret.flag}-stdin`,
+      type: "boolean",
+      required: false,
+      sensitive: true,
+      desc: `${secret.desc} Read from stdin; do not combine with --${secret.flag}-file.${requirement}`
+    }
+  ];
+}
+function buildSystemInput(ctx, fields, secrets, risk) {
+  const input = {};
+  for (const field of fields) {
+    const value = fieldValue(ctx, field);
+    if (value !== void 0) input[field.input ?? kebabToSnake(field.flag)] = value;
+  }
+  for (const secret of secrets) {
+    const value = secretValue(ctx, secret);
+    if (value !== void 0) input[secret.input] = secret.transform ? secret.transform(value) : value;
+  }
+  if (risk === "high-risk-write") input.yes = true;
+  return compactInput(input);
+}
+function fieldValue(ctx, field) {
+  const raw = ctx.str(field.flag);
+  if (raw === "") return void 0;
+  if (field.type === "string") return raw;
+  if (field.type === "number") return Number(raw);
+  if (field.type === "boolean") return ctx.bool(field.flag);
+  return ctx.json(field.flag);
+}
+function validateFields(fields, input) {
+  for (const field of fields) {
+    const inputName = field.input ?? kebabToSnake(field.flag);
+    const value = input[inputName];
+    if (field.required && value === void 0) {
+      throw validation(`--${field.flag} is required.`);
+    }
+    if (value === void 0) continue;
+    if (field.array && !Array.isArray(value)) {
+      throw validation(`--${field.flag} must be a JSON array.`);
+    }
+    if (field.allowed && !field.allowed.includes(value)) {
+      throw validation(`--${field.flag} must be one of: ${field.allowed.join(", ")}.`);
+    }
+  }
+}
+function validateSecretSources(ctx, secrets) {
+  let stdinSources = 0;
+  for (const secret of secrets) {
+    const file = ctx.str(`${secret.flag}-file`);
+    const stdin = ctx.bool(`${secret.flag}-stdin`);
+    if (file && stdin) {
+      throw validation(`Use only one of --${secret.flag}-file and --${secret.flag}-stdin.`);
+    }
+    if (secret.required && !file && !stdin) {
+      throw validation(`Provide --${secret.flag}-file or --${secret.flag}-stdin.`);
+    }
+    if (stdin) stdinSources += 1;
+  }
+  if (stdinSources > 1) {
+    throw validation("Only one secret value may be read from stdin in a single invocation; use protected files for the others.");
+  }
+}
+function secretValue(ctx, secret) {
+  let values = secretValues.get(ctx);
+  if (!values) {
+    values = /* @__PURE__ */ new Map();
+    secretValues.set(ctx, values);
+  }
+  if (values.has(secret.flag)) {
+    return values.get(secret.flag);
+  }
+  let value;
+  const file = ctx.str(`${secret.flag}-file`);
+  if (file) {
+    const stat = statSync2(file);
+    if (!stat.isFile()) throw validation(`--${secret.flag}-file must reference a regular file.`);
+    if ((stat.mode & 63) !== 0) {
+      throw validation(`--${secret.flag}-file must not be readable or writable by group/others (use chmod 600).`);
+    }
+    value = nonEmptySecret(readFileSync(file, "utf8"), secret.flag);
+  } else if (ctx.bool(`${secret.flag}-stdin`)) {
+    value = nonEmptySecret(readFileSync(0, "utf8"), secret.flag);
+  }
+  values.set(secret.flag, value);
+  return value;
+}
+function nonEmptySecret(value, flag) {
+  const normalized = value.replace(/\r?\n$/, "");
+  if (normalized.length === 0) throw validation(`Secret input for --${flag} must not be empty.`);
+  return normalized;
+}
+function requireAtLeastOne(input, names, message) {
+  const present = names.some((name) => {
+    const value = input[name];
+    return Array.isArray(value) ? value.length > 0 : value !== void 0 && value !== "";
+  });
+  if (!present) throw validation(message);
+}
+function requireArrayObjects(input, name, requiredKeys) {
+  const value = input[name];
+  if (value === void 0) return;
+  if (!Array.isArray(value)) throw validation(`${snakeToFlag(name)} must be a JSON array.`);
+  value.forEach((item, index) => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) {
+      throw validation(`${snakeToFlag(name)} item ${index + 1} must be an object.`);
+    }
+    for (const key of requiredKeys) {
+      if (!(key in item)) {
+        throw validation(`${snakeToFlag(name)} item ${index + 1} is missing ${key}.`);
+      }
+    }
+  });
+}
+function validation(message) {
+  return new CliValidationError(message, { code: "INVALID_SYSTEM_CAPABILITY_INPUT" });
+}
+function kebabToSnake(value) {
+  return value.replaceAll("-", "_");
+}
+function snakeToFlag(value) {
+  return `--${value.replaceAll("_", "-")}`;
+}
+
+// src/commands/te-analysis/system/configuration.ts
+var addressUrl = { flag: "address-url", type: "string", required: true, desc: "Receiver address URL." };
+var addressType = {
+  flag: "address-type",
+  type: "string",
+  required: true,
+  desc: "Receiver address type.",
+  allowed: ["public", "private"]
+};
+var loginType = {
+  flag: "login-type",
+  type: "string",
+  required: true,
+  desc: "Third-party login type.",
+  allowed: ["wecom", "dingtalk", "feishu"]
+};
+var systemConfigurationCommands = [
+  defineSystemCommand({
+    resource: "preference",
+    command: "get",
+    capabilityId: "system.preference.get",
+    description: "Get typed company preferences exposed to CLI.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "preference",
