@thinkingai/ae-cli 6.1.16 → 6.1.18

package/dist/{te-analysis-ZMNGOVNW.js → te-analysis-4YGQL5RC.js}

@@ -6,17 +6,17 @@ import {
   waitForAnalysisRun,
   withAsyncArtifactLifecycle,
   withInterruptSignal
-} from "./chunk-SAU3QFIQ.js";
+} from "./chunk-EFH4XWYC.js";
 import {
   createCapabilityCommand
-} from "./chunk-RGKJGKT7.js";
+} from "./chunk-Y3LOALAV.js";
 import {
   registerCapabilityGatewayRoute,
   resolveGatewayDomain
-} from "./chunk-PTE56QPL.js";
+} from "./chunk-3KWQYGYI.js";
 import {
   withOutputMetadata
-} from "./chunk-GT46FPXN.js";
+} from "./chunk-BYYS3ANB.js";
 import {
   CapabilityGatewayError,
   buildCapabilityGatewayUrl,
@@ -27,17 +27,17 @@ import {
   requestCapabilityGatewayWithEnvelope,
   uploadInputFile,
   validateCapability
-} from "./chunk-P3FGXJTU.js";
-import "./chunk-C4MGVGJW.js";
+} from "./chunk-ZQ47LWTI.js";
+import "./chunk-SERWF6G5.js";
 import {
   getCliToken
-} from "./chunk-4SGZG4XY.js";
-import "./chunk-ZZUOD757.js";
+} from "./chunk-J2DEBMRF.js";
+import "./chunk-ZQKDZXDO.js";
+import "./chunk-3FY3RJ26.js";
 import {
   CliValidationError
 } from "./chunk-UW5UN47B.js";
-import "./chunk-LYVNONC4.js";
-import "./chunk-QGM4M3NI.js";
+import "./chunk-JHENBQ5B.js";
 
 // src/commands/te-analysis/capability-shared.ts
 var ANALYSIS_GATEWAY_CLI_SERVICES = /* @__PURE__ */ new Set(["project", "system"]);
@@ -179,6 +179,13 @@ var directoryOffsetFlag = {
   alias: "o",
   min: 0
 };
+var certificationScopeFlag = {
+  name: "certification-scope",
+  type: "string",
+  required: false,
+  desc: "Asset certification filter scope: project follows the project switch, certified returns only certified assets, all returns every asset.",
+  default: "project"
+};
 var payloadFlag = {
   name: "payload",
   type: "json",
@@ -268,9 +275,18 @@ function listInput(ctx) {
 function reportListInput(ctx) {
   return compactInput({
     ...listInput(ctx),
-    model_types: optionalJson(ctx, "model-types")
+    model_types: optionalJson(ctx, "model-types"),
+    certification_scope: certificationScopeInput(ctx)
   });
 }
+function certificationScopeInput(ctx) {
+  const value = optionalString(ctx, "certification-scope");
+  if (value === void 0) return void 0;
+  if (!["project", "certified", "all"].includes(value)) {
+    throw new Error("--certification-scope must be project, certified, or all.");
+  }
+  return value;
+}
 function dashboardReportDataInput(ctx) {
   return compactInput({
     ...projectInput(ctx),
@@ -644,7 +660,8 @@ var metadataEventList = createAnalysisMetaCapabilityCommand({
     fieldsFlag,
     directoryLimitFlag,
     directoryOffsetFlag,
-    { name: "authenticated-only", type: "boolean", required: false, desc: "When true, return only authenticated events." }
+    { name: "authenticated-only", type: "boolean", required: false, desc: "When true, return only authenticated events." },
+    certificationScopeFlag
   ],
   risk: "read",
   validate: validateCatalogListFlags,
@@ -654,9 +671,23 @@ var metadataEventList = createAnalysisMetaCapabilityCommand({
     fields: optionalJson(ctx, "fields"),
     limit: optionalNumber(ctx, "limit"),
     offset: optionalNumber(ctx, "offset"),
-    authenticated_only: optionalBoolean(ctx, "authenticated-only")
-  })
+    authenticated_only: optionalBoolean(ctx, "authenticated-only"),
+    certification_scope: certificationScopeInput(ctx)
+  }),
+  postProcess: normalizeEventDirectory
 });
+function normalizeEventDirectory(result) {
+  if (result === null || typeof result !== "object" || Array.isArray(result)) {
+    return result;
+  }
+  const directory = result;
+  const items = Array.isArray(directory.items) ? directory.items : directory.events;
+  if (!Array.isArray(items)) {
+    return result;
+  }
+  const { events: _events, ...rest } = directory;
+  return { ...rest, items };
+}
 
