@thinkingai/ae-cli 6.0.38 → 6.0.40

package/dist/{te-analysis-RAC67YYD.js → te-analysis-N2BRDJZ5.js}

@@ -1,10 +1,13 @@
 import {
   createCapabilityCommand
-} from "./chunk-PVBYJWC2.js";
+} from "./chunk-TS6BUGUY.js";
 import {
   registerCapabilityGatewayRoute,
   resolveGatewayDomain
 } from "./chunk-PTE56QPL.js";
+import {
+  withOutputMetadata
+} from "./chunk-YTG6Q75E.js";
 import {
   CapabilityGatewayError,
   buildCapabilityGatewayUrl,
@@ -16,25 +19,51 @@ import {
   requestCapabilityGatewayWithEnvelope,
   uploadInputFile,
   validateCapability
-} from "./chunk-HQ2A7ITL.js";
+} from "./chunk-GS2P7LFD.js";
+import "./chunk-Z3OXWCIA.js";
+import "./chunk-YV52FB5G.js";
+import "./chunk-GJJA4CQZ.js";
 import {
-  withOutputMetadata
-} from "./chunk-KTYR3U6D.js";
-import "./chunk-E7UXXHO3.js";
-import "./chunk-IR4ZLVPW.js";
-import "./chunk-V6FR6WTW.js";
-import "./chunk-24BAVOX3.js";
-import "./chunk-LYVNONC4.js";
+  CliValidationError
+} from "./chunk-AXDXJTPC.js";
+import "./chunk-JHENBQ5B.js";
 
 // src/commands/te-analysis/capability-shared.ts
+var ANALYSIS_GATEWAY_CLI_SERVICES = /* @__PURE__ */ new Set(["project", "system"]);
 var analysisDataRunRoutingHelp = "Routing: use run only for analysis data that fits <=1000 inline rows and <=180s; use export for full, unknown-size, >1000-row, or long-running data.";
 var analysisDataExportRoutingHelp = "Routing: use export for full, unknown-size, >1000-row, or long-running analysis data; inspect/download by run_id/artifact_id; use run only for <=1000-row inline previews.";
 function createAnalysisCapabilityCommand(config) {
+  const cliPath = resolveAnalysisGatewayCliPath(config);
   return createCapabilityCommand({
     ...config,
-    cliService: "analysis"
+    ...cliPath,
+    gatewayDomain: "analysis"
   });
 }
+function resolveAnalysisGatewayCliPath(config) {
+  const [capabilityService, capabilityResource, capabilityAction, ...extraSegments] = config.capabilityId.split(".");
+  if (!ANALYSIS_GATEWAY_CLI_SERVICES.has(capabilityService)) {
+    return {
+      cliService: "analysis",
+      resource: config.resource,
+      command: config.command
+    };
+  }
+  if (!capabilityResource || !capabilityAction || extraSegments.length > 0) {
+    throw new Error(
+      `Capability '${config.capabilityId}' must have exactly three segments for direct CLI registration.`
+    );
+  }
+  const resource = capabilityResource.replaceAll("_", "-");
+  const command = capabilityAction.replaceAll("_", "-");
+  const expectedLegacyResource = `${capabilityService} ${resource}`;
+  if (config.resource !== expectedLegacyResource || config.command !== command) {
+    throw new Error(
+      `Capability '${config.capabilityId}' must map to ae-cli ${capabilityService} ${resource} ${command}.`
+    );
+  }
+  return { cliService: capabilityService, resource, command };
+}
 function createAnalysisMetaCapabilityCommand(config) {
   return createCapabilityCommand({
     ...config,
@@ -5039,6 +5068,43 @@ var commands47 = [
 ];
 var function_default = commands47;
 
+// src/commands/te-analysis/project/info/create.ts
+var projectInfoCreate = createAnalysisCapabilityCommand({
+  resource: "project info",
+  command: "create",
+  capabilityId: "project.info.create",
+  description: "Create a project without exposing unsupported avatar fields.",
+  flags: [
+    { name: "company-id", type: "number", required: true, min: 1, desc: "Company ID." },
+    { name: "project-name", type: "string", required: true, minLength: 1, maxLength: 80, desc: "Project name." },
+    { name: "load-history", type: "boolean", required: false, desc: "Load historical data. Default: false." },
+    { name: "owner-user-id", type: "number", required: false, min: 1, desc: "Optional owner user ID." },
+    { name: "project-remark", type: "string", required: false, maxLength: 200, desc: "Optional project remark." }
+  ],
+  risk: "write",
+  buildInput: (ctx) => compactInput({
+    company_id: ctx.num("company-id"),
+    project_name: ctx.str("project-name"),
+    load_history: ctx.str("load-history") === "" ? false : ctx.bool("load-history"),
+    owner_user_id: optionalNumber(ctx, "owner-user-id"),
+    project_remark: optionalString(ctx, "project-remark")
+  })
+});
+
+// src/commands/te-analysis/project/info/delete.ts
+var projectInfoDelete = createAnalysisCapabilityCommand({
+  resource: "project info",
+  command: "delete",
+  capabilityId: "project.info.delete",
+  description: "Delete a project and flush its receiver cache.",
+  flags: [projectIdFlag],
+  risk: "high-risk-write",
+  buildInput: (ctx) => compactInput({
+    project_id: ctx.num("project-id"),
+    yes: true
+  })
+});
+
 // src/commands/te-analysis/project/info/get.ts
 var projectInfoGet = createAnalysisCapabilityCommand({
   resource: "project info",
@@ -5096,6 +5162,8 @@ var projectInfoUpdate = createAnalysisCapabilityCommand({
 
 // src/commands/te-analysis/project/info/index.ts
 var commands48 = [
+  projectInfoCreate,
+  projectInfoDelete,
   projectInfoGet,
   projectInfoList,
   projectInfoUpdate
@@ -6969,8 +7037,1078 @@ var commands77 = [
 ];
 var alert_notice_config_default = commands77;
 
+// src/commands/te-analysis/system/shared.ts
+import { readFileSync, statSync as statSync2 } from "fs";
+var secretValues = /* @__PURE__ */ new WeakMap();
+var companyIdField = {
+  flag: "company-id",
+  input: "company_id",
+  type: "number",
+  required: true,
+  min: 1,
+  desc: "Company ID."
