@thinkingai/ae-cli 6.1.18 → 6.1.20

package/dist/{te-analysis-7VUNUYWZ.js → te-analysis-3YJAAT2D.js}

@@ -1,3 +1,4 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   assertOutputPathAvailable,
   clientWaitTimeoutSeconds,
@@ -6,17 +7,10 @@ import {
   waitForAnalysisRun,
   withAsyncArtifactLifecycle,
   withInterruptSignal
-} from "./chunk-QZ3AS4KK.js";
+} from "./chunk-RSG4ONOI.js";
 import {
   createCapabilityCommand
-} from "./chunk-JRJY5DMJ.js";
-import {
-  registerCapabilityGatewayRoute,
-  resolveGatewayDomain
-} from "./chunk-3KWQYGYI.js";
-import {
-  withOutputMetadata
-} from "./chunk-BYYS3ANB.js";
+} from "./chunk-TAL6CZH6.js";
 import {
   CapabilityGatewayError,
   buildCapabilityGatewayUrl,
@@ -27,17 +21,22 @@ import {
   requestCapabilityGatewayWithEnvelope,
   uploadInputFile,
   validateCapability
-} from "./chunk-OMPRXM3V.js";
-import "./chunk-6EIJSNBD.js";
+} from "./chunk-QJQZH5GQ.js";
+import {
+  registerCapabilityGatewayRoute,
+  resolveGatewayDomain
+} from "./chunk-TKHSULJT.js";
+import {
+  withOutputMetadata
+} from "./chunk-CZU3V3DQ.js";
+import "./chunk-Y74WTIKJ.js";
 import {
   getCliToken
-} from "./chunk-J2DEBMRF.js";
-import "./chunk-ZQKDZXDO.js";
-import "./chunk-3FY3RJ26.js";
+} from "./chunk-ATSM5XAW.js";
+import "./chunk-WZ6YVQSF.js";
 import {
   CliValidationError
-} from "./chunk-UW5UN47B.js";
-import "./chunk-JHENBQ5B.js";
+} from "./chunk-4P355ZWB.js";
 
 // src/commands/te-analysis/capability-shared.ts
 var ANALYSIS_GATEWAY_CLI_SERVICES = /* @__PURE__ */ new Set(["project", "system"]);
@@ -334,6 +333,9 @@ function optionalString(ctx, name) {
   const value = ctx.str(name);
   return value === "" ? void 0 : value;
 }
+function optionalStringPreserveEmpty(ctx, name) {
+  return ctx.has?.(name) ? ctx.str(name) : optionalString(ctx, name);
+}
 function optionalNumber(ctx, name) {
   const value = ctx.str(name);
   return value === "" ? void 0 : Number(value);
@@ -2781,7 +2783,7 @@ var REPORT_WRITE_MODEL_TYPE_VALUES = [
   "tag"
 ];
 var REPORT_WRITE_MODEL_DESCRIPTION = `${AI_MODEL_DESCRIPTION} Report create/update also supports tag for saved tag report data; use tag as the AI-facing spelling.`;
-var AI_DEFINITION_DESCRIPTION = 'AI-facing model definition JSON. Do not pass raw QP, events, event_view, visual_view, or analysis_query. Distribution filters must be attached to the corresponding distribution_metrics[].filters; do not use top-level filters or relation. For path definitions, global filters support user_property, cluster, and tag only; event_property is not supported. session_unit accepts second (1..999), minute (1..999), or hour (1..24). Do not use day; express one day as session_interval=24 and session_unit=hour. For SQL, a simple query is {"sql":"select ..."}; raw variables use ${name}, while typed params use ${Text:name}, ${Selector:name}, or ${PartDate:name}. PartDate expands to a complete predicate, so write WHERE ${PartDate:d}, not a column followed by the placeholder. A part_date parameter may set boolean use_timezone; it defaults to false and controls whether that parameter uses the query effective timezone. Selector value must match one options[].value. Trino identifiers containing #, $, @, spaces, punctuation, or a reserved word must be delimited with double quotes, for example SELECT "#user_id", "$part_event", "end" FROM ...; single quotes are string literals. For multiline SQL JSON, the decoded sql value must contain a real line break; do not submit a literal \\n sequence outside quoted SQL text. Queries against an event table must include a date-partition predicate on the quoted "$part_date" column, for example WHERE "$part_date" BETWEEN \'2026-07-01\' AND \'2026-07-07\'; the backend rejects event-table SQL without it. The CLI preserves SQL text and never auto-quotes identifiers.';