+    command: "update",
+    capabilityId: "system.preference.update",
+    description: "Update typed company navigation preference.",
+    risk: "write",
+    fields: [
+      { flag: "navigation-permission-hide", type: "boolean", required: true, desc: "Hide navigation entries without permission." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "smtp",
+    command: "get",
+    capabilityId: "system.smtp.get",
+    description: "Get sanitized company SMTP configuration.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "smtp",
+    command: "upsert",
+    capabilityId: "system.smtp.upsert",
+    description: "Create or update company SMTP configuration using a protected password source.",
+    risk: "write",
+    fields: [
+      { flag: "server-host", type: "string", required: true, desc: "SMTP server host." },
+      { flag: "server-port", type: "number", required: true, min: 1, max: 65535, desc: "SMTP server port." },
+      { flag: "has-encrypt", type: "number", allowed: [0, 1, 2], desc: "Encryption mode: 0, 1, or 2." },
+      { flag: "sender-address", type: "string", required: true, desc: "Sender email address." },
+      { flag: "sender-name", type: "string", required: true, desc: "Sender display name." },
+      { flag: "subject-prefix", type: "string", desc: "Optional subject prefix." }
+    ],
+    secrets: [
+      { input: "password", flag: "password", required: true, desc: "SMTP password." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "smtp",
+    command: "test",
+    capabilityId: "system.smtp.test",
+    description: "Send one SMTP test using the saved configuration.",
+    risk: "write",
+    fields: [
+      { flag: "receiver", type: "string", required: true, desc: "Test email receiver." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "smtp",
+    command: "delete",
+    capabilityId: "system.smtp.delete",
+    description: "Delete company SMTP configuration.",
+    risk: "high-risk-write"
+  }),
+  defineSystemCommand({
+    resource: "receiver-address",
+    command: "overview",
+    capabilityId: "system.receiver_address.overview",
+    description: "Get company receiver-address overview.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "receiver-address",
+    command: "project-list",
+    capabilityId: "system.receiver_address.project_list",
+    description: "List project receiver-address overrides.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "receiver-address",
+    command: "upsert",
+    capabilityId: "system.receiver_address.upsert",
+    description: "Create or update a typed receiver address.",
+    risk: "write",
+    fields: [
+      { flag: "scope", type: "string", required: true, desc: "Receiver scope.", allowed: ["global", "project"] },
+      addressUrl,
+      addressType,
+      { flag: "project-ids", type: "json", array: true, desc: "Project ID JSON array; required for project scope." },
+      { flag: "original-address-url", type: "string", desc: "Original URL when changing an existing address." },
+      { flag: "original-address-type", type: "string", desc: "Original address type.", allowed: ["public", "private"] }
+    ],
+    validate: (_ctx, input) => {
+      if (input.scope === "project" && (!Array.isArray(input.project_ids) || input.project_ids.length === 0)) {
+        throw validation("--project-ids is required when --scope project.");
+      }
+    }
+  }),
+  defineSystemCommand({
+    resource: "receiver-address",
+    command: "promote",
+    capabilityId: "system.receiver_address.promote",
+    description: "Promote a receiver address to company scope.",
+    risk: "write",
+    fields: [
+      addressUrl,
+      addressType,
+      { flag: "remove-project-custom", type: "boolean", desc: "Remove matching project overrides after promotion." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "receiver-address",
+    command: "delete",
+    capabilityId: "system.receiver_address.delete",
+    description: "Delete a receiver address.",
+    risk: "high-risk-write",
+    fields: [addressUrl, addressType]
+  }),
+  defineSystemCommand({
+    resource: "receiver-detection",
+    command: "get",
+    capabilityId: "system.receiver_detection.get",
+    description: "Get receiver-address detection configuration.",
+    risk: "read",
+    fields: [addressUrl]
+  }),
+  defineSystemCommand({
+    resource: "receiver-detection",
+    command: "update",
+    capabilityId: "system.receiver_detection.update",
+    description: "Update typed receiver-address detection configuration.",
+    risk: "write",
+    fields: [
+      addressUrl,
+      { flag: "execute-type", type: "string", required: true, desc: "Detection execution scope.", allowed: ["ta_cluster", "all"] },
+      { flag: "schedule-type", type: "string", required: true, desc: "Detection schedule.", allowed: ["minutes", "hour", "day", "disabled"] },
+      { flag: "allow-notification", type: "boolean", required: true, desc: "Allow detection notifications." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "receiver-detection",
+    command: "run",
+    capabilityId: "system.receiver_detection.run",
+    description: "Run receiver-address detection now.",
+    risk: "write",
+    fields: [addressUrl]