 // src/commands/te-analysis/metadata-export.ts
 import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
@@ -935,7 +966,8 @@ var metadataPropertyList = createAnalysisMetaCapabilityCommand({
     fieldsFlag,
     directoryLimitFlag,
     directoryOffsetFlag,
-    { name: "authenticated-only", type: "boolean", required: false, desc: "When true, return only authenticated properties." }
+    { name: "authenticated-only", type: "boolean", required: false, desc: "When true, return only authenticated properties." },
+    certificationScopeFlag
   ],
   risk: "read",
   validate: validateCatalogListFlags,
@@ -948,7 +980,8 @@ var metadataPropertyList = createAnalysisMetaCapabilityCommand({
     fields: optionalJson(ctx, "fields"),
     limit: optionalNumber(ctx, "limit"),
     offset: optionalNumber(ctx, "offset"),
-    authenticated_only: optionalBoolean(ctx, "authenticated-only")
+    authenticated_only: optionalBoolean(ctx, "authenticated-only"),
+    certification_scope: certificationScopeInput(ctx)
   })
 });
 
@@ -1340,7 +1373,8 @@ var metadataMetricList = createAnalysisMetaCapabilityCommand({
     fieldsFlag,
     directoryLimitFlag,
     directoryOffsetFlag,
-    { name: "authenticated-only", type: "boolean", required: false, desc: "When true, return only authenticated metrics." }
+    { name: "authenticated-only", type: "boolean", required: false, desc: "When true, return only authenticated metrics." },
+    certificationScopeFlag
   ],
   risk: "read",
   validate: validateCatalogListFlags,
@@ -1351,7 +1385,8 @@ var metadataMetricList = createAnalysisMetaCapabilityCommand({
     fields: optionalJson(ctx, "fields"),
     limit: optionalNumber(ctx, "limit"),
     offset: optionalNumber(ctx, "offset"),
-    authenticated_only: optionalBoolean(ctx, "authenticated-only")
+    authenticated_only: optionalBoolean(ctx, "authenticated-only"),
+    certification_scope: certificationScopeInput(ctx)
   })
 });
 
@@ -1976,13 +2011,14 @@ var metadataCatalogExport = createAnalysisMetaCapabilityCommand({
     materialize: catalogArtifactMaterializer("analysis_metadata")
   },
   description: "Export the complete accessible analysis metadata catalog to JSONL with an integrity sidecar.",
-  flags: [projectIdFlag, requestIdFlag, asyncTimeoutSecondsFlag],
+  flags: [projectIdFlag, requestIdFlag, asyncTimeoutSecondsFlag, certificationScopeFlag],
   risk: "read",
   validate: validateCatalogExportFlags,
   buildInput: (ctx) => compactInput({
     ...projectInput(ctx),
     request_id: optionalString(ctx, "request-id"),
-    timeout_seconds: optionalNumber(ctx, "timeout-seconds")
+    timeout_seconds: optionalNumber(ctx, "timeout-seconds"),
+    certification_scope: certificationScopeInput(ctx)
   })
 });
 
@@ -2038,7 +2074,8 @@ var metadataCatalogList = createAnalysisMetaCapabilityCommand({
     projectIdFlag,
     queriesFlag,
     resourceTypesFlag,
-    limitPerTypeFlag
+    limitPerTypeFlag,
+    certificationScopeFlag
   ],
   risk: "read",
   validate: validateMetadataCatalogList,
@@ -2046,7 +2083,8 @@ var metadataCatalogList = createAnalysisMetaCapabilityCommand({
     ...projectInput(ctx),
     queries: optionalQueries(ctx),
     resource_types: optionalResourceTypes(ctx),
-    limit_per_type: ctx.optionalNum("limit-per-type")
+    limit_per_type: ctx.optionalNum("limit-per-type"),
+    certification_scope: certificationScopeInput(ctx)
   })
 });
 
@@ -2289,8 +2327,353 @@ var analysisMetaAssetOperationRecordExport = createAnalysisGovernanceCapabilityC
   buildInput: (ctx) => assetGovernanceInput(ctx, ["record_id"])
 });
 