+var AI_DEFINITION_DESCRIPTION = 'Event metrics: omit optional display_name unless the target command schema explicitly supports it. Funnel step filters use event_property_name (not field) and string-array values, including "true"/"false" for boolean properties. AI-facing model definition JSON. Do not pass raw QP, events, event_view, visual_view, or analysis_query. Distribution filters must be attached to the corresponding distribution_metrics[].filters; do not use top-level filters or relation. For path definitions, global filters support user_property, cluster, and tag only; event_property is not supported. session_unit accepts second (1..999), minute (1..999), or hour (1..24). Do not use day; express one day as session_interval=24 and session_unit=hour. For SQL, a simple query is {"sql":"select ..."}; raw variables use ${name}, while typed params use ${Text:name}, ${Selector:name}, or ${PartDate:name}. PartDate expands to a complete predicate, so write WHERE ${PartDate:d}, not a column followed by the placeholder. A part_date parameter may set boolean use_timezone; it defaults to false and controls whether that parameter uses the query effective timezone. Selector value must match one options[].value. Trino identifiers containing #, $, @, spaces, punctuation, or a reserved word must be delimited with double quotes, for example SELECT "#user_id", "$part_event", "end" FROM ...; single quotes are string literals. For multiline SQL JSON, the decoded sql value must contain a real line break; do not submit a literal \\n sequence outside quoted SQL text. Queries against an event table must include a date-partition predicate on the quoted "$part_date" column, for example WHERE "$part_date" BETWEEN \'2026-07-01\' AND \'2026-07-07\'; the backend rejects event-table SQL without it. The CLI preserves SQL text and never auto-quotes identifiers.';
 var REPORT_WRITE_DEFINITION_DESCRIPTION = `${AI_DEFINITION_DESCRIPTION} For model_type=tag, pass a tag report intent such as {"tag":{"tag_name":"vip_users","time_range":{"mode":"recent","unit":"day","value":7}}}. Tags are supported for report create/update and report data, not ad-hoc analysis.`;
 function aiModelTypeFlag(required) {
   return {
@@ -2791,6 +2793,34 @@ function aiModelTypeFlag(required) {
     desc: AI_MODEL_DESCRIPTION
   };
 }
+function validateFunnelStepFilters(modelType, definition) {
+  if (modelType !== "funnel" || !isRecord(definition) || !isRecord(definition.funnel)) return;
+  const steps = definition.funnel.steps;
+  if (!Array.isArray(steps)) return;
+  const errors = [];
+  steps.forEach((step, stepIndex) => {
+    if (!isRecord(step) || !Array.isArray(step.filters)) return;
+    step.filters.forEach((filter, filterIndex) => {
+      if (!isRecord(filter)) return;
+      const location = `definition.funnel.steps[${stepIndex}].filters[${filterIndex}]`;
+      if ("field" in filter || typeof filter.event_property_name !== "string" || !filter.event_property_name.trim()) {
+        errors.push(`${location}: use a non-empty event_property_name, not a generic field object.`);
+      }
+      if ("values" in filter && (!Array.isArray(filter.values) || filter.values.some((value) => typeof value !== "string"))) {
+        errors.push(`${location}.values: use an array of strings (boolean properties use "true" or "false").`);
+      }
+    });
+  });
+  if (errors.length) {
+    throw new CliValidationError(errors.join("\n"), {
+      code: "INVALID_ANALYSIS_DEFINITION",
+      hint: "Correct all reported step-filter fields together, preserve the complete requested definition, then validate it once. No query was dispatched."
