@thinkingai/ae-cli 6.1.17 → 6.1.19

package/dist/{te-analysis-O6DCO6BS.js → te-analysis-MNCG65LU.js}

@@ -1,3 +1,4 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   assertOutputPathAvailable,
   clientWaitTimeoutSeconds,
@@ -6,17 +7,17 @@ import {
   waitForAnalysisRun,
   withAsyncArtifactLifecycle,
   withInterruptSignal
-} from "./chunk-YA6SMTXG.js";
+} from "./chunk-S5PONFBM.js";
 import {
   createCapabilityCommand
-} from "./chunk-VR3LCBHW.js";
+} from "./chunk-DKEXH6Q5.js";
 import {
   registerCapabilityGatewayRoute,
   resolveGatewayDomain
-} from "./chunk-PTE56QPL.js";
+} from "./chunk-TKHSULJT.js";
 import {
   withOutputMetadata
-} from "./chunk-GT46FPXN.js";
+} from "./chunk-KEWVSO64.js";
 import {
   CapabilityGatewayError,
   buildCapabilityGatewayUrl,
@@ -27,17 +28,17 @@ import {
   requestCapabilityGatewayWithEnvelope,
   uploadInputFile,
   validateCapability
-} from "./chunk-ILIU36SU.js";
-import "./chunk-6EIJSNBD.js";
+} from "./chunk-GJXRF7Y6.js";
+import "./chunk-Y74WTIKJ.js";
 import {
   getCliToken
-} from "./chunk-4SGZG4XY.js";
-import "./chunk-ZZUOD757.js";
+} from "./chunk-RWXIXOZG.js";
+import "./chunk-O6K2ODUE.js";
+import "./chunk-KZ6ZHF5J.js";
 import {
   CliValidationError
-} from "./chunk-UW5UN47B.js";
-import "./chunk-LYVNONC4.js";
-import "./chunk-QGM4M3NI.js";
+} from "./chunk-533JK3YX.js";
+import "./chunk-FR2EDAQM.js";
 
 // src/commands/te-analysis/capability-shared.ts
 var ANALYSIS_GATEWAY_CLI_SERVICES = /* @__PURE__ */ new Set(["project", "system"]);
@@ -179,6 +180,13 @@ var directoryOffsetFlag = {
   alias: "o",
   min: 0
 };
+var certificationScopeFlag = {
+  name: "certification-scope",
+  type: "string",
+  required: false,
+  desc: "Asset certification filter scope: project follows the project switch, certified returns only certified assets, all returns every asset.",
+  default: "project"
+};
 var payloadFlag = {
   name: "payload",
   type: "json",
@@ -268,9 +276,18 @@ function listInput(ctx) {
 function reportListInput(ctx) {
   return compactInput({
     ...listInput(ctx),
-    model_types: optionalJson(ctx, "model-types")
+    model_types: optionalJson(ctx, "model-types"),
+    certification_scope: certificationScopeInput(ctx)
   });
 }
+function certificationScopeInput(ctx) {
+  const value = optionalString(ctx, "certification-scope");
+  if (value === void 0) return void 0;
+  if (!["project", "certified", "all"].includes(value)) {
+    throw new Error("--certification-scope must be project, certified, or all.");
+  }
+  return value;
+}
 function dashboardReportDataInput(ctx) {
   return compactInput({
     ...projectInput(ctx),
@@ -644,7 +661,8 @@ var metadataEventList = createAnalysisMetaCapabilityCommand({
     fieldsFlag,
     directoryLimitFlag,
     directoryOffsetFlag,
-    { name: "authenticated-only", type: "boolean", required: false, desc: "When true, return only authenticated events." }
+    { name: "authenticated-only", type: "boolean", required: false, desc: "When true, return only authenticated events." },
+    certificationScopeFlag
   ],
   risk: "read",
   validate: validateCatalogListFlags,
@@ -654,9 +672,23 @@ var metadataEventList = createAnalysisMetaCapabilityCommand({
     fields: optionalJson(ctx, "fields"),
     limit: optionalNumber(ctx, "limit"),
     offset: optionalNumber(ctx, "offset"),
-    authenticated_only: optionalBoolean(ctx, "authenticated-only")
-  })
+    authenticated_only: optionalBoolean(ctx, "authenticated-only"),
+    certification_scope: certificationScopeInput(ctx)
+  }),
+  postProcess: normalizeEventDirectory
 });
+function normalizeEventDirectory(result) {
+  if (result === null || typeof result !== "object" || Array.isArray(result)) {
+    return result;
+  }
+  const directory = result;
+  const items = Array.isArray(directory.items) ? directory.items : directory.events;
+  if (!Array.isArray(items)) {
+    return result;
+  }
+  const { events: _events, ...rest } = directory;
+  return { ...rest, items };
+}
 
 // src/commands/te-analysis/metadata-export.ts
 import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
@@ -935,7 +967,8 @@ var metadataPropertyList = createAnalysisMetaCapabilityCommand({
     fieldsFlag,
     directoryLimitFlag,
     directoryOffsetFlag,