+// src/commands/te-analysis/governance/asset-authentication-shared.ts
+import { createHash as createHash3, randomBytes as randomBytes3 } from "crypto";
+import { readFileSync, statSync } from "fs";
+import { mkdir as mkdir3, open as open3, rm as rm3 } from "fs/promises";
+import { dirname as dirname3, extname as extname3, resolve as resolve3 } from "path";
+var ASSET_TYPES = /* @__PURE__ */ new Set([
+  "event",
+  "event_prop",
+  "user_prop",
+  "user_tag",
+  "user_cluster",
+  "metric",
+  "report",
+  "dashboard"
+]);
+var OUTPUT_FIELDS = /* @__PURE__ */ new Set([
+  "resource_type",
+  "resource_key",
+  "display_name",
+  "description",
+  "owner_open_id",
+  "owner_name",
+  "authentication_status",
+  "heat_count90d",
+  "user_count90d",
+  "impact_degree"
+]);
+var assetTypesFlag = {
+  name: "asset-types",
+  type: "json",
+  required: false,
+  desc: "Optional JSON array of asset types. Omit for every supported type."
+};
+var authenticationStatusFilterFlag = {
+  name: "authentication-status",
+  type: "number",
+  required: false,
+  desc: "Authentication status: 1 for authenticated or 0 for unauthenticated.",
+  min: 0,
+  max: 1
+};
+var governanceQueriesFlag = {
+  name: "queries",
+  type: "json",
+  required: false,
+  desc: "Optional JSON array of 1 to 20 keywords matched against identity and display fields."
+};
+var heatCountGtFlag = {
+  name: "heat-count-gt",
+  type: "number",
+  required: false,
+  desc: "Strict recent-90-day heat threshold.",
+  min: 0
+};
+var userCountGtFlag = {
+  name: "user-count-gt",
+  type: "number",
+  required: false,
+  desc: "Strict recent-90-day user threshold.",
+  min: 0
+};
+var impactDegreeGtFlag = {
+  name: "impact-degree-gt",
+  type: "number",
+  required: false,
+  desc: "Strict governance impact threshold.",
+  min: 0
+};
+var matchFlag = {
+  name: "match",
+  type: "string",
+  required: false,
+  desc: "Combine multiple numeric thresholds with any or all. Default: all.",
+  default: "all"
+};
+var authenticationFieldsFlag = {
+  name: "fields",
+  type: "json",
+  required: false,
+  desc: "Optional JSON array of output fields."
+};
+var authenticationExportOutputFlag = {
+  name: "output",
+  type: "string",
+  required: true,
+  desc: "Local .jsonl output path. Integrity metadata is written to <output>.meta.json."
+};
+var authenticationFilterFlags = [
+  assetTypesFlag,
+  authenticationStatusFilterFlag,
+  governanceQueriesFlag,
+  heatCountGtFlag,
+  userCountGtFlag,
+  impactDegreeGtFlag,
+  matchFlag,
+  authenticationFieldsFlag
+];
+function validateAuthenticationFilters(ctx) {
+  validateQueriesFlag(ctx);
+  validateStringArray(ctx, "asset-types", ASSET_TYPES);
+  validateStringArray(ctx, "fields", OUTPUT_FIELDS);
+  const match = optionalString(ctx, "match");
+  if (match !== void 0 && match !== "any" && match !== "all") {
+    throw new CliValidationError("--match must be any or all");
+  }
+}
+function authenticationFilterInput(ctx) {
+  return compactInput({
+    ...projectInput(ctx),
+    asset_types: optionalJson(ctx, "asset-types"),
+    authentication_status: optionalNumber(ctx, "authentication-status"),
+    queries: optionalJson(ctx, "queries"),
+    heat_count_gt: optionalNumber(ctx, "heat-count-gt"),
+    user_count_gt: optionalNumber(ctx, "user-count-gt"),
+    impact_degree_gt: optionalNumber(ctx, "impact-degree-gt"),
+    match: optionalString(ctx, "match"),
+    fields: optionalJson(ctx, "fields")
+  });
+}
+function validateAuthenticationExport(ctx) {
+  validateAuthenticationFilters(ctx);
+  if (extname3(ctx.str("output").trim()).toLowerCase() !== ".jsonl") {
+    throw new CliValidationError("--output must use the .jsonl extension");
+  }
+}
+function authenticationExportPostProcess() {
+  return async (result, input, ctx) => {
+    if (typeof result !== "object" || result === null) {
+      throw new Error("Asset-authentication export returned an invalid response");
+    }
+    const data = result;
+    const rows = data.assets;
+    if (!Array.isArray(rows) || data.complete !== true || typeof data.total !== "number" || data.total !== rows.length || typeof data.snapshot_hash !== "string" || typeof data.stat_as_of !== "string") {
+      throw new Error("Asset-authentication export failed completeness or snapshot validation");
+    }
+    const outputPath = resolve3(ctx.str("output").trim());
+    const metaPath = `${outputPath}.meta.json`;
+    await mkdir3(dirname3(outputPath), { recursive: true });
+    await assertRegularFileOrMissing(outputPath);
+    await assertRegularFileOrMissing(metaPath);
+    const suffix = `${process.pid}.${randomBytes3(8).toString("hex")}`;
+    const partPath = `${outputPath}.part.${suffix}`;
+    const metaPartPath = `${metaPath}.part.${suffix}`;