+};
+var queryField = {
+  flag: "query",
+  type: "string",
+  desc: "Optional keyword filter."
+};
+var limitField = {
+  flag: "limit",
+  type: "number",
+  min: 1,
+  max: 200,
+  desc: "Page size. Default and maximum depend on the capability schema."
+};
+var offsetField = {
+  flag: "offset",
+  type: "number",
+  min: 0,
+  desc: "Zero-based result offset."
+};
+var fieldsField = {
+  flag: "fields",
+  type: "json",
+  array: true,
+  desc: "Optional snake_case result field projection JSON array."
+};
+function defineSystemCommand(spec) {
+  const fields = [companyIdField, ...spec.fields ?? []];
+  const secrets = spec.secrets ?? [];
+  return createAnalysisCapabilityCommand({
+    resource: `system ${spec.resource}`,
+    command: spec.command,
+    capabilityId: spec.capabilityId,
+    description: spec.description,
+    flags: [
+      ...fields.map(fieldFlag),
+      ...secrets.flatMap(secretFlags)
+    ],
+    risk: spec.risk,
+    validate: (ctx) => {
+      validateSecretSources(ctx, secrets);
+      const input = buildSystemInput(ctx, fields, [], spec.risk);
+      for (const secret of secrets) {
+        if (ctx.str(`${secret.flag}-file`) || ctx.bool(`${secret.flag}-stdin`)) {
+          input[secret.input] = "<provided>";
+        }
+      }
+      validateFields(fields, input);
+      spec.validate?.(ctx, input);
+    },
+    buildInput: (ctx) => {
+      const input = buildSystemInput(ctx, fields, secrets, spec.risk);
+      validateFields(fields, input);
+      validateSecretSources(ctx, secrets);
+      spec.validate?.(ctx, input);
+      return input;
+    }
+  });
+}
+function fieldFlag(field) {
+  return {
+    name: field.flag,
+    type: field.type,
+    required: field.required,
+    desc: field.desc,
+    min: field.min,
+    max: field.max,
+    pattern: field.pattern
+  };
+}
+function secretFlags(secret) {
+  const requirement = secret.required ? ` One of --${secret.flag}-file or --${secret.flag}-stdin is required.` : "";
+  return [
+    {
+      name: `${secret.flag}-file`,
+      type: "string",
+      required: false,
+      desc: `${secret.desc} Read from a local permission-protected file; the value is never accepted directly on argv.${requirement}`
+    },
+    {
+      name: `${secret.flag}-stdin`,
+      type: "boolean",
+      required: false,
+      sensitive: true,
+      desc: `${secret.desc} Read from stdin; do not combine with --${secret.flag}-file.${requirement}`
+    }
+  ];
+}
+function buildSystemInput(ctx, fields, secrets, risk) {
+  const input = {};
+  for (const field of fields) {
+    const value = fieldValue(ctx, field);
+    if (value !== void 0) input[field.input ?? kebabToSnake(field.flag)] = value;
+  }
+  for (const secret of secrets) {
+    const value = secretValue(ctx, secret);
+    if (value !== void 0) input[secret.input] = secret.transform ? secret.transform(value) : value;
+  }
+  if (risk === "high-risk-write") input.yes = true;
+  return compactInput(input);
+}
+function fieldValue(ctx, field) {
+  const raw = ctx.str(field.flag);
+  if (raw === "") return void 0;
+  if (field.type === "string") return raw;
+  if (field.type === "number") return Number(raw);
+  if (field.type === "boolean") return ctx.bool(field.flag);
+  return ctx.json(field.flag);
+}
+function validateFields(fields, input) {
+  for (const field of fields) {
+    const inputName = field.input ?? kebabToSnake(field.flag);
+    const value = input[inputName];
+    if (field.required && value === void 0) {
+      throw validation(`--${field.flag} is required.`);
+    }
+    if (value === void 0) continue;
+    if (field.array && !Array.isArray(value)) {
+      throw validation(`--${field.flag} must be a JSON array.`);
+    }
+    if (field.allowed && !field.allowed.includes(value)) {
+      throw validation(`--${field.flag} must be one of: ${field.allowed.join(", ")}.`);
+    }
+  }
+}
+function validateSecretSources(ctx, secrets) {
+  let stdinSources = 0;
+  for (const secret of secrets) {
+    const file = ctx.str(`${secret.flag}-file`);
+    const stdin = ctx.bool(`${secret.flag}-stdin`);
+    if (file && stdin) {
+      throw validation(`Use only one of --${secret.flag}-file and --${secret.flag}-stdin.`);
+    }
+    if (secret.required && !file && !stdin) {
+      throw validation(`Provide --${secret.flag}-file or --${secret.flag}-stdin.`);
+    }
+    if (stdin) stdinSources += 1;
+  }
+  if (stdinSources > 1) {
+    throw validation("Only one secret value may be read from stdin in a single invocation; use protected files for the others.");
+  }
+}
+function secretValue(ctx, secret) {
+  let values = secretValues.get(ctx);
+  if (!values) {
+    values = /* @__PURE__ */ new Map();
+    secretValues.set(ctx, values);
+  }
+  if (values.has(secret.flag)) {
+    return values.get(secret.flag);
+  }
+  let value;
+  const file = ctx.str(`${secret.flag}-file`);
+  if (file) {
+    const stat = statSync2(file);
+    if (!stat.isFile()) throw validation(`--${secret.flag}-file must reference a regular file.`);
+    if ((stat.mode & 63) !== 0) {
+      throw validation(`--${secret.flag}-file must not be readable or writable by group/others (use chmod 600).`);
+    }
+    value = nonEmptySecret(readFileSync(file, "utf8"), secret.flag);
+  } else if (ctx.bool(`${secret.flag}-stdin`)) {
+    value = nonEmptySecret(readFileSync(0, "utf8"), secret.flag);
+  }
+  values.set(secret.flag, value);
+  return value;
+}
+function nonEmptySecret(value, flag) {
+  const normalized = value.replace(/\r?\n$/, "");
+  if (normalized.length === 0) throw validation(`Secret input for --${flag} must not be empty.`);
+  return normalized;
+}
+function requireAtLeastOne(input, names, message) {
+  const present = names.some((name) => {
+    const value = input[name];
+    return Array.isArray(value) ? value.length > 0 : value !== void 0 && value !== "";
+  });
+  if (!present) throw validation(message);
+}
+function requireArrayObjects(input, name, requiredKeys) {