-    { name: "authenticated-only", type: "boolean", required: false, desc: "When true, return only authenticated properties." }
+    { name: "authenticated-only", type: "boolean", required: false, desc: "When true, return only authenticated properties." },
+    certificationScopeFlag
   ],
   risk: "read",
   validate: validateCatalogListFlags,
@@ -948,7 +981,8 @@ var metadataPropertyList = createAnalysisMetaCapabilityCommand({
     fields: optionalJson(ctx, "fields"),
     limit: optionalNumber(ctx, "limit"),
     offset: optionalNumber(ctx, "offset"),
-    authenticated_only: optionalBoolean(ctx, "authenticated-only")
+    authenticated_only: optionalBoolean(ctx, "authenticated-only"),
+    certification_scope: certificationScopeInput(ctx)
   })
 });
 
@@ -1340,7 +1374,8 @@ var metadataMetricList = createAnalysisMetaCapabilityCommand({
     fieldsFlag,
     directoryLimitFlag,
     directoryOffsetFlag,
-    { name: "authenticated-only", type: "boolean", required: false, desc: "When true, return only authenticated metrics." }
+    { name: "authenticated-only", type: "boolean", required: false, desc: "When true, return only authenticated metrics." },
+    certificationScopeFlag
   ],
   risk: "read",
   validate: validateCatalogListFlags,
@@ -1351,7 +1386,8 @@ var metadataMetricList = createAnalysisMetaCapabilityCommand({
     fields: optionalJson(ctx, "fields"),
     limit: optionalNumber(ctx, "limit"),
     offset: optionalNumber(ctx, "offset"),
-    authenticated_only: optionalBoolean(ctx, "authenticated-only")
+    authenticated_only: optionalBoolean(ctx, "authenticated-only"),
+    certification_scope: certificationScopeInput(ctx)
   })
 });
 
@@ -1976,13 +2012,14 @@ var metadataCatalogExport = createAnalysisMetaCapabilityCommand({
     materialize: catalogArtifactMaterializer("analysis_metadata")
   },
   description: "Export the complete accessible analysis metadata catalog to JSONL with an integrity sidecar.",
-  flags: [projectIdFlag, requestIdFlag, asyncTimeoutSecondsFlag],
+  flags: [projectIdFlag, requestIdFlag, asyncTimeoutSecondsFlag, certificationScopeFlag],
   risk: "read",
   validate: validateCatalogExportFlags,
   buildInput: (ctx) => compactInput({
     ...projectInput(ctx),
     request_id: optionalString(ctx, "request-id"),
-    timeout_seconds: optionalNumber(ctx, "timeout-seconds")
+    timeout_seconds: optionalNumber(ctx, "timeout-seconds"),
+    certification_scope: certificationScopeInput(ctx)
   })
 });
 
@@ -2038,7 +2075,8 @@ var metadataCatalogList = createAnalysisMetaCapabilityCommand({
     projectIdFlag,
     queriesFlag,
     resourceTypesFlag,
-    limitPerTypeFlag
+    limitPerTypeFlag,
+    certificationScopeFlag
   ],
   risk: "read",
   validate: validateMetadataCatalogList,
@@ -2046,7 +2084,8 @@ var metadataCatalogList = createAnalysisMetaCapabilityCommand({
     ...projectInput(ctx),
     queries: optionalQueries(ctx),
     resource_types: optionalResourceTypes(ctx),
-    limit_per_type: ctx.optionalNum("limit-per-type")
+    limit_per_type: ctx.optionalNum("limit-per-type"),
+    certification_scope: certificationScopeInput(ctx)
   })
 });
 
@@ -2289,8 +2328,353 @@ var analysisMetaAssetOperationRecordExport = createAnalysisGovernanceCapabilityC
   buildInput: (ctx) => assetGovernanceInput(ctx, ["record_id"])
 });
 
+// src/commands/te-analysis/governance/asset-authentication-shared.ts
+import { createHash as createHash3, randomBytes as randomBytes3 } from "crypto";
+import { readFileSync, statSync } from "fs";
+import { mkdir as mkdir3, open as open3, rm as rm3 } from "fs/promises";
+import { dirname as dirname3, extname as extname3, resolve as resolve3 } from "path";
+var ASSET_TYPES = /* @__PURE__ */ new Set([
+  "event",
+  "event_prop",
+  "user_prop",
+  "user_tag",
+  "user_cluster",
+  "metric",
+  "report",
+  "dashboard"
+]);
+var OUTPUT_FIELDS = /* @__PURE__ */ new Set([
+  "resource_type",
+  "resource_key",
+  "display_name",
+  "description",
+  "owner_open_id",
+  "owner_name",
+  "authentication_status",
+  "heat_count90d",
+  "user_count90d",
+  "impact_degree"
+]);
+var assetTypesFlag = {
+  name: "asset-types",
+  type: "json",
+  required: false,
+  desc: "Optional JSON array of asset types. Omit for every supported type."
