e10-data 0.1.18-xiaoe → 0.1.21

package/bin/e10-data.mjs

@@ -7,7 +7,11 @@
  *   e10-data login  xiaoe-env [--domain <url>]   **无凭据时**用环境变量 XIAOE_USER_TOKEN + XIAOE_DOMAIN
  *                   （XiaoE 全局 token）换 ETEAMSID 并落 profile（免浏览器/免 python；2026-09-17 移植）
  *   e10-data query    DSL 查询 executeQueryDsl（conn/model/schema/tableId/dslQuery/debug）
- *   e10-data ds     tables|fields|list|chart|stat|count   数据源（业务模块）取数与元数据
+ *   e10-data ds     groups|find|describe|tables|fields|fields-dsl|list|chart|stat|count
+ *                   数据源（业务模块）取数与元数据
+ *                   groups  内置分组清单（仅作 find 的默认扫描集）
+ *                   find    跨分组找表（进程内并发扇出；产物=候选表清单 + 路由建议，不取数）
+ *                   describe 一次并发取回「字段 + 词库」（不做权限校验，EB 权限仍走 eb perm-page）
  *                   appId 一律由调用方显式传入（v0.1.14 起 CLI 不再自动反查）：
  *                   EB 建模表单（groupId=weaver-ebuilder-form-service）取数必须带 --app-id <id>，
  *                   该值只能来自 chat_bi_eb_config_map 的权限校验查询（同一次查询给出权限与 appId）；
@@ -19,11 +23,16 @@
  *                              环境参数配置中心（chatBi config map，替代 config-resolve 脚本 URL 直连；
  *                              confType=api 时支持 confGroup 分组二级定位，见 --group）
  *   e10-data attend statis     考勤假期余额统计 getAttendInfoStatis（hr-attendance 病假/事假，2026-09-07）
+ *   e10-data module call       模块配置接口调用（配置中心驱动）：**已确定「哪个模块的哪条具体接口」之后**的
+ *                              统一取数入口 —— 精取该条 confAttrs → 按 http_method/input_params 组参 →
+ *                              发请求（禁代理 + Cookie/eteamsid/UA 三件套）→ 提取精简结果（2026-09-28）
+ *                              与技能自带 script/call_module.py 等价（参数/退出码/提取全对齐），
+ *                              复用本 CLI 凭据缓存与 conf 通道、零临时文件
  *
  * 通用：--json 原样输出；复杂 JSON 参数支持 @文件 或 内联（中文走 @文件 更稳）
- * 认证：加解密全部由 e10-login 负责（本 CLI 不实现任何加解密）。凭据出口优先级：
- *   ① e10-login auth --json → ② e10-login whoami --json → ③ e10-login whoami（文本解析）
- *   → ④ 明文镜像 ~/.workbuddy/e10-login-cache.md（兜底，命中时告警）；均不可用时提示先 e10-login oidc 登录
+ * 认证：凭据**唯一来源 = weaver-work-cli**（本 CLI 不实现任何加解密，**不设 e10-login 回退**）：
+ *   weaver-work-cli auth export-weaver-env —— 解析 WEAVER_BASE_URL / WEAVER_ETEAMSID / WEAVER_COOKIE
+ *   e10-login 系出口 / 明文镜像已于 2026-09-24 停用；未登录时提示 `weaver-work-cli auth login`
  *   例外：`login xiaoe-env` 在"还没有任何凭据"时可独立完成登录（换 token 自己算，落 profile 仍交 e10-login）
  *
  * 用法示例：
@@ -196,7 +205,9 @@ function normalizeAuth(o) {
   const cookie = String(o.cookie || "").trim();
   if (!baseUrl || !eteamsid || !cookie) return null;
   if (/^\((未知|空)\)$/.test(eteamsid) || /^\((未知|空)\)$/.test(cookie)) return null;
-  return { baseUrl, eteamsid, cookie, userId: String(o.userId || "").trim(), tenantKey: String(o.tenantKey || "").trim(), source: o.source };
+  // userAgent：模块配置通道的请求头需要 `AgentType=<agentType>,IsAgent=true`（见 module 命令族）。
+  // 属"非凭据"的请求头取值，缺失时由 moduleUserAgent() 从 cookie 的 agentType= 推导，不影响取数。
+  return { baseUrl, eteamsid, cookie, userId: String(o.userId || "").trim(), tenantKey: String(o.tenantKey || "").trim(), userAgent: String(o.userAgent || "").trim(), source: o.source };
 }
 