+    });
+  }
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 function reportWriteModelTypeFlag(required) {
   return {
     name: "model-type",
@@ -3195,16 +3225,16 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
   flags: [
     projectIdFlag,
     { name: "operation", type: "string", required: true, desc: "Update operation: settings, note-upsert, default-filter, or business-filter." },
-    { name: "dashboard-id", type: "number", required: false, desc: "Dashboard ID for a single-dashboard update." },
+    { name: "dashboard-id", type: "number", required: false, desc: "Dashboard ID for a single-dashboard update. Required for note-upsert." },
     { name: "dashboard-ids", type: "json", required: false, desc: "Dashboard ID array for batch settings updates." },
     { name: "dashboard-name", type: "string", required: false, desc: "Dashboard name for single rename." },
     { name: "zone-offset", type: "number", required: false, desc: "Fixed dashboard time zone offset in hours. For example, UTC+8 is 8 and UTC-5 is -5. Valid range: -12 to 14." },
     { name: "refresh-type", type: "number", required: false, desc: "Dashboard refresh type: 0 real-time, 1 scheduled.", min: 0, max: 1 },
     { name: "dashboard-status", type: "string", required: false, desc: "Dashboard status: normal or freeze." },
-    { name: "note-id", type: "number", required: false, desc: "Dashboard note ID. Omit to create a new note." },
-    { name: "note-title", type: "string", required: false, desc: "Dashboard note title." },
-    { name: "description", type: "string", required: false, desc: "Dashboard note description." },
-    { name: "ui-config", type: "string", required: false, desc: "Dashboard or note UI config string." },
+    { name: "note-id", type: "number", required: false, desc: "Dashboard note ID. Omit to create a new note attached to the dashboard." },
+    { name: "note-title", type: "string", required: false, desc: "Dashboard note title. Defaults to empty on create; omitted values are preserved on update." },
+    { name: "description", type: "string", required: false, desc: "Dashboard note description. Defaults to empty on create; omitted values are preserved on update." },
+    { name: "ui-config", type: "string", required: false, desc: "Dashboard or note UI config string. Omitted note style is preserved on update." },
     { name: "filter-name", type: "string", required: false, desc: "Saved filter name. Required with --operation default-filter." },
     { name: "filter", type: "json", required: false, desc: 'Saved filter in snake_case QP form. Required with --operation default-filter or business-filter. Pass {"junction_kind":"and","ta_filters":[]} to clear a business filter.' },
     payloadFlag
@@ -3220,8 +3250,8 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
     refresh_type: optionalNumber(ctx, "refresh-type"),
     dashboard_status: optionalString(ctx, "dashboard-status"),
     note_id: optionalNumber(ctx, "note-id"),
-    note_title: optionalString(ctx, "note-title"),
-    description: optionalString(ctx, "description"),
+    note_title: optionalStringPreserveEmpty(ctx, "note-title"),
+    description: optionalStringPreserveEmpty(ctx, "description"),
     ui_config: optionalString(ctx, "ui-config"),
     filter_name: optionalString(ctx, "filter-name"),
     filter: optionalJson(ctx, "filter"),
@@ -3763,10 +3793,12 @@ var zoneOffsetFlag2 = {
   desc: "Optional timezone mode. Fixed UTC offsets are -12..14; 99 means stored local time without fixed UTC conversion (not UTC+99). Omit to use the project analysis default."