+  const value = input[name];
+  if (value === void 0) return;
+  if (!Array.isArray(value)) throw validation(`${snakeToFlag(name)} must be a JSON array.`);
+  value.forEach((item, index) => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) {
+      throw validation(`${snakeToFlag(name)} item ${index + 1} must be an object.`);
+    }
+    for (const key of requiredKeys) {
+      if (!(key in item)) {
+        throw validation(`${snakeToFlag(name)} item ${index + 1} is missing ${key}.`);
+      }
+    }
+  });
+}
+function validation(message) {
+  return new CliValidationError(message, { code: "INVALID_SYSTEM_CAPABILITY_INPUT" });
+}
+function kebabToSnake(value) {
+  return value.replaceAll("-", "_");
+}
+function snakeToFlag(value) {
+  return `--${value.replaceAll("_", "-")}`;
+}
+
+// src/commands/te-analysis/system/configuration.ts
+var addressUrl = { flag: "address-url", type: "string", required: true, desc: "Receiver address URL." };
+var addressType = {
+  flag: "address-type",
+  type: "string",
+  required: true,
+  desc: "Receiver address type.",
+  allowed: ["public", "private"]
+};
+var loginType = {
+  flag: "login-type",
+  type: "string",
+  required: true,
+  desc: "Third-party login type.",
+  allowed: ["wecom", "dingtalk", "feishu"]
+};
+var systemConfigurationCommands = [
+  defineSystemCommand({
+    resource: "preference",
+    command: "get",
+    capabilityId: "system.preference.get",
+    description: "Get typed company preferences exposed to CLI.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "preference",
+    command: "update",
+    capabilityId: "system.preference.update",
+    description: "Update typed company navigation preference.",
+    risk: "write",
+    fields: [
+      { flag: "navigation-permission-hide", type: "boolean", required: true, desc: "Hide navigation entries without permission." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "smtp",
+    command: "get",
+    capabilityId: "system.smtp.get",
+    description: "Get sanitized company SMTP configuration.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "smtp",
+    command: "upsert",
+    capabilityId: "system.smtp.upsert",
+    description: "Create or update company SMTP configuration using a protected password source.",
+    risk: "write",
+    fields: [
+      { flag: "server-host", type: "string", required: true, desc: "SMTP server host." },
+      { flag: "server-port", type: "number", required: true, min: 1, max: 65535, desc: "SMTP server port." },
+      { flag: "has-encrypt", type: "number", allowed: [0, 1, 2], desc: "Encryption mode: 0, 1, or 2." },
+      { flag: "sender-address", type: "string", required: true, desc: "Sender email address." },
+      { flag: "sender-name", type: "string", required: true, desc: "Sender display name." },
+      { flag: "subject-prefix", type: "string", desc: "Optional subject prefix." }
+    ],
+    secrets: [
+      { input: "password", flag: "password", required: true, desc: "SMTP password." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "smtp",
+    command: "test",
+    capabilityId: "system.smtp.test",
+    description: "Send one SMTP test using the saved configuration.",
+    risk: "write",
+    fields: [
+      { flag: "receiver", type: "string", required: true, desc: "Test email receiver." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "smtp",
+    command: "delete",
+    capabilityId: "system.smtp.delete",
+    description: "Delete company SMTP configuration.",
+    risk: "high-risk-write"
+  }),
+  defineSystemCommand({
+    resource: "receiver-address",
+    command: "overview",
+    capabilityId: "system.receiver_address.overview",
+    description: "Get company receiver-address overview.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "receiver-address",
+    command: "project-list",
+    capabilityId: "system.receiver_address.project_list",
+    description: "List project receiver-address overrides.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "receiver-address",
+    command: "upsert",
+    capabilityId: "system.receiver_address.upsert",
+    description: "Create or update a typed receiver address.",
+    risk: "write",
+    fields: [
+      { flag: "scope", type: "string", required: true, desc: "Receiver scope.", allowed: ["global", "project"] },
+      addressUrl,
+      addressType,
+      { flag: "project-ids", type: "json", array: true, desc: "Project ID JSON array; required for project scope." },
+      { flag: "original-address-url", type: "string", desc: "Original URL when changing an existing address." },
+      { flag: "original-address-type", type: "string", desc: "Original address type.", allowed: ["public", "private"] }
+    ],
+    validate: (_ctx, input) => {
+      if (input.scope === "project" && (!Array.isArray(input.project_ids) || input.project_ids.length === 0)) {
+        throw validation("--project-ids is required when --scope project.");
+      }
+    }
+  }),
+  defineSystemCommand({
+    resource: "receiver-address",
+    command: "promote",
+    capabilityId: "system.receiver_address.promote",
+    description: "Promote a receiver address to company scope.",
+    risk: "write",
+    fields: [
+      addressUrl,
+      addressType,
+      { flag: "remove-project-custom", type: "boolean", desc: "Remove matching project overrides after promotion." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "receiver-address",
+    command: "delete",
+    capabilityId: "system.receiver_address.delete",
+    description: "Delete a receiver address.",
+    risk: "high-risk-write",
+    fields: [addressUrl, addressType]
+  }),
+  defineSystemCommand({
+    resource: "receiver-detection",
+    command: "get",
+    capabilityId: "system.receiver_detection.get",
+    description: "Get receiver-address detection configuration.",
+    risk: "read",
+    fields: [addressUrl]
+  }),
+  defineSystemCommand({
+    resource: "receiver-detection",
+    command: "update",
+    capabilityId: "system.receiver_detection.update",