+  }),
+  defineSystemCommand({
+    resource: "third-party-login",
+    command: "list",
+    capabilityId: "system.third_party_login.list",
+    description: "List sanitized third-party login configurations.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "third-party-login",
+    command: "upsert",
+    capabilityId: "system.third_party_login.upsert",
+    description: "Create or update a third-party login configuration using protected secret sources.",
+    risk: "write",
+    fields: [
+      loginType,
+      { flag: "app-id", type: "string", required: true, desc: "Provider application ID." },
+      { flag: "corp-id", type: "string", desc: "Provider corporation ID." },
+      { flag: "agent-id", type: "string", desc: "Provider agent ID." },
+      { flag: "dd-scan-app-id", type: "string", desc: "DingTalk scan-login application ID." }
+    ],
+    secrets: [
+      { input: "app_secret", flag: "app-secret", required: true, desc: "Provider application secret." },
+      { input: "dd_scan_app_secret", flag: "dd-scan-app-secret", desc: "DingTalk scan-login application secret." }
+    ],
+    validate: (_ctx, input) => {
+      if (input.login_type === "wecom" && !input.corp_id) {
+        throw validation("--corp-id is required for wecom.");
+      }
+      if (input.login_type === "dingtalk") {
+        requireAtLeastOne(input, ["corp_id"], "--corp-id is required for dingtalk.");
+        for (const name of ["agent_id", "dd_scan_app_id", "dd_scan_app_secret"]) {
+          if (!input[name]) throw validation(`--${name.replaceAll("_", "-")} is required for dingtalk.`);
+        }
+      }
+    }
+  }),
+  defineSystemCommand({
+    resource: "third-party-login",
+    command: "disable",
+    capabilityId: "system.third_party_login.disable",
+    description: "Disable a third-party login provider.",
+    risk: "high-risk-write",
+    fields: [loginType]
+  }),
+  defineSystemCommand({
+    resource: "oauth2",
+    command: "update",
+    capabilityId: "system.oauth2.update",
+    description: "Enable or disable company OAuth2 login.",
+    risk: "write",
+    fields: [
+      { flag: "enable-oauth2", type: "boolean", required: true, desc: "Target OAuth2 login state." }
+    ]
+  })
+];
+
+// src/commands/te-analysis/system/identity.ts
+var roleName = { flag: "role-name", type: "string", required: true, desc: "Role name." };
+var targetOpenId = { flag: "target-open-id", type: "string", required: true, desc: "Target member open ID." };
+var systemIdentityCommands = [
+  defineSystemCommand({
+    resource: "member",
+    command: "list",
+    capabilityId: "system.member.list",
+    description: "List company members.",
+    risk: "read",
+    fields: [queryField, limitField, offsetField]
+  }),
+  defineSystemCommand({
+    resource: "member-candidate",
+    command: "list",
+    capabilityId: "system.member_candidate.list",
+    description: "Resolve candidate company members by login name.",
+    risk: "read",
+    fields: [{ flag: "login-names", type: "json", required: true, array: true, desc: "Login-name JSON array." }]
+  }),
+  defineSystemCommand({
+    resource: "member",
+    command: "add",
+    capabilityId: "system.member.add",
+    description: "Add company members atomically.",
+    risk: "write",
+    fields: [
+      { flag: "members", type: "json", required: true, array: true, desc: "Member array with login_name and user_name." }
+    ],
+    validate: (_ctx, input) => {
+      requireAtLeastOne(input, ["members"], "Provide a non-empty --members array.");
+      requireArrayObjects(input, "members", ["login_name", "user_name"]);
+    }
+  }),
+  defineSystemCommand({
+    resource: "member",
+    command: "update",
+    capabilityId: "system.member.update",
+    description: "Update a company member display name.",
+    risk: "write",
+    fields: [
+      targetOpenId,
+      { flag: "user-name", type: "string", required: true, desc: "New display name." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "member-status",
+    command: "update",
+    capabilityId: "system.member_status.update",
+    description: "Lock or reactivate a company member.",
+    risk: "high-risk-write",
+    fields: [
+      targetOpenId,
+      { flag: "status", type: "string", required: true, desc: "Target status.", allowed: ["locked", "active"] }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "member-project",
+    command: "batch-update",
+    capabilityId: "system.member_project.batch_update",
+    description: "Batch update and remove a member project assignments.",
+    risk: "high-risk-write",
+    fields: [
+      targetOpenId,
+      { flag: "project-updates", type: "json", array: true, desc: "Project update array: project_id, role_names, and optional data_power_id." },
+      { flag: "project-removals", type: "json", array: true, desc: "Project removal and handover array." }
+    ],
+    validate: (_ctx, input) => {
+      requireAtLeastOne(input, ["project_updates", "project_removals"], "Provide a non-empty --project-updates or --project-removals array.");
+      requireArrayObjects(input, "project_updates", ["project_id", "role_names"]);
+      requireArrayObjects(input, "project_removals", ["project_id", "handover_type"]);
+    }
+  }),