+};
+var authenticationStatusFilterFlag = {
+  name: "authentication-status",
+  type: "number",
+  required: false,
+  desc: "Authentication status: 1 for authenticated or 0 for unauthenticated.",
+  min: 0,
+  max: 1
+};
+var governanceQueriesFlag = {
+  name: "queries",
+  type: "json",
+  required: false,
+  desc: "Optional JSON array of 1 to 20 keywords matched against identity and display fields."
+};
+var heatCountGtFlag = {
+  name: "heat-count-gt",
+  type: "number",
+  required: false,
+  desc: "Strict recent-90-day heat threshold.",
+  min: 0
+};
+var userCountGtFlag = {
+  name: "user-count-gt",
+  type: "number",
+  required: false,
+  desc: "Strict recent-90-day user threshold.",
+  min: 0
+};
+var impactDegreeGtFlag = {
+  name: "impact-degree-gt",
+  type: "number",
+  required: false,
+  desc: "Strict governance impact threshold.",
+  min: 0
+};
+var matchFlag = {
+  name: "match",
+  type: "string",
+  required: false,
+  desc: "Combine multiple numeric thresholds with any or all. Default: all.",
+  default: "all"
+};
+var authenticationFieldsFlag = {
+  name: "fields",
+  type: "json",
+  required: false,
+  desc: "Optional JSON array of output fields."
+};
+var authenticationExportOutputFlag = {
+  name: "output",
+  type: "string",
+  required: true,
+  desc: "Local .jsonl output path. Integrity metadata is written to <output>.meta.json."
+};
+var authenticationFilterFlags = [
+  assetTypesFlag,
+  authenticationStatusFilterFlag,
+  governanceQueriesFlag,
+  heatCountGtFlag,
+  userCountGtFlag,
+  impactDegreeGtFlag,
+  matchFlag,
+  authenticationFieldsFlag
+];
+function validateAuthenticationFilters(ctx) {
+  validateQueriesFlag(ctx);
+  validateStringArray(ctx, "asset-types", ASSET_TYPES);
+  validateStringArray(ctx, "fields", OUTPUT_FIELDS);
+  const match = optionalString(ctx, "match");
+  if (match !== void 0 && match !== "any" && match !== "all") {
+    throw new CliValidationError("--match must be any or all");
+  }
+}
+function authenticationFilterInput(ctx) {
+  return compactInput({
+    ...projectInput(ctx),
+    asset_types: optionalJson(ctx, "asset-types"),
+    authentication_status: optionalNumber(ctx, "authentication-status"),
+    queries: optionalJson(ctx, "queries"),
+    heat_count_gt: optionalNumber(ctx, "heat-count-gt"),
+    user_count_gt: optionalNumber(ctx, "user-count-gt"),
+    impact_degree_gt: optionalNumber(ctx, "impact-degree-gt"),
+    match: optionalString(ctx, "match"),
+    fields: optionalJson(ctx, "fields")
+  });
+}
+function validateAuthenticationExport(ctx) {
+  validateAuthenticationFilters(ctx);
+  if (extname3(ctx.str("output").trim()).toLowerCase() !== ".jsonl") {
+    throw new CliValidationError("--output must use the .jsonl extension");
+  }
+}
+function authenticationExportPostProcess() {
+  return async (result, input, ctx) => {
+    if (typeof result !== "object" || result === null) {
+      throw new Error("Asset-authentication export returned an invalid response");
+    }
+    const data = result;
+    const rows = data.assets;
+    if (!Array.isArray(rows) || data.complete !== true || typeof data.total !== "number" || data.total !== rows.length || typeof data.snapshot_hash !== "string" || typeof data.stat_as_of !== "string") {
+      throw new Error("Asset-authentication export failed completeness or snapshot validation");
+    }
+    const outputPath = resolve3(ctx.str("output").trim());
+    const metaPath = `${outputPath}.meta.json`;
+    await mkdir3(dirname3(outputPath), { recursive: true });
+    await assertRegularFileOrMissing(outputPath);
+    await assertRegularFileOrMissing(metaPath);
+    const suffix = `${process.pid}.${randomBytes3(8).toString("hex")}`;
+    const partPath = `${outputPath}.part.${suffix}`;
+    const metaPartPath = `${metaPath}.part.${suffix}`;
+    const hash = createHash3("sha256");
+    let bytes = 0;
+    let handle;
+    try {
+      handle = await open3(partPath, "w", 384);
+      for (const row of rows) {
+        const line = `${JSON.stringify(row)}
+`;
+        const buffer = Buffer.from(line, "utf8");
+        hash.update(buffer);
+        bytes += buffer.length;
+        await handle.write(buffer);
+      }
+      await handle.sync();
+      await handle.close();
+      handle = void 0;
+      const checksum = hash.digest("hex");
+      const metadata = {
+        complete: true,
+        project_id: input.project_id,
+        total: rows.length,
+        stat_as_of: data.stat_as_of,
