@thinkingai/ae-cli 6.1.19 → 6.1.21

package/dist/{te-analysis-MNCG65LU.js → te-analysis-AISWCOOZ.js}

@@ -7,17 +7,12 @@ import {
   waitForAnalysisRun,
   withAsyncArtifactLifecycle,
   withInterruptSignal
-} from "./chunk-S5PONFBM.js";
+} from "./chunk-VYXXOKYS.js";
 import {
-  createCapabilityCommand
-} from "./chunk-DKEXH6Q5.js";
-import {
-  registerCapabilityGatewayRoute,
-  resolveGatewayDomain
-} from "./chunk-TKHSULJT.js";
-import {
-  withOutputMetadata
-} from "./chunk-KEWVSO64.js";
+  createCapabilityCommand,
+  definitionIntentSnapshotFlag,
+  modelDefinitionIntentSnapshotFlag
+} from "./chunk-CCS66K4K.js";
 import {
   CapabilityGatewayError,
   buildCapabilityGatewayUrl,
@@ -28,17 +23,22 @@ import {
   requestCapabilityGatewayWithEnvelope,
   uploadInputFile,
   validateCapability
-} from "./chunk-GJXRF7Y6.js";
+} from "./chunk-HFGZGYCG.js";
+import {
+  registerCapabilityGatewayRoute,
+  resolveGatewayDomain
+} from "./chunk-KPQY44JQ.js";
+import {
+  withOutputMetadata
+} from "./chunk-DX5CDO34.js";
 import "./chunk-Y74WTIKJ.js";
 import {
   getCliToken
-} from "./chunk-RWXIXOZG.js";
-import "./chunk-O6K2ODUE.js";
-import "./chunk-KZ6ZHF5J.js";
+} from "./chunk-7XGFSUOM.js";
+import "./chunk-7FTTULED.js";
 import {
   CliValidationError
-} from "./chunk-533JK3YX.js";
-import "./chunk-FR2EDAQM.js";
+} from "./chunk-MAPZ7VB6.js";
 
 // src/commands/te-analysis/capability-shared.ts
 var ANALYSIS_GATEWAY_CLI_SERVICES = /* @__PURE__ */ new Set(["project", "system"]);
@@ -335,6 +335,9 @@ function optionalString(ctx, name) {
   const value = ctx.str(name);
   return value === "" ? void 0 : value;
 }
+function optionalStringPreserveEmpty(ctx, name) {
+  return ctx.has?.(name) ? ctx.str(name) : optionalString(ctx, name);
+}
 function optionalNumber(ctx, name) {
   const value = ctx.str(name);
   return value === "" ? void 0 : Number(value);
@@ -403,99 +406,43 @@ function validateCatalogExportFlags(ctx) {
     throw new CliValidationError("--output must use the .jsonl extension");
   }
 }
-function catalogArtifactMaterializer(resourceType) {
-  return async ({
-    ctx,
+async function catalogArtifactMaterializer({
+  ctx,
+  runId,
+  artifactId,
+  output,
+  force,
+  signal,
+  finalDescriptor
+}) {
+  await assertRegularFileOrMissing(resolve(output), force);
+  const download = await downloadAnalysisArtifact(
+    ctx.host(),
     runId,
     artifactId,
     output,
-    force,
-    signal,
-    finalDescriptor
-  }) => {
-    const outputPath = resolve(output);
-    const metaPath = join(
-      dirname(outputPath),
-      `${basename(outputPath, extname(outputPath))}.meta.json`
-    );
-    await mkdir(dirname(outputPath), { recursive: true });
-    await assertRegularFileOrMissing(outputPath, force);
-    await assertRegularFileOrMissing(metaPath, force);
-    const suffix = `${process.pid}.${randomBytes(8).toString("hex")}`;
-    const partPath = `${outputPath}.part.${suffix}`;
-    const metaPartPath = `${metaPath}.part.${suffix}`;
-    let handle;
-    try {
-      const download = await downloadAnalysisArtifact(
-        ctx.host(),
-        runId,
-        artifactId,
-        partPath,
-        { force: true, signal, ensureReady: false }
-      );
-      const hash = createHash("sha256");
-      let bytes = 0;
-      let rows = 0;
-      for await (const chunk of createReadStream(partPath)) {
-        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-        hash.update(buffer);
-        bytes += buffer.length;
-        for (const value of buffer) {
-          if (value === 10) rows++;
-        }
-      }
-      const contentSha256 = hash.digest("hex");
-      const token = await getCliToken(ctx.host());
-      const metadata = {
-        schema_version: 1,
-        resource_type: resourceType,
-        host: ctx.host(),
-        project_id: ctx.num("project-id"),
-        principal_fingerprint: `sha256:${createHash("sha256").update(token).digest("hex")}`,
-        generated_at: (/* @__PURE__ */ new Date()).toISOString(),
-        row_count: rows,
-        complete: true,
-        content_sha256: contentSha256,
-        run_id: runId,
-        artifact_id: artifactId
-      };
-      handle = await open(metaPartPath, "w", 384);
-      await handle.write(`${JSON.stringify(metadata)}
-`, void 0, "utf8");
-      await handle.sync();
-      await handle.close();
-      handle = void 0;
-      await publishCatalogPair(partPath, outputPath, metaPartPath, metaPath, suffix);
-      return {
-        ...finalDescriptor,
-        ...download,
-        output_path: outputPath,
-        metadata_path: metaPath,
-        format: "jsonl",
-        row_count: rows,
-        bytes,
-        content_sha256: contentSha256,
-        complete: true
-      };
-    } catch (error) {
-      await handle?.close().catch(() => void 0);
-      await rm(partPath, { force: true }).catch(() => void 0);
-      await rm(metaPartPath, { force: true }).catch(() => void 0);
-      throw error;
+    { force, signal, ensureReady: false, mode: 384 }
+  );
+  let rows = 0;
+  for await (const chunk of createReadStream(download.output_path)) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+    for (const value of buffer) {
+      if (value === 10) rows++;
     }
+  }
+  return {
+    ...finalDescriptor,
+    ...download,
+    format: "jsonl",
+    row_count: rows,
+    complete: true
   };
 }
 async function preflightCatalogArtifactOutput({
   output,
   force
 }) {
-  const outputPath = resolve(output);
-  const metaPath = join(
-    dirname(outputPath),
-    `${basename(outputPath, extname(outputPath))}.meta.json`
-  );
-  await assertRegularFileOrMissing(outputPath, force);
-  await assertRegularFileOrMissing(metaPath, force);
+  await assertRegularFileOrMissing(resolve(output), force);
 }
 function validateQueriesFlag(ctx) {
   const queries = ctx.json("queries");
@@ -1181,8 +1128,8 @@ var metadataVirtualEventCreate = createAnalysisMetaCapabilityCommand({
     { name: "event-name", type: "string", required: false, desc: "Virtual event name. Must start with 'ta@'." },
     { name: "event-desc", type: "string", required: false, desc: "Virtual event display name." },
     { name: "remark", type: "string", required: false, desc: "Optional virtual event remark." },
-    { name: "events", type: "json", required: false, desc: "Event array using snake_case event_name and optional AI-facing filter {relation,items:[{field:{name,type?},operator,values?}]}." },
-    { name: "filter", type: "json", required: false, desc: "Optional AI-facing global filter {relation,items:[{field:{name,type?},operator,values?}]}; raw taFilters/junctionKind are rejected." },
+    { name: "events", type: "json", required: false, desc: "Event array using snake_case event_name and optional AI-facing filter conditions. Tag/cluster conditions accept cluster_date_policy and specified_cluster_date." },
+    { name: "filter", type: "json", required: false, desc: "Optional AI-facing global filter. Tag/cluster conditions accept LATEST, AUTO, or SPECIFIED; SPECIFIED requires specified_cluster_date. Raw taFilters/junctionKind are rejected." },
     { name: "override", type: "boolean", required: false, desc: "Whether to override an existing virtual event rule." }
   ],
   risk: "write",
@@ -1538,21 +1485,43 @@ var commands5 = [
 var metric_default = commands5;
 
 // src/commands/te-analysis/meta/asset/search.ts
-var metadataAssetSearch = createAnalysisMetaCapabilityCommand({
+var assetTypesFlag = {
+  name: "asset-types",
+  type: "json",
+  required: false,
+  desc: "Optional saved analysis asset type narrowing. Omit by default for first-pass asset discovery so dashboards and reports are searched together; pass only when the user explicitly asks for one type or after refining a broad search."
+};
+var ownTypesFlag = {
+  name: "own-types",
+  type: "json",
+  required: false,
+  desc: "Optional owner filter. CREATED means owned by the current user; SHARED means visible assets created by others."
+};
+var requiredQueriesFlag = {
+  ...queriesFlag,
+  required: true,
+  desc: "Required JSON array of 1 to 20 keyword filters. For first-pass asset discovery, use one broad search without --asset-types so results can include both dashboards and reports."
+};
+var analysisAssetSearch = createAnalysisCapabilityCommand({
   resource: "asset",
   command: "search",
-  capabilityId: "metadata.asset.search",
-  description: "Search project assets by keyword.",
+  capabilityId: "analysis.asset.search",
+  description: "Search visible saved analysis assets by keyword. Default first-pass search should omit --asset-types to cover both dashboards and reports.",
   flags: [
     projectIdFlag,
-    requiredPayloadFlag,
+    requiredQueriesFlag,
+    assetTypesFlag,
+    ownTypesFlag,
     directoryLimitFlag,
     directoryOffsetFlag
   ],
   risk: "read",
+  validate: validateQueriesFlag,
   buildInput: (ctx) => compactInput({
     ...projectInput(ctx),
-    payload: ctx.json("payload"),
+    queries: optionalJson(ctx, "queries"),
+    asset_types: optionalJson(ctx, "asset-types"),
+    own_types: optionalJson(ctx, "own-types"),
     limit: optionalNumber(ctx, "limit"),
     offset: optionalNumber(ctx, "offset")
   })
@@ -1655,13 +1624,11 @@ var ruleIdFlag = { name: "rule-id", type: "number", required: false, desc: "Gove
 var ruleNameFlag = { name: "rule-name", type: "string", required: false, desc: "Governance rule name." };
 var commentFlag = { name: "comment", type: "string", required: false, desc: "Governance rule comment." };
 var nodeIdsFlag = { name: "node-ids", type: "json", required: false, desc: "Asset node ID JSON array." };
-var reportsVersionFlag = { name: "reports-version", type: "number", required: false, desc: "Dashboard reports version." };
-var zoneOffsetFlag = { name: "zone-offset", type: "number", required: false, desc: "Dashboard zone offset." };
 var scheduleUiConfigFlag = { name: "schedule-ui-config", type: "json", required: false, desc: "Dashboard schedule UI config JSON." };
 var dashboardStatusFlag = { name: "dashboard-status", type: "string", required: false, desc: "Dashboard status." };
 var refreshTypeFlag = { name: "refresh-type", type: "number", required: false, desc: "Dashboard refresh type: 1 enabled, 0 disabled." };
 var cacheConfigFlag = { name: "cache-config", type: "json", required: false, desc: "Dashboard cache config JSON." };
-var toUserIdFlag = { name: "to-user-id", type: "number", required: true, desc: "Target user ID for handover." };
+var toUserIdFlag = { name: "to-user-id", type: "number", required: false, desc: "Target user ID for handover; required here or as payload.to_user_id." };
 var clearHistoryTagFlag = { name: "clear-history-tag", type: "number", required: false, desc: "Whether to clear tag history: 1 yes, 0 no." };
 var typeFlag = { name: "type", type: "string", required: false, desc: "Batch operation type." };
 var statusFlag = { name: "status", type: "json", required: false, desc: "Operation status JSON array." };
@@ -1680,7 +1647,7 @@ var readers = {
   rule_id: (ctx) => optionalNumber(ctx, "rule-id"),
   rule_name: (ctx) => optionalString(ctx, "rule-name"),
   comment: (ctx) => optionalString(ctx, "comment"),
-  node_ids: (ctx) => optionalJsonArray(ctx, "node-ids"),
+  node_ids: (ctx) => optionalJson(ctx, "node-ids"),
   reports_version: (ctx) => optionalNumber(ctx, "reports-version"),
   zone_offset: (ctx) => optionalNumber(ctx, "zone-offset"),
   schedule_ui_config: (ctx) => optionalJson(ctx, "schedule-ui-config"),
@@ -1697,37 +1664,79 @@ var readers = {
   limit: (ctx) => optionalNumber(ctx, "limit"),
   offset: (ctx) => optionalNumber(ctx, "offset")
 };
-function assetGovernanceInput(ctx, fields) {
+function assetGovernanceInput(ctx, fields2) {
+  const payload = optionalJson(ctx, "payload");
+  if (payload !== void 0 && (!payload || typeof payload !== "object" || Array.isArray(payload))) {
+    throw new CliValidationError("--payload must be a JSON object.");
+  }
+  if (payload && Object.hasOwn(payload, "payload")) {
+    throw new CliValidationError("--payload must not contain a nested payload field.");
+  }
   const input = {
-    ...projectInput(ctx),
-    payload: optionalJson(ctx, "payload")
+    ...payload,
+    ...projectInput(ctx)
   };
-  for (const field of fields) {
-    input[field] = readers[field]?.(ctx);
+  for (const field of fields2) {
+    const value = readers[field]?.(ctx);
+    if (value !== void 0) input[field] = value;
   }
-  return compactInput(input);
+  for (const field of ["node_ids", "searchs", "status"]) {
+    if (input[field] !== void 0 && !Array.isArray(input[field])) {
+      throw new CliValidationError(`${field} must be a JSON array.`);
+    }
+  }
+  if (input.rule !== void 0 && (!input.rule || typeof input.rule !== "object" || Array.isArray(input.rule))) {
+    throw new CliValidationError("rule must be a JSON object.");
+  }
+  if (fields2.includes("to_user_id") && (!Number.isInteger(input.to_user_id) || Number(input.to_user_id) <= 0)) {
+    throw new CliValidationError("to_user_id must be a positive integer; provide --to-user-id or payload.to_user_id.");
+  }
+  return input;
 }
 
 // src/core/resource-url.ts
-function normalizeResourceUrlFields(node, host) {
+var LOCAL_BACKEND_PORTS = /* @__PURE__ */ new Set(["8992", "8996"]);
+function normalizeResourceUrlFields(node, host, sourceHost = host) {
   if (!node || typeof node !== "object") return;
   const obj = node;
   for (const [key, value] of Object.entries(obj)) {
     if (typeof value === "string") {
       if (/url|link/i.test(key) || value.includes("/#/")) {
-        obj[key] = absolutizeRelativeUrls(value, host);
+        obj[key] = normalizeResourceUrls(value, host, sourceHost);
       }
     } else if (value && typeof value === "object") {
-      normalizeResourceUrlFields(value, host);
+      normalizeResourceUrlFields(value, host, sourceHost);
     }
   }
 }
-function absolutizeRelativeUrls(s, host) {
+function normalizeResourceUrls(s, host, sourceHost = host) {
   const base = host.replace(/\/+$/, "");
+  const sourceBase = sourceHost.replace(/\/+$/, "");
+  if (sourceBase && sourceBase !== base) {
+    s = s.replace(new RegExp(`${escapeRegExp(sourceBase)}/#`, "g"), `${base}/#`);
+  }
   s = s.replace(/\]\((\/(?!\/)[^)]*)\)/g, `](${base}$1)`);
   if (/^\/(?!\/)/.test(s)) s = base + s;
   return s;
 }
+function resolvePublicWebHost(host) {
+  const override = process.env.AE_CLI_PUBLIC_WEB_URL || process.env.AE_CLI_WEB_HOST;
+  if (override?.trim()) {
+    return override.trim().replace(/\/+$/, "");
+  }
+  try {
+    const url = new URL(host);
+    if ((url.hostname === "127.0.0.1" || url.hostname === "localhost") && LOCAL_BACKEND_PORTS.has(url.port)) {
+      url.port = "10010";
+      return url.toString().replace(/\/+$/, "");
+    }
+  } catch {
+  }
+  return host.replace(/\/+$/, "");
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 
 // src/commands/te-analysis/meta/asset/url-get.ts
 var analysisMetaAssetUrlGet = createAnalysisMetaCapabilityCommand({
@@ -1746,7 +1755,7 @@ var analysisMetaAssetUrlGet = createAnalysisMetaCapabilityCommand({
 
 // src/commands/te-analysis/meta/asset/index.ts
 var commands6 = [
-  metadataAssetSearch,
+  analysisAssetSearch,
   metadataAssetRecentList,
   metadataAssetAuthenticationList,
   metadataAssetAuthenticationUpdate,
@@ -2009,9 +2018,9 @@ var metadataCatalogExport = createAnalysisMetaCapabilityCommand({
   capabilityId: "metadata.catalog.export",
   asyncArtifact: {
     preflightOutput: preflightCatalogArtifactOutput,
-    materialize: catalogArtifactMaterializer("analysis_metadata")
+    materialize: catalogArtifactMaterializer
   },
-  description: "Export the complete accessible analysis metadata catalog to JSONL with an integrity sidecar.",
+  description: "Export the complete accessible analysis metadata catalog to one local JSONL file.",
   flags: [projectIdFlag, requestIdFlag, asyncTimeoutSecondsFlag, certificationScopeFlag],
   risk: "read",
   validate: validateCatalogExportFlags,
@@ -2093,8 +2102,653 @@ var metadataCatalogList = createAnalysisMetaCapabilityCommand({
 var commands10 = [metadataCatalogList, metadataCatalogExport];
 var catalog_default = commands10;
 