 /** ① e10-login auth --json（正式契约：{v,baseUrl,eteamsId,cookie,userAgent,userId,tenantKey,agentType,profile}） */
@@ -270,14 +281,152 @@ function providerCacheMd() {
   });
 }
 
+// ---------------- weaver-work-cli 凭据出口（首选来源）----------------
+// 背景：本包要求 e10-data 的凭据**优先取自 weaver-work-cli**（与连接器无关的用户级登录体系）。
+//   weaver-work-cli 的登录态存于 ~/.weaver-work-cli/（@napi-rs/keyring 加密），与 e10-login 完全独立、
+//   互不通用；它提供 `auth export-weaver-env` 输出 WEAVER_* 变量，其中
+//   WEAVER_BASE_URL / WEAVER_ETEAMSID / WEAVER_COOKIE 正好对应本 CLI 需要的三要素。
+// 安全边界：**只在进程内存中解析** —— 不经 shell、不落盘、不打印、不写入任何日志/报告/错误信息；
+//   凭据随进程结束即释放（后续调用仍走 v0.1.17 的内存 TTL 缓存，不落明文）。
+// 定位策略：与 e10-login 相同的四段式（WEAVER_WORK_CLI_ENTRY → 模块解析 → PATH shim → 常见全局前缀）。
+const WEAVER_PROVIDER_NAME = "weaver-work-cli";
+const WEAVER_CLI_ENTRY_ENV = "WEAVER_WORK_CLI_ENTRY";
+
+let _weaverEntry;
+let _weaverEntryDone = false;
+
+function resolveWeaverEntry() {
+  if (_weaverEntryDone) return _weaverEntry;
+  _weaverEntryDone = true;
+  const isFile = (p) => { try { return !!p && fs.statSync(p).isFile(); } catch { return false; } };
+
+  const entryFromPkgDir = (dir) => {
+    try {
+      const pj = path.join(dir, "package.json");
+      if (!isFile(pj)) return null;
+      const j = JSON.parse(fs.readFileSync(pj, "utf-8"));
+      if (j.name !== "weaver-work-cli") return null;
+      let b = j.bin;
+      if (typeof b === "string") b = { "weaver-work-cli": b };
+      const rel = b && b["weaver-work-cli"];
+      if (!rel) return null;
+      const entry = path.resolve(dir, rel);
+      return isFile(entry) ? entry : null;
+    } catch { return null; }
+  };
+
+  const envEntry = (process.env[WEAVER_CLI_ENTRY_ENV] || "").trim();
+  if (envEntry && isFile(envEntry)) { _weaverEntry = envEntry; return _weaverEntry; }
+
+  try {
+    const pj = createRequire(import.meta.url).resolve("weaver-work-cli/package.json");
+    const e = entryFromPkgDir(path.dirname(pj));
+    if (e) { _weaverEntry = e; return _weaverEntry; }
+  } catch {}
+
+  const pathDirs = String(process.env.PATH || "").split(path.delimiter).filter(Boolean);
+  const shimNames = process.platform === "win32"
+    ? ["weaver-work-cli.cmd", "weaver-work-cli.exe", "weaver-work-cli"]
+    : ["weaver-work-cli"];
+  for (const d of pathDirs) {
+    for (const n of shimNames) {
+      if (!isFile(path.join(d, n))) continue;
+      const e = entryFromPkgDir(path.join(d, "node_modules", "weaver-work-cli"));
+      if (e) { _weaverEntry = e; return _weaverEntry; }
+    }
+  }
+
+  const home = os.homedir();
+  const prefixes = [
+    path.join(path.dirname(process.execPath), "node_modules"),
+    path.join(path.dirname(process.execPath), "..", "lib", "node_modules"),
+    path.join(home, ".npm-global", "lib", "node_modules"),
+    process.env.APPDATA ? path.join(process.env.APPDATA, "npm", "node_modules") : null,
+    process.env.ProgramFiles ? path.join(process.env.ProgramFiles, "nodejs", "node_modules") : null,
+  ].filter(Boolean);
+  for (const p of prefixes) {
+    const e = entryFromPkgDir(path.join(p, "weaver-work-cli"));