+        snapshot_hash: data.snapshot_hash,
+        checksum
+      };
+      handle = await open3(metaPartPath, "w", 384);
+      await handle.write(`${JSON.stringify(metadata)}
+`, void 0, "utf8");
+      await handle.sync();
+      await handle.close();
+      handle = void 0;
+      await publishCatalogPair(partPath, outputPath, metaPartPath, metaPath, suffix);
+      return {
+        output_path: outputPath,
+        metadata_path: metaPath,
+        format: "jsonl",
+        row_count: rows.length,
+        bytes,
+        checksum,
+        snapshot_hash: data.snapshot_hash,
+        complete: true
+      };
+    } catch (error) {
+      await handle?.close().catch(() => void 0);
+      await rm3(partPath, { force: true }).catch(() => void 0);
+      await rm3(metaPartPath, { force: true }).catch(() => void 0);
+      throw error;
+    }
+  };
+}
+function assetRefsInput(ctx) {
+  const inline = optionalJson(ctx, "asset-refs");
+  const file = optionalString(ctx, "asset-file");
+  const assetType = optionalString(ctx, "asset-type");
+  const assetIds = optionalJson(ctx, "asset-ids");
+  const sources = Number(inline !== void 0) + Number(file !== void 0) + Number(assetType !== void 0 || assetIds !== void 0);
+  if (sources !== 1) {
+    throw new CliValidationError("Use exactly one input: --asset-refs, --asset-file, or --asset-type with --asset-ids");
+  }
+  let values;
+  if (inline !== void 0) {
+    values = inline;
+  } else if (file !== void 0) {
+    const path = resolve3(file);
+    if (!statSync(path, { throwIfNoEntry: false })?.isFile()) {
+      throw new CliValidationError(`--asset-file must be a regular file: ${path}`);
+    }
+    values = readFileSync(path, "utf8").split(/\r?\n/).filter(Boolean).map((line, index) => {
+      try {
+        return JSON.parse(line);
+      } catch {
+        throw new CliValidationError(`--asset-file line ${index + 1} is not valid JSON`);
+      }
+    });
+  } else {
+    if (assetType === void 0 || assetIds === void 0 || !Array.isArray(assetIds)) {
+      throw new CliValidationError("--asset-type and --asset-ids must be provided together");
+    }
+    values = assetIds.map((resourceKey) => ({ resource_type: assetType, resource_key: resourceKey }));
+  }
+  if (!Array.isArray(values) || values.length === 0) {
+    throw new CliValidationError("The selected asset reference set must not be empty");
+  }
+  const refs = values.map((value, index) => normalizeRef(value, index));
+  return [...new Map(refs.map((ref) => [`${ref.resource_type}
${ref.resource_key}`, ref])).values()];
+}
+function normalizeRef(value, index) {
+  if (typeof value !== "object" || value === null) {
+    throw new CliValidationError(`Asset reference ${index + 1} must be an object`);
+  }
+  const source = value;
+  const resourceType = source.resource_type;
+  const resourceKey = source.resource_key;
+  if (typeof resourceType !== "string" || !ASSET_TYPES.has(resourceType) || typeof resourceKey !== "string" && typeof resourceKey !== "number" || String(resourceKey).trim() === "") {
+    throw new CliValidationError(`Asset reference ${index + 1} requires a supported resource_type and non-empty resource_key`);
+  }
+  return { resource_type: resourceType, resource_key: String(resourceKey) };
+}
+function validateStringArray(ctx, name, allowed) {
+  const value = optionalJson(ctx, name);
+  if (value === void 0) return;
+  if (!Array.isArray(value) || value.length === 0 || value.some((item) => typeof item !== "string" || !allowed.has(item))) {
+    throw new CliValidationError(`--${name} must be a non-empty JSON array of supported values`);
+  }
+}
+
+// src/commands/te-analysis/governance/asset-authentication-list.ts
+var analysisGovernanceAssetAuthenticationList = createAnalysisGovernanceCapabilityCommand({
+  resource: "asset-authentication",
+  command: "list",
+  capabilityId: "governance.asset_authentication.list",
+  description: "Preview asset authentication with server-side filtering, sorting, and pagination.",
+  flags: [projectIdFlag, ...authenticationFilterFlags, directoryLimitFlag, directoryOffsetFlag],
+  risk: "read",
+  validate: validateAuthenticationFilters,
+  buildInput: (ctx) => compactInput({
+    ...authenticationFilterInput(ctx),
+    limit: optionalNumber(ctx, "limit"),
+    offset: optionalNumber(ctx, "offset")
+  })
+});
+
+// src/commands/te-analysis/governance/asset-authentication-export.ts
+var analysisGovernanceAssetAuthenticationExport = createAnalysisGovernanceCapabilityCommand({