-// src/commands/te-analysis/meta/index.ts
+// src/commands/te-analysis/meta/governance-recommendation/export.ts
+var windowDaysFlag = {
+  name: "window-days",
+  type: "number",
+  required: false,
+  min: 1,
+  max: 365,
+  desc: "Usage window in days. Default: 90."
+};
+var limitFlag2 = {
+  name: "limit",
+  type: "number",
+  required: false,
+  min: 1,
+  max: 100,
+  desc: "Maximum hot dashboard evidence packages selected before report and metadata expansion. Default: 20; this is not the business-topic count."
+};
+var includeCompletedFlag = {
+  name: "include-completed",
+  type: "boolean",
+  required: false,
+  desc: "Whether to include completed/authenticated context in the same business topic. Default: true; set false only for pending-only review."
+};
+var GOVERNANCE_RECOMMENDATION_EXPORT_HELP = [
+  "Customer/Agent material package contract:",
+  "- Requires project_semantic_enable=on. A disabled project returns PROJECT_SEMANTIC_DISABLED before collecting export materials.",
+  "- Use this command as the entry point before asset-certification recommendation display or review-page submission.",
+  "- The command requires a numeric --project-id. If the user provides only a project name, resolve it on the same host with ae-cli project info list before calling export.",
+  "- The response run_id, snapshot_hash, and review_material_package are the handoff package for the Agent.",
+  "- review_material_package should carry candidate_assets, heat evidence, source_link/evidence_links, relations, report definitions, AI-model definitions, target_revision, and hashes needed for review drafting.",
+  "- Dashboard candidates may include optional space_id/space_name. Preserve these fields into the review draft when present; not every dashboard belongs to a space, so never invent or require them.",
+  "- The Agent turns that package into a submit-to-page draft with batch ai_summary, presentation_snapshot, per-item ai_summary/reasons, copied evidence_snapshot, copied source links, and relations.",
+  "- work_units are deterministic evidence containers from Common. They are not final page groups; the Agent clusters selected assets into one or more business-domain topics.",
+  "- For report and SQL items, use packaged evidence_snapshot.analysis first. Call analysis-meta agent-review evidence only for explicit definition/analysis gaps or draft validation.",
+  "- For real page-review submission, start with --limit 20, filter out completed/rejected/deferred/in-flight items, and expand to --limit 50 then --limit 100 only when the remaining pending review assets or visible business domains are too few.",
+  "- Expansion increases business-domain coverage; it must not submit every pending asset found. Keep a daily review capacity target such as 20-50 pending assets, hard cap around 80, and select about 3-6 visible domains.",
+  "- When candidates exceed the cap, rank by impact, heat, user count, dependency breadth, and under-covered domains; keep only direct context needed for selected pending assets and report overflow for later batches.",
+  "- Draft only business domains with pending review assets. Completed/authenticated assets are necessary context under those visible domains, not standalone work and not a reason to display a zero-pending domain.",
+  "- Generate long Agent summaries only for visible business domains and pending review assets; hidden domains and pure authenticated context should keep copied evidence/links without new page-visible narrative.",
+  "- Page submission uses analysis-meta agent-review submit-to-page. governance-recommendation submit is for explicit approval decisions and must not be used to create page drafts."
+].join("\n");
+var metadataGovernanceRecommendationExport = createAnalysisMetaCapabilityCommand({
+  resource: "governance-recommendation",
+  command: "export",
+  capabilityId: "metadata.governance_recommendation.export",
+  description: "Export the material package for CLI Agent asset-authentication and metric-recommendation review.",
+  helpText: GOVERNANCE_RECOMMENDATION_EXPORT_HELP,
+  flags: [projectIdFlag, windowDaysFlag, limitFlag2, includeCompletedFlag],
+  risk: "read",
+  buildInput: (ctx) => compactInput({
+    ...projectInput(ctx),
+    window_days: optionalNumber(ctx, "window-days"),
+    limit: optionalNumber(ctx, "limit"),
+    include_completed: optionalBoolean(ctx, "include-completed")
+  }),
+  postProcess: (result, _input, ctx) => {
+    normalizeResourceUrlFields(result, resolvePublicWebHost(ctx.host()), ctx.host());
+    return result;
+  }
+});
+
+// src/commands/te-analysis/meta/governance-recommendation/submit.ts
+var runIdFlag = {
+  name: "run-id",
+  type: "string",
+  required: true,
+  desc: "run_id returned by governance-recommendation export."
+};
+var snapshotHashFlag = {
+  name: "snapshot-hash",
+  type: "string",
+  required: false,
+  desc: "Authentication snapshot hash returned by governance-recommendation export."
+};
+var topicIdFlag = {
+  name: "topic-id",
+  type: "string",
+  required: false,
+  desc: "Optional CLI Agent business-domain ID. Dashboard-seeded evidence may submit only topic-name."
+};
+var topicNameFlag = {
+  name: "topic-name",
+  type: "string",
+  required: true,
+  desc: "CLI Agent business-domain display name."
+};
+var decisionsFlag = {
+  name: "decisions",
+  type: "json",
+  required: true,
+  desc: "Approval decisions JSON array for one CLI Agent topic. Each item uses item_type asset or metric_candidate and decision APPROVE, REJECT, or SKIP."
+};
+var windowDaysFlag2 = {
+  name: "window-days",
+  type: "number",
+  required: false,
+  min: 1,
+  max: 365,
+  desc: "Usage window in days for server-side metric candidate re-scan. Default: 90."
+};
+var limitFlag3 = {
+  name: "limit",
+  type: "number",
+  required: false,
+  min: 1,
+  max: 100,
+  desc: "Dashboard limit for server-side metric candidate re-scan. Default: 20."
+};
+var metadataGovernanceRecommendationSubmit = createAnalysisMetaCapabilityCommand({
+  resource: "governance-recommendation",
+  command: "submit",
+  capabilityId: "metadata.governance_recommendation.submit",
+  description: "Submit CLI Agent approval decisions for asset authentication and metric recommendation items.",
+  flags: [
+    projectIdFlag,
+    runIdFlag,
+    snapshotHashFlag,
+    topicIdFlag,
+    topicNameFlag,
+    windowDaysFlag2,
+    limitFlag3,
+    decisionsFlag
+  ],
+  risk: "write",
+  buildInput: (ctx) => compactInput({
+    ...projectInput(ctx),
+    run_id: ctx.str("run-id"),
+    snapshot_hash: optionalString(ctx, "snapshot-hash"),
+    topic_id: optionalString(ctx, "topic-id"),
+    topic_name: ctx.str("topic-name"),
+    window_days: optionalNumber(ctx, "window-days"),
+    limit: optionalNumber(ctx, "limit"),
+    decisions: ctx.json("decisions")
+  })
+});
+
+// src/commands/te-analysis/meta/governance-recommendation/decisions.ts
+var runIdFlag2 = {
+  name: "run-id",
+  type: "string",
+  required: false,
+  desc: "Optional run_id filter."
+};
+var limitFlag4 = {
+  name: "limit",
+  type: "number",
+  required: false,
+  min: 1,
+  max: 500,
+  desc: "Maximum rows returned. Default: 100."
+};
+var metadataGovernanceRecommendationDecisions = createAnalysisMetaCapabilityCommand({
+  resource: "governance-recommendation",
+  command: "decisions",
+  capabilityId: "metadata.governance_recommendation.decisions",
+  description: "List recent CLI Agent recommendation approval decisions.",
+  flags: [projectIdFlag, runIdFlag2, limitFlag4],
+  risk: "read",
+  buildInput: (ctx) => compactInput({
+    ...projectInput(ctx),
+    run_id: optionalString(ctx, "run-id"),
+    limit: optionalNumber(ctx, "limit")
+  })
+});
+
+// src/commands/te-analysis/meta/governance-recommendation/index.ts
 var commands11 = [
+  metadataGovernanceRecommendationExport,
+  metadataGovernanceRecommendationSubmit,
+  metadataGovernanceRecommendationDecisions
+];
+var governance_recommendation_default = commands11;
+
+// src/commands/te-analysis/meta/agent-review/shared.ts
+var projectFlag = {
+  name: "project-id",
+  type: "number",
+  required: true,
+  min: 1,
+  desc: "Numeric project ID."
+};
+var batchFlag = {
+  name: "batch-id",
+  type: "string",
+  required: true,
+  desc: "Review batch ID as a decimal string; preserve all digits."
+};
+var clientRequestFlag = {
+  name: "client-request-id",
+  type: "string",
+  required: true,
+  desc: "Stable operation key. Reuse for network replay; use a new key for a new decision or manual retry."
+};
+function text(ctx, name) {
+  const value = ctx.str(name);
+  if (!value.trim()) throw new Error(`--${name} must not be empty.`);
+  return value;
+}
+function decimalId(value, name) {
+  if (typeof value !== "string" || !/^[1-9]\d*$/.test(value) || BigInt(value) > 9223372036854775807n) {
+    throw new Error(`${name} must be a positive signed 64-bit decimal string.`);
+  }
+  return value;
+}
+function projectInput2(ctx) {
+  const id = ctx.num("project-id");
+  if (!Number.isInteger(id) || id < 1 || id > 2147483647) {
+    throw new Error("--project-id must be a positive 32-bit integer.");
+  }
+  return { project_id: id };
+}
+function batchInput(ctx) {
+  return { ...projectInput2(ctx), batch_id: decimalId(ctx.str("batch-id"), "--batch-id") };
+}
+function object(value, name) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${name} must be a JSON object.`);
+  }
+  return value;
+}
+function array(value, name) {
+  if (!Array.isArray(value) || value.length < 1 || value.length > 5e3) {
+    throw new Error(`${name} must contain 1 to 5000 items.`);
+  }
+  return value;
+}
+function fields(value, allowed, name) {
+  const unknown = Object.keys(value).filter((key) => !allowed.includes(key));
+  if (unknown.length) throw new Error(`${name} has unsupported fields: ${unknown.join(", ")}.`);
+}
+function unique(values, name) {
+  if (new Set(values).size !== values.length) throw new Error(`${name} must be unique.`);
+}
+
+// src/commands/te-analysis/meta/agent-review/submit-to-page.ts
+import { readFileSync } from "fs";
+var supportedTargetTypes = /* @__PURE__ */ new Set([
+  "dashboard",
+  "report",
+  "event",
+  "event_prop",
+  "user_prop",
+  "user_tag",
+  "user_cluster",
+  "metric"
+]);
+var SUBMIT_TO_PAGE_HELP = [
+  "Customer/Agent review-page draft contract:",
+  "- Normal flow: governance-recommendation export -> Agent builds ai_summary/presentation_snapshot/item reasons -> submit-to-page --input-file -> review page batch and site notification.",
+  "- This command creates an asset certification review draft for humans. It never approves, certifies, retries, or creates metrics.",
+  "- Use --input-file for real drafts. The file is JSON; --project-id and --client-request-id come from CLI flags so replays keep one stable operation key.",
+  "- Build the file from review_material_package, preserving candidate assets, heat evidence, source_link/evidence_links, relations, report/AI-model definitions, target_revision, and hashes.",
+  "- For dashboard items, preserve optional space_id/space_name from the material package into evidence_snapshot.definition.config when present. Not every dashboard has a space; do not invent or require one.",
+  "- For recurring recommendation jobs, build the draft from the latest sufficient export: start at top-20 hot dashboards, expand to top-50/top-100 only when filtering leaves too few pending review assets or visible business domains, and record the final scope in batch ai_summary.",
+  "- Expansion is for coverage, not unlimited workload. Target about 20-50 pending assets per daily batch, cap around 80, and balance roughly 3-6 visible domains with per-domain quotas before adding context.",
+  "- If more pending candidates exist, submit the ranked slice and record overflow counts/domains in batch ai_summary for later batches.",
+  "- presentation_snapshot should display only business-domain topics that contain pending review assets. Authenticated/completed assets may appear as context under those topics, but must not create standalone zero-pending topics.",
+  "- Do not author long page-visible AI summaries for hidden topics or pure authenticated context. Copy evidence, links, signals, and relations for context; spend Agent interpretation on visible domains and pending review assets.",
+  "- Scripts may assemble transport JSON and copy evidence, but page-visible ai_summary and analysis_explanation text must be Agent-written interpretation from verified evidence, not generated boilerplate.",
+  "- Follow agent_review_preflight.md: independent Agent review, at most 3 corrections, then submit with unresolved-quality warnings only when already authorized. LOCAL_ONLY never submits. Business meaning and visible-text quality are Agent review responsibilities; this command enforces only transport structure and evidence references.",
+  "- Follow agent_review_priorities_comparisons.md: item ai_summary includes recommendation.priority/priority_reason/evidence_refs, classified comparisons with both-side evidence, and comparison_review coverage. LOW is review urgency, not a defer decision; only POSSIBLE_CONFLICT merits a conflict badge. These assessments share the same 3-correction budget.",
+  "- presentation_snapshot.topics is one or more business-domain topics. Each topic must use groups[].items; do not use top-level topics[].items or raw Common work_units as the page grouping.",
+  "- relations should let the page render dashboard -> report -> metadata with contains/uses edges. Use an empty relations array only when the package truly has no known parent-child evidence.",
+  "- Each submitted item must keep source_link or evidence_links[].url so reviewers can jump to source evidence.",
+  "- item.ai_summary.summary is the per-item recommendation reason. It must cite concrete item evidence, not generic review boilerplate. batch ai_summary.summary is only the batch overview.",
+  "- For reports and SQL reports, item.ai_summary.analysis_explanation must explain reviewer-readable calculations or measures from packaged evidence_snapshot.analysis. A purpose-only summary is incomplete and is rejected locally before dispatch.",
+  "- Reviewer-visible text should follow the project-KB source style: one business Chinese Agent summary that explains purpose, calculation caliber, filters, time scope, boundaries, and concrete reviewer questions. Keep raw SQL, parser labels, temporary aliases, parameter placeholders, hashes, and evidence paths in evidence_snapshot only; independent Agent preflight flags visible implementation terms as quality findings.",
+  "- The command output includes review_page_url when review_url is present. Return review_page_url to the user; do not prepend the Common/API host to review_url yourself.",
+  "",
+  "Input-file JSON shape:",
+  "{",
+  '  "review_type": "ASSET_GOVERNANCE",',
+  '  "schema_version": "1.0",',
+  '  "title": "<review batch title>",',
+  '  "source_run_id": "<export.run_id>",',
+  '  "source_task_id": "<optional preauthorized task id>",',
+  '  "ai_summary": { "summary": "<batch overview>" },',
+  '  "presentation_snapshot": {',
+  '    "project": { "id": 1, "name": "<project name>" },',
+  '    "evidenceDate": "YYYY-MM-DD",',
+  '    "topics": [{',
+  '      "id": "<business-domain-id>",',
+  '      "name": "<business-domain-name>",',
+  '      "groups": [{',
+  '        "id": "<second-level-group-id>",',
+  '        "name": "<second-level group or source dashboard>",',
+  '        "items": [{ "id": "<client_item_id>" }]',
+  "      }]",
+  "    }],",
+  '    "relations": [{ "parent": "<dashboard item id>", "child": "<report item id>", "type": "contains" }, { "parent": "<report item id>", "child": "<metadata item id>", "type": "uses" }],',
+  '    "analysisByItem": {}',
+  "  },",
+  '  "items": [{',
+  '    "client_item_id": "<stable item id used by presentation_snapshot>",',
+  '    "target_ref": { "type": "dashboard|report|event|event_prop|user_prop|user_tag|user_cluster|metric", "key": "<lossless target key>" },',
+  '    "action_type": "CERTIFY",',
+  '    "proposal_payload": { "authentication_status": 1 },',
+  '    "source_link": "<copied source URL>",',
+  '    "evidence_links": [{ "label": "<source label>", "url": "<copied evidence URL>" }],',
+  '    "evidence_snapshot": { "analysis": "<Common packaged evidence when available>", "target_revision": "<definition version/hash>" },',
+  '    "ai_summary": {',
+  '      "summary": "<item reason with evidence basis and risks>",',
+  '      "analysis_explanation": {',
+  '        "business_purpose": "<what the reviewer uses this asset for>",',
+  '        "measures": [{ "statement": "<measure explanation>", "evidence_refs": ["evidence_snapshot.analysis..."], "inferred": false }],',
+  '        "calculations": [{ "statement": "<formula or aggregation explanation>", "evidence_refs": ["evidence_snapshot.analysis..."], "inferred": false }],',
+  '        "filters": [], "time_scope": [], "dimensions": [], "query_columns": [],',
+  '        "limitations": [], "open_questions": []',
+  "      }",
+  "    }",
+  "  }]",
+  "}"
+].join("\n");
+var agentReviewSubmitToPage = createAnalysisMetaCapabilityCommand({
+  resource: "agent-review",
+  command: "submit-to-page",
+  capabilityId: "metadata.agent_review.create",
+  description: "Submit evidence-backed asset proposals to a review page without approving or certifying assets.",
+  helpText: SUBMIT_TO_PAGE_HELP,
+  risk: "write",
+  flags: [
+    projectFlag,
+    clientRequestFlag,
+    { name: "input-file", type: "string", required: false, sensitive: true, desc: "Local JSON draft generated from review_material_package; includes ai_summary, presentation_snapshot.topics[].groups, copied evidence/source links, and items." },
+    { name: "title", type: "string", required: false, desc: "Review batch title." },
+    { name: "source-run-id", type: "string", required: false, desc: "Evidence run that produced this proposal." },
+    { name: "source-task-id", type: "string", desc: "Optional preauthorized task ID." },
+    { name: "ai-summary", type: "json", required: false, desc: "Evidence-backed batch summary object." },
+    { name: "presentation-snapshot", type: "json", required: false, desc: "Review page packet with business-domain topics, groups[].items, relations, stable client_item_id references, and real evidence links." },
+    { name: "items", type: "json", required: false, desc: "1 to 5000 CERTIFY proposals with client_item_id, target_ref, source/evidence links, proposal_payload, item ai_summary/reasons, and evidence_snapshot." }
+  ],
+  buildInput: (ctx) => {
+    const publicWebHost = resolvePublicWebHost(ctx.host());
+    const file = ctx.str("input-file");
+    if (file) {
+      const input = object(JSON.parse(readFileSync(file, "utf8")), "--input-file");
+      return normalizeSubmitInput(validateInput({
+        ...input,
+        ...projectInput2(ctx),
+        client_request_id: text(ctx, "client-request-id")
+      }), publicWebHost, ctx.host());
+    }
+    const title = text(ctx, "title");
+    const sourceRunId = text(ctx, "source-run-id");
+    if (!title || !sourceRunId || !ctx.str("ai-summary") || !ctx.str("presentation-snapshot") || !ctx.str("items")) {
+      throw new Error("Pass --input-file, or pass --title, --source-run-id, --ai-summary, --presentation-snapshot, and --items together.");
+    }
+    return normalizeSubmitInput(validateInput({
+      ...projectInput2(ctx),
+      review_type: "ASSET_GOVERNANCE",
+      schema_version: "1.0",
+      client_request_id: text(ctx, "client-request-id"),
+      title,
+      source_run_id: sourceRunId,
+      ...ctx.str("source-task-id") ? { source_task_id: text(ctx, "source-task-id") } : {},
+      ai_summary: object(ctx.json("ai-summary"), "--ai-summary"),
+      presentation_snapshot: object(ctx.json("presentation-snapshot"), "--presentation-snapshot"),
+      items: ctx.json("items")
+    }), publicWebHost, ctx.host());
+  },
+  postProcess: (result, _input, ctx) => normalizeSubmitResult(result, resolvePublicWebHost(ctx.host()), ctx.host())
+});
+function validateInput(input) {
+  const items = array(input.items, "items").map((value) => {
+    const item = object(value, "items[]");
+    fields(item, [
+      "client_item_id",
+      "target_ref",
+      "action_type",
+      "proposal_payload",
+      "ai_summary",
+      "evidence_snapshot",
+      "source_link",
+      "evidence_links"
+    ], "items[]");
+    if (typeof item.client_item_id !== "string" || !item.client_item_id.trim()) {
+      throw new Error("items[].client_item_id must be a nonempty string.");
+    }
+    const target = object(item.target_ref, "items[].target_ref");
+    const targetType = typeof target.type === "string" ? target.type.trim() : "";
+    const targetKey = typeof target.key === "string" ? target.key.trim() : "";
+    if (!targetType || !targetKey) {
+      throw new Error("items[].target_ref requires nonempty string type and key.");
+    }
+    if (!supportedTargetTypes.has(targetType)) {
+      throw new Error("items[].target_ref.type must be one of dashboard, report, event, event_prop, user_prop, user_tag, user_cluster, metric.");
+    }
+    const proposal = object(item.proposal_payload, "items[].proposal_payload");
+    fields(proposal, ["authentication_status"], "items[].proposal_payload");
+    if (item.action_type !== "CERTIFY" || proposal.authentication_status !== 1) {
+      throw new Error("Only CERTIFY with authentication_status=1 is supported by the review page.");
+    }
+    const aiSummary = object(item.ai_summary, "items[].ai_summary");
+    const evidenceSnapshot = object(item.evidence_snapshot, "items[].evidence_snapshot");
+    validateItemAiSummary(aiSummary, `items[${String(item.client_item_id)}].ai_summary`);
+    if (targetType === "report") {
+      validateReportAnalysis(aiSummary, evidenceSnapshot, `items[${String(item.client_item_id)}]`);
+    }
+    validateEvidenceLinks(item);
+    return item;
+  });
+  unique(items.map((item) => item.client_item_id), "client_item_id");
+  fields(input, [
+    "project_id",
+    "review_type",
+    "schema_version",
+    "client_request_id",
+    "title",
+    "source_run_id",
+    "source_task_id",
+    "ai_summary",
+    "presentation_snapshot",
+    "items"
+  ], "submit-to-page input");
+  object(input.ai_summary, "ai_summary");
+  validatePresentation(object(input.presentation_snapshot, "presentation_snapshot"), new Set(items.map((item) => item.client_item_id)));
+  if (input.review_type !== "ASSET_GOVERNANCE" || input.schema_version !== "1.0") {
+    throw new Error("submit-to-page input requires review_type=ASSET_GOVERNANCE and schema_version=1.0.");
+  }
+  return { ...input, items };
+}
+function validateItemAiSummary(aiSummary, name) {
+  if (!meaningfulText(aiSummary.summary)) {
+    throw new Error(`${name}.summary must be a nonempty string.`);
+  }
+}
+function validateReportAnalysis(aiSummary, evidenceSnapshot, name) {
+  const analysis = object(evidenceSnapshot.analysis, `${name}.evidence_snapshot.analysis`);
+  if (!meaningfulText(evidenceSnapshot.target_revision)) {
+    throw new Error(`${name}.evidence_snapshot.target_revision is required for report drafts.`);
+  }
+  const explanation = object(aiSummary.analysis_explanation, `${name}.ai_summary.analysis_explanation`);
+  const evidenceRefs = [
+    ...explanationRows(explanation.measures, `${name}.ai_summary.analysis_explanation.measures`),
+    ...explanationRows(explanation.calculations, `${name}.ai_summary.analysis_explanation.calculations`)
+  ].filter((row) => meaningfulText(row.statement)).flatMap((row) => evidenceRefList(row.evidence_refs));
+  if (!evidenceRefs.some((ref) => resolvesAnalysisPath(analysis, ref))) {
+    throw new Error(`${name} report analysis_explanation requires calculations or measures with resolvable evidence_snapshot.analysis refs.`);
+  }
+}
+function explanationRows(value, name) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) throw new Error(`${name} must be an array.`);
+  return value.map((entry) => object(entry, `${name}[]`));
+}
+function evidenceRefList(value) {
+  if (!Array.isArray(value)) return [];
+  return value.filter((entry) => typeof entry === "string" && entry.trim().length > 0);
+}
+function meaningfulText(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+function resolvesAnalysisPath(analysis, path) {
+  const prefix = "evidence_snapshot.analysis";
+  if (path === prefix) return true;
+  if (!path.startsWith(`${prefix}.`) && !path.startsWith(`${prefix}[`)) return false;
+  const suffix = path.slice(prefix.length);
+  const matcher = /(?:\.([A-Za-z0-9_$-]+)|\[(\d+)\])/g;
+  let index = 0;
+  let current = analysis;
+  for (let match = matcher.exec(suffix); match; match = matcher.exec(suffix)) {
+    if (match.index !== index) return false;
+    index += match[0].length;
+    const [, key, arrayIndex] = match;
+    if (arrayIndex !== void 0) {
+      if (!Array.isArray(current)) return false;
+      current = current[Number(arrayIndex)];
+    } else {
+      if (current === null || typeof current !== "object" || Array.isArray(current)) return false;
+      current = current[key];
+    }
+    if (current === void 0) return false;
+  }
+  return index === suffix.length;
+}
+function validateEvidenceLinks(item) {
+  const sourceLink = typeof item.source_link === "string" && item.source_link.trim();
+  let evidenceLink = false;
+  if ("evidence_links" in item) {
+    evidenceLink = array(item.evidence_links, "items[].evidence_links").some((value) => {
+      const link = object(value, "items[].evidence_links[]");
+      return typeof link.url === "string" && !!link.url.trim();
+    });
+  }
+  if (!sourceLink && !evidenceLink) {
+    throw new Error("items[] must include source_link or evidence_links[].url so reviewers can open source evidence.");
+  }
+}
+function validatePresentation(presentation, itemIds) {
+  const displayed = /* @__PURE__ */ new Set();
+  for (const topicValue of array(presentation.topics, "presentation_snapshot.topics")) {
+    const topic = object(topicValue, "presentation_snapshot.topics[]");
+    if ("items" in topic) {
+      throw new Error("presentation_snapshot.topics[] must use groups[].items, not top-level items.");
+    }
+    for (const groupValue of array(topic.groups, "presentation_snapshot.topics[].groups")) {
+      const group = object(groupValue, "presentation_snapshot.topics[].groups[]");
+      if (typeof group.id !== "string" || !group.id.trim() || typeof group.name !== "string" || !group.name.trim()) {
+        throw new Error("presentation_snapshot.topics[].groups[] requires nonempty string id and name.");
+      }
+      for (const itemValue of array(group.items, "presentation_snapshot.topics[].groups[].items")) {
+        const item = object(itemValue, "presentation_snapshot.topics[].groups[].items[]");
+        if (typeof item.id !== "string" || !item.id.trim()) {
+          throw new Error("presentation_snapshot display items require nonempty string id.");
+        }
+        if (!itemIds.has(item.id)) {
+          throw new Error("presentation_snapshot references an unknown client_item_id.");
+        }
+        displayed.add(item.id);
+      }
+    }
+  }
+  for (const id of itemIds) {
+    if (!displayed.has(String(id))) {
+      throw new Error("presentation_snapshot must display every submitted item under topics[].groups[].items.");
+    }
+  }
+}
+function normalizeSubmitInput(input, publicWebHost, sourceHost) {
+  normalizeResourceUrlFields(input, publicWebHost, sourceHost);
+  return input;
+}
+function normalizeSubmitResult(result, publicWebHost, sourceHost) {
+  normalizeResourceUrlFields(result, publicWebHost, sourceHost);
+  if (result && typeof result === "object" && !Array.isArray(result)) {
+    const data = result;
+    if (typeof data.review_url === "string" && data.review_url.trim()) {
+      data.review_page_url = normalizeResourceUrls(data.review_url, publicWebHost, sourceHost);
+    }
+  }
+  return result;
+}
+
+// src/commands/te-analysis/meta/agent-review/review.ts
+var agentReviewReview = createAnalysisMetaCapabilityCommand({
+  resource: "agent-review",
+  command: "review",
+  capabilityId: "metadata.agent_review.review",
+  description: "Record explicit human decisions and execute approved certification proposals.",
+  risk: "write",
+  flags: [
+    projectFlag,
+    batchFlag,
+    clientRequestFlag,
+    { name: "decisions", type: "json", required: true, desc: "Versioned decisions: item_id (string), version (integer), decision APPROVE/DEFER/REJECT, reason (required for DEFER/REJECT)." }
+  ],
+  buildInput: (ctx) => {
+    const decisions = array(ctx.json("decisions"), "--decisions").map((value) => {
+      const decision = object(value, "decisions[]");
+      fields(decision, ["item_id", "version", "decision", "reason"], "decisions[]");
+      decimalId(decision.item_id, "decisions[].item_id");
+      if (!Number.isSafeInteger(decision.version) || Number(decision.version) < 0) {
+        throw new Error("decisions[].version must be a nonnegative safe integer from detail.");
+      }
+      if (!["APPROVE", "DEFER", "REJECT"].includes(String(decision.decision))) {
+        throw new Error("decisions[].decision must be APPROVE, DEFER, or REJECT.");
+      }
+      if (decision.reason !== void 0 && typeof decision.reason !== "string") {
+        throw new Error("decisions[].reason must be a string.");
+      }
+      if (decision.decision !== "APPROVE" && !String(decision.reason ?? "").trim()) {
+        throw new Error("DEFER and REJECT require a nonempty reason.");
+      }
+      return decision;
+    });
+    unique(decisions.map((decision) => decision.item_id), "decisions[].item_id");
+    return { ...batchInput(ctx), client_request_id: text(ctx, "client-request-id"), decisions };
+  }
+});
+
+// src/commands/te-analysis/meta/agent-review/retry.ts
+var agentReviewRetry = createAnalysisMetaCapabilityCommand({
+  resource: "agent-review",
+  command: "retry",
+  capabilityId: "metadata.agent_review.retry",
+  description: "Retry selected failed executions under their existing approvals.",
+  risk: "write",
+  flags: [
+    projectFlag,
+    batchFlag,
+    clientRequestFlag,
+    { name: "item-ids", type: "json", required: true, desc: "1 to 5000 failed item IDs as decimal strings. Successful items must not be retried." }
+  ],
+  buildInput: (ctx) => {
+    const ids = array(ctx.json("item-ids"), "--item-ids").map((id) => decimalId(id, "item_ids[]"));
+    unique(ids, "item_ids");
+    return { ...batchInput(ctx), client_request_id: text(ctx, "client-request-id"), item_ids: ids };
+  }
+});
+
+// src/commands/te-analysis/meta/agent-review/evidence.ts
+var agentReviewEvidence = createAnalysisMetaCapabilityCommand({
+  resource: "agent-review",
+  command: "evidence",
+  capabilityId: "metadata.agent_review.evidence",
+  description: "Read current server-generated asset review evidence before drafting a proposal. Does not submit or certify.",
+  risk: "read",
+  flags: [
+    projectFlag,
+    { name: "target-type", type: "string", required: true, desc: "Resolved asset type supported by Common, for example report or dashboard." },
+    { name: "target-key", type: "string", required: true, desc: "Exact resolved asset key as a string; preserve all ID digits and technical names." }
+  ],
+  buildInput: (ctx) => ({
+    ...projectInput2(ctx),
+    review_type: "ASSET_GOVERNANCE",
+    target_ref: { type: text(ctx, "target-type"), key: text(ctx, "target-key") },
+    action_type: "CERTIFY",
+    proposal_payload: { authentication_status: 1 }
+  })
+});
+
+// src/commands/te-analysis/meta/agent-review/index.ts
+var agentReviewList = createAnalysisMetaCapabilityCommand({
+  resource: "agent-review",
+  command: "list",
+  capabilityId: "metadata.agent_review.list",
+  description: "List recent visible review batches and their current status.",
+  risk: "read",
+  flags: [projectFlag, { name: "limit", type: "number", min: 1, max: 500, default: 20, desc: "Maximum recent batches, from 1 to 500. Default: 20." }],
+  buildInput: (ctx) => {
+    const limit = ctx.str("limit") === "" ? 20 : ctx.num("limit");
+    if (!Number.isInteger(limit) || limit < 1 || limit > 500) throw new Error("--limit must be an integer from 1 to 500.");
+    return { ...projectInput2(ctx), limit };
+  }
+});
+var agentReviewDetail = createAnalysisMetaCapabilityCommand({
+  resource: "agent-review",
+  command: "detail",
+  capabilityId: "metadata.agent_review.detail",
+  description: "Read review snapshots, item versions, decisions, and execution status.",
+  risk: "read",
+  flags: [projectFlag, batchFlag],
+  buildInput: batchInput
+});
+var agentReviewRecords = createAnalysisMetaCapabilityCommand({
+  resource: "agent-review",
+  command: "records",
+  capabilityId: "metadata.agent_review.records",
+  description: "Read immutable review and execution events for a batch.",
+  risk: "read",
+  flags: [projectFlag, batchFlag],
+  buildInput: batchInput
+});
+var agent_review_default = [agentReviewSubmitToPage, agentReviewList, agentReviewDetail, agentReviewRecords, agentReviewReview, agentReviewRetry, agentReviewEvidence];
+
+// src/commands/te-analysis/meta/index.ts
+var commands12 = [
   ...event_default,
   ...property_default,
   ...virtual_event_default,
@@ -2104,9 +2758,11 @@ var commands11 = [
   ...exchange_default,
   ...super_metadata_default,
   ...datatable_default,
-  ...catalog_default
+  ...catalog_default,
+  ...governance_recommendation_default,
+  ...agent_review_default
 ];
-var meta_default = commands11;
+var meta_default = commands12;
 