+  defineSystemCommand({
+    resource: "member",
+    command: "delete",
+    capabilityId: "system.member.delete",
+    description: "Delete a company member after all project memberships and assets are cleared.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "target-user-id", type: "number", required: true, min: 1, desc: "Target member user ID." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "admin",
+    command: "list",
+    capabilityId: "system.admin.list",
+    description: "List company system administrators.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "admin",
+    command: "upsert",
+    capabilityId: "system.admin.upsert",
+    description: "Create or update company system-administrator assignments.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "admins", type: "json", required: true, array: true, desc: "Administrator array with target_user_id and function_names." }
+    ],
+    validate: (_ctx, input) => requireArrayObjects(input, "admins", ["target_user_id", "function_names"])
+  }),
+  defineSystemCommand({
+    resource: "admin-function",
+    command: "list",
+    capabilityId: "system.admin_function.list",
+    description: "List functions assigned to a system administrator.",
+    risk: "read",
+    fields: [targetOpenId]
+  }),
+  defineSystemCommand({
+    resource: "admin-function",
+    command: "update",
+    capabilityId: "system.admin_function.update",
+    description: "Replace functions assigned to a system administrator.",
+    risk: "high-risk-write",
+    fields: [
+      targetOpenId,
+      { flag: "function-names", type: "json", required: true, array: true, desc: "Complete function-name JSON array." }
+    ],
+    validate: (_ctx, input) => requireAtLeastOne(input, ["function_names"], "--function-names must contain at least one function.")
+  }),
+  defineSystemCommand({
+    resource: "admin",
+    command: "remove",
+    capabilityId: "system.admin.remove",
+    description: "Remove a company-scoped system administrator role.",
+    risk: "high-risk-write",
+    fields: [targetOpenId]
+  }),
+  defineSystemCommand({
+    resource: "role",
+    command: "list",
+    capabilityId: "system.role.list",
+    description: "List company roles.",
+    risk: "read",
+    fields: [queryField, limitField, offsetField]
+  }),
+  defineSystemCommand({
+    resource: "role",
+    command: "get",
+    capabilityId: "system.role.get",
+    description: "Get one company role.",
+    risk: "read",
+    fields: [roleName]
+  }),
+  defineSystemCommand({
+    resource: "role",
+    command: "upsert",
+    capabilityId: "system.role.upsert",
+    description: "Create or update a company role and its function set.",
+    risk: "high-risk-write",
+    fields: [
+      { ...roleName, required: false, desc: "Existing role name for update; omit when creating." },
+      { flag: "role-desc", type: "string", required: true, desc: "Role description." },
+      { flag: "function-names", type: "json", required: true, array: true, desc: "Complete function-name JSON array." }
+    ],
+    validate: (_ctx, input) => requireAtLeastOne(input, ["function_names"], "--function-names must contain at least one function.")
+  }),
+  defineSystemCommand({
+    resource: "role",
+    command: "delete",
+    capabilityId: "system.role.delete",
+    description: "Delete a company role and optionally migrate its users.",
+    risk: "high-risk-write",
+    fields: [
+      roleName,
+      { flag: "new-role-name", type: "string", desc: "Replacement role for affected users." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "role-function",
+    command: "list",
+    capabilityId: "system.role_function.list",
+    description: "List functions assigned to a company role.",
+    risk: "read",
+    fields: [roleName]
+  }),
+  defineSystemCommand({
+    resource: "role-user",
+    command: "list",
+    capabilityId: "system.role_user.list",
+    description: "List users assigned to a company role.",
+    risk: "read",
+    fields: [roleName]
+  }),
+  defineSystemCommand({
+    resource: "function",
+    command: "list",
+    capabilityId: "system.function.list",
+    description: "List company-level system functions available for role assignment.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "seat",
+    command: "list",
+    capabilityId: "system.seat.list",
+    description: "List company seat assignments.",
+    risk: "read",
+    fields: [
+      queryField,
+      limitField,
+      offsetField,
+      { flag: "seat-type", type: "string", desc: "Optional seat type.", allowed: ["manage", "view", "empty"] }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "seat",
+    command: "update",
+    capabilityId: "system.seat.update",
+    description: "Assign or remove BI seats under serialized company quota enforcement.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "seat-type", type: "string", required: true, desc: "Seat type; empty removes seats.", allowed: ["manage", "view", "empty"] },
+      { flag: "open-ids", type: "json", required: true, array: true, desc: "Company member open-ID JSON array." }
+    ],
+    validate: (_ctx, input) => requireAtLeastOne(input, ["open_ids"], "--open-ids must contain at least one company member.")