+  resource: "asset-authentication",
+  command: "export",
+  capabilityId: "governance.asset_authentication.export",
+  description: "Export the complete filtered asset-authentication catalog to JSONL without pagination.",
+  flags: [projectIdFlag, ...authenticationFilterFlags, authenticationExportOutputFlag],
+  risk: "read",
+  validate: validateAuthenticationExport,
+  buildInput: authenticationFilterInput,
+  postProcess: authenticationExportPostProcess()
+});
+
+// src/commands/te-analysis/governance/asset-authentication-update.ts
+var authenticationStatusFlag = {
+  name: "authentication-status",
+  type: "number",
+  required: true,
+  desc: "Target authentication status: 1 authenticates and 0 revokes.",
+  min: 0,
+  max: 1
+};
+var assetRefsFlag = {
+  name: "asset-refs",
+  type: "json",
+  required: false,
+  desc: "Inline JSON array of {resource_type,resource_key} asset references."
+};
+var assetFileFlag = {
+  name: "asset-file",
+  type: "string",
+  required: false,
+  desc: "JSONL file whose rows contain resource_type and resource_key."
+};
+var assetTypeFlag = {
+  name: "asset-type",
+  type: "string",
+  required: false,
+  desc: "Convenience asset type used together with --asset-ids."
+};
+var assetIdsFlag = {
+  name: "asset-ids",
+  type: "json",
+  required: false,
+  desc: "Convenience JSON array of business keys used together with --asset-type."
+};
+var expectedSnapshotHashFlag = {
+  name: "expected-snapshot-hash",
+  type: "string",
+  required: false,
+  desc: "Optional snapshot_hash from the export sidecar. A mismatch rejects the whole update."
+};
+var analysisGovernanceAssetAuthenticationUpdate = createAnalysisGovernanceCapabilityCommand({
+  resource: "asset-authentication",
+  command: "update",
+  capabilityId: "governance.asset_authentication.update",
+  description: "Batch update explicit typed asset references.",
+  flags: [
+    projectIdFlag,
+    authenticationStatusFlag,
+    assetRefsFlag,
+    assetFileFlag,
+    assetTypeFlag,
+    assetIdsFlag,
+    expectedSnapshotHashFlag,
+    requestIdFlag
+  ],
+  risk: "write",
+  buildInput: (ctx) => compactInput({
+    project_id: ctx.num("project-id"),
+    authentication_status: ctx.num("authentication-status"),
+    asset_refs: assetRefsInput(ctx),
+    expected_snapshot_hash: optionalString(ctx, "expected-snapshot-hash"),
+    request_id: optionalString(ctx, "request-id")
+  })
+});
+
 // src/commands/te-analysis/governance/index.ts
 var commands12 = [
+  analysisGovernanceAssetAuthenticationList,
+  analysisGovernanceAssetAuthenticationExport,
+  analysisGovernanceAssetAuthenticationUpdate,
   analysisMetaAssetUsageList,
   analysisMetaAssetUsageExport,
   analysisMetaAssetBatchInfoExport,
@@ -2320,7 +2704,15 @@ var reportList = createAnalysisCapabilityCommand({
   command: "list",
   capabilityId: "analysis.report.list",
   description: "List analysis reports visible to the current user through the capability gateway.",
-  flags: [projectIdFlag, queriesFlag, fieldsFlag, reportModelTypesFlag, reportListLimitFlag, directoryOffsetFlag],
+  flags: [
+    projectIdFlag,
+    queriesFlag,
+    fieldsFlag,
+    reportModelTypesFlag,
+    reportListLimitFlag,
+    directoryOffsetFlag,
+    certificationScopeFlag
+  ],
   risk: "read",
   validate: validateQueriesFlag,
   buildInput: reportListInput
@@ -2340,7 +2732,8 @@ var reportListExport = createAnalysisCapabilityCommand({
     reportModelTypesFlag,
     requestIdFlag,
     artifactFormatFlag,
-    asyncTimeoutSecondsFlag
+    asyncTimeoutSecondsFlag,
+    certificationScopeFlag
   ],
   risk: "read",
   validate: validateQueriesFlag,
@@ -2349,6 +2742,7 @@ var reportListExport = createAnalysisCapabilityCommand({
     queries: optionalQueries(ctx),
     fields: optionalJson(ctx, "fields"),
     model_types: optionalJson(ctx, "model-types"),
+    certification_scope: certificationScopeInput(ctx),
     ...exportLifecycleInput(ctx)
   })
 });
@@ -2738,11 +3132,15 @@ var dashboardList = createAnalysisCapabilityCommand({
       alias: "f"
     },
     directoryLimitFlag,
-    directoryOffsetFlag
+    directoryOffsetFlag,
+    certificationScopeFlag
   ],
   risk: "read",
   validate: validateQueriesFlag,
-  buildInput: listInput
+  buildInput: (ctx) => compactInput({
+    ...listInput(ctx),
+    certification_scope: certificationScopeInput(ctx)
+  })
 });
 
 // src/commands/te-analysis/dashboard/create.ts
@@ -2775,7 +3173,7 @@ var dashboardGet = createAnalysisCapabilityCommand({
   resource: "dashboard",