+    if (e) { _weaverEntry = e; return _weaverEntry; }
+  }
+
+  _weaverEntry = null;
+  return null;
+}
+
+/** 调用 weaver-work-cli（失败返回 null，诊断留在 lastLoginDiag 供 loadAuth 汇总） */
+function runWeaverCli(args, timeout = 20000) {
+  try {
+    const entry = resolveWeaverEntry();
+    const r = entry
+      ? spawnSync(process.execPath, [entry, ...args], { encoding: "utf-8", timeout, windowsHide: true })
+      : spawnSync("weaver-work-cli", args, { shell: true, encoding: "utf-8", timeout, windowsHide: true });
+    const out = (r.stdout || "").trim();
+    if (r.error || r.status !== 0) {
+      lastLoginDiag = ((r.stderr || "") + out).trim().split(/\r?\n/).slice(0, 2).join(" / ") || (r.error ? String(r.error.message) : "exit=" + r.status);
+      return null;
+    }
+    return out || null;
+  } catch (e) { lastLoginDiag = String((e && e.message) || e); return null; }
+}
+
+/** 去掉 shell 引号包装（兼容 POSIX 单/双引号与 PowerShell 双引号） */
+function unquoteShellValue(raw) {
+  const s = String(raw || "").trim();
+  if (s.length >= 2 && s.startsWith("'") && s.endsWith("'")) return s.slice(1, -1).replace(/'\\''/g, "'");
+  if (s.length >= 2 && s.startsWith('"') && s.endsWith('"')) return s.slice(1, -1).replace(/\\(["\\$`])/g, "$1");
+  return s;
+}
+
+/** 解析 KEY=VALUE 行（POSIX `export K='V'` / PowerShell `$env:K = "V"`） */
+function parseShellExports(text) {
+  const env = {};
+  for (const line of String(text || "").split(/\r?\n/)) {
+    const s = line.trim();
+    if (!s) continue;
+    let m = s.match(/^export\s+([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!m) m = s.match(/^\$env:([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);
+    if (m) env[m[1]] = unquoteShellValue(m[2]);
+  }
+  return env;
+}
+
+/** ⓪ weaver-work-cli auth export-weaver-env（唯一凭据来源） */
+function providerWeaverWorkCli() {
+  const out = runWeaverCli(["auth", "export-weaver-env", "--shell", "posix"]);
+  if (!out) return null;
+  const env = parseShellExports(out);
+  const auth = normalizeAuth({
+    baseUrl: env.WEAVER_BASE_URL,
+    eteamsid: env.WEAVER_ETEAMSID,
+    cookie: env.WEAVER_COOKIE,
+    userAgent: env.WEAVER_USER_AGENT,
+    source: "weaver-work-cli auth export-weaver-env",
+  });
+  if (!auth) return null;
+  // export-weaver-env 不导出 userId / tenantKey，需另向 auth status 取。
+  // 二者均为「非凭据」的身份字段：userId 会被部分命令用作"当前登录用户"默认值（如 attend statis 的 --user），
+  // 缺失会导致这些命令报「缺少查询人员」。取不到不影响凭据本身的可用性。
+  try {
+    const st = runWeaverCli(["--json", "auth", "status", "--no-check"]);
+    if (st) {
+      const j = JSON.parse(st);
+      if (j && j.loggedIn) {
+        auth.userId = String(j.userId || "").trim();
+        auth.tenantKey = String(j.tenantKey || "").trim();
+      }
+    }
+  } catch {}
+  return auth;
+}
+
+// ⚠️ 2026-09-24：凭据**唯一来源 = weaver-work-cli**，不再回退 e10-login。
+// providerAuthJson / providerWhoamiJson / providerWhoamiText / providerCacheMd 保留函数定义但不挂载
+// （如需恢复回退，把对应条目加回本数组即可）。
 const AUTH_PROVIDERS = [
-  ["auth-json", providerAuthJson],
-  ["whoami-json", providerWhoamiJson],