+  })
+];
+
+// src/commands/te-analysis/system/monitoring.ts
+var monitorScopeFields = [
+  { flag: "project-ids", type: "json", array: true, desc: "Project ID JSON array." },
+  { flag: "space-codes", type: "json", array: true, desc: "Project space-code JSON array." }
+];
+var monitorTimeFields = [
+  {
+    flag: "start-time",
+    type: "string",
+    required: true,
+    pattern: "^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$",
+    desc: "Inclusive query range start, yyyy-MM-dd HH:mm:ss."
+  },
+  {
+    flag: "end-time",
+    type: "string",
+    required: true,
+    pattern: "^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$",
+    desc: "Inclusive query range end, yyyy-MM-dd HH:mm:ss."
+  }
+];
+function validateTaskQueryInput(input) {
+  validateMonitorScope(input);
+  for (const name of ["status_codes", "content_codes", "task_type_codes"]) {
+    requireAtLeastOne(input, [name], `--${name.replaceAll("_", "-")} must be a non-empty JSON array.`);
+  }
+}
+function validateMonitorScope(input) {
+  requireAtLeastOne(
+    input,
+    ["project_ids", "space_codes"],
+    "Provide a non-empty --project-ids or --space-codes array."
+  );
+}
+var contactWebhookSecrets = [
+  { input: "dingding_webhook", flag: "dingding-webhook", desc: "DingTalk webhook." },
+  { input: "wechat_webhook", flag: "wechat-webhook", desc: "WeCom webhook." },
+  { input: "feishu_webhook", flag: "feishu-webhook", desc: "Feishu webhook." },
+  { input: "slack_webhook", flag: "slack-webhook", desc: "Slack webhook." },
+  { input: "kim_webhook", flag: "kim-webhook", desc: "KIM webhook." }
+];
+var systemMonitoringCommands = [
+  defineSystemCommand({
+    resource: "query-monitor",
+    command: "overview",
+    capabilityId: "system.query_monitor.overview",
+    description: "Get bounded query queue and resource-monitor charts.",
+    risk: "read",
+    fields: [
+      { flag: "duration-minutes", type: "number", min: 1, max: 1440, desc: "Monitoring duration in minutes. Default: 60." },
+      ...monitorScopeFields,
+      { flag: "cluster-names", type: "json", required: true, array: true, desc: "Query cluster-name JSON array." },
+      { flag: "point-interval-seconds", type: "number", min: 5, max: 300, desc: "Chart sample interval seconds. Default: 5." }
+    ],
+    validate: (_ctx, input) => validateMonitorScope(input)
+  }),
+  defineSystemCommand({
+    resource: "query-task",
+    command: "options",
+    capabilityId: "system.query_task.options",
+    description: "List valid query-task filter codes and cluster names before list or export.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "query-task",
+    command: "list",
+    capabilityId: "system.query_task.list",
+    description: "List query-monitor tasks; run query-task options first to discover filter codes.",
+    risk: "read",
+    fields: [
+      ...monitorTimeFields,
+      ...monitorScopeFields,
+      { flag: "status-codes", type: "json", required: true, array: true, desc: "Task status-code JSON array." },
+      { flag: "content-codes", type: "json", required: true, array: true, desc: "Query content-code JSON array." },
+      { flag: "task-type-codes", type: "json", required: true, array: true, desc: "Query task-type-code JSON array." },
+      { flag: "cluster-names", type: "json", array: true, desc: "Optional cluster-name JSON array." },
+      { flag: "limit", type: "number", min: 1, max: 1e3, desc: "Maximum returned tasks. Default: 100, max: 1000." },
+      offsetField,
+      fieldsField
+    ],
+    validate: (_ctx, input) => validateTaskQueryInput(input)
+  }),
+  defineSystemCommand({
+    resource: "query-task",
+    command: "get",
+    capabilityId: "system.query_task.get",
+    description: "Get a sanitized query-monitor task detail.",
+    risk: "read",
+    fields: [
+      { flag: "task-id", type: "string", required: true, desc: "Query-monitor task ID." },
+      { flag: "sql-max-chars", type: "number", min: 0, max: 1e5, desc: "Maximum returned SQL characters." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "query-task",
+    command: "cancel",
+    capabilityId: "system.query_task.cancel",
+    description: "Cancel one running query-monitor task by task_id.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "task-id", type: "string", required: true, desc: "Query-monitor task ID, not a CLI run_id." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "query-task",
+    command: "export",
+    capabilityId: "system.query_task.export",
+    description: "Export query tasks; run query-task options first to discover filter codes.",
+    risk: "read",
+    fields: [
+      ...monitorTimeFields,
+      ...monitorScopeFields,
+      { flag: "status-codes", type: "json", required: true, array: true, desc: "Task status-code JSON array." },
+      { flag: "content-codes", type: "json", required: true, array: true, desc: "Query content-code JSON array." },