   command: "get",
   capabilityId: "analysis.dashboard.get",
-  description: "Get one dashboard detail, including location, creator, create/update time, settings, reports, notes, and share information.",
+  description: "Get one dashboard detail, including normalized effective settings, saved filter configuration, location, reports, notes, and sharing context.",
   flags: [
     projectIdFlag,
     { name: "dashboard-id", type: "number", required: true, desc: "Dashboard ID." },
@@ -2794,10 +3192,10 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
   resource: "dashboard",
   command: "update",
   capabilityId: "analysis.dashboard.update",
-  description: "Update dashboard settings, create/update a dashboard note, or replace the dashboard-level business filter. Use --operation settings, note-upsert, or business-filter.",
+  description: "Update dashboard settings, create/update a dashboard note, save a dashboard-wide default filter, or replace the dashboard-level business filter. Use --operation settings, note-upsert, default-filter, or business-filter.",
   flags: [
     projectIdFlag,
-    { name: "operation", type: "string", required: true, desc: "Update operation: settings, note-upsert, or business-filter." },
+    { name: "operation", type: "string", required: true, desc: "Update operation: settings, note-upsert, default-filter, or business-filter." },
     { name: "dashboard-id", type: "number", required: false, desc: "Dashboard ID for a single-dashboard update." },
     { name: "dashboard-ids", type: "json", required: false, desc: "Dashboard ID array for batch settings updates." },
     { name: "dashboard-name", type: "string", required: false, desc: "Dashboard name for single rename." },
@@ -2808,7 +3206,8 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
     { name: "note-title", type: "string", required: false, desc: "Dashboard note title." },
     { name: "description", type: "string", required: false, desc: "Dashboard note description." },
     { name: "ui-config", type: "string", required: false, desc: "Dashboard or note UI config string." },
-    { name: "filter", type: "json", required: false, desc: 'Dashboard-level business filter in snake_case QP form. Required with --operation business-filter. Pass {"junction_kind":"and","ta_filters":[]} to clear it.' },
+    { name: "filter-name", type: "string", required: false, desc: "Saved filter name. Required with --operation default-filter." },
+    { name: "filter", type: "json", required: false, desc: 'Saved filter in snake_case QP form. Required with --operation default-filter or business-filter. Pass {"junction_kind":"and","ta_filters":[]} to clear a business filter.' },
     payloadFlag
   ],
   risk: "write",
@@ -2825,6 +3224,7 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
     note_title: optionalString(ctx, "note-title"),
     description: optionalString(ctx, "description"),
     ui_config: optionalString(ctx, "ui-config"),
+    filter_name: optionalString(ctx, "filter-name"),
     filter: optionalJson(ctx, "filter"),
     payload: optionalJson(ctx, "payload")
   })
@@ -3301,7 +3701,7 @@ var commands23 = [
 var run_default = commands23;
 
 // src/commands/te-analysis/artifact/download.ts
-import { resolve as resolve3 } from "path";
+import { resolve as resolve4 } from "path";
 function artifactPath(runId, artifactId) {
   return `runs/${encodeURIComponent(runId)}/artifacts/${encodeURIComponent(artifactId)}/download`;
 }
@@ -3325,7 +3725,7 @@ var artifactDownload = {
       resolveGatewayDomain("analysis"),
       artifactPath(ctx.str("run-id"), ctx.str("artifact-id"))
     ),
-    output_path: resolve3(ctx.str("output")),
+    output_path: resolve4(ctx.str("output")),
     ...ctx.bool("force") ? { force: true } : {}
   }),
   execute: async (ctx) => {
@@ -4664,7 +5064,7 @@ var commands39 = [drilldownUserEventsRun, drilldownUserEventsExport];
 var drilldown_user_events_default = commands39;
 
 // src/commands/te-analysis/user/index.ts
-import { existsSync, statSync } from "fs";
+import { existsSync, statSync as statSync2 } from "fs";
 var authenticatedOnlyFlag = {
   name: "authenticated-only",
   type: "boolean",
@@ -4741,7 +5141,7 @@ var clusterDefinitionRequestFlag = {
 var optionalClusterDefinitionRequestFlag = {
   ...clusterDefinitionRequestFlag,
   required: false,
-  desc: "Optional semantic snake_case cluster definition. Read user_cluster_models.md; raw filts, C-codes, ftv, columnName, and backend DTOs are rejected."