 // src/commands/te-analysis/meta/asset/usage-list.ts
 var analysisMetaAssetUsageList = createAnalysisGovernanceCapabilityCommand({
@@ -2158,9 +2814,9 @@ var analysisMetaAssetImpactList = createAnalysisGovernanceCapabilityCommand({
   command: "list",
   capabilityId: "governance.asset_impact.list",
   description: "List downstream impacts for one asset.",
-  flags: [projectIdFlag, nodeIdFlag, queryFlag, searchsFlag, ruleFlag, directoryLimitFlag, directoryOffsetFlag, payloadFlag],
+  flags: [projectIdFlag, nodeIdFlag, directoryLimitFlag, directoryOffsetFlag, payloadFlag],
   risk: "read",
-  buildInput: (ctx) => assetGovernanceInput(ctx, ["node_id", "query", "searchs", "rule", "limit", "offset"])
+  buildInput: (ctx) => assetGovernanceInput(ctx, ["node_id", "limit", "offset"])
 });
 
 // src/commands/te-analysis/meta/asset/query-history-list.ts
@@ -2169,9 +2825,9 @@ var analysisMetaAssetQueryHistoryList = createAnalysisGovernanceCapabilityComman
   command: "list",
   capabilityId: "governance.asset_query_history.list",
   description: "List query history for one asset.",
-  flags: [projectIdFlag, nodeIdFlag, queryFlag, searchsFlag, ruleFlag, directoryLimitFlag, directoryOffsetFlag, payloadFlag],
+  flags: [projectIdFlag, nodeIdFlag, directoryLimitFlag, directoryOffsetFlag, payloadFlag],
   risk: "read",
-  buildInput: (ctx) => assetGovernanceInput(ctx, ["node_id", "query", "searchs", "rule", "limit", "offset"])
+  buildInput: (ctx) => assetGovernanceInput(ctx, ["node_id", "limit", "offset"])
 });
 
 // src/commands/te-analysis/meta/asset/rule-schema.ts
@@ -2235,9 +2891,9 @@ var analysisMetaAssetBatchInfoExport = createAnalysisGovernanceCapabilityCommand
   command: "batch-info-export",
   capabilityId: "governance.asset.batch_export_info",
   description: "Batch export asset information.",
-  flags: [projectIdFlag, nodeIdsFlag, reportsVersionFlag, zoneOffsetFlag, scheduleUiConfigFlag, dashboardStatusFlag, refreshTypeFlag, cacheConfigFlag, clearHistoryTagFlag, payloadFlag],
+  flags: [projectIdFlag, nodeIdsFlag, payloadFlag],
   risk: "read",
-  buildInput: (ctx) => assetGovernanceInput(ctx, ["node_ids", "reports_version", "zone_offset", "schedule_ui_config", "dashboard_status", "refresh_type", "cache_config", "clear_history_tag"])
+  buildInput: (ctx) => assetGovernanceInput(ctx, ["node_ids"])
 });
 