+      { flag: "task-type-codes", type: "json", required: true, array: true, desc: "Query task-type-code JSON array." },
+      { flag: "cluster-names", type: "json", array: true, desc: "Optional cluster-name JSON array." },
+      { flag: "download-columns", type: "json", array: true, desc: "Optional CSV column JSON array." },
+      {
+        flag: "request-id",
+        type: "string",
+        pattern: "^cli_[0-9a-f]{32}$",
+        desc: "Optional caller-supplied cli_<32 lowercase hex> lifecycle ID; ae-cli generates one before dispatch when omitted."
+      },
+      {
+        flag: "timeout-seconds",
+        type: "number",
+        min: 1,
+        max: 21600,
+        desc: "Maximum export runtime in seconds. Default and max: 21600."
+      }
+    ],
+    validate: (_ctx, input) => validateTaskQueryInput(input)
+  }),
+  defineSystemCommand({
+    resource: "node-monitor",
+    command: "list",
+    capabilityId: "system.node_monitor.list",
+    description: "List sanitized cluster node usage.",
+    risk: "read",
+    fields: [
+      { flag: "limit", type: "number", min: 1, max: 200, desc: "Page size. Default: 50, max: 200." },
+      offsetField,
+      fieldsField
+    ]
+  }),
+  defineSystemCommand({
+    resource: "query-alert-rule",
+    command: "list",
+    capabilityId: "system.query_alert_rule.list",
+    description: "List query-monitor alert rules and metric definitions.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "query-alert-rule",
+    command: "update",
+    capabilityId: "system.query_alert_rule.update",
+    description: "Batch upsert and delete query-monitor alert rules.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "upserts", type: "json", array: true, desc: "Rule upsert JSON array." },
+      { flag: "delete-ids", type: "json", array: true, desc: "Positive rule-ID JSON array to delete." }
+    ],
+    validate: (_ctx, input) => {
+      requireAtLeastOne(input, ["upserts", "delete_ids"], "Provide a non-empty --upserts or --delete-ids array.");
+      requireArrayObjects(input, "upserts", ["metric_content", "wheel_minutes", "wheel_interval", "threshold"]);
+      const deleteIds = input.delete_ids;
+      if (deleteIds?.some((id) => !Number.isInteger(id) || Number(id) <= 0)) {
+        throw validation("--delete-ids must contain positive integers.");
+      }
+      const upserts = input.upserts;
+      for (const [index, item] of (upserts ?? []).entries()) {
+        const metric = Number(item.metric_content);
+        const wheelMinutes = Number(item.wheel_minutes);
+        const wheelInterval = Number(item.wheel_interval);
+        const threshold = Number(item.threshold);
+        if (![1, 2, 3].includes(metric) || !Number.isInteger(wheelMinutes) || wheelMinutes < 1 || wheelMinutes > 1440 || !Number.isInteger(wheelInterval) || wheelInterval < 1 || wheelInterval > 1e3 || !Number.isFinite(threshold) || threshold < 0) {
+          throw validation(`--upserts item ${index + 1} contains an invalid metric/window/threshold.`);
+        }
+      }
+      const deleted = new Set((deleteIds ?? []).map(Number));
+      if ((upserts ?? []).some((item) => item.rule_id !== void 0 && deleted.has(Number(item.rule_id)))) {
+        throw validation("The same rule_id cannot appear in both --upserts and --delete-ids.");
+      }
+    }
+  }),
+  defineSystemCommand({
+    resource: "ops-alert-contact",
+    command: "list",
+    capabilityId: "system.ops_alert_contact.list",
+    description: "List sanitized operations-alert contacts.",
+    risk: "read",
+    fields: [
+      { flag: "limit", type: "number", min: 1, max: 200, desc: "Page size. Default: 50, max: 200." },
+      offsetField
+    ]
+  }),
+  defineSystemCommand({
+    resource: "ops-alert-contact",
+    command: "upsert",
+    capabilityId: "system.ops_alert_contact.upsert",
+    description: "Create or update an operations-alert contact without exposing webhooks on argv.",
+    risk: "write",
+    fields: [
+      { flag: "contact-id", type: "number", min: 1, desc: "Existing contact ID; omit to create." },
+      { flag: "name", type: "string", desc: "Contact name." },
+      { flag: "mail-address", type: "string", desc: "Email delivery target." },
+      { flag: "mobile", type: "string", desc: "Mobile delivery target." },
+      { flag: "on-status", type: "number", allowed: [0, 1], desc: "Enable state: 0 or 1; required on create." }
+    ],
+    secrets: contactWebhookSecrets,
+    validate: (_ctx, input) => {
+      if (input.contact_id === void 0) {
+        if (!input.name) throw validation("--name is required when creating a contact.");
+        if (input.on_status === void 0) throw validation("--on-status is required when creating a contact.");
+        requireAtLeastOne(
+          input,
+          ["mail_address", "mobile", ...contactWebhookSecrets.map((item) => item.input)],
+          "Provide at least one delivery target when creating a contact."