+    const hash = createHash3("sha256");
+    let bytes = 0;
+    let handle;
+    try {
+      handle = await open3(partPath, "w", 384);
+      for (const row of rows) {
+        const line = `${JSON.stringify(row)}
+`;
+        const buffer = Buffer.from(line, "utf8");
+        hash.update(buffer);
+        bytes += buffer.length;
+        await handle.write(buffer);
+      }
+      await handle.sync();
+      await handle.close();
+      handle = void 0;
+      const checksum = hash.digest("hex");
+      const metadata = {
+        complete: true,
+        project_id: input.project_id,
+        total: rows.length,
+        stat_as_of: data.stat_as_of,
+        snapshot_hash: data.snapshot_hash,
+        checksum
+      };
+      handle = await open3(metaPartPath, "w", 384);
+      await handle.write(`${JSON.stringify(metadata)}
+`, void 0, "utf8");
+      await handle.sync();
+      await handle.close();
+      handle = void 0;
+      await publishCatalogPair(partPath, outputPath, metaPartPath, metaPath, suffix);
+      return {
+        output_path: outputPath,
+        metadata_path: metaPath,
+        format: "jsonl",
+        row_count: rows.length,
+        bytes,
+        checksum,
+        snapshot_hash: data.snapshot_hash,
+        complete: true
+      };
+    } catch (error) {
+      await handle?.close().catch(() => void 0);
+      await rm3(partPath, { force: true }).catch(() => void 0);
+      await rm3(metaPartPath, { force: true }).catch(() => void 0);
+      throw error;
+    }
+  };
+}
+function assetRefsInput(ctx) {
+  const inline = optionalJson(ctx, "asset-refs");
+  const file = optionalString(ctx, "asset-file");
+  const assetType = optionalString(ctx, "asset-type");
+  const assetIds = optionalJson(ctx, "asset-ids");
+  const sources = Number(inline !== void 0) + Number(file !== void 0) + Number(assetType !== void 0 || assetIds !== void 0);
+  if (sources !== 1) {
+    throw new CliValidationError("Use exactly one input: --asset-refs, --asset-file, or --asset-type with --asset-ids");
+  }
+  let values;
+  if (inline !== void 0) {
+    values = inline;
+  } else if (file !== void 0) {
+    const path = resolve3(file);
+    if (!statSync(path, { throwIfNoEntry: false })?.isFile()) {
+      throw new CliValidationError(`--asset-file must be a regular file: ${path}`);
+    }
+    values = readFileSync(path, "utf8").split(/\r?\n/).filter(Boolean).map((line, index) => {
+      try {
+        return JSON.parse(line);
+      } catch {
+        throw new CliValidationError(`--asset-file line ${index + 1} is not valid JSON`);
+      }
+    });
+  } else {
+    if (assetType === void 0 || assetIds === void 0 || !Array.isArray(assetIds)) {
+      throw new CliValidationError("--asset-type and --asset-ids must be provided together");
+    }
+    values = assetIds.map((resourceKey) => ({ resource_type: assetType, resource_key: resourceKey }));
+  }
+  if (!Array.isArray(values) || values.length === 0) {
+    throw new CliValidationError("The selected asset reference set must not be empty");
+  }
+  const refs = values.map((value, index) => normalizeRef(value, index));
+  return [...new Map(refs.map((ref) => [`${ref.resource_type}
${ref.resource_key}`, ref])).values()];
+}
+function normalizeRef(value, index) {
+  if (typeof value !== "object" || value === null) {
+    throw new CliValidationError(`Asset reference ${index + 1} must be an object`);
+  }
+  const source = value;
+  const resourceType = source.resource_type;
+  const resourceKey = source.resource_key;
+  if (typeof resourceType !== "string" || !ASSET_TYPES.has(resourceType) || typeof resourceKey !== "string" && typeof resourceKey !== "number" || String(resourceKey).trim() === "") {
+    throw new CliValidationError(`Asset reference ${index + 1} requires a supported resource_type and non-empty resource_key`);
+  }
+  return { resource_type: resourceType, resource_key: String(resourceKey) };
+}
+function validateStringArray(ctx, name, allowed) {
+  const value = optionalJson(ctx, name);
+  if (value === void 0) return;
+  if (!Array.isArray(value) || value.length === 0 || value.some((item) => typeof item !== "string" || !allowed.has(item))) {
+    throw new CliValidationError(`--${name} must be a non-empty JSON array of supported values`);
+  }
+}
+
+// src/commands/te-analysis/governance/asset-authentication-list.ts
+var analysisGovernanceAssetAuthenticationList = createAnalysisGovernanceCapabilityCommand({
+  resource: "asset-authentication",
+  command: "list",
+  capabilityId: "governance.asset_authentication.list",
+  description: "Preview asset authentication with server-side filtering, sorting, and pagination.",
+  flags: [projectIdFlag, ...authenticationFilterFlags, directoryLimitFlag, directoryOffsetFlag],