+    description: "Update typed receiver-address detection configuration.",
+    risk: "write",
+    fields: [
+      addressUrl,
+      { flag: "execute-type", type: "string", required: true, desc: "Detection execution scope.", allowed: ["ta_cluster", "all"] },
+      { flag: "schedule-type", type: "string", required: true, desc: "Detection schedule.", allowed: ["minutes", "hour", "day", "disabled"] },
+      { flag: "allow-notification", type: "boolean", required: true, desc: "Allow detection notifications." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "receiver-detection",
+    command: "run",
+    capabilityId: "system.receiver_detection.run",
+    description: "Run receiver-address detection now.",
+    risk: "write",
+    fields: [addressUrl]
+  }),
+  defineSystemCommand({
+    resource: "third-party-login",
+    command: "list",
+    capabilityId: "system.third_party_login.list",
+    description: "List sanitized third-party login configurations.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "third-party-login",
+    command: "upsert",
+    capabilityId: "system.third_party_login.upsert",
+    description: "Create or update a third-party login configuration using protected secret sources.",
+    risk: "write",
+    fields: [
+      loginType,
+      { flag: "app-id", type: "string", required: true, desc: "Provider application ID." },
+      { flag: "corp-id", type: "string", desc: "Provider corporation ID." },
+      { flag: "agent-id", type: "string", desc: "Provider agent ID." },
+      { flag: "dd-scan-app-id", type: "string", desc: "DingTalk scan-login application ID." }
+    ],
+    secrets: [
+      { input: "app_secret", flag: "app-secret", required: true, desc: "Provider application secret." },
+      { input: "dd_scan_app_secret", flag: "dd-scan-app-secret", desc: "DingTalk scan-login application secret." }
+    ],
+    validate: (_ctx, input) => {
+      if (input.login_type === "wecom" && !input.corp_id) {
+        throw validation("--corp-id is required for wecom.");
+      }
+      if (input.login_type === "dingtalk") {
+        requireAtLeastOne(input, ["corp_id"], "--corp-id is required for dingtalk.");
+        for (const name of ["agent_id", "dd_scan_app_id", "dd_scan_app_secret"]) {
+          if (!input[name]) throw validation(`--${name.replaceAll("_", "-")} is required for dingtalk.`);
+        }
+      }
+    }
+  }),
+  defineSystemCommand({
+    resource: "third-party-login",
+    command: "disable",
+    capabilityId: "system.third_party_login.disable",
+    description: "Disable a third-party login provider.",
+    risk: "high-risk-write",
+    fields: [loginType]
+  }),
+  defineSystemCommand({
+    resource: "oauth2",
+    command: "update",
+    capabilityId: "system.oauth2.update",
+    description: "Enable or disable company OAuth2 login.",
+    risk: "write",
+    fields: [
+      { flag: "enable-oauth2", type: "boolean", required: true, desc: "Target OAuth2 login state." }
+    ]
+  })
+];
+
+// src/commands/te-analysis/system/identity.ts
+var roleName = { flag: "role-name", type: "string", required: true, desc: "Role name." };
+var targetOpenId = { flag: "target-open-id", type: "string", required: true, desc: "Target member open ID." };
+var systemIdentityCommands = [
+  defineSystemCommand({
+    resource: "member",
+    command: "list",
+    capabilityId: "system.member.list",
+    description: "List company members.",
+    risk: "read",
+    fields: [queryField, limitField, offsetField]
+  }),
+  defineSystemCommand({
+    resource: "member-candidate",
+    command: "list",
+    capabilityId: "system.member_candidate.list",
+    description: "Resolve candidate company members by login name.",
+    risk: "read",
+    fields: [{ flag: "login-names", type: "json", required: true, array: true, desc: "Login-name JSON array." }]
+  }),
+  defineSystemCommand({
+    resource: "member",
+    command: "add",
+    capabilityId: "system.member.add",
+    description: "Add company members atomically.",
+    risk: "write",
+    fields: [
+      { flag: "members", type: "json", required: true, array: true, desc: "Member array with login_name and user_name." }
+    ],
+    validate: (_ctx, input) => {
+      requireAtLeastOne(input, ["members"], "Provide a non-empty --members array.");
+      requireArrayObjects(input, "members", ["login_name", "user_name"]);
+    }
+  }),
+  defineSystemCommand({
+    resource: "member",
+    command: "update",
+    capabilityId: "system.member.update",
+    description: "Update a company member display name.",
+    risk: "write",
+    fields: [
+      targetOpenId,
+      { flag: "user-name", type: "string", required: true, desc: "New display name." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "member-status",
+    command: "update",
+    capabilityId: "system.member_status.update",
+    description: "Lock or reactivate a company member.",
+    risk: "high-risk-write",
+    fields: [
+      targetOpenId,
+      { flag: "status", type: "string", required: true, desc: "Target status.", allowed: ["locked", "active"] }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "member-project",
+    command: "batch-update",
+    capabilityId: "system.member_project.batch_update",
+    description: "Batch update and remove a member project assignments.",
+    risk: "high-risk-write",
+    fields: [
+      targetOpenId,
+      { flag: "project-updates", type: "json", array: true, desc: "Project update array: project_id, role_names, and optional data_power_id." },
+      { flag: "project-removals", type: "json", array: true, desc: "Project removal and handover array." }
+    ],
+    validate: (_ctx, input) => {
+      requireAtLeastOne(input, ["project_updates", "project_removals"], "Provide a non-empty --project-updates or --project-removals array.");
+      requireArrayObjects(input, "project_updates", ["project_id", "role_names"]);
+      requireArrayObjects(input, "project_removals", ["project_id", "handover_type"]);