+        );
+      }
+    }
+  }),
+  defineSystemCommand({
+    resource: "ops-alert-contact",
+    command: "delete",
+    capabilityId: "system.ops_alert_contact.delete",
+    description: "Delete an operations-alert contact.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "contact-id", type: "number", required: true, min: 1, desc: "Contact ID to delete." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "ops-alert-contact",
+    command: "test",
+    capabilityId: "system.ops_alert_contact.test",
+    description: "Send one rate-limited external alert test to a constrained target.",
+    risk: "write",
+    fields: [
+      {
+        flag: "channel",
+        type: "string",
+        required: true,
+        desc: "Test channel.",
+        allowed: ["email", "sms", "dingding", "wechat", "feishu", "slack"]
+      }
+    ],
+    secrets: [
+      { input: "target", flag: "target", required: true, desc: "Sensitive test destination." }
+    ]
+  })
+];
+
+// src/core/ta-password-encryption.ts
+import { constants, publicEncrypt } from "crypto";
+var TA_PASSWORD_PUBLIC_KEY = [
+  "-----BEGIN PUBLIC KEY-----",
+  "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCT+JeQB4oij4007Kslmma0sfFo",
+  "dahq1olOpWJoZR+aimyNuYUSTmbK1/bArGkIb0CxIPUGQIrARpY6apQNncORutdmB",
+  "HonFkn7r7XpktL7bxZhDUKeLjIdjaEB1lh1tFxLl3cP0siHwuc1aAaEOWAjuCu2f",
+  "9+FgY7WCEJla9Qa/QIDAQAB",
+  "-----END PUBLIC KEY-----"
+].join("\n");
+function encryptTaPassword(plaintext) {
+  return publicEncrypt(
+    {
+      key: TA_PASSWORD_PUBLIC_KEY,
+      padding: constants.RSA_PKCS1_PADDING
+    },
+    Buffer.from(plaintext, "utf8")
+  ).toString("base64");
+}
+
+// src/commands/te-analysis/system/security.ts
+var systemSecurityCommands = [
+  defineSystemCommand({
+    resource: "mfa",
+    command: "get",
+    capabilityId: "system.mfa.get",
+    description: "Get the company MFA enforcement state.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "mfa",
+    command: "update",
+    capabilityId: "system.mfa.update",
+    description: "Enable or disable company MFA enforcement.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "enabled", type: "boolean", required: true, desc: "Target MFA enforcement state." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "member-mfa",
+    command: "unbind",
+    capabilityId: "system.member_mfa.unbind",
+    description: "Unbind one member MFA enrollment.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "login-name", type: "string", required: true, desc: "Target member login name." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "member-password",
+    command: "reset",
+    capabilityId: "system.member_password.reset",
+    description: "Reset one member password after local TA-compatible RSA encryption.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "target-user-id", type: "number", required: true, min: 1, desc: "Target member user ID." }
+    ],
+    secrets: [
+      {
+        input: "encrypted_password",
+        flag: "password",
+        required: true,
+        desc: "New member password.",
+        transform: encryptTaPassword
+      }
+    ]
+  })
+];
+
+// src/commands/te-analysis/system/usage.ts
+var dateFields = [
+  { flag: "start-time", type: "string", required: true, desc: "Inclusive ISO date/time lower bound." },
+  { flag: "end-time", type: "string", required: true, desc: "Inclusive ISO date/time upper bound." }
+];
+var systemUsageCommands = [
+  defineSystemCommand({
+    resource: "usage",
+    command: "overview",
+    capabilityId: "system.usage.overview",
+    description: "Get the current company system-usage summary.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "project-usage",
+    command: "list",
+    capabilityId: "system.project_usage.list",
+    description: "List project storage and usage statistics in a bounded time range.",
+    risk: "read",
+    fields: [
+      ...dateFields,
+      fieldsField,
+      limitField,
+      offsetField,
+      { flag: "sort-by", type: "string", desc: "Sort field.", allowed: ["data_num", "project_id", "project_name", "status"] },