+  risk: "read",
+  validate: validateAuthenticationFilters,
+  buildInput: (ctx) => compactInput({
+    ...authenticationFilterInput(ctx),
+    limit: optionalNumber(ctx, "limit"),
+    offset: optionalNumber(ctx, "offset")
+  })
+});
+
+// src/commands/te-analysis/governance/asset-authentication-export.ts
+var analysisGovernanceAssetAuthenticationExport = createAnalysisGovernanceCapabilityCommand({
+  resource: "asset-authentication",
+  command: "export",
+  capabilityId: "governance.asset_authentication.export",
+  description: "Export the complete filtered asset-authentication catalog to JSONL without pagination.",
+  flags: [projectIdFlag, ...authenticationFilterFlags, authenticationExportOutputFlag],
+  risk: "read",
+  validate: validateAuthenticationExport,
+  buildInput: authenticationFilterInput,
+  postProcess: authenticationExportPostProcess()
+});
+
+// src/commands/te-analysis/governance/asset-authentication-update.ts
+var authenticationStatusFlag = {
+  name: "authentication-status",
+  type: "number",
+  required: true,
+  desc: "Target authentication status: 1 authenticates and 0 revokes.",
+  min: 0,
+  max: 1
+};
+var assetRefsFlag = {
+  name: "asset-refs",
+  type: "json",
+  required: false,
+  desc: "Inline JSON array of {resource_type,resource_key} asset references."
+};
+var assetFileFlag = {
+  name: "asset-file",
+  type: "string",
+  required: false,
+  desc: "JSONL file whose rows contain resource_type and resource_key."
+};
+var assetTypeFlag = {
+  name: "asset-type",
+  type: "string",
+  required: false,
+  desc: "Convenience asset type used together with --asset-ids."
+};
+var assetIdsFlag = {
+  name: "asset-ids",
+  type: "json",
+  required: false,
+  desc: "Convenience JSON array of business keys used together with --asset-type."
+};
+var expectedSnapshotHashFlag = {
+  name: "expected-snapshot-hash",
+  type: "string",
+  required: false,
+  desc: "Optional snapshot_hash from the export sidecar. A mismatch rejects the whole update."
+};
+var analysisGovernanceAssetAuthenticationUpdate = createAnalysisGovernanceCapabilityCommand({
+  resource: "asset-authentication",
+  command: "update",
+  capabilityId: "governance.asset_authentication.update",
+  description: "Batch update explicit typed asset references.",
+  flags: [
+    projectIdFlag,
+    authenticationStatusFlag,
+    assetRefsFlag,
+    assetFileFlag,
+    assetTypeFlag,
+    assetIdsFlag,
+    expectedSnapshotHashFlag,
+    requestIdFlag
+  ],
+  risk: "write",
+  buildInput: (ctx) => compactInput({
+    project_id: ctx.num("project-id"),
+    authentication_status: ctx.num("authentication-status"),
+    asset_refs: assetRefsInput(ctx),
+    expected_snapshot_hash: optionalString(ctx, "expected-snapshot-hash"),
+    request_id: optionalString(ctx, "request-id")
+  })
+});
+
 // src/commands/te-analysis/governance/index.ts
 var commands12 = [
+  analysisGovernanceAssetAuthenticationList,
+  analysisGovernanceAssetAuthenticationExport,
+  analysisGovernanceAssetAuthenticationUpdate,
   analysisMetaAssetUsageList,
   analysisMetaAssetUsageExport,
   analysisMetaAssetBatchInfoExport,
@@ -2320,7 +2703,15 @@ var reportList = createAnalysisCapabilityCommand({
   command: "list",
   capabilityId: "analysis.report.list",
   description: "List analysis reports visible to the current user through the capability gateway.",
-  flags: [projectIdFlag, queriesFlag, fieldsFlag, reportModelTypesFlag, reportListLimitFlag, directoryOffsetFlag],
+  flags: [
+    projectIdFlag,
+    queriesFlag,
+    fieldsFlag,
+    reportModelTypesFlag,
+    reportListLimitFlag,
+    directoryOffsetFlag,
+    certificationScopeFlag
+  ],
   risk: "read",
   validate: validateQueriesFlag,
   buildInput: reportListInput
@@ -2340,7 +2731,8 @@ var reportListExport = createAnalysisCapabilityCommand({
     reportModelTypesFlag,
     requestIdFlag,
     artifactFormatFlag,
-    asyncTimeoutSecondsFlag
+    asyncTimeoutSecondsFlag,
+    certificationScopeFlag
   ],
   risk: "read",
   validate: validateQueriesFlag,
@@ -2349,6 +2741,7 @@ var reportListExport = createAnalysisCapabilityCommand({
     queries: optionalQueries(ctx),
     fields: optionalJson(ctx, "fields"),
     model_types: optionalJson(ctx, "model-types"),
+    certification_scope: certificationScopeInput(ctx),
     ...exportLifecycleInput(ctx)
   })
 });
@@ -2738,11 +3131,15 @@ var dashboardList = createAnalysisCapabilityCommand({
       alias: "f"
     },
     directoryLimitFlag,
-    directoryOffsetFlag
+    directoryOffsetFlag,
+    certificationScopeFlag
   ],
   risk: "read",
   validate: validateQueriesFlag,
-  buildInput: listInput
+  buildInput: (ctx) => compactInput({
+    ...listInput(ctx),
+    certification_scope: certificationScopeInput(ctx)
+  })
 });
 