 };
 function adhocRunInput(ctx) {
+  const definition = ctx.json("definition");
+  validateFunnelStepFilters(ctx.str("model-type"), definition);
   return compactInput({
     project_id: ctx.num("project-id"),
     model_type: ctx.str("model-type"),
-    definition: ctx.json("definition"),
+    definition,
     resolutions: optionalJson(ctx, "resolutions"),
     request_id: optionalString(ctx, "request-id"),
     use_cache: optionalBoolean(ctx, "use-cache"),
@@ -3779,10 +3811,12 @@ function adhocRunInput(ctx) {
   });
 }
 function adhocExportInput(ctx) {
+  const definition = ctx.json("definition");
+  validateFunnelStepFilters(ctx.str("model-type"), definition);
   return compactInput({
     project_id: ctx.num("project-id"),
     model_type: ctx.str("model-type"),
-    definition: ctx.json("definition"),
+    definition,
     resolutions: optionalJson(ctx, "resolutions"),
     request_id: optionalString(ctx, "request-id"),
     use_cache: optionalBoolean(ctx, "use-cache"),
@@ -5140,7 +5174,7 @@ var clusterDefinitionRequestFlag = {
 var optionalClusterDefinitionRequestFlag = {
   ...clusterDefinitionRequestFlag,
   required: false,
-  desc: "Optional semantic snake_case cluster definition. Read user_cluster_models.md; raw filts, C-codes, ftv, columnName, and backend DTOs are rejected."
+  desc: "Optional semantic snake_case cluster definition. Its type must match the existing cluster type; update cannot change the analysis entity. Read user_cluster_models.md; raw filts, C-codes, ftv, columnName, and backend DTOs are rejected."
 };
 var tagDefinitionRequestFlag = {
   ...clusterDefinitionRequestFlag,
@@ -5163,6 +5197,24 @@ var autoRefreshCronFlag = {
   required: false,
   desc: "Optional Quartz cron expression for an existing enabled auto-refresh schedule. This does not enable auto refresh."
 };
+var tagAutoRefreshFlags = [
+  {
+    name: "enable-auto-refresh",
+    type: "boolean",
+    required: false,
+    desc: "Enable or disable periodic refresh. Omit to preserve the setting on update. Enabling on create requires a schedule."
+  },
+  {
+    ...autoRefreshCronFlag,
+    desc: "Quartz cron expression in the tag timezone. Enables periodic refresh. Mutually exclusive with --auto-refresh-schedule."
+  },
+  {
+    name: "auto-refresh-schedule",
+    type: "json",
+    required: false,
+    desc: 'Schedule object: frequency daily|weekly|monthly, time HH:mm, weekdays (weekly, ISO 1=Monday to 7=Sunday), month_days (monthly, 1-31). Enables periodic refresh in the tag timezone. Example: {"frequency":"daily","time":"02:30"}.'
+  }
+];
 var entityIdFlag = {
   name: "entity-id",
   type: "number",
@@ -5411,6 +5463,18 @@ function clusterWriteInput(ctx, create) {
 function tagWriteInput(ctx, create) {
   const definitionRequest = optionalJson(ctx, "definition-request");
   validateDefinitionRequest(create, definitionRequest);
+  const enabled = optionalBoolean(ctx, "enable-auto-refresh");
+  const cron = optionalString(ctx, "auto-refresh-cron");
+  const schedule = optionalJson(ctx, "auto-refresh-schedule");
+  if (cron !== void 0 && schedule !== void 0) {
+    throw new Error("Pass only one of --auto-refresh-cron and --auto-refresh-schedule");
+  }
+  if (enabled === false && (cron !== void 0 || schedule !== void 0)) {
+    throw new Error("Cannot set a schedule with --enable-auto-refresh false");