 // src/commands/te-analysis/meta/asset/batch-sql-export.ts
@@ -2246,9 +2902,9 @@ var analysisMetaAssetBatchSqlExport = createAnalysisGovernanceCapabilityCommand(
   command: "batch-sql-export",
   capabilityId: "governance.asset.batch_export_sql",
   description: "Batch export asset SQL definitions.",
-  flags: [projectIdFlag, nodeIdsFlag, reportsVersionFlag, zoneOffsetFlag, scheduleUiConfigFlag, dashboardStatusFlag, refreshTypeFlag, cacheConfigFlag, clearHistoryTagFlag, payloadFlag],
+  flags: [projectIdFlag, nodeIdsFlag, payloadFlag],
   risk: "read",
-  buildInput: (ctx) => assetGovernanceInput(ctx, ["node_ids", "reports_version", "zone_offset", "schedule_ui_config", "dashboard_status", "refresh_type", "cache_config", "clear_history_tag"])
+  buildInput: (ctx) => assetGovernanceInput(ctx, ["node_ids"])
 });
 
 // src/commands/te-analysis/meta/asset/batch-delete.ts
@@ -2290,9 +2946,9 @@ var analysisMetaAssetBatchDashboardScheduleFreeze = createAnalysisGovernanceCapa
   command: "batch-dashboard-schedule-freeze",
   capabilityId: "governance.asset.batch_dashboard_schedule_freeze",
   description: "Batch freeze dashboard schedules for governed assets.",
-  flags: [projectIdFlag, nodeIdsFlag, reportsVersionFlag, zoneOffsetFlag, scheduleUiConfigFlag, dashboardStatusFlag, refreshTypeFlag, cacheConfigFlag, payloadFlag],
+  flags: [projectIdFlag, nodeIdsFlag, scheduleUiConfigFlag, dashboardStatusFlag, refreshTypeFlag, cacheConfigFlag, payloadFlag],
   risk: "write",
-  buildInput: (ctx) => assetGovernanceInput(ctx, ["node_ids", "reports_version", "zone_offset", "schedule_ui_config", "dashboard_status", "refresh_type", "cache_config"])
+  buildInput: (ctx) => assetGovernanceInput(ctx, ["node_ids", "schedule_ui_config", "dashboard_status", "refresh_type", "cache_config"])
 });
 
 // src/commands/te-analysis/meta/asset/batch-handover.ts
@@ -2330,7 +2986,7 @@ var analysisMetaAssetOperationRecordExport = createAnalysisGovernanceCapabilityC
 
 // src/commands/te-analysis/governance/asset-authentication-shared.ts
 import { createHash as createHash3, randomBytes as randomBytes3 } from "crypto";
-import { readFileSync, statSync } from "fs";
+import { readFileSync as readFileSync2, statSync } from "fs";
 import { mkdir as mkdir3, open as open3, rm as rm3 } from "fs/promises";
 import { dirname as dirname3, extname as extname3, resolve as resolve3 } from "path";
 var ASSET_TYPES = /* @__PURE__ */ new Set([
@@ -2355,7 +3011,7 @@ var OUTPUT_FIELDS = /* @__PURE__ */ new Set([
   "user_count90d",
   "impact_degree"
 ]);
-var assetTypesFlag = {
+var assetTypesFlag2 = {
   name: "asset-types",
   type: "json",
   required: false,
@@ -2416,7 +3072,7 @@ var authenticationExportOutputFlag = {
   desc: "Local .jsonl output path. Integrity metadata is written to <output>.meta.json."
 };
 var authenticationFilterFlags = [
-  assetTypesFlag,
+  assetTypesFlag2,
   authenticationStatusFilterFlag,
   governanceQueriesFlag,
   heatCountGtFlag,
@@ -2538,7 +3194,7 @@ function assetRefsInput(ctx) {
     if (!statSync(path, { throwIfNoEntry: false })?.isFile()) {
       throw new CliValidationError(`--asset-file must be a regular file: ${path}`);
     }
-    values = readFileSync(path, "utf8").split(/\r?\n/).filter(Boolean).map((line, index) => {
+    values = readFileSync2(path, "utf8").split(/\r?\n/).filter(Boolean).map((line, index) => {
       try {
         return JSON.parse(line);
       } catch {
@@ -2671,7 +3327,7 @@ var analysisGovernanceAssetAuthenticationUpdate = createAnalysisGovernanceCapabi
 });
 
 // src/commands/te-analysis/governance/index.ts
-var commands12 = [
+var commands13 = [
   analysisGovernanceAssetAuthenticationList,
   analysisGovernanceAssetAuthenticationExport,
   analysisGovernanceAssetAuthenticationUpdate,
@@ -2696,7 +3352,7 @@ var commands12 = [
   analysisMetaAssetOperationRecordList,
   analysisMetaAssetOperationRecordExport
 ];
-var governance_default = commands12;
+var governance_default = commands13;
 
 // src/commands/te-analysis/report/list.ts
 var reportList = createAnalysisCapabilityCommand({
@@ -2782,7 +3438,7 @@ var REPORT_WRITE_MODEL_TYPE_VALUES = [
   "tag"
 ];
 var REPORT_WRITE_MODEL_DESCRIPTION = `${AI_MODEL_DESCRIPTION} Report create/update also supports tag for saved tag report data; use tag as the AI-facing spelling.`;
-var AI_DEFINITION_DESCRIPTION = 'AI-facing model definition JSON. Do not pass raw QP, events, event_view, visual_view, or analysis_query. Distribution filters must be attached to the corresponding distribution_metrics[].filters; do not use top-level filters or relation. For path definitions, global filters support user_property, cluster, and tag only; event_property is not supported. session_unit accepts second (1..999), minute (1..999), or hour (1..24). Do not use day; express one day as session_interval=24 and session_unit=hour. For SQL, a simple query is {"sql":"select ..."}; raw variables use ${name}, while typed params use ${Text:name}, ${Selector:name}, or ${PartDate:name}. PartDate expands to a complete predicate, so write WHERE ${PartDate:d}, not a column followed by the placeholder. A part_date parameter may set boolean use_timezone; it defaults to false and controls whether that parameter uses the query effective timezone. Selector value must match one options[].value. Trino identifiers containing #, $, @, spaces, punctuation, or a reserved word must be delimited with double quotes, for example SELECT "#user_id", "$part_event", "end" FROM ...; single quotes are string literals. For multiline SQL JSON, the decoded sql value must contain a real line break; do not submit a literal \\n sequence outside quoted SQL text. Queries against an event table must include a date-partition predicate on the quoted "$part_date" column, for example WHERE "$part_date" BETWEEN \'2026-07-01\' AND \'2026-07-07\'; the backend rejects event-table SQL without it. The CLI preserves SQL text and never auto-quotes identifiers.';
+var AI_DEFINITION_DESCRIPTION = 'Event metrics: omit optional display_name unless the target command schema explicitly supports it. Funnel step filters use event_property_name (not field) and string-array values, including "true"/"false" for boolean properties. For tag/cluster filters, cluster_date_policy accepts LATEST (default), AUTO (match the computed result for each analysis date), or SPECIFIED (requires specified_cluster_date in yyyy-MM-dd format). AI-facing model definition JSON. Do not pass raw QP, events, event_view, visual_view, or analysis_query. Distribution filters must be attached to the corresponding distribution_metrics[].filters; do not use top-level filters or relation. For path definitions, global filters support user_property, cluster, and tag only; event_property is not supported. session_unit accepts second (1..999), minute (1..999), or hour (1..24). Do not use day; express one day as session_interval=24 and session_unit=hour. For SQL, a simple query is {"sql":"select ..."}; raw variables use ${name}, while typed params use ${Text:name}, ${Selector:name}, or ${PartDate:name}. PartDate expands to a complete predicate, so write WHERE ${PartDate:d}, not a column followed by the placeholder. A part_date parameter may set boolean use_timezone; it defaults to false and controls whether that parameter uses the query effective timezone. Selector value must match one options[].value. Trino identifiers containing #, $, @, spaces, punctuation, or a reserved word must be delimited with double quotes, for example SELECT "#user_id", "$part_event", "end" FROM ...; single quotes are string literals. For multiline SQL JSON, the decoded sql value must contain a real line break; do not submit a literal \\n sequence outside quoted SQL text. Queries against an event table must include a date-partition predicate on the quoted "$part_date" column, for example WHERE "$part_date" BETWEEN \'2026-07-01\' AND \'2026-07-07\'; the backend rejects event-table SQL without it. The CLI preserves SQL text and never auto-quotes identifiers.';
 var REPORT_WRITE_DEFINITION_DESCRIPTION = `${AI_DEFINITION_DESCRIPTION} For model_type=tag, pass a tag report intent such as {"tag":{"tag_name":"vip_users","time_range":{"mode":"recent","unit":"day","value":7}}}. Tags are supported for report create/update and report data, not ad-hoc analysis.`;
 function aiModelTypeFlag(required) {
   return {
@@ -2792,6 +3448,34 @@ function aiModelTypeFlag(required) {
     desc: AI_MODEL_DESCRIPTION
   };
 }
+function validateFunnelStepFilters(modelType, definition) {
+  if (modelType !== "funnel" || !isRecord(definition) || !isRecord(definition.funnel)) return;
+  const steps = definition.funnel.steps;
+  if (!Array.isArray(steps)) return;
+  const errors = [];
+  steps.forEach((step, stepIndex) => {
+    if (!isRecord(step) || !Array.isArray(step.filters)) return;
+    step.filters.forEach((filter, filterIndex) => {
+      if (!isRecord(filter)) return;
+      const location = `definition.funnel.steps[${stepIndex}].filters[${filterIndex}]`;
+      if ("field" in filter || typeof filter.event_property_name !== "string" || !filter.event_property_name.trim()) {
+        errors.push(`${location}: use a non-empty event_property_name, not a generic field object.`);
+      }
+      if ("values" in filter && (!Array.isArray(filter.values) || filter.values.some((value) => typeof value !== "string"))) {
+        errors.push(`${location}.values: use an array of strings (boolean properties use "true" or "false").`);
+      }
+    });
+  });
+  if (errors.length) {
+    throw new CliValidationError(errors.join("\n"), {
+      code: "INVALID_ANALYSIS_DEFINITION",
+      hint: "Correct all reported step-filter fields together, preserve the complete requested definition, then validate it once. No query was dispatched."
+    });
+  }
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
 function reportWriteModelTypeFlag(required) {
   return {
     name: "model-type",
@@ -2820,7 +3504,7 @@ var metadataResolutionsFlag = {
   name: "resolutions",
   type: "json",
   required: false,
-  desc: "Optional user-confirmed metadata bindings keyed by compiler error path. Each value requires raw_value, resource_type, and resource_key. Reuse the unchanged definition and only pass values explicitly confirmed by the user."
+  desc: "Optional user-confirmed metadata bindings keyed by compiler error path. Each value requires raw_value, resource_type, and resource_key. Keep each bound field's path and raw_value; fill the confirmed aggregation and other model parameters in the definition."
 };
 var reportMetadataResolutionsFlag = {
   ...metadataResolutionsFlag,
@@ -2843,6 +3527,7 @@ var reportCreate = createAnalysisCapabilityCommand({
     { name: "report-name", type: "string", required: true, desc: "Report display name." },
     reportWriteModelTypeFlag(true),
     reportWriteDefinitionFlag(true),
+    modelDefinitionIntentSnapshotFlag,
     reportMetadataResolutionsFlag,
     { name: "report-desc", type: "string", required: false, desc: "Optional report description." },
     { name: "cache-seconds", type: "number", required: false, desc: "Optional cache duration in seconds." },
@@ -2851,6 +3536,7 @@ var reportCreate = createAnalysisCapabilityCommand({
   ],
   risk: "write",
   validate: validateReportMetadataResolutions,
+  intentConsistency: { definitionFlag: "definition", modelTypeFlag: "model-type" },
   buildInput: (ctx) => compactInput({
     ...projectInput(ctx),
     report_name: ctx.str("report-name"),
@@ -2893,12 +3579,14 @@ var reportUpdate = createAnalysisCapabilityCommand({
     { name: "report-desc", type: "string", required: false, desc: "New report description." },
     reportWriteModelTypeFlag(false),
     reportWriteDefinitionFlag(false),
+    modelDefinitionIntentSnapshotFlag,
     reportMetadataResolutionsFlag,
     { name: "cache-seconds", type: "number", required: false, desc: "Optional cache duration in seconds." },
     { name: "query-duration-ms", type: "number", required: false, desc: "Optional last query duration in milliseconds." }
   ],
   risk: "write",
   validate: validateReportUpdate,
+  intentConsistency: { definitionFlag: "definition", modelTypeFlag: "model-type" },
   buildInput: (ctx) => compactInput({
     ...projectInput(ctx),
     report_id: ctx.num("report-id"),
@@ -2928,7 +3616,7 @@ var reportDelete = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/report/index.ts
-var commands13 = [
+var commands14 = [
   reportList,
   reportListExport,
   reportGet,
@@ -2936,10 +3624,43 @@ var commands13 = [
   reportUpdate,
   reportDelete
 ];
-var report_default = commands13;
+var report_default = commands14;
 
 // src/commands/te-analysis/report-data/shared.ts
 var reportDataZoneOffsetDescription = "Query execution timezone. Omit it to match the report UI for the current user (user selection when available, otherwise project default). Use a fixed UTC offset from -12 through 14, or 99 for local-time mode with no conversion to one fixed UTC offset; 99 is not UTC+99. This is not persisted in the report definition.";
+var sqlReportParamsDescription = "SQL reports only. First run analysis report get for every target SQL report; each name must exist in every definition.params. For a selector parameter, put the exact UI option label from definition.params[].options[].name in the override value field; never send options[].value or its SQL fragment. Other parameter types use their documented value/range fields. Do not send definition fields such as paramType, selectorItems, options, or use_timezone.";
+var SQL_SELECTOR_RUNTIME_ERROR_HINT = "If --sql-params overrides a selector, run analysis report get and copy the exact definition.params[].options[].name label into the override value field. Do not pass options[].value or its underlying SQL fragment, and do not guess or automatically rewrite an ambiguous option.";
+function enrichSqlSelectorRuntimeError(error) {
+  if (!(error instanceof CapabilityGatewayError) || error.code !== "INVALID_REPORT_DEFINITION" || !/selectorName\s+invalid/i.test(error.message)) {
+    return error;
+  }
+  const hint = error.hint ? `${error.hint} ${SQL_SELECTOR_RUNTIME_ERROR_HINT}` : SQL_SELECTOR_RUNTIME_ERROR_HINT;
+  return new CapabilityGatewayError(
+    error.message,
+    error.code,
+    error.httpStatus,
+    hint,
+    error.meta
+  );
+}
+async function withSqlSelectorRuntimeErrorHint(operation) {
+  try {
+    return await operation();
+  } catch (error) {
+    throw enrichSqlSelectorRuntimeError(error);
+  }
+}
+function withSqlSelectorRuntimeDiagnostics(command) {
+  const validateInput2 = command.validateInput;
+  const dryRun = command.dryRun;
+  const execute = command.execute;
+  return {
+    ...command,
+    ...validateInput2 ? { validateInput: (ctx) => withSqlSelectorRuntimeErrorHint(() => validateInput2(ctx)) } : {},
+    ...dryRun ? { dryRun: (ctx) => withSqlSelectorRuntimeErrorHint(() => dryRun(ctx)) } : {},
+    execute: (ctx) => withSqlSelectorRuntimeErrorHint(() => execute(ctx))
+  };
+}
 function reportDataInput(ctx) {
   return compactInput({
     ...projectInput(ctx),
@@ -2967,7 +3688,7 @@ function reportDataExportInput(ctx) {
 }
 
 // src/commands/te-analysis/report-data/run.ts
-var reportDataRun = createAnalysisCapabilityCommand({
+var reportDataRun = withSqlSelectorRuntimeDiagnostics(createAnalysisCapabilityCommand({
   resource: "report-data",
   command: "run",
   capabilityId: "analysis.report_data.run",
@@ -2978,7 +3699,7 @@ var reportDataRun = createAnalysisCapabilityCommand({
     requestIdFlag,
     { name: "filters", type: "json", required: false, desc: 'Non-SQL analysis models only. SQL-only requests reject this field; mixed batches warn for SQL report_ids that ignore it. AI-facing shape: {"relation":"and","items":[{"field":{"name":"country","type":"user_property"},"operator":"eq","values":["US"]}]}. Never pass QP taFilters.' },
     { name: "group-by", type: "json", required: false, desc: 'Non-SQL analysis models only. SQL-only requests reject this field; mixed batches warn. AI-facing shape: [{"field":{"name":"country","type":"user_property"}}]. Time granularity uses --time-granularity.' },
-    { name: "sql-params", type: "json", required: false, desc: 'SQL reports only. First run analysis report get for every target SQL report; each name must exist in every definition.params. Send value overrides only, for example [{"name":"platform","value":"ios"}] or saved part_date/time parameters with start_time/end_time. Do not send definition fields such as paramType, selectorItems, or use_timezone.' },
+    { name: "sql-params", type: "json", required: false, desc: sqlReportParamsDescription },
     { name: "start-time", type: "string", required: false, desc: "Non-SQL analysis-model date override start, yyyy-MM-dd. SQL dates must be saved parameters overridden through --sql-params." },
     { name: "end-time", type: "string", required: false, desc: "Non-SQL analysis-model date override end, yyyy-MM-dd. SQL dates must be saved parameters overridden through --sql-params." },
     { name: "time-granularity", type: "string", required: false, desc: "Non-SQL analysis-model time granularity override. SQL accepts only --sql-params." },
@@ -2992,10 +3713,10 @@ var reportDataRun = createAnalysisCapabilityCommand({
   risk: "read",
   validate: validateClusterQueryRouting,
   buildInput: reportDataInput
-});
+}));
 