 // src/commands/te-analysis/dashboard/create.ts
@@ -2775,7 +3172,7 @@ var dashboardGet = createAnalysisCapabilityCommand({
   resource: "dashboard",
   command: "get",
   capabilityId: "analysis.dashboard.get",
-  description: "Get one dashboard detail, including location, creator, create/update time, settings, reports, notes, and share information.",
+  description: "Get one dashboard detail, including normalized effective settings, saved filter configuration, location, reports, notes, and sharing context.",
   flags: [
     projectIdFlag,
     { name: "dashboard-id", type: "number", required: true, desc: "Dashboard ID." },
@@ -2794,10 +3191,10 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
   resource: "dashboard",
   command: "update",
   capabilityId: "analysis.dashboard.update",
-  description: "Update dashboard settings, create/update a dashboard note, or replace the dashboard-level business filter. Use --operation settings, note-upsert, or business-filter.",
+  description: "Update dashboard settings, create/update a dashboard note, save a dashboard-wide default filter, or replace the dashboard-level business filter. Use --operation settings, note-upsert, default-filter, or business-filter.",
   flags: [
     projectIdFlag,
-    { name: "operation", type: "string", required: true, desc: "Update operation: settings, note-upsert, or business-filter." },
+    { name: "operation", type: "string", required: true, desc: "Update operation: settings, note-upsert, default-filter, or business-filter." },
     { name: "dashboard-id", type: "number", required: false, desc: "Dashboard ID for a single-dashboard update." },
     { name: "dashboard-ids", type: "json", required: false, desc: "Dashboard ID array for batch settings updates." },
     { name: "dashboard-name", type: "string", required: false, desc: "Dashboard name for single rename." },
@@ -2808,7 +3205,8 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
     { name: "note-title", type: "string", required: false, desc: "Dashboard note title." },
     { name: "description", type: "string", required: false, desc: "Dashboard note description." },
     { name: "ui-config", type: "string", required: false, desc: "Dashboard or note UI config string." },
-    { name: "filter", type: "json", required: false, desc: 'Dashboard-level business filter in snake_case QP form. Required with --operation business-filter. Pass {"junction_kind":"and","ta_filters":[]} to clear it.' },
+    { name: "filter-name", type: "string", required: false, desc: "Saved filter name. Required with --operation default-filter." },
+    { name: "filter", type: "json", required: false, desc: 'Saved filter in snake_case QP form. Required with --operation default-filter or business-filter. Pass {"junction_kind":"and","ta_filters":[]} to clear a business filter.' },
     payloadFlag
   ],
   risk: "write",
@@ -2825,6 +3223,7 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
     note_title: optionalString(ctx, "note-title"),
     description: optionalString(ctx, "description"),
     ui_config: optionalString(ctx, "ui-config"),
+    filter_name: optionalString(ctx, "filter-name"),
     filter: optionalJson(ctx, "filter"),
     payload: optionalJson(ctx, "payload")
   })
@@ -3301,7 +3700,7 @@ var commands23 = [
 var run_default = commands23;
 