+  desc: "Optional semantic snake_case cluster definition. Its type must match the existing cluster type; update cannot change the analysis entity. Read user_cluster_models.md; raw filts, C-codes, ftv, columnName, and backend DTOs are rejected."
 };
 var tagDefinitionRequestFlag = {
   ...clusterDefinitionRequestFlag,
@@ -4894,7 +5294,7 @@ function idImportCapability(command) {
         throw new Error("Pass exactly one of --input-file, --input-file-id, or --file-content");
       }
       const localFile = ctx.str("input-file");
-      if (localFile && (!existsSync(localFile) || !statSync(localFile).isFile())) {
+      if (localFile && (!existsSync(localFile) || !statSync2(localFile).isFile())) {
         throw new Error(`--input-file must reference a readable local file: ${localFile}`);
       }
     },
@@ -5192,7 +5592,7 @@ var commands40 = [
     zoneOffsetFlag3,
     entityIdFlag
   ], "write", (ctx) => clusterWriteInput(ctx, true)),
-  capability("user-cluster", "update", "analysis.user_cluster.update", "Update a condition or SQL user cluster. Pass only fields that should change.", [
+  capability("user-cluster", "update", "analysis.user_cluster.update", "Update a condition or SQL user cluster without changing its existing type or analysis entity. Pass only fields that should change.", [
     projectIdFlag,
     clusterNameFlag,
     optionalDisplayNameFlag,
@@ -5201,7 +5601,7 @@ var commands40 = [
     remarkFlag,
     zoneOffsetFlag3,
     autoRefreshCronFlag
-  ], "write", (ctx) => clusterWriteInput(ctx, false)),
+  ], "high-risk-write", (ctx) => clusterWriteInput(ctx, false)),
   idImportCapability(capability("user-cluster", "create-id", "analysis.user_cluster.create_id", "Create a cluster by mapping imported values to an analysis entity.", [
     projectIdFlag,
     { ...newClusterNameFlag, required: false, desc: "Optional cluster_name; generated if omitted. When provided, it must satisfy the 1-80 character machine-name contract." },
@@ -6487,6 +6887,16 @@ var projectTimezoneOverview = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/timezone/update.ts
+var TIMEZONE_ITEMS = [
+  "timezone_toggle",
+  "zone_offset",
+  "user_timezone",
+  "project_timezone_display"
+];
+var timezonePayloadFlag = {
+  ...requiredPayloadFlag,
+  desc: 'Item-specific snake_case payload: timezone_toggle uses {"toggle":true}; zone_offset uses {"column_name":"#zone_offset"}; user_timezone uses {"column_name":"user_timezone","codetable":"optional_table"}; project_timezone_display uses {"display_timezones":[{"timezone":8,"is_default":true}]}.'