 // src/commands/te-analysis/report-data/export.ts
-var reportDataExport = createAnalysisCapabilityCommand({
+var reportDataExport = withSqlSelectorRuntimeDiagnostics(createAnalysisCapabilityCommand({
   resource: "report-data",
   command: "export",
   capabilityId: "analysis.report_data.export",
@@ -3007,7 +3728,7 @@ var reportDataExport = createAnalysisCapabilityCommand({
     requestIdFlag,
     { name: "filters", type: "json", required: false, desc: "Non-SQL analysis models only. SQL-only requests reject this field; mixed batches are best-effort. Use AI-facing field intent, never QP taFilters." },
     { name: "group-by", type: "json", required: false, desc: 'Non-SQL analysis models only. SQL-only requests reject this field. Shape: [{"field":{"name":"country","type":"user_property"}}].' },
-    { name: "sql-params", type: "json", required: false, desc: "SQL reports only. First run analysis report get for every target SQL report; each name must exist in every definition.params. Send value overrides only, including saved part_date/time parameters for date changes. Do not send definition fields such as paramType, selectorItems, or use_timezone." },
+    { name: "sql-params", type: "json", required: false, desc: sqlReportParamsDescription },
     { name: "start-time", type: "string", required: false, desc: "Non-SQL analysis-model date override start, yyyy-MM-dd. SQL dates use --sql-params." },
     { name: "end-time", type: "string", required: false, desc: "Non-SQL analysis-model date override end, yyyy-MM-dd. SQL dates use --sql-params." },
     { name: "time-granularity", type: "string", required: false, desc: "Non-SQL analysis-model time granularity override. SQL accepts only --sql-params." },
@@ -3021,14 +3742,14 @@ var reportDataExport = createAnalysisCapabilityCommand({
   risk: "read",
   validate: validateClusterQueryRouting,
   buildInput: reportDataExportInput
-});
+}));
 
 // src/commands/te-analysis/report-data/index.ts
-var commands14 = [
+var commands15 = [
   reportDataRun,
   reportDataExport
 ];
-var report_data_default = commands14;
+var report_data_default = commands15;
 
 // src/commands/te-analysis/report-change-log/list.ts
 var reportChangeLogList = createAnalysisCapabilityCommand({
@@ -3064,11 +3785,11 @@ var reportChangeLogGet = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/report-change-log/index.ts
-var commands15 = [
+var commands16 = [
   reportChangeLogList,
   reportChangeLogGet
 ];
-var report_change_log_default = commands15;
+var report_change_log_default = commands16;
 
 // src/commands/te-analysis/report-version/rollback.ts
 var reportVersionRollback = createAnalysisCapabilityCommand({
@@ -3090,10 +3811,10 @@ var reportVersionRollback = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/report-version/index.ts
-var commands16 = [
+var commands17 = [
   reportVersionRollback
 ];
-var report_version_default = commands16;
+var report_version_default = commands17;
 
 // src/commands/te-analysis/report-abnormal/get.ts
 var reportAbnormalGet = createAnalysisCapabilityCommand({
@@ -3110,10 +3831,10 @@ var reportAbnormalGet = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/report-abnormal/index.ts
-var commands17 = [
+var commands18 = [
   reportAbnormalGet
 ];
-var report_abnormal_default = commands17;
+var report_abnormal_default = commands18;
 
 // src/commands/te-analysis/dashboard/list.ts
 var dashboardList = createAnalysisCapabilityCommand({
@@ -3192,22 +3913,22 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
   resource: "dashboard",
   command: "update",
   capabilityId: "analysis.dashboard.update",
-  description: "Update dashboard settings, create/update a dashboard note, save a dashboard-wide default filter, or replace the dashboard-level business filter. Use --operation settings, note-upsert, default-filter, or business-filter.",
+  description: "Update dashboard settings, create/update a dashboard note, save a dashboard-wide or personal default filter, or replace the dashboard-level business filter. Use --operation settings, note-upsert, default-filter, personal-default-filter, or business-filter.",
   flags: [
     projectIdFlag,
-    { name: "operation", type: "string", required: true, desc: "Update operation: settings, note-upsert, default-filter, or business-filter." },
-    { name: "dashboard-id", type: "number", required: false, desc: "Dashboard ID for a single-dashboard update." },
+    { name: "operation", type: "string", required: true, desc: "Update operation: settings, note-upsert, default-filter, personal-default-filter, or business-filter." },
+    { name: "dashboard-id", type: "number", required: false, desc: "Dashboard ID. Required for note-upsert, default-filter, personal-default-filter, and single-dashboard settings updates." },
     { name: "dashboard-ids", type: "json", required: false, desc: "Dashboard ID array for batch settings updates." },
     { name: "dashboard-name", type: "string", required: false, desc: "Dashboard name for single rename." },
     { name: "zone-offset", type: "number", required: false, desc: "Fixed dashboard time zone offset in hours. For example, UTC+8 is 8 and UTC-5 is -5. Valid range: -12 to 14." },
     { name: "refresh-type", type: "number", required: false, desc: "Dashboard refresh type: 0 real-time, 1 scheduled.", min: 0, max: 1 },
     { name: "dashboard-status", type: "string", required: false, desc: "Dashboard status: normal or freeze." },
-    { name: "note-id", type: "number", required: false, desc: "Dashboard note ID. Omit to create a new note." },
-    { name: "note-title", type: "string", required: false, desc: "Dashboard note title." },
-    { name: "description", type: "string", required: false, desc: "Dashboard note description." },
-    { name: "ui-config", type: "string", required: false, desc: "Dashboard or note UI config string." },
-    { name: "filter-name", type: "string", required: false, desc: "Saved filter name. Required with --operation default-filter." },
-    { name: "filter", type: "json", required: false, desc: 'Saved filter in snake_case QP form. Required with --operation default-filter or business-filter. Pass {"junction_kind":"and","ta_filters":[]} to clear a business filter.' },
+    { name: "note-id", type: "number", required: false, desc: "Dashboard note ID. Omit to create a new note attached to the dashboard." },
+    { name: "note-title", type: "string", required: false, desc: "Dashboard note title. Defaults to empty on create; omitted values are preserved on update." },
+    { name: "description", type: "string", required: false, desc: "Dashboard note description. Defaults to empty on create; omitted values are preserved on update." },
+    { name: "ui-config", type: "string", required: false, desc: "Dashboard or note UI config string. Omitted note style is preserved on update." },
+    { name: "filter-name", type: "string", required: false, desc: "Saved filter name. Required with --operation default-filter or personal-default-filter." },
+    { name: "filter", type: "json", required: false, desc: 'Saved filter in snake_case QP form: root junction_kind (and/or) and ta_filters array; SIMPLE conditions use filter_type="SIMPLE", column_name, table_type ("0" event, "1" user, "2" cluster/tag), select_type, calcu_symbol (C00 equals), and ftv. Do not use metadata table names or property_name/values. Common validates the QP format; ae-cli forwards it without local QP validation. Required with --operation default-filter, personal-default-filter, or business-filter. Pass {"junction_kind":"and","ta_filters":[]} to clear a business filter.' },
     payloadFlag
   ],
   risk: "write",
@@ -3221,8 +3942,8 @@ var dashboardUpdate = createAnalysisCapabilityCommand({
     refresh_type: optionalNumber(ctx, "refresh-type"),
     dashboard_status: optionalString(ctx, "dashboard-status"),
     note_id: optionalNumber(ctx, "note-id"),
-    note_title: optionalString(ctx, "note-title"),
-    description: optionalString(ctx, "description"),
+    note_title: optionalStringPreserveEmpty(ctx, "note-title"),
+    description: optionalStringPreserveEmpty(ctx, "description"),
     ui_config: optionalString(ctx, "ui-config"),
     filter_name: optionalString(ctx, "filter-name"),
     filter: optionalJson(ctx, "filter"),
@@ -3371,7 +4092,7 @@ var dashboardTaskStatus = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/dashboard/index.ts
-var commands18 = [
+var commands19 = [
   dashboardList,
   dashboardCreate,
   dashboardGet,
@@ -3385,7 +4106,7 @@ var commands18 = [
   dashboardAbnormalGet,
   dashboardTaskStatus
 ];
-var dashboard_default = commands18;
+var dashboard_default = commands19;
 
 // src/commands/te-analysis/dashboard-report/add.ts
 var dashboardReportAdd = createAnalysisCapabilityCommand({
@@ -3407,10 +4128,10 @@ var dashboardReportAdd = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/dashboard-report/index.ts
-var commands19 = [
+var commands20 = [
   dashboardReportAdd
 ];
-var dashboard_report_default = commands19;
+var dashboard_report_default = commands20;
 
 // src/commands/te-analysis/dashboard-report-data/run.ts
 var dashboardReportDataRun = createAnalysisCapabilityCommand({
@@ -3466,11 +4187,11 @@ var dashboardReportDataExport = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/dashboard-report-data/index.ts
-var commands20 = [
+var commands21 = [
   dashboardReportDataRun,
   dashboardReportDataExport
 ];
-var dashboard_report_data_default = commands20;
+var dashboard_report_data_default = commands21;
 
 // src/commands/te-analysis/query/cancel.ts
 var queryCancel = createAnalysisCapabilityCommand({
@@ -3565,11 +4286,11 @@ var queryCreateResultCluster = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/query/index.ts
-var commands21 = [
+var commands22 = [
   queryCancel,
   queryCreateResultCluster
 ];
-var query_default = commands21;
+var query_default = commands22;
 
 // src/commands/te-analysis/query-context/get.ts
 var queryContextGet = createAnalysisCapabilityCommand({
@@ -3601,8 +4322,8 @@ var queryContextGet = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/query-context/index.ts
-var commands22 = [queryContextGet];
-var query_context_default = commands22;
+var commands23 = [queryContextGet];
+var query_context_default = commands23;
 
 // src/commands/te-analysis/run/inspect.ts
 var runInspect = {
@@ -3694,11 +4415,11 @@ function artifactIdFrom(descriptor) {
 }
 
 // src/commands/te-analysis/run/index.ts
-var commands23 = [
+var commands24 = [
   runInspect,
   runWait
 ];
-var run_default = commands23;
+var run_default = commands24;
 
 // src/commands/te-analysis/artifact/download.ts
 import { resolve as resolve4 } from "path";
@@ -3745,10 +4466,10 @@ var artifactDownload = {
 };
 
 // src/commands/te-analysis/artifact/index.ts
-var commands24 = [
+var commands25 = [
   artifactDownload
 ];
-var artifact_default = commands24;
+var artifact_default = commands25;
 
 // src/commands/te-analysis/adhoc/shared.ts
 var useCacheFlag2 = {
@@ -3757,17 +4478,19 @@ var useCacheFlag2 = {
   required: false,
   desc: "Whether to use query cache. Default: true."
 };
-var zoneOffsetFlag2 = {
+var zoneOffsetFlag = {
   name: "zone-offset",
   type: "number",
   required: false,
   desc: "Optional timezone mode. Fixed UTC offsets are -12..14; 99 means stored local time without fixed UTC conversion (not UTC+99). Omit to use the project analysis default."
 };
 function adhocRunInput(ctx) {
+  const definition = ctx.json("definition");
+  validateFunnelStepFilters(ctx.str("model-type"), definition);
   return compactInput({
     project_id: ctx.num("project-id"),
     model_type: ctx.str("model-type"),
-    definition: ctx.json("definition"),
+    definition,
     resolutions: optionalJson(ctx, "resolutions"),
     request_id: optionalString(ctx, "request-id"),
     use_cache: optionalBoolean(ctx, "use-cache"),
@@ -3780,10 +4503,12 @@ function adhocRunInput(ctx) {
   });
 }
 function adhocExportInput(ctx) {
+  const definition = ctx.json("definition");
+  validateFunnelStepFilters(ctx.str("model-type"), definition);
   return compactInput({
     project_id: ctx.num("project-id"),
     model_type: ctx.str("model-type"),
-    definition: ctx.json("definition"),
+    definition,
     resolutions: optionalJson(ctx, "resolutions"),
     request_id: optionalString(ctx, "request-id"),
     use_cache: optionalBoolean(ctx, "use-cache"),
@@ -3799,10 +4524,11 @@ var adhocBaseFlags = [
   projectIdFlag,
   aiModelTypeFlag(true),
   aiDefinitionFlag(true),
+  modelDefinitionIntentSnapshotFlag,
   metadataResolutionsFlag,
   requestIdFlag,
   useCacheFlag2,
-  zoneOffsetFlag2,
+  zoneOffsetFlag,
   fieldsFlag,
   clusterQueryScopeFlag,
   slaveClusterIdFlag
@@ -3829,6 +4555,7 @@ var adhocRun = createAnalysisCapabilityCommand({
   ],
   risk: "read",
   validate: validateClusterQueryRouting,
+  intentConsistency: { definitionFlag: "definition", modelTypeFlag: "model-type" },
   buildInput: adhocRunInput
 });
 
@@ -3844,15 +4571,16 @@ var adhocExport = createAnalysisCapabilityCommand({
   ],
   risk: "read",
   validate: validateClusterQueryRouting,
+  intentConsistency: { definitionFlag: "definition", modelTypeFlag: "model-type" },
   buildInput: adhocExportInput
 });
 
 // src/commands/te-analysis/adhoc/index.ts
-var commands25 = [
+var commands26 = [
   adhocRun,
   adhocExport
 ];
-var adhoc_default = commands25;
+var adhoc_default = commands26;
 
 // src/commands/te-analysis/dashboard-definition/export.ts
 var dashboardDefinitionExport = createAnalysisCapabilityCommand({
@@ -3907,11 +4635,11 @@ var dashboardDefinitionImport = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/dashboard-definition/index.ts
-var commands26 = [
+var commands27 = [
   dashboardDefinitionExport,
   dashboardDefinitionImport
 ];
-var dashboard_definition_default = commands26;
+var dashboard_definition_default = commands27;
 
 // src/commands/te-analysis/dashboard-daily-report/get.ts
 var dashboardDailyReportGet = createAnalysisCapabilityCommand({
@@ -4095,13 +4823,13 @@ var dashboardDailyReportSendStatus = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/dashboard-daily-report/index.ts
-var commands27 = [
+var commands28 = [
   dashboardDailyReportGet,
   dashboardDailyReportUpdate,
   dashboardDailyReportSend,
   dashboardDailyReportSendStatus
 ];
-var dashboard_daily_report_default = commands27;
+var dashboard_daily_report_default = commands28;
 
 // src/commands/te-analysis/bi-panel/list.ts
 var biPanelList = createAnalysisCapabilityCommand({
@@ -4211,8 +4939,8 @@ var biPanelCopy = createAnalysisCapabilityCommand({
   description: "Copy a BI panel.",
   flags: [
     projectIdFlag,
-    { name: "panel-name", type: "string", required: false, desc: "New BI panel name." },
-    { name: "panel-uuid", type: "string", required: false, desc: "Source BI panel UUID." },
+    { name: "panel-name", type: "string", required: true, desc: "New BI panel name." },
+    { name: "panel-uuid", type: "string", required: true, desc: "Source BI panel UUID." },
     { name: "space-id", type: "number", required: false, desc: "Target project space ID." },
     { name: "folder-id", type: "number", required: false, desc: "Target folder ID." },
     payloadFlag
@@ -4229,7 +4957,7 @@ var biPanelCopy = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/bi-panel/index.ts
-var commands28 = [
+var commands29 = [
   biPanelList,
   biPanelGet,
   biPanelCreate,
@@ -4238,7 +4966,7 @@ var commands28 = [
   biPanelShare,
   biPanelCopy
 ];
-var bi_panel_default = commands28;
+var bi_panel_default = commands29;
 
 // src/commands/te-analysis/bi-panel-version/get.ts
 var biPanelVersionGet = createAnalysisCapabilityCommand({
@@ -4285,11 +5013,11 @@ var biPanelVersionPublish = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/bi-panel-version/index.ts
-var commands29 = [
+var commands30 = [
   biPanelVersionGet,
   biPanelVersionPublish
 ];
-var bi_panel_version_default = commands29;
+var bi_panel_version_default = commands30;
 
 // src/commands/te-analysis/bi-panel-page-data/run.ts
 var biPanelPageDataRun = createAnalysisCapabilityCommand({
@@ -4343,11 +5071,11 @@ var biPanelPageDataExport = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/bi-panel-page-data/index.ts
-var commands30 = [
+var commands31 = [
   biPanelPageDataRun,
   biPanelPageDataExport
 ];
-var bi_panel_page_data_default = commands30;
+var bi_panel_page_data_default = commands31;
 
 // src/commands/te-analysis/project-space/list.ts
 var projectSpaceList = createAnalysisCapabilityCommand({
@@ -4396,12 +5124,12 @@ var projectSpaceBusinessFilterUpsert = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project-space/index.ts
-var commands31 = [
+var commands32 = [
   projectSpaceList,
   projectSpaceGet,
   projectSpaceBusinessFilterUpsert
 ];
-var project_space_default = commands31;
+var project_space_default = commands32;
 
 // src/commands/te-analysis/favorite/add.ts
 var favoriteAdd = createAnalysisCapabilityCommand({
@@ -4446,11 +5174,11 @@ var favoriteRemove = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/favorite/index.ts
-var commands32 = [
+var commands33 = [
   favoriteAdd,
   favoriteRemove
 ];
-var favorite_default = commands32;
+var favorite_default = commands33;
 
 // src/commands/te-analysis/public-link/create.ts
 var publicLinkCreate = createAnalysisCapabilityCommand({
@@ -4567,14 +5295,14 @@ var publicLinkDelete = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/public-link/index.ts
-var commands33 = [
+var commands34 = [
   publicLinkCreate,
   publicLinkList,
   publicLinkUpdate,
   publicLinkOffline,
   publicLinkDelete
 ];
-var public_link_default = commands33;
+var public_link_default = commands34;
 