 // src/commands/te-analysis/artifact/download.ts
-import { resolve as resolve3 } from "path";
+import { resolve as resolve4 } from "path";
 function artifactPath(runId, artifactId) {
   return `runs/${encodeURIComponent(runId)}/artifacts/${encodeURIComponent(artifactId)}/download`;
 }
@@ -3325,7 +3724,7 @@ var artifactDownload = {
       resolveGatewayDomain("analysis"),
       artifactPath(ctx.str("run-id"), ctx.str("artifact-id"))
     ),
-    output_path: resolve3(ctx.str("output")),
+    output_path: resolve4(ctx.str("output")),
     ...ctx.bool("force") ? { force: true } : {}
   }),
   execute: async (ctx) => {
@@ -4664,7 +5063,7 @@ var commands39 = [drilldownUserEventsRun, drilldownUserEventsExport];
 var drilldown_user_events_default = commands39;
 
 // src/commands/te-analysis/user/index.ts
-import { existsSync, statSync } from "fs";
+import { existsSync, statSync as statSync2 } from "fs";
 var authenticatedOnlyFlag = {
   name: "authenticated-only",
   type: "boolean",
@@ -4894,7 +5293,7 @@ function idImportCapability(command) {
         throw new Error("Pass exactly one of --input-file, --input-file-id, or --file-content");
       }
       const localFile = ctx.str("input-file");
-      if (localFile && (!existsSync(localFile) || !statSync(localFile).isFile())) {
+      if (localFile && (!existsSync(localFile) || !statSync2(localFile).isFile())) {
         throw new Error(`--input-file must reference a readable local file: ${localFile}`);
       }
     },
@@ -7832,7 +8231,7 @@ var commands79 = [
 var alert_notice_config_default = commands79;
 
 // src/commands/te-analysis/system/shared.ts
-import { readFileSync, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync2, statSync as statSync3 } from "fs";
 var secretValues = /* @__PURE__ */ new WeakMap();
 var companyIdField = {
   flag: "company-id",
@@ -7995,14 +8394,14 @@ function secretValue(ctx, secret) {
   let value;
   const file = ctx.str(`${secret.flag}-file`);
   if (file) {
-    const stat = statSync2(file);
+    const stat = statSync3(file);
     if (!stat.isFile()) throw validation(`--${secret.flag}-file must reference a regular file.`);
     if ((stat.mode & 63) !== 0) {
       throw validation(`--${secret.flag}-file must not be readable or writable by group/others (use chmod 600).`);
     }
-    value = nonEmptySecret(readFileSync(file, "utf8"), secret.flag);
+    value = nonEmptySecret(readFileSync2(file, "utf8"), secret.flag);
   } else if (ctx.bool(`${secret.flag}-stdin`)) {
-    value = nonEmptySecret(readFileSync(0, "utf8"), secret.flag);
+    value = nonEmptySecret(readFileSync2(0, "utf8"), secret.flag);
   }
   values.set(secret.flag, value);
   return value;