+    }
+  }),
+  defineSystemCommand({
+    resource: "member",
+    command: "delete",
+    capabilityId: "system.member.delete",
+    description: "Delete a company member after all project memberships and assets are cleared.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "target-user-id", type: "number", required: true, min: 1, desc: "Target member user ID." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "admin",
+    command: "list",
+    capabilityId: "system.admin.list",
+    description: "List company system administrators.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "admin",
+    command: "upsert",
+    capabilityId: "system.admin.upsert",
+    description: "Create or update company system-administrator assignments.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "admins", type: "json", required: true, array: true, desc: "Administrator array with target_user_id and function_names." }
+    ],
+    validate: (_ctx, input) => requireArrayObjects(input, "admins", ["target_user_id", "function_names"])
+  }),
+  defineSystemCommand({
+    resource: "admin-function",
+    command: "list",
+    capabilityId: "system.admin_function.list",
+    description: "List functions assigned to a system administrator.",
+    risk: "read",
+    fields: [targetOpenId]
+  }),
+  defineSystemCommand({
+    resource: "admin-function",
+    command: "update",
+    capabilityId: "system.admin_function.update",
+    description: "Replace functions assigned to a system administrator.",
+    risk: "high-risk-write",
+    fields: [
+      targetOpenId,
+      { flag: "function-names", type: "json", required: true, array: true, desc: "Complete function-name JSON array." }
+    ],
+    validate: (_ctx, input) => requireAtLeastOne(input, ["function_names"], "--function-names must contain at least one function.")
+  }),
+  defineSystemCommand({
+    resource: "admin",
+    command: "remove",
+    capabilityId: "system.admin.remove",
+    description: "Remove a company-scoped system administrator role.",
+    risk: "high-risk-write",
+    fields: [targetOpenId]
+  }),
+  defineSystemCommand({
+    resource: "role",
+    command: "list",
+    capabilityId: "system.role.list",
+    description: "List company roles.",
+    risk: "read",
+    fields: [queryField, limitField, offsetField]
+  }),
+  defineSystemCommand({
+    resource: "role",
+    command: "get",
+    capabilityId: "system.role.get",
+    description: "Get one company role.",
+    risk: "read",
+    fields: [roleName]
+  }),
+  defineSystemCommand({
+    resource: "role",
+    command: "upsert",
+    capabilityId: "system.role.upsert",
+    description: "Create or update a company role and its function set.",
+    risk: "high-risk-write",
+    fields: [
+      { ...roleName, required: false, desc: "Existing role name for update; omit when creating." },
+      { flag: "role-desc", type: "string", required: true, desc: "Role description." },
+      { flag: "function-names", type: "json", required: true, array: true, desc: "Complete function-name JSON array." }
+    ],
+    validate: (_ctx, input) => requireAtLeastOne(input, ["function_names"], "--function-names must contain at least one function.")
+  }),
+  defineSystemCommand({
+    resource: "role",
+    command: "delete",
+    capabilityId: "system.role.delete",
+    description: "Delete a company role and optionally migrate its users.",
+    risk: "high-risk-write",
+    fields: [
+      roleName,
+      { flag: "new-role-name", type: "string", desc: "Replacement role for affected users." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "role-function",
+    command: "list",
+    capabilityId: "system.role_function.list",
+    description: "List functions assigned to a company role.",
+    risk: "read",
+    fields: [roleName]
+  }),
+  defineSystemCommand({
+    resource: "role-user",
+    command: "list",
+    capabilityId: "system.role_user.list",
+    description: "List users assigned to a company role.",
+    risk: "read",
+    fields: [roleName]
+  }),
+  defineSystemCommand({
+    resource: "function",
+    command: "list",
+    capabilityId: "system.function.list",
+    description: "List company-level system functions available for role assignment.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "seat",
+    command: "list",
+    capabilityId: "system.seat.list",
+    description: "List company seat assignments.",
+    risk: "read",
+    fields: [
+      queryField,
+      limitField,
+      offsetField,
+      { flag: "seat-type", type: "string", desc: "Optional seat type.", allowed: ["manage", "view", "empty"] }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "seat",
+    command: "update",
+    capabilityId: "system.seat.update",
+    description: "Assign or remove BI seats under serialized company quota enforcement.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "seat-type", type: "string", required: true, desc: "Seat type; empty removes seats.", allowed: ["manage", "view", "empty"] },
+      { flag: "open-ids", type: "json", required: true, array: true, desc: "Company member open-ID JSON array." }
+    ],
+    validate: (_ctx, input) => requireAtLeastOne(input, ["open_ids"], "--open-ids must contain at least one company member.")
+  })
+];
+
+// src/commands/te-analysis/system/monitoring.ts
+var monitorScopeFields = [
+  { flag: "project-ids", type: "json", array: true, desc: "Project ID JSON array." },
+  { flag: "space-codes", type: "json", array: true, desc: "Project space-code JSON array." }
+];
+var monitorTimeFields = [
+  {
+    flag: "start-time",
+    type: "string",
+    required: true,
+    pattern: "^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$",
+    desc: "Inclusive query range start, yyyy-MM-dd HH:mm:ss."
+  },
+  {
+    flag: "end-time",
+    type: "string",
+    required: true,
+    pattern: "^\\d{4}-\\d{2}-\\d{2} \\d{2}:\\d{2}:\\d{2}$",
+    desc: "Inclusive query range end, yyyy-MM-dd HH:mm:ss."