 // src/commands/te-analysis/filter-value/list.ts
 var filterValueList = createAnalysisCapabilityCommand({
@@ -4608,8 +5336,8 @@ var filterValueList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/filter-value/index.ts
-var commands34 = [filterValueList];
-var filter_value_default = commands34;
+var commands35 = [filterValueList];
+var filter_value_default = commands35;
 
 // src/commands/te-analysis/event-detail/shared.ts
 var eventDetailDefinitionFlag = {
@@ -4653,9 +5381,10 @@ function eventDetailExportInput(ctx) {
 var eventDetailBaseFlags = [
   projectIdFlag,
   eventDetailDefinitionFlag,
+  definitionIntentSnapshotFlag,
   requestIdFlag,
   useCacheFlag2,
-  zoneOffsetFlag2
+  zoneOffsetFlag
 ];
 var eventDetailExportFlags = [
   ...eventDetailBaseFlags,
@@ -4675,6 +5404,7 @@ var eventDetailRun = createAnalysisCapabilityCommand({
     syncTimeoutSecondsFlag
   ],
   risk: "read",
+  intentConsistency: { definitionFlag: "definition" },
   buildInput: eventDetailRunInput
 });
 
@@ -4689,15 +5419,16 @@ var eventDetailExport = createAnalysisCapabilityCommand({
     ...eventDetailExportFlags
   ],
   risk: "read",
+  intentConsistency: { definitionFlag: "definition" },
   buildInput: eventDetailExportInput
 });
 
 // src/commands/te-analysis/event-detail/index.ts
-var commands35 = [
+var commands36 = [
   eventDetailRun,
   eventDetailExport
 ];
-var event_detail_default = commands35;
+var event_detail_default = commands36;
 
 // src/commands/te-analysis/entity-detail/shared.ts
 var entityDetailDefinitionFlag = {
@@ -4741,9 +5472,10 @@ function entityDetailExportInput(ctx) {
 var entityDetailBaseFlags = [
   projectIdFlag,
   entityDetailDefinitionFlag,
+  definitionIntentSnapshotFlag,
   requestIdFlag,
   useCacheFlag2,
-  zoneOffsetFlag2
+  zoneOffsetFlag
 ];
 var entityDetailExportFlags = [
   ...entityDetailBaseFlags,
@@ -4763,6 +5495,7 @@ var entityDetailRun = createAnalysisCapabilityCommand({
     syncTimeoutSecondsFlag
   ],
   risk: "read",
+  intentConsistency: { definitionFlag: "definition" },
   buildInput: entityDetailRunInput
 });
 
@@ -4777,15 +5510,16 @@ var entityDetailExport = createAnalysisCapabilityCommand({
     ...entityDetailExportFlags
   ],
   risk: "read",
+  intentConsistency: { definitionFlag: "definition" },
   buildInput: entityDetailExportInput
 });
 
 // src/commands/te-analysis/entity-detail/index.ts
-var commands36 = [
+var commands37 = [
   entityDetailRun,
   entityDetailExport
 ];
-var entity_detail_default = commands36;
+var entity_detail_default = commands37;
 
 // src/commands/te-analysis/drilldown-events/shared.ts
 var queryContextIdFlag = {
@@ -4873,8 +5607,8 @@ var drilldownEventsRun = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/drilldown-events/index.ts
-var commands37 = [drilldownEventsRun, drilldownEventsExport];
-var drilldown_events_default = commands37;
+var commands38 = [drilldownEventsRun, drilldownEventsExport];
+var drilldown_events_default = commands38;
 
 // src/commands/te-analysis/drilldown-entities/shared.ts
 var queryContextIdFlag2 = {
@@ -4958,8 +5692,8 @@ var drilldownEntitiesRun = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/drilldown-entities/index.ts
-var commands38 = [drilldownEntitiesRun, drilldownEntitiesExport];
-var drilldown_entities_default = commands38;
+var commands39 = [drilldownEntitiesRun, drilldownEntitiesExport];
+var drilldown_entities_default = commands39;
 
 // src/commands/te-analysis/drilldown-user-events/shared.ts
 var drilldownContextIdFlag = {
@@ -5060,8 +5794,8 @@ var drilldownUserEventsRun = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/drilldown-user-events/index.ts
-var commands39 = [drilldownUserEventsRun, drilldownUserEventsExport];
-var drilldown_user_events_default = commands39;
+var commands40 = [drilldownUserEventsRun, drilldownUserEventsExport];
+var drilldown_user_events_default = commands40;
 
 // src/commands/te-analysis/user/index.ts
 import { existsSync, statSync as statSync2 } from "fs";
@@ -5152,7 +5886,7 @@ var optionalTagDefinitionRequestFlag = {
   required: false,
   desc: "Optional semantic snake_case tag definition. Read user_tag_models.md; raw filts, C-codes, ftv, columnName, and backend DTOs are rejected."
 };
-var zoneOffsetFlag3 = {
+var zoneOffsetFlag2 = {
   name: "zone-offset",
   type: "number",
   required: false,
@@ -5164,6 +5898,24 @@ var autoRefreshCronFlag = {
   required: false,
   desc: "Optional Quartz cron expression for an existing enabled auto-refresh schedule. This does not enable auto refresh."
 };
+var tagAutoRefreshFlags = [
+  {
+    name: "enable-auto-refresh",
+    type: "boolean",
+    required: false,
+    desc: "Enable or disable periodic refresh. Omit to preserve the setting on update. Enabling on create requires a schedule."
+  },
+  {
+    ...autoRefreshCronFlag,
+    desc: "Quartz cron expression in the tag timezone. Enables periodic refresh. Mutually exclusive with --auto-refresh-schedule."
+  },
+  {
+    name: "auto-refresh-schedule",
+    type: "json",
+    required: false,
+    desc: 'Schedule object: frequency daily|weekly|monthly, time HH:mm, weekdays (weekly, ISO 1=Monday to 7=Sunday), month_days (monthly, 1-31). Enables periodic refresh in the tag timezone. Example: {"frequency":"daily","time":"02:30"}.'
+  }
+];
 var entityIdFlag = {
   name: "entity-id",
   type: "number",
@@ -5412,6 +6164,18 @@ function clusterWriteInput(ctx, create) {
 function tagWriteInput(ctx, create) {
   const definitionRequest = optionalJson(ctx, "definition-request");
   validateDefinitionRequest(create, definitionRequest);
+  const enabled = optionalBoolean(ctx, "enable-auto-refresh");
+  const cron = optionalString(ctx, "auto-refresh-cron");
+  const schedule = optionalJson(ctx, "auto-refresh-schedule");
+  if (cron !== void 0 && schedule !== void 0) {
+    throw new Error("Pass only one of --auto-refresh-cron and --auto-refresh-schedule");
+  }
+  if (enabled === false && (cron !== void 0 || schedule !== void 0)) {
+    throw new Error("Cannot set a schedule with --enable-auto-refresh false");
+  }
+  if (create && enabled === true && cron === void 0 && schedule === void 0) {
+    throw new Error("Enabling auto refresh on create requires --auto-refresh-schedule or --auto-refresh-cron");
+  }
   return compactInput({
     project_id: ctx.num("project-id"),
     tag_name: ctx.str("tag-name"),
@@ -5420,7 +6184,9 @@ function tagWriteInput(ctx, create) {
     authenticated_only: optionalBoolean(ctx, "authenticated-only"),
     remark: create ? void 0 : optionalString(ctx, "remark"),
     zone_offset: optionalNumber(ctx, "zone-offset"),
-    auto_refresh_cron: create ? void 0 : optionalString(ctx, "auto-refresh-cron"),
+    enable_auto_refresh: enabled,
+    auto_refresh_cron: cron,
+    auto_refresh_schedule: schedule,
     entity_id: create ? optionalNumber(ctx, "entity-id") : void 0
   });
 }
@@ -5542,7 +6308,7 @@ var memberExportFlags = [
   memberArtifactFormatFlag,
   asyncTimeoutSecondsFlag
 ];
-var commands40 = [
+var commands41 = [
   capability(
     "user-cluster",
     "list",
@@ -5589,7 +6355,7 @@ var commands40 = [
     displayNameFlag,
     clusterDefinitionRequestFlag,
     authenticatedOnlyFlag,
-    zoneOffsetFlag3,
+    zoneOffsetFlag2,
     entityIdFlag
   ], "write", (ctx) => clusterWriteInput(ctx, true)),
   capability("user-cluster", "update", "analysis.user_cluster.update", "Update a condition or SQL user cluster without changing its existing type or analysis entity. Pass only fields that should change.", [
@@ -5599,7 +6365,7 @@ var commands40 = [
     optionalClusterDefinitionRequestFlag,
     authenticatedOnlyFlag,
     remarkFlag,
-    zoneOffsetFlag3,
+    zoneOffsetFlag2,
     autoRefreshCronFlag
   ], "high-risk-write", (ctx) => clusterWriteInput(ctx, false)),
   idImportCapability(capability("user-cluster", "create-id", "analysis.user_cluster.create_id", "Create a cluster by mapping imported values to an analysis entity.", [
@@ -5682,8 +6448,9 @@ var commands40 = [
     displayNameFlag,
     tagDefinitionRequestFlag,
     authenticatedOnlyFlag,
-    zoneOffsetFlag3,
-    entityIdFlag
+    zoneOffsetFlag2,
+    entityIdFlag,
+    ...tagAutoRefreshFlags
   ], "write", (ctx) => tagWriteInput(ctx, true)),
   capability("user-tag", "update", "analysis.user_tag.update", "Update a user tag. Pass only fields that should change.", [
     projectIdFlag,
@@ -5692,8 +6459,8 @@ var commands40 = [
     optionalTagDefinitionRequestFlag,
     authenticatedOnlyFlag,
     remarkFlag,
-    zoneOffsetFlag3,
-    autoRefreshCronFlag
+    zoneOffsetFlag2,
+    ...tagAutoRefreshFlags
   ], "write", (ctx) => tagWriteInput(ctx, false)),
   capability("user-tag", "refresh", "analysis.user_tag.refresh", "Refresh a user tag by exact tag_name.", [
     projectIdFlag,
@@ -5796,7 +6563,7 @@ var commands40 = [
     ...memberExportFlags
   ], "read", (ctx) => historyTagDataDrilldownInput(ctx, false), { asyncArtifact: true })
 ];
-var user_default = commands40;
+var user_default = commands41;
 
 // src/commands/te-analysis/query-cluster/list.ts
 var queryClusterList = createAnalysisCapabilityCommand({
@@ -5810,8 +6577,8 @@ var queryClusterList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/query-cluster/index.ts
-var commands41 = [queryClusterList];
-var query_cluster_default = commands41;
+var commands42 = [queryClusterList];
+var query_cluster_default = commands42;
 
 // src/commands/te-analysis/sql-table/columns.ts
 var sqlTableColumns = createAnalysisCapabilityCommand({
@@ -5856,8 +6623,8 @@ var sqlTableList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/sql-table/index.ts
-var commands42 = [sqlTableList, sqlTableColumns];
-var sql_table_default = commands42;
+var commands43 = [sqlTableList, sqlTableColumns];
+var sql_table_default = commands43;
 
 // src/commands/te-analysis/entity/id-import-options.ts
 var entityIdImportOptions = createAnalysisCapabilityCommand({
@@ -5882,8 +6649,8 @@ var entityIdImportOptions = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/entity/index.ts
-var commands43 = [entityIdImportOptions];
-var entity_default = commands43;
+var commands44 = [entityIdImportOptions];
+var entity_default = commands44;
 
 // src/commands/te-analysis/input-file/inspect.ts
 var inputFileInspect = {
@@ -5966,8 +6733,8 @@ var inputFileUpload = {
 };
 
 // src/commands/te-analysis/input-file/index.ts
-var commands44 = [inputFileUpload, inputFileInspect, inputFilePurposeList];
-var input_file_default = commands44;
+var commands45 = [inputFileUpload, inputFileInspect, inputFilePurposeList];
+var input_file_default = commands45;
 
 // src/commands/te-analysis/project/access-detail/get.ts
 var projectAccessDetailGet = createAnalysisCapabilityCommand({
@@ -5985,10 +6752,10 @@ var projectAccessDetailGet = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/access-detail/index.ts
-var commands45 = [
+var commands46 = [
   projectAccessDetailGet
 ];
-var access_detail_default = commands45;
+var access_detail_default = commands46;
 
 // src/commands/te-analysis/project/data-power/delete.ts
 var projectDataPowerDelete = createAnalysisCapabilityCommand({
@@ -6060,13 +6827,13 @@ var projectDataPowerUpsert = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/data-power/index.ts
-var commands46 = [
+var commands47 = [
   projectDataPowerDelete,
   projectDataPowerGet,
   projectDataPowerList,
   projectDataPowerUpsert
 ];
-var data_power_default = commands46;
+var data_power_default = commands47;
 
 // src/commands/te-analysis/project/entity/create.ts
 var projectEntityCreate = createAnalysisCapabilityCommand({
@@ -6177,14 +6944,14 @@ var projectEntityUpdate = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/entity/index.ts
-var commands47 = [
+var commands48 = [
   projectEntityCreate,
   projectEntityDelete,
   projectEntityGet,
   projectEntityList,
   projectEntityUpdate
 ];
-var entity_default2 = commands47;
+var entity_default2 = commands48;
 
 // src/commands/te-analysis/project/entity-event/list.ts
 var projectEntityEventList = createAnalysisCapabilityCommand({
@@ -6204,10 +6971,10 @@ var projectEntityEventList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/entity-event/index.ts
-var commands48 = [
+var commands49 = [
   projectEntityEventList
 ];
-var entity_event_default = commands48;
+var entity_event_default = commands49;
 
 // src/commands/te-analysis/project/function/list.ts
 var projectFunctionList = createAnalysisCapabilityCommand({
@@ -6227,10 +6994,10 @@ var projectFunctionList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/function/index.ts
-var commands49 = [
+var commands50 = [
   projectFunctionList
 ];
-var function_default = commands49;
+var function_default = commands50;
 
 // src/commands/te-analysis/project/info/create.ts
 var projectInfoCreate = createAnalysisCapabilityCommand({
@@ -6325,14 +7092,14 @@ var projectInfoUpdate = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/info/index.ts
-var commands50 = [
+var commands51 = [
   projectInfoCreate,
   projectInfoDelete,
   projectInfoGet,
   projectInfoList,
   projectInfoUpdate
 ];
-var info_default = commands50;
+var info_default = commands51;
 
 // src/commands/te-analysis/project/mark-time/create.ts
 var projectMarkTimeCreate = createAnalysisCapabilityCommand({
@@ -6426,13 +7193,13 @@ var projectMarkTimeUpdate = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/mark-time/index.ts
-var commands51 = [
+var commands52 = [
   projectMarkTimeCreate,
   projectMarkTimeDelete,
   projectMarkTimeList,
   projectMarkTimeUpdate
 ];
-var mark_time_default = commands51;
+var mark_time_default = commands52;
 
 // src/commands/te-analysis/project/member/add.ts
 var projectMemberAdd = createAnalysisCapabilityCommand({
@@ -6443,7 +7210,12 @@ var projectMemberAdd = createAnalysisCapabilityCommand({
   flags: [
     projectIdFlag,
     requiredPayloadFlag,
-    { name: "type", type: "string", required: true, desc: "Add type accepted by ProjMemberAddTypeEnum." }
+    {
+      name: "type",
+      type: "string",
+      required: true,
+      desc: "Member add type: 0 creates a company member from project management; 1 adds an existing company member. Type 0 may be disabled by company configuration."
+    }
   ],
   risk: "write",
   buildInput: (ctx) => compactInput({
@@ -6543,7 +7315,7 @@ var projectMemberUpdate = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/member/index.ts
-var commands52 = [
+var commands53 = [
   projectMemberAdd,
   projectMemberBatchUpdate,
   projectMemberImport,
@@ -6551,7 +7323,7 @@ var commands52 = [
   projectMemberRemove,
   projectMemberUpdate
 ];
-var member_default = commands52;
+var member_default = commands53;
 
 // src/commands/te-analysis/project/member-candidate/list.ts
 var projectMemberCandidateList = createAnalysisCapabilityCommand({
@@ -6561,8 +7333,18 @@ var projectMemberCandidateList = createAnalysisCapabilityCommand({
   description: "List candidate users and role/data-power options for adding project members.",
   flags: [
     projectIdFlag,
-    { name: "type", type: "string", required: true, desc: "Add type accepted by ProjMemberAddTypeEnum." },
-    { name: "login-names", type: "string", required: false, desc: "Comma-separated login names when checking new users." }
+    {
+      name: "type",
+      type: "string",
+      required: true,
+      desc: "Member add type: 0 checks new company members from project management; 1 lists existing company members. Type 0 may be disabled by company configuration."
+    },
+    {
+      name: "login-names",
+      type: "string",
+      required: false,
+      desc: "Comma-separated login names when checking new users."
+    }
   ],
   risk: "read",
   buildInput: (ctx) => compactInput({
@@ -6573,10 +7355,10 @@ var projectMemberCandidateList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/member-candidate/index.ts
-var commands53 = [
+var commands54 = [
   projectMemberCandidateList
 ];
-var member_candidate_default = commands53;
+var member_candidate_default = commands54;
 
 // src/commands/te-analysis/project/member-handover/export.ts
 var projectMemberHandoverExport = createAnalysisCapabilityCommand({
@@ -6617,11 +7399,11 @@ var projectMemberHandoverRun = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/member-handover/index.ts
-var commands54 = [
+var commands55 = [
   projectMemberHandoverExport,
   projectMemberHandoverRun
 ];
-var member_handover_default = commands54;
+var member_handover_default = commands55;
 
 // src/commands/te-analysis/project/member-receiver/list.ts
 var projectMemberReceiverList = createAnalysisCapabilityCommand({
@@ -6639,10 +7421,10 @@ var projectMemberReceiverList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/member-receiver/index.ts
-var commands55 = [
+var commands56 = [
   projectMemberReceiverList
 ];
-var member_receiver_default = commands55;
+var member_receiver_default = commands56;
 