-  ["whoami-text", providerWhoamiText],
-  ["cache-md", providerCacheMd],
+  ["weaver-work-cli", providerWeaverWorkCli],
 ];
-/** 兜底出口不进记忆：否则 e10-login 偶发不可用一次，就会把"用镜像"永久设为首选、次次告警 */
-const AUTH_FALLBACK_PROVIDERS = new Set(["cache-md"]);
+/** 预留：登记"命中后不进记忆"的出口（当前为空——唯一出口需要被记忆） */
+const AUTH_FALLBACK_PROVIDERS = new Set();
 
 function readAuthModeMemo() {
   try {
@@ -296,7 +445,13 @@ function loadAuth() {
   const memo = override || (process.env.E10_DATA_AUTH_PROBE ? null : readAuthModeMemo());
   const order = memo
     ? AUTH_PROVIDERS.filter(([n]) => n === memo).concat(AUTH_PROVIDERS.filter(([n]) => n !== memo))
-    : AUTH_PROVIDERS;
+    : AUTH_PROVIDERS.slice();
+  // 首选来源固定为 weaver-work-cli：无论 memo 指向谁，都把它提到最前再依次尝试
+  // （仅当未用 E10_DATA_AUTH_MODE 显式指定时；它取不到凭据会自动回落后续出口）
+  if (!override) {
+    const wi = order.findIndex(([n]) => n === WEAVER_PROVIDER_NAME);
+    if (wi > 0) order.unshift(order.splice(wi, 1)[0]);
+  }
 
   const diag = [];
   for (const [name, fn] of order) {
@@ -317,10 +472,10 @@ function loadAuth() {
   }
 
   throw new Error(
-    "未取得登录凭据（解密由 e10-login 负责，本 CLI 不参与）。请依次检查：\n" +
-    "  ① e10-login 是否可用：`e10-login --version`（缺失 → `npm i -g e10-login`）；`e10-login whoami` 应能输出 cookies\n" +
-    "  ② 是否已登录 / 登录态是否失效：`e10-login oidc` 重新登录（当前 profile: " + profile + "）\n" +
-    "  ③ auth 文件：" + (fs.existsSync(file) ? "存在" : "不存在") + "（" + file + "）—— 其加解密由 e10-login 负责\n" +
+    "未取得登录凭据（唯一来源 = weaver-work-cli，**不设回退**）。请按顺序检查：\n" +
+    "  ① 命令是否可用：`weaver-work-cli --version`（缺失 → 安装 weaver-work-cli）\n" +
+    "  ② 是否已登录：`weaver-work-cli auth status --no-check`\n" +
+    "  ③ 未登录 / 登录态失效 → 执行 `weaver-work-cli auth login --base-url <域名>` 重新登录（当前 profile: " + profile + "）\n" +
     (diag.length ? "  探测诊断：" + diag.join(" ｜ ") + "\n" : "")
   );
 }
@@ -400,7 +555,7 @@ function credCachePublish(auth) {
       profile: auth.profile || "default",
       auth: {
         baseUrl: auth.baseUrl, eteamsid: auth.eteamsid, cookie: auth.cookie,
-        userId: auth.userId, tenantKey: auth.tenantKey, source: auth.source,
+        userId: auth.userId, tenantKey: auth.tenantKey, userAgent: auth.userAgent, source: auth.source,
       },
     });
     let settled = false;
@@ -544,7 +699,7 @@ async function cmdLoginXiaoeEnv(args, json) {
 // 为什么需要：loadAuth() 写在模块顶层，过去"未知命令"也要先付一整笔取凭据的开销
 // （Windows 上 ~1.0s，去 shell 后 ~0.22s）才打印用法。v0.1.17 起提前判定。
 const CMD_SUBS = {
-  ds: ["tables", "fields", "fields-dsl", "list", "chart", "stat", "count"],
+  ds: ["groups", "find", "describe", "tables", "fields", "fields-dsl", "list", "chart", "stat", "count"],
   doc: ["count", "list"],
   noun: ["list"],
   field: ["id2name", "name2id"],
@@ -552,6 +707,7 @@ const CMD_SUBS = {
   exp: ["status", "manifest", "commits", "file", "pull", "init", "commit", "lock", "release", "rollback"],
   attend: ["statis"],
   eb: ["perm-page"],
+  module: ["call"],
 };
 function commandIsKnown(pos) {
   const family = pos[0], sub = pos[1];
@@ -608,9 +764,7 @@ const USER = { id: auth.userId || "", tenantKey: auth.tenantKey || "" };