+  }
+];
+function validateTaskQueryInput(input) {
+  validateMonitorScope(input);
+  for (const name of ["status_codes", "content_codes", "task_type_codes"]) {
+    requireAtLeastOne(input, [name], `--${name.replaceAll("_", "-")} must be a non-empty JSON array.`);
+  }
+}
+function validateMonitorScope(input) {
+  requireAtLeastOne(
+    input,
+    ["project_ids", "space_codes"],
+    "Provide a non-empty --project-ids or --space-codes array."
+  );
+}
+var contactWebhookSecrets = [
+  { input: "dingding_webhook", flag: "dingding-webhook", desc: "DingTalk webhook." },
+  { input: "wechat_webhook", flag: "wechat-webhook", desc: "WeCom webhook." },
+  { input: "feishu_webhook", flag: "feishu-webhook", desc: "Feishu webhook." },
+  { input: "slack_webhook", flag: "slack-webhook", desc: "Slack webhook." },
+  { input: "kim_webhook", flag: "kim-webhook", desc: "KIM webhook." }
+];
+var systemMonitoringCommands = [
+  defineSystemCommand({
+    resource: "query-monitor",
+    command: "overview",
+    capabilityId: "system.query_monitor.overview",
+    description: "Get bounded query queue and resource-monitor charts.",
+    risk: "read",
+    fields: [
+      { flag: "duration-minutes", type: "number", min: 1, max: 1440, desc: "Monitoring duration in minutes. Default: 60." },
+      ...monitorScopeFields,
+      { flag: "cluster-names", type: "json", required: true, array: true, desc: "Query cluster-name JSON array." },
+      { flag: "point-interval-seconds", type: "number", min: 5, max: 300, desc: "Chart sample interval seconds. Default: 5." }
+    ],
+    validate: (_ctx, input) => validateMonitorScope(input)
+  }),
+  defineSystemCommand({
+    resource: "query-task",
+    command: "options",
+    capabilityId: "system.query_task.options",
+    description: "List valid query-task filter codes and cluster names before list or export.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "query-task",
+    command: "list",
+    capabilityId: "system.query_task.list",
+    description: "List query-monitor tasks; run query-task options first to discover filter codes.",
+    risk: "read",
+    fields: [
+      ...monitorTimeFields,
+      ...monitorScopeFields,
+      { flag: "status-codes", type: "json", required: true, array: true, desc: "Task status-code JSON array." },
+      { flag: "content-codes", type: "json", required: true, array: true, desc: "Query content-code JSON array." },
+      { flag: "task-type-codes", type: "json", required: true, array: true, desc: "Query task-type-code JSON array." },
+      { flag: "cluster-names", type: "json", array: true, desc: "Optional cluster-name JSON array." },
+      { flag: "limit", type: "number", min: 1, max: 1e3, desc: "Maximum returned tasks. Default: 100, max: 1000." },
+      offsetField,
+      fieldsField
+    ],
+    validate: (_ctx, input) => validateTaskQueryInput(input)
+  }),
+  defineSystemCommand({
+    resource: "query-task",
+    command: "get",
+    capabilityId: "system.query_task.get",
+    description: "Get a sanitized query-monitor task detail.",
+    risk: "read",
+    fields: [
+      { flag: "task-id", type: "string", required: true, desc: "Query-monitor task ID." },
+      { flag: "sql-max-chars", type: "number", min: 0, max: 1e5, desc: "Maximum returned SQL characters." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "query-task",
+    command: "cancel",
+    capabilityId: "system.query_task.cancel",
+    description: "Cancel one running query-monitor task by task_id.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "task-id", type: "string", required: true, desc: "Query-monitor task ID, not a CLI run_id." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "query-task",
+    command: "export",
+    capabilityId: "system.query_task.export",
+    description: "Export query tasks; run query-task options first to discover filter codes.",
+    risk: "read",
+    fields: [
+      ...monitorTimeFields,
+      ...monitorScopeFields,
+      { flag: "status-codes", type: "json", required: true, array: true, desc: "Task status-code JSON array." },
+      { flag: "content-codes", type: "json", required: true, array: true, desc: "Query content-code JSON array." },
+      { flag: "task-type-codes", type: "json", required: true, array: true, desc: "Query task-type-code JSON array." },
+      { flag: "cluster-names", type: "json", array: true, desc: "Optional cluster-name JSON array." },
+      { flag: "download-columns", type: "json", array: true, desc: "Optional CSV column JSON array." },
+      {
+        flag: "request-id",
+        type: "string",
+        pattern: "^cli_[0-9a-f]{32}$",
+        desc: "Optional caller-supplied cli_<32 lowercase hex> lifecycle ID; ae-cli generates one before dispatch when omitted."
+      },
+      {
+        flag: "timeout-seconds",
+        type: "number",
+        min: 1,
+        max: 21600,
+        desc: "Maximum export runtime in seconds. Default and max: 21600."