 // src/commands/te-analysis/project/owner/update.ts
 var projectOwnerUpdate = createAnalysisCapabilityCommand({
@@ -6668,10 +7450,10 @@ var projectOwnerUpdate = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/owner/index.ts
-var commands56 = [
+var commands57 = [
   projectOwnerUpdate
 ];
-var owner_default = commands56;
+var owner_default = commands57;
 
 // src/commands/te-analysis/project/permission-binding/list.ts
 var projectPermissionBindingList = createAnalysisCapabilityCommand({
@@ -6693,10 +7475,10 @@ var projectPermissionBindingList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/permission-binding/index.ts
-var commands57 = [
+var commands58 = [
   projectPermissionBindingList
 ];
-var permission_binding_default = commands57;
+var permission_binding_default = commands58;
 
 // src/commands/te-analysis/project/receive-status/update.ts
 var projectReceiveStatusUpdate = createAnalysisCapabilityCommand({
@@ -6717,10 +7499,10 @@ var projectReceiveStatusUpdate = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/receive-status/index.ts
-var commands58 = [
+var commands59 = [
   projectReceiveStatusUpdate
 ];
-var receive_status_default = commands58;
+var receive_status_default = commands59;
 
 // src/commands/te-analysis/project/role/delete.ts
 var projectRoleDelete = createAnalysisCapabilityCommand({
@@ -6779,14 +7561,30 @@ var projectRoleList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/role/upsert.ts
+var ROLE_UPSERT_HELP = [
+  "Payload contract:",
+  "- role_func_list is a non-empty array of objects. Each object requires a non-empty function_name and has_power set to integer 0 or 1.",
+  "- Resolve valid function_name values with ae-cli project function list before saving the role.",
+  "- role_desc is required when creating a role and must contain 1 to 80 characters. It may be omitted when updating an existing role.",
+  "- Omit role_name to create a role. Pass the existing role_name to update that role.",
+  "- Functions omitted from role_func_list are preserved by the service as unselected permissions with has_power=0.",
+  "Example create payload:",
+  '{"role_desc":"Data analyst","role_func_list":[{"function_name":"viewReport","has_power":1}]}',
+  "Example update payload:",
+  '{"role_name":"custom_role","role_func_list":[{"function_name":"viewReport","has_power":1}]}'
+].join("\n");
 var projectRoleUpsert = createAnalysisCapabilityCommand({
   resource: "project role",
   command: "upsert",
   capabilityId: "project.role.upsert",
   description: "Create or update a project role.",
+  helpText: ROLE_UPSERT_HELP,
   flags: [
     projectIdFlag,
-    requiredPayloadFlag
+    {
+      ...requiredPayloadFlag,
+      desc: "Role payload with role_func_list object items containing function_name and has_power (0 or 1)."
+    }
   ],
   risk: "write",
   buildInput: (ctx) => compactInput({
@@ -6796,13 +7594,13 @@ var projectRoleUpsert = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/role/index.ts
-var commands59 = [
+var commands60 = [
   projectRoleDelete,
   projectRoleGet,
   projectRoleList,
   projectRoleUpsert
 ];
-var role_default = commands59;
+var role_default = commands60;
 
 // src/commands/te-analysis/project/role-function/list.ts
 var projectRoleFunctionList = createAnalysisCapabilityCommand({
@@ -6828,10 +7626,10 @@ var projectRoleFunctionList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/role-function/index.ts
-var commands60 = [
+var commands61 = [
   projectRoleFunctionList
 ];
-var role_function_default = commands60;
+var role_function_default = commands61;
 
 // src/commands/te-analysis/project/role-user/list.ts
 var projectRoleUserList = createAnalysisCapabilityCommand({
@@ -6851,10 +7649,10 @@ var projectRoleUserList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/role-user/index.ts
-var commands61 = [
+var commands62 = [
   projectRoleUserList
 ];
-var role_user_default = commands61;
+var role_user_default = commands62;
 
 // src/commands/te-analysis/project/timezone/get.ts
 var projectTimezoneGet = createAnalysisCapabilityCommand({
@@ -6973,9 +7771,9 @@ function validateDisplayTimezones(value, item) {
     }
   }
 }
-function allowOnly(payload, item, fields) {
-  if (Object.keys(payload).some((field) => !fields.includes(field))) {
-    throw invalidPayload(item, `supports only fields ${fields.join(", ")}`);
+function allowOnly(payload, item, fields2) {
+  if (Object.keys(payload).some((field) => !fields2.includes(field))) {
+    throw invalidPayload(item, `supports only fields ${fields2.join(", ")}`);
   }
 }
 function invalidPayload(item, reason, example) {
@@ -6992,12 +7790,12 @@ function isObject(value) {
 }
 
 // src/commands/te-analysis/project/timezone/index.ts
-var commands62 = [
+var commands63 = [
   projectTimezoneGet,
   projectTimezoneOverview,
   projectTimezoneUpdate
 ];
-var timezone_default = commands62;
+var timezone_default = commands63;
 
 // src/commands/te-analysis/project/user-id-items/update.ts
 var projectUserIdItemsUpdate = createAnalysisCapabilityCommand({
@@ -7017,13 +7815,13 @@ var projectUserIdItemsUpdate = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/project/user-id-items/index.ts
-var commands63 = [
+var commands64 = [
   projectUserIdItemsUpdate
 ];
-var user_id_items_default = commands63;
+var user_id_items_default = commands64;
 
 // src/commands/te-analysis/project/index.ts
-var commands64 = [
+var commands65 = [
   ...access_detail_default,
   ...data_power_default,
   ...entity_default2,
@@ -7044,7 +7842,7 @@ var commands64 = [
   ...timezone_default,
   ...user_id_items_default
 ];
-var project_default = commands64;
+var project_default = commands65;
 
 // src/commands/te-analysis/tracking/shared.ts
 function createTrackingCapabilityCommand(config) {
@@ -7218,12 +8016,12 @@ var confirmFlag = {
   required: true,
   desc: "Must be true for this destructive tracking operation. Also use global --yes to skip local confirmation."
 };
-function projectInput2(ctx) {
+function projectInput3(ctx) {
   return { project_id: ctx.num("project-id") };
 }
 function projectLifecycleInput(ctx) {
   return compactInput({
-    ...projectInput2(ctx),
+    ...projectInput3(ctx),
     request_id: optionalString(ctx, "request-id"),
     timeout_seconds: optionalNumber(ctx, "timeout-seconds")
   });
@@ -7237,7 +8035,7 @@ var trackingPlanGet = createTrackingCapabilityCommand({
   description: "Get the tracking plan for one project.",
   flags: [projectIdFlag],
   risk: "read",
-  buildInput: projectInput2
+  buildInput: projectInput3
 });
 
 // src/commands/te-analysis/tracking/plan/save-items.ts
@@ -7249,7 +8047,7 @@ var trackingPlanSaveItems = createTrackingCapabilityCommand({
   flags: [projectIdFlag, eventsFlag, eventPropsFlag, userPropsFlag, commonEventPropsFlag],
   risk: "write",
   buildInput: (ctx) => compactInput({
-    ...projectInput2(ctx),
+    ...projectInput3(ctx),
     events: optionalJson(ctx, "events"),
     event_props: optionalJson(ctx, "event-props"),
     user_props: optionalJson(ctx, "user-props"),
@@ -7266,7 +8064,7 @@ var trackingPlanDeleteItems = createTrackingCapabilityCommand({
   flags: [projectIdFlag, eventsFlag, eventPropNamesFlag, userPropNamesFlag, commonEventPropNamesFlag, confirmFlag],
   risk: "high-risk-write",
   buildInput: (ctx) => compactInput({
-    ...projectInput2(ctx),
+    ...projectInput3(ctx),
     events: optionalJson(ctx, "events"),
     event_prop_names: optionalJson(ctx, "event-prop-names"),
     user_prop_names: optionalJson(ctx, "user-prop-names"),
@@ -7284,7 +8082,7 @@ var trackingPlanGenerate = createTrackingCapabilityCommand({
   flags: [projectIdFlag, languageFlag, formDataFlag, developmentCarrierFlag, predefinedEventFlag],
   risk: "write",
   buildInput: (ctx) => compactInput({
-    ...projectInput2(ctx),
+    ...projectInput3(ctx),
     language: ctx.str("language"),
     form_data: ctx.json("form-data"),
     development_carrier: optionalJson(ctx, "development-carrier"),
@@ -7410,7 +8208,7 @@ function validateSource(ctx) {
 }
 function buildInput(ctx, inputFileId) {
   return compactInput({
-    ...projectInput2(ctx),
+    ...projectInput3(ctx),
     input_file_id: inputFileId,
     lang: optionalString(ctx, "lang")
   });
@@ -7424,7 +8222,7 @@ var trackingPlanSyncFromMeta = createTrackingCapabilityCommand({
   description: "Synchronize tracking plan from project metadata.",
   flags: [projectIdFlag],
   risk: "write",
-  buildInput: projectInput2
+  buildInput: projectInput3
 });
 
 // src/commands/te-analysis/tracking/plan/sync-display-names.ts
@@ -7455,7 +8253,7 @@ function buildDisplayNameSyncPlan(draft, metadata) {
   };
 }
 function assertTrackingDraft(value) {
-  if (!isRecord(value)) {
+  if (!isRecord2(value)) {
     throw new Error("Tracking draft must be a JSON object.");
   }
   for (const field of [
@@ -7519,7 +8317,7 @@ function existingDefinitions(value, nameField, displayNameField) {
   if (!Array.isArray(value)) return [];
   const rows = [];
   for (const item of value) {
-    if (!isRecord(item)) continue;
+    if (!isRecord2(item)) continue;
     const name = nonEmptyString(item[nameField]);
     if (!name) continue;
     rows.push({
@@ -7562,7 +8360,7 @@ function nonEmptyString(value) {
   const trimmed = value.trim();
   return trimmed ? trimmed : void 0;
 }
-function isRecord(value) {
+function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -7775,7 +8573,7 @@ function counts(plan, value) {
 }
 
 // src/commands/te-analysis/tracking/plan/index.ts
-var commands65 = [
+var commands66 = [
   trackingPlanGet,
   trackingPlanSaveItems,
   trackingPlanDeleteItems,
@@ -7785,7 +8583,7 @@ var commands65 = [
   trackingPlanSyncFromMeta,
   trackingPlanSyncDisplayNames
 ];
-var plan_default = commands65;
+var plan_default = commands66;
 
 // src/commands/te-analysis/tracking/sdk-sample/generate.ts
 var trackingSdkSampleGenerate = createTrackingCapabilityCommand({
@@ -7795,14 +8593,14 @@ var trackingSdkSampleGenerate = createTrackingCapabilityCommand({
   description: "Submit an AI SDK sample generation task.",
   flags: [projectIdFlag, sdkTypesFlag],
   risk: "write",
-  buildInput: (ctx) => ({ ...projectInput2(ctx), sdk_types: ctx.json("sdk-types") })
+  buildInput: (ctx) => ({ ...projectInput3(ctx), sdk_types: ctx.json("sdk-types") })
 });
 
 // src/commands/te-analysis/tracking/sdk-sample/index.ts
-var commands66 = [
+var commands67 = [
   trackingSdkSampleGenerate
 ];
-var sdk_sample_default = commands66;
+var sdk_sample_default = commands67;
 
 // src/commands/te-analysis/tracking/plan-change-log/list.ts
 var trackingPlanChangeLogList = createTrackingCapabilityCommand({
@@ -7812,7 +8610,7 @@ var trackingPlanChangeLogList = createTrackingCapabilityCommand({
   description: "List tracking plan change logs.",
   flags: [projectIdFlag],
   risk: "read",
-  buildInput: projectInput2
+  buildInput: projectInput3
 });
 
 // src/commands/te-analysis/tracking/plan-change-log/export.ts
@@ -7824,15 +8622,15 @@ var trackingPlanChangeLogExport = createTrackingCapabilityCommand({
   description: "Export one tracking plan change log.",
   flags: [projectIdFlag, logIdFlag, requestIdFlag, asyncTimeoutSecondsFlag],
   risk: "read",
-  buildInput: (ctx) => compactInput({ ...projectInput2(ctx), log_id: ctx.num("log-id"), request_id: optionalString(ctx, "request-id"), timeout_seconds: optionalNumber(ctx, "timeout-seconds") })
+  buildInput: (ctx) => compactInput({ ...projectInput3(ctx), log_id: ctx.num("log-id"), request_id: optionalString(ctx, "request-id"), timeout_seconds: optionalNumber(ctx, "timeout-seconds") })
 });
 
 // src/commands/te-analysis/tracking/plan-change-log/index.ts
-var commands67 = [
+var commands68 = [
   trackingPlanChangeLogList,
   trackingPlanChangeLogExport
 ];
-var plan_change_log_default = commands67;
+var plan_change_log_default = commands68;
 
 // src/commands/te-analysis/tracking/check/run.ts
 var trackingCheckRun = createTrackingCapabilityCommand({
@@ -7843,7 +8641,7 @@ var trackingCheckRun = createTrackingCapabilityCommand({
   flags: [projectIdFlag, checkScopeFlag, resultScopeFlag],
   risk: "write",
   buildInput: (ctx) => compactInput({
-    ...projectInput2(ctx),
+    ...projectInput3(ctx),
     check_scope: ctx.json("check-scope"),
     result_scope: optionalJson(ctx, "result-scope")
   })
@@ -7857,7 +8655,7 @@ var trackingCheckList = createTrackingCapabilityCommand({
   description: "List tracking validation runs.",
   flags: [projectIdFlag],
   risk: "read",
-  buildInput: projectInput2
+  buildInput: projectInput3
 });
 
 // src/commands/te-analysis/tracking/check/get.ts
@@ -7868,7 +8666,7 @@ var trackingCheckGet = createTrackingCapabilityCommand({
   description: "Get one tracking validation result.",
   flags: [projectIdFlag, uuidFlag, requestIdFlag, timeoutSecondsFlag],
   risk: "read",
-  buildInput: (ctx) => compactInput({ ...projectInput2(ctx), uuid: ctx.str("uuid"), request_id: optionalString(ctx, "request-id"), timeout_seconds: optionalNumber(ctx, "timeout-seconds") })
+  buildInput: (ctx) => compactInput({ ...projectInput3(ctx), uuid: ctx.str("uuid"), request_id: optionalString(ctx, "request-id"), timeout_seconds: optionalNumber(ctx, "timeout-seconds") })
 });
 
 // src/commands/te-analysis/tracking/check/retry.ts
@@ -7879,7 +8677,7 @@ var trackingCheckRetry = createTrackingCapabilityCommand({
   description: "Retry one tracking validation run.",
   flags: [projectIdFlag, uuidFlag, requestIdFlag, timeoutSecondsFlag],
   risk: "write",
-  buildInput: (ctx) => compactInput({ ...projectInput2(ctx), uuid: ctx.str("uuid"), request_id: optionalString(ctx, "request-id"), timeout_seconds: optionalNumber(ctx, "timeout-seconds") })
+  buildInput: (ctx) => compactInput({ ...projectInput3(ctx), uuid: ctx.str("uuid"), request_id: optionalString(ctx, "request-id"), timeout_seconds: optionalNumber(ctx, "timeout-seconds") })
 });
 
 // src/commands/te-analysis/tracking/check/delete.ts
@@ -7890,7 +8688,7 @@ var trackingCheckDelete = createTrackingCapabilityCommand({
   description: "Delete one tracking validation run.",
   flags: [projectIdFlag, uuidFlag, confirmFlag],
   risk: "high-risk-write",
-  buildInput: (ctx) => ({ ...projectInput2(ctx), uuid: ctx.str("uuid"), yes: ctx.bool("confirm") })
+  buildInput: (ctx) => ({ ...projectInput3(ctx), uuid: ctx.str("uuid"), yes: ctx.bool("confirm") })
 });
 
 // src/commands/te-analysis/tracking/check/export.ts
@@ -7902,11 +8700,11 @@ var trackingCheckExport = createTrackingCapabilityCommand({
   description: "Export one tracking validation result.",
   flags: [projectIdFlag, uuidFlag, requestIdFlag, asyncTimeoutSecondsFlag],
   risk: "read",
-  buildInput: (ctx) => compactInput({ ...projectInput2(ctx), uuid: ctx.str("uuid"), request_id: optionalString(ctx, "request-id"), timeout_seconds: optionalNumber(ctx, "timeout-seconds") })
+  buildInput: (ctx) => compactInput({ ...projectInput3(ctx), uuid: ctx.str("uuid"), request_id: optionalString(ctx, "request-id"), timeout_seconds: optionalNumber(ctx, "timeout-seconds") })
 });
 
 // src/commands/te-analysis/tracking/check/index.ts
-var commands68 = [
+var commands69 = [
   trackingCheckRun,
   trackingCheckList,
   trackingCheckGet,
@@ -7914,7 +8712,7 @@ var commands68 = [
   trackingCheckDelete,
   trackingCheckExport
 ];
-var check_default = commands68;
+var check_default = commands69;
 
 // src/commands/te-analysis/tracking/ingest/summary.ts
 var trackingIngestSummary = createTrackingCapabilityCommand({
@@ -7924,14 +8722,14 @@ var trackingIngestSummary = createTrackingCapabilityCommand({
   description: "Get tracking ingest summary.",
   flags: [projectIdFlag, startTimeFlag, endTimeFlag],
   risk: "read",
-  buildInput: (ctx) => ({ ...projectInput2(ctx), start_time: ctx.str("start-time"), end_time: ctx.str("end-time") })
+  buildInput: (ctx) => ({ ...projectInput3(ctx), start_time: ctx.str("start-time"), end_time: ctx.str("end-time") })
 });
 
 // src/commands/te-analysis/tracking/ingest/index.ts
-var commands69 = [
+var commands70 = [
   trackingIngestSummary
 ];
-var ingest_default = commands69;
+var ingest_default = commands70;
 