+};
 var projectTimezoneUpdate = createAnalysisCapabilityCommand({
   resource: "project timezone",
   command: "update",
@@ -6494,16 +6904,92 @@ var projectTimezoneUpdate = createAnalysisCapabilityCommand({
   description: "Update one project time zone configuration item.",
   flags: [
     projectIdFlag,
-    requiredPayloadFlag,
+    timezonePayloadFlag,
     { name: "item", type: "string", required: true, desc: "Timezone item: timezone_toggle, zone_offset, user_timezone, project_timezone_display." }
   ],
   risk: "write",
-  buildInput: (ctx) => compactInput({
-    project_id: ctx.num("project-id"),
-    payload: ctx.json("payload"),
-    item: ctx.str("item")
-  })
+  buildInput: (ctx) => {
+    const item = ctx.str("item").toLowerCase();
+    const payload = ctx.json("payload");
+    validateTimezonePayload(item, payload);
+    return compactInput({
+      project_id: ctx.num("project-id"),
+      payload,
+      item
+    });
+  }
 });
+function validateTimezonePayload(item, payload) {
+  if (!TIMEZONE_ITEMS.includes(item)) {
+    throw new CliValidationError(
+      "--item must be timezone_toggle, zone_offset, user_timezone, or project_timezone_display.",
+      { code: "INVALID_TIMEZONE_ITEM" }
+    );
+  }
+  if (!isObject(payload)) {
+    throw invalidPayload(item, "must be a JSON object");
+  }
+  switch (item) {
+    case "timezone_toggle":
+      if (typeof payload.toggle !== "boolean") {
+        throw invalidPayload(item, "requires boolean field toggle", '{"toggle":true}');
+      }
+      allowOnly(payload, item, ["toggle"]);
+      return;
+    case "zone_offset":
+      if (typeof payload.column_name !== "string") {
+        throw invalidPayload(item, "requires string field column_name", '{"column_name":"#zone_offset"}');
+      }
+      allowOnly(payload, item, ["column_name"]);
+      return;
+    case "user_timezone":
+      if (typeof payload.column_name !== "string" || payload.column_name.length === 0) {
+        throw invalidPayload(item, "requires non-empty string field column_name", '{"column_name":"user_timezone"}');
+      }
+      if (payload.codetable !== void 0 && typeof payload.codetable !== "string") {
+        throw invalidPayload(item, "optional field codetable must be a string", '{"column_name":"user_timezone","codetable":"timezone_code_table"}');
+      }
+      allowOnly(payload, item, ["column_name", "codetable"]);
+      return;
+    case "project_timezone_display":
+      validateDisplayTimezones(payload.display_timezones, item);
+      allowOnly(payload, item, ["display_timezones"]);
+  }
+}
+function validateDisplayTimezones(value, item) {
+  if (!Array.isArray(value) || value.length === 0) {
+    throw invalidPayload(item, "requires non-empty array field display_timezones", '{"display_timezones":[{"timezone":8,"is_default":true}]}');
+  }
+  for (const entry of value) {
+    if (!isObject(entry)) {
+      throw invalidPayload(item, "display_timezones entries must be objects", '{"display_timezones":[{"timezone":8,"is_default":true}]}');
+    }
+    allowOnly(entry, item, ["timezone", "is_default"]);
+    if (!Number.isInteger(entry.timezone) || !(entry.timezone >= -12 && entry.timezone <= 14 || entry.timezone === 99)) {
+      throw invalidPayload(item, "display_timezones[].timezone must be an integer from -12 through 14, or 99 for no fixed display timezone");
+    }
+    if (entry.is_default !== void 0 && typeof entry.is_default !== "boolean") {
+      throw invalidPayload(item, "display_timezones[].is_default must be a boolean when provided");
+    }
+  }
+}
+function allowOnly(payload, item, fields) {
+  if (Object.keys(payload).some((field) => !fields.includes(field))) {
+    throw invalidPayload(item, `supports only fields ${fields.join(", ")}`);
+  }
+}
+function invalidPayload(item, reason, example) {
+  return new CliValidationError(
+    `--payload for --item ${item} ${reason}.`,
+    {
+      code: "INVALID_TIMEZONE_PAYLOAD",
+      hint: example === void 0 ? void 0 : `Use: --payload '${example}'`
+    }
+  );
+}
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 
 // src/commands/te-analysis/project/timezone/index.ts
 var commands62 = [
@@ -7832,7 +8318,7 @@ var commands79 = [
 var alert_notice_config_default = commands79;
 
 // src/commands/te-analysis/system/shared.ts
-import { readFileSync, statSync as statSync2 } from "fs";
+import { readFileSync as readFileSync2, statSync as statSync3 } from "fs";
 var secretValues = /* @__PURE__ */ new WeakMap();
 var companyIdField = {
   flag: "company-id",
@@ -7995,14 +8481,14 @@ function secretValue(ctx, secret) {
   let value;
   const file = ctx.str(`${secret.flag}-file`);
   if (file) {
-    const stat = statSync2(file);
+    const stat = statSync3(file);
     if (!stat.isFile()) throw validation(`--${secret.flag}-file must reference a regular file.`);
     if ((stat.mode & 63) !== 0) {
       throw validation(`--${secret.flag}-file must not be readable or writable by group/others (use chmod 600).`);
     }
-    value = nonEmptySecret(readFileSync(file, "utf8"), secret.flag);
+    value = nonEmptySecret(readFileSync2(file, "utf8"), secret.flag);
   } else if (ctx.bool(`${secret.flag}-stdin`)) {
-    value = nonEmptySecret(readFileSync(0, "utf8"), secret.flag);
+    value = nonEmptySecret(readFileSync2(0, "utf8"), secret.flag);
   }
   values.set(secret.flag, value);
   return value;