+      }
+    ],
+    validate: (_ctx, input) => validateTaskQueryInput(input)
+  }),
+  defineSystemCommand({
+    resource: "node-monitor",
+    command: "list",
+    capabilityId: "system.node_monitor.list",
+    description: "List sanitized cluster node usage.",
+    risk: "read",
+    fields: [
+      { flag: "limit", type: "number", min: 1, max: 200, desc: "Page size. Default: 50, max: 200." },
+      offsetField,
+      fieldsField
+    ]
+  }),
+  defineSystemCommand({
+    resource: "query-alert-rule",
+    command: "list",
+    capabilityId: "system.query_alert_rule.list",
+    description: "List query-monitor alert rules and metric definitions.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "query-alert-rule",
+    command: "update",
+    capabilityId: "system.query_alert_rule.update",
+    description: "Batch upsert and delete query-monitor alert rules.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "upserts", type: "json", array: true, desc: "Rule upsert JSON array." },
+      { flag: "delete-ids", type: "json", array: true, desc: "Positive rule-ID JSON array to delete." }
+    ],
+    validate: (_ctx, input) => {
+      requireAtLeastOne(input, ["upserts", "delete_ids"], "Provide a non-empty --upserts or --delete-ids array.");
+      requireArrayObjects(input, "upserts", ["metric_content", "wheel_minutes", "wheel_interval", "threshold"]);
+      const deleteIds = input.delete_ids;
+      if (deleteIds?.some((id) => !Number.isInteger(id) || Number(id) <= 0)) {
+        throw validation("--delete-ids must contain positive integers.");
+      }
+      const upserts = input.upserts;
+      for (const [index, item] of (upserts ?? []).entries()) {
+        const metric = Number(item.metric_content);
+        const wheelMinutes = Number(item.wheel_minutes);
+        const wheelInterval = Number(item.wheel_interval);
+        const threshold = Number(item.threshold);
+        if (![1, 2, 3].includes(metric) || !Number.isInteger(wheelMinutes) || wheelMinutes < 1 || wheelMinutes > 1440 || !Number.isInteger(wheelInterval) || wheelInterval < 1 || wheelInterval > 1e3 || !Number.isFinite(threshold) || threshold < 0) {
+          throw validation(`--upserts item ${index + 1} contains an invalid metric/window/threshold.`);
+        }
+      }
+      const deleted = new Set((deleteIds ?? []).map(Number));
+      if ((upserts ?? []).some((item) => item.rule_id !== void 0 && deleted.has(Number(item.rule_id)))) {
+        throw validation("The same rule_id cannot appear in both --upserts and --delete-ids.");
+      }
+    }
+  }),
+  defineSystemCommand({
+    resource: "ops-alert-contact",
+    command: "list",
+    capabilityId: "system.ops_alert_contact.list",
+    description: "List sanitized operations-alert contacts.",
+    risk: "read",
+    fields: [
+      { flag: "limit", type: "number", min: 1, max: 200, desc: "Page size. Default: 50, max: 200." },
+      offsetField
+    ]
+  }),
+  defineSystemCommand({
+    resource: "ops-alert-contact",
+    command: "upsert",
+    capabilityId: "system.ops_alert_contact.upsert",
+    description: "Create or update an operations-alert contact without exposing webhooks on argv.",
+    risk: "write",
+    fields: [
+      { flag: "contact-id", type: "number", min: 1, desc: "Existing contact ID; omit to create." },
+      { flag: "name", type: "string", desc: "Contact name." },
+      { flag: "mail-address", type: "string", desc: "Email delivery target." },
+      { flag: "mobile", type: "string", desc: "Mobile delivery target." },
+      { flag: "on-status", type: "number", allowed: [0, 1], desc: "Enable state: 0 or 1; required on create." }
+    ],
+    secrets: contactWebhookSecrets,
+    validate: (_ctx, input) => {
+      if (input.contact_id === void 0) {
+        if (!input.name) throw validation("--name is required when creating a contact.");
+        if (input.on_status === void 0) throw validation("--on-status is required when creating a contact.");
+        requireAtLeastOne(
+          input,
+          ["mail_address", "mobile", ...contactWebhookSecrets.map((item) => item.input)],
+          "Provide at least one delivery target when creating a contact."
+        );
+      }
+    }
+  }),
+  defineSystemCommand({
+    resource: "ops-alert-contact",
+    command: "delete",
+    capabilityId: "system.ops_alert_contact.delete",
+    description: "Delete an operations-alert contact.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "contact-id", type: "number", required: true, min: 1, desc: "Contact ID to delete." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "ops-alert-contact",
+    command: "test",
+    capabilityId: "system.ops_alert_contact.test",
+    description: "Send one rate-limited external alert test to a constrained target.",
+    risk: "write",
+    fields: [
+      {
+        flag: "channel",
+        type: "string",
+        required: true,
+        desc: "Test channel.",
+        allowed: ["email", "sms", "dingding", "wechat", "feishu", "slack"]
+      }
+    ],
+    secrets: [
+      { input: "target", flag: "target", required: true, desc: "Sensitive test destination." }
+    ]
+  })
+];
+
+// src/core/ta-password-encryption.ts
+import { constants, publicEncrypt } from "crypto";
+var TA_PASSWORD_PUBLIC_KEY = [
+  "-----BEGIN PUBLIC KEY-----",
+  "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCT+JeQB4oij4007Kslmma0sfFo",
+  "dahq1olOpWJoZR+aimyNuYUSTmbK1/bArGkIb0CxIPUGQIrARpY6apQNncORutdmB",
+  "HonFkn7r7XpktL7bxZhDUKeLjIdjaEB1lh1tFxLl3cP0siHwuc1aAaEOWAjuCu2f",
+  "9+FgY7WCEJla9Qa/QIDAQAB",
+  "-----END PUBLIC KEY-----"
+].join("\n");
+function encryptTaPassword(plaintext) {
+  return publicEncrypt(
+    {
+      key: TA_PASSWORD_PUBLIC_KEY,
+      padding: constants.RSA_PKCS1_PADDING
+    },
+    Buffer.from(plaintext, "utf8")
+  ).toString("base64");
+}
+
+// src/commands/te-analysis/system/security.ts
+var systemSecurityCommands = [
+  defineSystemCommand({
+    resource: "mfa",
+    command: "get",
+    capabilityId: "system.mfa.get",
+    description: "Get the company MFA enforcement state.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "mfa",
+    command: "update",
+    capabilityId: "system.mfa.update",