 // src/commands/te-analysis/tracking/ingest-error/list.ts
 var trackingIngestErrorList = createTrackingCapabilityCommand({
@@ -7941,14 +8739,14 @@ var trackingIngestErrorList = createTrackingCapabilityCommand({
   description: "List tracking ingest errors for one data name.",
   flags: [projectIdFlag, dataNameFlag, startTimeFlag, endTimeFlag],
   risk: "read",
-  buildInput: (ctx) => ({ ...projectInput2(ctx), data_name: ctx.str("data-name"), start_time: ctx.str("start-time"), end_time: ctx.str("end-time") })
+  buildInput: (ctx) => ({ ...projectInput3(ctx), data_name: ctx.str("data-name"), start_time: ctx.str("start-time"), end_time: ctx.str("end-time") })
 });
 
 // src/commands/te-analysis/tracking/ingest-error/index.ts
-var commands70 = [
+var commands71 = [
   trackingIngestErrorList
 ];
-var ingest_error_default = commands70;
+var ingest_error_default = commands71;
 
 // src/commands/te-analysis/tracking/live-data/list.ts
 var trackingLiveDataList = createTrackingCapabilityCommand({
@@ -7958,7 +8756,7 @@ var trackingLiveDataList = createTrackingCapabilityCommand({
   description: "List recent tracking live data.",
   flags: [projectIdFlag, dataTypeFlag, requestIdFlag, timeoutSecondsFlag],
   risk: "read",
-  buildInput: (ctx) => compactInput({ ...projectInput2(ctx), data_type: optionalString(ctx, "data-type"), request_id: optionalString(ctx, "request-id"), timeout_seconds: optionalNumber(ctx, "timeout-seconds") })
+  buildInput: (ctx) => compactInput({ ...projectInput3(ctx), data_type: optionalString(ctx, "data-type"), request_id: optionalString(ctx, "request-id"), timeout_seconds: optionalNumber(ctx, "timeout-seconds") })
 });
 
 // src/commands/te-analysis/tracking/live-data/export.ts
@@ -7970,15 +8768,15 @@ var trackingLiveDataExport = createTrackingCapabilityCommand({
   description: "Export recent tracking live data.",
   flags: [projectIdFlag, dataTypeFlag, requestIdFlag, asyncTimeoutSecondsFlag],
   risk: "read",
-  buildInput: (ctx) => compactInput({ ...projectInput2(ctx), data_type: optionalString(ctx, "data-type"), request_id: optionalString(ctx, "request-id"), timeout_seconds: optionalNumber(ctx, "timeout-seconds") })
+  buildInput: (ctx) => compactInput({ ...projectInput3(ctx), data_type: optionalString(ctx, "data-type"), request_id: optionalString(ctx, "request-id"), timeout_seconds: optionalNumber(ctx, "timeout-seconds") })
 });
 
 // src/commands/te-analysis/tracking/live-data/index.ts
-var commands71 = [
+var commands72 = [
   trackingLiveDataList,
   trackingLiveDataExport
 ];
-var live_data_default = commands71;
+var live_data_default = commands72;
 
 // src/commands/te-analysis/tracking/event-blacklist/list.ts
 var trackingEventBlacklistList = createTrackingCapabilityCommand({
@@ -7988,7 +8786,7 @@ var trackingEventBlacklistList = createTrackingCapabilityCommand({
   description: "List tracking event blacklist configuration.",
   flags: [projectIdFlag],
   risk: "read",
-  buildInput: projectInput2
+  buildInput: projectInput3
 });
 
 // src/commands/te-analysis/tracking/event-blacklist/add.ts
@@ -7999,7 +8797,7 @@ var trackingEventBlacklistAdd = createTrackingCapabilityCommand({
   description: "Add events to tracking event blacklist.",
   flags: [projectIdFlag, eventNamesFlag],
   risk: "write",
-  buildInput: (ctx) => ({ ...projectInput2(ctx), event_names: ctx.json("event-names") })
+  buildInput: (ctx) => ({ ...projectInput3(ctx), event_names: ctx.json("event-names") })
 });
 
 // src/commands/te-analysis/tracking/event-blacklist/update.ts
@@ -8010,16 +8808,16 @@ var trackingEventBlacklistUpdate = createTrackingCapabilityCommand({
   description: "Update tracking event blacklist config.",
   flags: [projectIdFlag, eventNamesFlag, blacklistTypeFlag],
   risk: "write",
-  buildInput: (ctx) => ({ ...projectInput2(ctx), event_names: ctx.json("event-names"), type: ctx.num("type") })
+  buildInput: (ctx) => ({ ...projectInput3(ctx), event_names: ctx.json("event-names"), type: ctx.num("type") })
 });
 
 // src/commands/te-analysis/tracking/event-blacklist/index.ts
-var commands72 = [
+var commands73 = [
   trackingEventBlacklistList,
   trackingEventBlacklistAdd,
   trackingEventBlacklistUpdate
 ];
-var event_blacklist_default = commands72;
+var event_blacklist_default = commands73;
 
 // src/commands/te-analysis/tracking/debug-device/add.ts
 var trackingDebugDeviceAdd = createTrackingCapabilityCommand({
@@ -8030,7 +8828,7 @@ var trackingDebugDeviceAdd = createTrackingCapabilityCommand({
   flags: [projectIdFlag, debugDeviceIdFlag, debugDeviceNameFlag],
   risk: "write",
   buildInput: (ctx) => ({
-    ...projectInput2(ctx),
+    ...projectInput3(ctx),
     device_id: ctx.str("device-id"),
     device_name: ctx.str("device-name")
   })
@@ -8044,7 +8842,7 @@ var trackingDebugDeviceList = createTrackingCapabilityCommand({
   description: "List Debug devices and the device selected by the current CLI user.",
   flags: [projectIdFlag],
   risk: "read",
-  buildInput: projectInput2
+  buildInput: projectInput3
 });
 
 // src/commands/te-analysis/tracking/debug-device/select.ts
@@ -8056,18 +8854,18 @@ var trackingDebugDeviceSelect = createTrackingCapabilityCommand({
   flags: [projectIdFlag, debugDeviceIdFlag],
   risk: "write",
   buildInput: (ctx) => ({
-    ...projectInput2(ctx),
+    ...projectInput3(ctx),
     device_id: ctx.str("device-id")
   })
 });
 
 // src/commands/te-analysis/tracking/debug-device/index.ts
-var commands73 = [
+var commands74 = [
   trackingDebugDeviceList,
   trackingDebugDeviceAdd,
   trackingDebugDeviceSelect
 ];
-var debug_device_default = commands73;
+var debug_device_default = commands74;
 
 // src/commands/te-analysis/tracking/debug-data/list.ts
 var debugStartTimeFlag = {
@@ -8084,13 +8882,13 @@ var trackingDebugDataList = createTrackingCapabilityCommand({
   flags: [projectIdFlag, debugDeviceIdFlag, debugStartTimeFlag, eventNameFlag],
   risk: "read",
   buildInput: (ctx) => compactInput({
-    ...projectInput2(ctx),
+    ...projectInput3(ctx),
     device_id: ctx.str("device-id"),
     start_time: optionalString(ctx, "start-time") ?? formatLocalTime(new Date(Date.now() - 60 * 60 * 1e3)),
     event_name: optionalString(ctx, "event-name")
   }),
   postProcess: (result, input) => {
-    const data = isRecord2(result) ? result : {};
+    const data = isRecord3(result) ? result : {};
     const eventList = Array.isArray(data.event_list) ? data.event_list : [];
     const deviceDataList = Array.isArray(data.device_data_list) ? data.device_data_list : [];
     return {
@@ -8121,16 +8919,16 @@ function formatLocalTime(value) {
     pad(value.getSeconds())
   ].join("");
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
 // src/commands/te-analysis/tracking/debug-data/index.ts
-var commands74 = [trackingDebugDataList];
-var debug_data_default = commands74;
+var commands75 = [trackingDebugDataList];
+var debug_data_default = commands75;
 
 // src/commands/te-analysis/tracking/index.ts
-var commands75 = [
+var commands76 = [
   ...plan_default,
   ...sdk_sample_default,
   ...plan_change_log_default,
@@ -8142,7 +8940,7 @@ var commands75 = [
   ...debug_device_default,
   ...debug_data_default
 ];
-var tracking_default = commands75;
+var tracking_default = commands76;
 
 // src/commands/te-analysis/alert/shared.ts
 var alertIdFlag = {
@@ -8169,11 +8967,11 @@ var endTimeFlag2 = {
   required: false,
   desc: "Optional alert detail end time."
 };
-function projectInput3(ctx) {
+function projectInput4(ctx) {
   return { project_id: ctx.num("project-id") };
 }
 function alertIdInput(ctx) {
-  return { ...projectInput3(ctx), alert_id: ctx.num("alert-id") };
+  return { ...projectInput4(ctx), alert_id: ctx.num("alert-id") };
 }
 
 // src/commands/te-analysis/alert/list.ts
@@ -8185,7 +8983,7 @@ var analysisAlertList = createAnalysisCapabilityCommand({
   flags: [projectIdFlag, queriesFlag, directoryLimitFlag, directoryOffsetFlag],
   risk: "read",
   validate: validateQueriesFlag,
-  buildInput: (ctx) => compactInput({ ...projectInput3(ctx), queries: optionalQueries(ctx), limit: optionalNumber(ctx, "limit"), offset: optionalNumber(ctx, "offset") })
+  buildInput: (ctx) => compactInput({ ...projectInput4(ctx), queries: optionalQueries(ctx), limit: optionalNumber(ctx, "limit"), offset: optionalNumber(ctx, "offset") })
 });
 
 // src/commands/te-analysis/alert/get.ts
@@ -8207,7 +9005,7 @@ var analysisAlertCreate = createAnalysisCapabilityCommand({
   description: "Create an alert.",
   flags: [projectIdFlag, definitionRequestFlag],
   risk: "write",
-  buildInput: (ctx) => ({ ...projectInput3(ctx), definition_request: ctx.json("definition-request") })
+  buildInput: (ctx) => ({ ...projectInput4(ctx), definition_request: ctx.json("definition-request") })
 });
 
 // src/commands/te-analysis/alert/update.ts
@@ -8255,7 +9053,7 @@ var analysisAlertStop = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/alert/index.ts
-var commands76 = [
+var commands77 = [
   analysisAlertList,
   analysisAlertGet,
   analysisAlertCreate,
@@ -8264,7 +9062,7 @@ var commands76 = [
   analysisAlertStart,
   analysisAlertStop
 ];
-var alert_default = commands76;
+var alert_default = commands77;
 
 // src/commands/te-analysis/alert-detail/list.ts
 var analysisAlertDetailList = createAnalysisCapabilityCommand({
@@ -8278,10 +9076,10 @@ var analysisAlertDetailList = createAnalysisCapabilityCommand({
 });
 
 // src/commands/te-analysis/alert-detail/index.ts
-var commands77 = [
+var commands78 = [
   analysisAlertDetailList
 ];
-var alert_detail_default = commands77;
+var alert_detail_default = commands78;
 
 // src/commands/te-analysis/alert-job/list.ts
 var analysisAlertJobList = createAnalysisCapabilityCommand({
@@ -8291,14 +9089,14 @@ var analysisAlertJobList = createAnalysisCapabilityCommand({
   description: "List alert job status.",
   flags: [projectIdFlag],
   risk: "read",
-  buildInput: projectInput3
+  buildInput: projectInput4
 });
 
 // src/commands/te-analysis/alert-job/index.ts
-var commands78 = [
+var commands79 = [
   analysisAlertJobList
 ];
-var alert_job_default = commands78;
+var alert_job_default = commands79;
 
 // src/commands/te-analysis/alert-notice-config/list.ts
 var analysisAlertNoticeConfigList = createAnalysisCapabilityCommand({
@@ -8308,17 +9106,17 @@ var analysisAlertNoticeConfigList = createAnalysisCapabilityCommand({
   description: "List alert notice configs.",
   flags: [projectIdFlag],
   risk: "read",
-  buildInput: projectInput3
+  buildInput: projectInput4
 });
 
 // src/commands/te-analysis/alert-notice-config/index.ts
-var commands79 = [
+var commands80 = [
   analysisAlertNoticeConfigList
 ];
-var alert_notice_config_default = commands79;
+var alert_notice_config_default = commands80;
 
 // src/commands/te-analysis/system/shared.ts
-import { readFileSync as readFileSync2, statSync as statSync3 } from "fs";
+import { readFileSync as readFileSync3, statSync as statSync3 } from "fs";
 var secretValues = /* @__PURE__ */ new WeakMap();
 var companyIdField = {
   flag: "company-id",
@@ -8353,7 +9151,7 @@ var fieldsField = {
   desc: "Optional snake_case result field projection JSON array."
 };
 function defineSystemCommand(spec) {
-  const fields = [companyIdField, ...spec.fields ?? []];
+  const fields2 = [companyIdField, ...spec.fields ?? []];
   const secrets = spec.secrets ?? [];
   return createAnalysisCapabilityCommand({
     resource: `system ${spec.resource}`,
@@ -8362,24 +9160,24 @@ function defineSystemCommand(spec) {
     asyncArtifact: spec.asyncArtifact,
     description: spec.description,
     flags: [
-      ...fields.map(fieldFlag),
+      ...fields2.map(fieldFlag),
       ...secrets.flatMap(secretFlags)
     ],
     risk: spec.risk,
     validate: (ctx) => {
       validateSecretSources(ctx, secrets);
-      const input = buildSystemInput(ctx, fields, [], spec.risk);
+      const input = buildSystemInput(ctx, fields2, [], spec.risk);
       for (const secret of secrets) {
         if (ctx.str(`${secret.flag}-file`) || ctx.bool(`${secret.flag}-stdin`)) {
           input[secret.input] = "<provided>";
         }
       }
-      validateFields(fields, input);
+      validateFields(fields2, input);
       spec.validate?.(ctx, input);
     },
     buildInput: (ctx) => {
-      const input = buildSystemInput(ctx, fields, secrets, spec.risk);
-      validateFields(fields, input);
+      const input = buildSystemInput(ctx, fields2, secrets, spec.risk);
+      validateFields(fields2, input);
       validateSecretSources(ctx, secrets);
       spec.validate?.(ctx, input);
       return input;
@@ -8415,9 +9213,9 @@ function secretFlags(secret) {
     }
   ];
 }
-function buildSystemInput(ctx, fields, secrets, risk) {
+function buildSystemInput(ctx, fields2, secrets, risk) {
   const input = {};
-  for (const field of fields) {
+  for (const field of fields2) {
     const value = fieldValue(ctx, field);
     if (value !== void 0) input[field.input ?? kebabToSnake(field.flag)] = value;
   }
@@ -8436,8 +9234,8 @@ function fieldValue(ctx, field) {
   if (field.type === "boolean") return ctx.bool(field.flag);
   return ctx.json(field.flag);
 }
-function validateFields(fields, input) {
-  for (const field of fields) {
+function validateFields(fields2, input) {
+  for (const field of fields2) {
     const inputName = field.input ?? kebabToSnake(field.flag);
     const value = input[inputName];
     if (field.required && value === void 0) {
@@ -8486,9 +9284,9 @@ function secretValue(ctx, secret) {
     if ((stat.mode & 63) !== 0) {
       throw validation(`--${secret.flag}-file must not be readable or writable by group/others (use chmod 600).`);
     }
-    value = nonEmptySecret(readFileSync2(file, "utf8"), secret.flag);
+    value = nonEmptySecret(readFileSync3(file, "utf8"), secret.flag);
   } else if (ctx.bool(`${secret.flag}-stdin`)) {
-    value = nonEmptySecret(readFileSync2(0, "utf8"), secret.flag);
+    value = nonEmptySecret(readFileSync3(0, "utf8"), secret.flag);
   }
   values.set(secret.flag, value);
   return value;
@@ -8665,7 +9463,7 @@ var systemConfigurationCommands = [
     command: "get",
     capabilityId: "system.receiver_detection.get",
     description: "Get receiver-address detection configuration.",
-    risk: "read",
+    risk: "write",
     fields: [addressUrl]
   }),
   defineSystemCommand({
@@ -9054,7 +9852,7 @@ var systemMonitoringCommands = [
     risk: "read",
     fields: [
       { flag: "task-id", type: "string", required: true, desc: "Query-monitor task ID." },
-      { flag: "sql-max-chars", type: "number", min: 0, max: 1e5, desc: "Maximum returned SQL characters." }
+      { flag: "sql-max-chars", type: "number", min: 0, max: 2e4, desc: "Maximum returned SQL characters. Max: 20000." }
     ]
   }),
   defineSystemCommand({
@@ -9157,7 +9955,7 @@ var systemMonitoringCommands = [
     description: "List sanitized operations-alert contacts.",
     risk: "read",
     fields: [
-      { flag: "limit", type: "number", min: 1, max: 200, desc: "Page size. Default: 50, max: 200." },
+      { flag: "limit", type: "number", min: 1, max: 100, desc: "Page size. Default: 50, max: 100." },
       offsetField
     ]
   }),
@@ -9379,14 +10177,14 @@ var systemUsageCommands = [
 ];
 
 // src/commands/te-analysis/system/index.ts
-var commands80 = [
+var commands81 = [
   ...systemUsageCommands,
   ...systemIdentityCommands,
   ...systemSecurityCommands,
   ...systemMonitoringCommands,
   ...systemConfigurationCommands
 ];
-var system_default = commands80;
+var system_default = commands81;
 
 // src/commands/te-analysis/index.ts
 registerCapabilityGatewayRoute("analysis", { gatewayDomain: "analysis" });
@@ -9436,8 +10234,8 @@ var baseCommands = [
   ...alert_notice_config_default,
   ...system_default
 ];
-var commands81 = [...baseCommands];
-var te_analysis_default = commands81;
+var commands82 = [...baseCommands];
+var te_analysis_default = commands82;
 export {
   baseCommands,
   te_analysis_default as default