+  }
+  if (create && enabled === true && cron === void 0 && schedule === void 0) {
+    throw new Error("Enabling auto refresh on create requires --auto-refresh-schedule or --auto-refresh-cron");
+  }
   return compactInput({
     project_id: ctx.num("project-id"),
     tag_name: ctx.str("tag-name"),
@@ -5419,7 +5483,9 @@ function tagWriteInput(ctx, create) {
     authenticated_only: optionalBoolean(ctx, "authenticated-only"),
     remark: create ? void 0 : optionalString(ctx, "remark"),
     zone_offset: optionalNumber(ctx, "zone-offset"),
-    auto_refresh_cron: create ? void 0 : optionalString(ctx, "auto-refresh-cron"),
+    enable_auto_refresh: enabled,
+    auto_refresh_cron: cron,
+    auto_refresh_schedule: schedule,
     entity_id: create ? optionalNumber(ctx, "entity-id") : void 0
   });
 }
@@ -5591,7 +5657,7 @@ var commands40 = [
     zoneOffsetFlag3,
     entityIdFlag
   ], "write", (ctx) => clusterWriteInput(ctx, true)),
-  capability("user-cluster", "update", "analysis.user_cluster.update", "Update a condition or SQL user cluster. Pass only fields that should change.", [
+  capability("user-cluster", "update", "analysis.user_cluster.update", "Update a condition or SQL user cluster without changing its existing type or analysis entity. Pass only fields that should change.", [
     projectIdFlag,
     clusterNameFlag,
     optionalDisplayNameFlag,
@@ -5600,7 +5666,7 @@ var commands40 = [
     remarkFlag,
     zoneOffsetFlag3,
     autoRefreshCronFlag
-  ], "write", (ctx) => clusterWriteInput(ctx, false)),
+  ], "high-risk-write", (ctx) => clusterWriteInput(ctx, false)),
   idImportCapability(capability("user-cluster", "create-id", "analysis.user_cluster.create_id", "Create a cluster by mapping imported values to an analysis entity.", [
     projectIdFlag,
     { ...newClusterNameFlag, required: false, desc: "Optional cluster_name; generated if omitted. When provided, it must satisfy the 1-80 character machine-name contract." },
@@ -5682,7 +5748,8 @@ var commands40 = [
     tagDefinitionRequestFlag,
     authenticatedOnlyFlag,
     zoneOffsetFlag3,
-    entityIdFlag
+    entityIdFlag,
+    ...tagAutoRefreshFlags
   ], "write", (ctx) => tagWriteInput(ctx, true)),
   capability("user-tag", "update", "analysis.user_tag.update", "Update a user tag. Pass only fields that should change.", [
     projectIdFlag,
@@ -5692,7 +5759,7 @@ var commands40 = [
     authenticatedOnlyFlag,
     remarkFlag,
     zoneOffsetFlag3,
-    autoRefreshCronFlag
+    ...tagAutoRefreshFlags
   ], "write", (ctx) => tagWriteInput(ctx, false)),
   capability("user-tag", "refresh", "analysis.user_tag.refresh", "Refresh a user tag by exact tag_name.", [
     projectIdFlag,
@@ -6886,6 +6953,16 @@ var projectTimezoneOverview = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/timezone/update.ts
+var TIMEZONE_ITEMS = [
+  "timezone_toggle",
+  "zone_offset",
+  "user_timezone",
+  "project_timezone_display"
+];
+var timezonePayloadFlag = {
+  ...requiredPayloadFlag,
+  desc: 'Item-specific snake_case payload: timezone_toggle uses {"toggle":true}; zone_offset uses {"column_name":"#zone_offset"}; user_timezone uses {"column_name":"user_timezone","codetable":"optional_table"}; project_timezone_display uses {"display_timezones":[{"timezone":8,"is_default":true}]}.'