+      { flag: "sort-order", type: "string", desc: "Sort direction.", allowed: ["asc", "desc"] }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "usage-trend",
+    command: "query",
+    capabilityId: "system.usage_trend.query",
+    description: "Query a bounded company or project usage trend.",
+    risk: "read",
+    fields: [
+      ...dateFields,
+      { flag: "metric", type: "string", required: true, desc: "Supported usage metric; apollo_token is not available." },
+      { flag: "time-granularity", type: "string", required: true, desc: "Aggregation granularity.", allowed: ["day", "week", "month"] },
+      { flag: "scope", type: "string", desc: "Aggregation scope.", allowed: ["company", "project"] },
+      { flag: "project-ids", type: "json", array: true, desc: "Project ID JSON array; required for project scope." },
+      { flag: "data-type", type: "string", desc: "Optional event-volume data type.", allowed: ["all", "event", "user"] }
+    ],
+    validate: (_ctx, input) => {
+      if (input.metric === "apollo_token") {
+        throw validation("--metric apollo_token is not implemented by the current service.");
+      }
+      if (input.scope === "project" && (!Array.isArray(input.project_ids) || input.project_ids.length === 0)) {
+        throw validation("--project-ids is required when --scope project.");
+      }
+    }
+  }),
+  defineSystemCommand({
+    resource: "usage-trend",
+    command: "export",
+    capabilityId: "system.usage_trend.export",
+    description: "Export a bounded usage trend as a cancellable run-scoped gzip JSONL artifact.",
+    risk: "read",
+    fields: [
+      ...dateFields,
+      { flag: "metric", type: "string", required: true, desc: "Supported usage metric; apollo_token is not available." },
+      { flag: "time-granularity", type: "string", required: true, desc: "Aggregation granularity.", allowed: ["day", "week", "month"] },
+      { flag: "scope", type: "string", desc: "Aggregation scope.", allowed: ["company", "project"] },
+      { flag: "project-ids", type: "json", array: true, desc: "Project ID JSON array; required for project scope." },
+      { flag: "data-type", type: "string", desc: "Optional event-volume data type.", allowed: ["all", "event", "user"] },
+      {
+        flag: "request-id",
+        type: "string",
+        pattern: "^cli_[0-9a-f]{32}$",
+        desc: "Optional caller-supplied cli_<32 lowercase hex> lifecycle ID; ae-cli generates one before dispatch when omitted."
+      },
+      {
+        flag: "timeout-seconds",
+        type: "number",
+        min: 1,
+        max: 21600,
+        desc: "Maximum export runtime in seconds. Default and max: 21600."
+      }
+    ],
+    validate: (_ctx, input) => {
+      if (input.metric === "apollo_token") {
+        throw validation("--metric apollo_token is not implemented by the current service.");
+      }
+      if (input.scope === "project" && (!Array.isArray(input.project_ids) || input.project_ids.length === 0)) {
+        throw validation("--project-ids is required when --scope project.");
+      }
+    }
+  })
+];
+
+// src/commands/te-analysis/system/index.ts
+var commands78 = [
+  ...systemUsageCommands,
+  ...systemIdentityCommands,
+  ...systemSecurityCommands,
+  ...systemMonitoringCommands,
+  ...systemConfigurationCommands
+];
+var system_default = commands78;
 
 // src/commands/te-analysis/index.ts
 registerCapabilityGatewayRoute("analysis", { gatewayDomain: "analysis" });
+registerCapabilityGatewayRoute("project", { gatewayDomain: "analysis" });
+registerCapabilityGatewayRoute("system", { gatewayDomain: "analysis" });
 registerCapabilityGatewayRoute("tracking", { gatewayDomain: "analysis" });
 var baseCommands = [
   ...meta_default,
@@ -6564,10 +8149,11 @@ var baseCommands = [
   ...alert_default,
   ...alert_detail_default,
   ...alert_job_default,
-  ...alert_notice_config_default
+  ...alert_notice_config_default,
+  ...system_default
 ];
-var commands76 = [...baseCommands];
-var te_analysis_default = commands76;
+var commands79 = [...baseCommands];
+var te_analysis_default = commands79;
 export {
   baseCommands,
   te_analysis_default as default