+    description: "Enable or disable company MFA enforcement.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "enabled", type: "boolean", required: true, desc: "Target MFA enforcement state." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "member-mfa",
+    command: "unbind",
+    capabilityId: "system.member_mfa.unbind",
+    description: "Unbind one member MFA enrollment.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "login-name", type: "string", required: true, desc: "Target member login name." }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "member-password",
+    command: "reset",
+    capabilityId: "system.member_password.reset",
+    description: "Reset one member password after local TA-compatible RSA encryption.",
+    risk: "high-risk-write",
+    fields: [
+      { flag: "target-user-id", type: "number", required: true, min: 1, desc: "Target member user ID." }
+    ],
+    secrets: [
+      {
+        input: "encrypted_password",
+        flag: "password",
+        required: true,
+        desc: "New member password.",
+        transform: encryptTaPassword
+      }
+    ]
+  })
+];
+
+// src/commands/te-analysis/system/usage.ts
+var dateFields = [
+  { flag: "start-time", type: "string", required: true, desc: "Inclusive ISO date/time lower bound." },
+  { flag: "end-time", type: "string", required: true, desc: "Inclusive ISO date/time upper bound." }
+];
+var systemUsageCommands = [
+  defineSystemCommand({
+    resource: "usage",
+    command: "overview",
+    capabilityId: "system.usage.overview",
+    description: "Get the current company system-usage summary.",
+    risk: "read"
+  }),
+  defineSystemCommand({
+    resource: "project-usage",
+    command: "list",
+    capabilityId: "system.project_usage.list",
+    description: "List project storage and usage statistics in a bounded time range.",
+    risk: "read",
+    fields: [
+      ...dateFields,
+      fieldsField,
+      limitField,
+      offsetField,
+      { flag: "sort-by", type: "string", desc: "Sort field.", allowed: ["data_num", "project_id", "project_name", "status"] },
+      { flag: "sort-order", type: "string", desc: "Sort direction.", allowed: ["asc", "desc"] }
+    ]
+  }),
+  defineSystemCommand({
+    resource: "usage-trend",
+    command: "query",
+    capabilityId: "system.usage_trend.query",
+    description: "Query a bounded company or project usage trend.",
+    risk: "read",
+    fields: [
+      ...dateFields,
+      { flag: "metric", type: "string", required: true, desc: "Supported usage metric; apollo_token is not available." },
+      { flag: "time-granularity", type: "string", required: true, desc: "Aggregation granularity.", allowed: ["day", "week", "month"] },
+      { flag: "scope", type: "string", desc: "Aggregation scope.", allowed: ["company", "project"] },
+      { flag: "project-ids", type: "json", array: true, desc: "Project ID JSON array; required for project scope." },
+      { flag: "data-type", type: "string", desc: "Optional event-volume data type.", allowed: ["all", "event", "user"] }
+    ],
+    validate: (_ctx, input) => {
+      if (input.metric === "apollo_token") {
+        throw validation("--metric apollo_token is not implemented by the current service.");
+      }
+      if (input.scope === "project" && (!Array.isArray(input.project_ids) || input.project_ids.length === 0)) {
+        throw validation("--project-ids is required when --scope project.");
+      }
+    }
+  }),
+  defineSystemCommand({
+    resource: "usage-trend",
+    command: "export",
+    capabilityId: "system.usage_trend.export",
+    description: "Export a bounded usage trend as a cancellable run-scoped gzip JSONL artifact.",
+    risk: "read",
+    fields: [
+      ...dateFields,
+      { flag: "metric", type: "string", required: true, desc: "Supported usage metric; apollo_token is not available." },
+      { flag: "time-granularity", type: "string", required: true, desc: "Aggregation granularity.", allowed: ["day", "week", "month"] },
+      { flag: "scope", type: "string", desc: "Aggregation scope.", allowed: ["company", "project"] },
+      { flag: "project-ids", type: "json", array: true, desc: "Project ID JSON array; required for project scope." },
+      { flag: "data-type", type: "string", desc: "Optional event-volume data type.", allowed: ["all", "event", "user"] },
+      {
+        flag: "request-id",
+        type: "string",
+        pattern: "^cli_[0-9a-f]{32}$",
+        desc: "Optional caller-supplied cli_<32 lowercase hex> lifecycle ID; ae-cli generates one before dispatch when omitted."
+      },
+      {
+        flag: "timeout-seconds",
+        type: "number",
+        min: 1,
+        max: 21600,
+        desc: "Maximum export runtime in seconds. Default and max: 21600."
+      }
+    ],
+    validate: (_ctx, input) => {
+      if (input.metric === "apollo_token") {
+        throw validation("--metric apollo_token is not implemented by the current service.");
+      }
+      if (input.scope === "project" && (!Array.isArray(input.project_ids) || input.project_ids.length === 0)) {
+        throw validation("--project-ids is required when --scope project.");
+      }
+    }
+  })
+];
+
+// src/commands/te-analysis/system/index.ts
+var commands78 = [
+  ...systemUsageCommands,
+  ...systemIdentityCommands,
+  ...systemSecurityCommands,
+  ...systemMonitoringCommands,
+  ...systemConfigurationCommands
+];
+var system_default = commands78;
+
 // src/commands/te-analysis/index.ts
 registerCapabilityGatewayRoute("analysis", { gatewayDomain: "analysis" });
+registerCapabilityGatewayRoute("project", { gatewayDomain: "analysis" });
+registerCapabilityGatewayRoute("system", { gatewayDomain: "analysis" });
 registerCapabilityGatewayRoute("tracking", { gatewayDomain: "analysis" });
 var baseCommands = [
   ...meta_default,
@@ -7011,10 +8149,11 @@ var baseCommands = [
   ...alert_default,
   ...alert_detail_default,
   ...alert_job_default,
-  ...alert_notice_config_default
+  ...alert_notice_config_default,
+  ...system_default
 ];
-var commands78 = [...baseCommands];
-var te_analysis_default = commands78;
+var commands79 = [...baseCommands];
+var te_analysis_default = commands79;
 export {
   baseCommands,
   te_analysis_default as default