+};
 var projectTimezoneUpdate = createAnalysisCapabilityCommand({
   resource: "project timezone",
   command: "update",
@@ -6893,16 +6970,92 @@ var projectTimezoneUpdate = createAnalysisCapabilityCommand({
   description: "Update one project time zone configuration item.",
   flags: [
     projectIdFlag,
-    requiredPayloadFlag,
+    timezonePayloadFlag,
     { name: "item", type: "string", required: true, desc: "Timezone item: timezone_toggle, zone_offset, user_timezone, project_timezone_display." }
   ],
   risk: "write",
-  buildInput: (ctx) => compactInput({
-    project_id: ctx.num("project-id"),
-    payload: ctx.json("payload"),
-    item: ctx.str("item")
-  })
+  buildInput: (ctx) => {
+    const item = ctx.str("item").toLowerCase();
+    const payload = ctx.json("payload");
+    validateTimezonePayload(item, payload);
+    return compactInput({
+      project_id: ctx.num("project-id"),
+      payload,
+      item
+    });
+  }
 });
+function validateTimezonePayload(item, payload) {
+  if (!TIMEZONE_ITEMS.includes(item)) {
+    throw new CliValidationError(
+      "--item must be timezone_toggle, zone_offset, user_timezone, or project_timezone_display.",
+      { code: "INVALID_TIMEZONE_ITEM" }
+    );
+  }
+  if (!isObject(payload)) {
+    throw invalidPayload(item, "must be a JSON object");
+  }
+  switch (item) {
+    case "timezone_toggle":
+      if (typeof payload.toggle !== "boolean") {
+        throw invalidPayload(item, "requires boolean field toggle", '{"toggle":true}');
+      }
+      allowOnly(payload, item, ["toggle"]);
+      return;
+    case "zone_offset":
+      if (typeof payload.column_name !== "string") {
+        throw invalidPayload(item, "requires string field column_name", '{"column_name":"#zone_offset"}');
+      }
+      allowOnly(payload, item, ["column_name"]);
+      return;
+    case "user_timezone":
+      if (typeof payload.column_name !== "string" || payload.column_name.length === 0) {
+        throw invalidPayload(item, "requires non-empty string field column_name", '{"column_name":"user_timezone"}');
+      }
+      if (payload.codetable !== void 0 && typeof payload.codetable !== "string") {
+        throw invalidPayload(item, "optional field codetable must be a string", '{"column_name":"user_timezone","codetable":"timezone_code_table"}');
+      }
+      allowOnly(payload, item, ["column_name", "codetable"]);
+      return;
+    case "project_timezone_display":
+      validateDisplayTimezones(payload.display_timezones, item);
+      allowOnly(payload, item, ["display_timezones"]);
+  }
+}
+function validateDisplayTimezones(value, item) {
+  if (!Array.isArray(value) || value.length === 0) {
+    throw invalidPayload(item, "requires non-empty array field display_timezones", '{"display_timezones":[{"timezone":8,"is_default":true}]}');
+  }
+  for (const entry of value) {
+    if (!isObject(entry)) {
+      throw invalidPayload(item, "display_timezones entries must be objects", '{"display_timezones":[{"timezone":8,"is_default":true}]}');
+    }
+    allowOnly(entry, item, ["timezone", "is_default"]);
+    if (!Number.isInteger(entry.timezone) || !(entry.timezone >= -12 && entry.timezone <= 14 || entry.timezone === 99)) {
+      throw invalidPayload(item, "display_timezones[].timezone must be an integer from -12 through 14, or 99 for no fixed display timezone");
+    }
+    if (entry.is_default !== void 0 && typeof entry.is_default !== "boolean") {
+      throw invalidPayload(item, "display_timezones[].is_default must be a boolean when provided");
+    }
+  }
+}
+function allowOnly(payload, item, fields) {
+  if (Object.keys(payload).some((field) => !fields.includes(field))) {
+    throw invalidPayload(item, `supports only fields ${fields.join(", ")}`);
+  }
+}
+function invalidPayload(item, reason, example) {
+  return new CliValidationError(
+    `--payload for --item ${item} ${reason}.`,
+    {
+      code: "INVALID_TIMEZONE_PAYLOAD",
+      hint: example === void 0 ? void 0 : `Use: --payload '${example}'`
+    }
+  );
+}
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 
 // src/commands/te-analysis/project/timezone/index.ts
 var commands62 = [
@@ -7368,7 +7521,7 @@ function buildDisplayNameSyncPlan(draft, metadata) {
   };
 }
 function assertTrackingDraft(value) {
-  if (!isRecord(value)) {
+  if (!isRecord2(value)) {
     throw new Error("Tracking draft must be a JSON object.");
   }
   for (const field of [
@@ -7432,7 +7585,7 @@ function existingDefinitions(value, nameField, displayNameField) {
   if (!Array.isArray(value)) return [];
   const rows = [];
   for (const item of value) {
-    if (!isRecord(item)) continue;
+    if (!isRecord2(item)) continue;
     const name = nonEmptyString(item[nameField]);
     if (!name) continue;
     rows.push({
@@ -7475,7 +7628,7 @@ function nonEmptyString(value) {
   const trimmed = value.trim();
   return trimmed ? trimmed : void 0;
 }
-function isRecord(value) {
+function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -8003,7 +8156,7 @@ var trackingDebugDataList = createTrackingCapabilityCommand({
     event_name: optionalString(ctx, "event-name")
   }),
   postProcess: (result, input) => {
-    const data = isRecord2(result) ? result : {};
+    const data = isRecord3(result) ? result : {};
     const eventList = Array.isArray(data.event_list) ? data.event_list : [];
     const deviceDataList = Array.isArray(data.device_data_list) ? data.device_data_list : [];
     return {
@@ -8034,7 +8187,7 @@ function formatLocalTime(value) {
     pad(value.getSeconds())
   ].join("");
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 

package/dist/{te-community-5DMNKJWY.js → te-community-UDBI672N.js}

@@ -1,25 +1,23 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
 import {
   registerCapabilityGatewayRoute
-} from "./chunk-3KWQYGYI.js";
+} from "./chunk-TKHSULJT.js";
 import {
   internalCallSourceHeaders
-} from "./chunk-6EIJSNBD.js";
+} from "./chunk-Y74WTIKJ.js";
 import {
-  clearCliToken,
+  SecureStoreAuthError,
   getCliToken
-} from "./chunk-J2DEBMRF.js";
-import "./chunk-ZQKDZXDO.js";
+} from "./chunk-ATSM5XAW.js";
 import {
   getActiveHost,
   safeJsonParse
-} from "./chunk-3FY3RJ26.js";
+} from "./chunk-WZ6YVQSF.js";
 import {
   CliValidationError,
-  PermissionError
-} from "./chunk-UW5UN47B.js";
-import {
+  PermissionError,
   logger
-} from "./chunk-JHENBQ5B.js";
+} from "./chunk-4P355ZWB.js";
 
 // src/core/mcp.ts
 async function permissionDetails(resp) {
@@ -105,30 +103,10 @@ async function mcpRequest(url, method, params = {}, hostOverride) {
       throw new PermissionError(permission.message, permission.code, permission.hint);
     }
     if (resp.status === 401) {
-      logger.warn(`MCP request failed (HTTP 401) for ${hostUrl}, refreshing CLI token`);
-      clearCliToken(hostUrl);
-      const newToken = await getCliToken(hostUrl);
-      logger.info(`CLI token refreshed for ${hostUrl}`);
-      process.stderr.write(`[ae-cli] CLI token refreshed for ${hostUrl}
-`);
-      Object.assign(headers, buildAuthHeaders(newToken));
-      const retryResp = await fetch(url, {
-        method: "POST",
-        headers,
-        body: JSON.stringify(body)
-      });
-      if (retryResp.status === 403) {
-        const permission = await permissionDetails(retryResp);
-        throw new PermissionError(permission.message, permission.code, permission.hint);
-      }
-      if (!retryResp.ok) {
-        throw new Error(`MCP HTTP error: ${retryResp.status} ${retryResp.statusText}`);
-      }
-      const retryData = safeJsonParse(await retryResp.text());
-      if (retryData.error) {
-        throw new Error(`MCP error: ${retryData.error.message || JSON.stringify(retryData.error)}`);
-      }
-      return retryData.result;
+      logger.warn(`MCP request failed (HTTP 401) for ${hostUrl}; CLI token must be replaced by login`);
+      throw new SecureStoreAuthError(
+        `CLI token is invalid or expired for ${hostUrl}. Run: ae-cli auth login --host ${hostUrl}`
+      );
     }
     throw new Error(`MCP HTTP error: ${resp.status} ${resp.statusText}`);
   }