 function checkAuthFail(resp, text, j) {
   if (resp.status === 401 || (j && String(j.code) === "-1" && /token|登录|失效/i.test(String(j.msg || "")))) {
     const from = (auth && auth.source) || "未知";
-    const hint = /镜像/.test(from)
-      ? "当前用的是明文镜像兜底凭据（可能已过期），请先确认 `e10-login whoami` 能正常导出 cookies，或执行 `e10-login oidc` 重新登录"
-      : "凭据由 e10-login 提供，请执行 `e10-login oidc` 重新登录";
+    const hint = "凭据由 weaver-work-cli 提供，请执行 `weaver-work-cli auth login --base-url <域名>` 重新登录";
     throw new Error("登录态失效(" + (j.msg || resp.status) + ")：凭据来源＝" + from + "；" + hint);
   }
 }
@@ -865,6 +1019,15 @@ function parseOrder(val) {
 function dsFieldsForm(gid, tid, st) {
   return { groupId: gid, sourceId: tid, sourceType: st, detailFieldsGroup: "true", enableMerge: "true", needTableName: "true", params: "[]" };
 }
+// ---- ds listByPage 端点（唯一）：/api/dw/newetl/chatBi/ds/listByPage ----
+// ⚠️ 该端点**当前会忽略 name**（传 name/tableName/keyword/title 等任意字段名，都返回该分组全量，实测 8531 条）。
+//    后端后续会升级支持 name 过滤（用户 2026-09-24 确认）——升级后 `ds find` / `ds tables --name` **无需改代码**
+//    即自动恢复服务端过滤能力（本封装与分页逻辑已按「total 为过滤后总数」的语义写好）。
+//    在此之前，`ds find` 走「分页抓取 + 本地过滤」，未命中只代表「未在已扫描窗口内命中」。
+const DS_LB_PATH = "/api/dw/newetl/chatBi/ds/listByPage";
+async function dsListByPage(form) {
+  return postMultipart(DS_LB_PATH, form);
+}
 // ds 取数统一入口：appId 只认显式 --app-id <id>
 // （--app-id auto / --no-app-id 一律视为未传：v0.1.14 起不再自动解析，也不做缺失拦截）
 async function dsDto(args, tid, gid, pageNo, pageSize, queryType) {
@@ -877,7 +1040,7 @@ async function cmdTables(args, json) {
   const gid = need("group", args);
   const form = { name: args.name || "", pageNo: args.page || "1", pageSize: args.size || "100", groupId: gid, sourceType: args["source-type"] || "LOGIC", dataUsage: "" };
   if (typeof args["app-id"] === "string" && args["app-id"] !== "" && args["app-id"] !== "auto") form.appId = args["app-id"];
-  const r = await postMultipart("/api/dw/newetl/chatBi/ds/listByPage", form);
+  const r = await dsListByPage(form);
   if (json) return r;
   const recs = ((r.data || {}).records) || [];
   printHuman("分组表清单 (total=" + ((r.data || {}).total) + ")", recs, ["id", "name", "appId", "tableText", "detailTable", "usage"]);
@@ -950,6 +1113,433 @@ async function cmdCount(args, json) {
   console.log("totalCount = " + (data.totalCount ?? "-"));
 }
 
+// ================= ds 发现层聚合：groups / find / describe（2026-09-24 新增）=================
+// 背景：一次「表单业务词」问数原本要串行跑 5 跳（定分组 → 找表 → 取字段 → 查词库 → 查权限），
+//   每跳都是一次独立 CLI 调用。实测单次调用固定开销 ~5.4s，其中「凭据现取」~4.8s 且
+//   **与请求条数/返回体量无关**（取 48 条 vs 取 1 条：5.5s vs 5.8s）⇒ 5 跳 ≈ 27s；
+//   若逐进程扫 58 个分组，串行累计约 313s。
+//   故把「找表」「字段+词库」各收敛成 1 次 CLI 调用，**在进程内并发发 HTTP**（一次凭据搞定）。
+//   实测同样的全分组扇出：进程内并发 ≈5.3~5.9s（逐进程 47.5s / 逐进程串行 ~313s）。
+//
+// ⚠️ 权限闸门不在本命令范围：`ds/listByPage` 虽然也回带 appId，但**数据源通道不拦权限**
+//   （实测：未授权表在数据源上照样能取到数据）。拿 listByPage 的 appId 跳过校验 = 闸门静默失效。
+//   ⇒ EB 建模表单取数前**必须单独**执行 `e10-data eb perm-page`，appId 只从那次调用取。
+
+// 分组清单（技能文档 data-source-query.md 1.1 的 58 个）。**仅作 ds find 的「默认扫描候选集」**，
+// 不参与任何取数参数推导。分组随环境模块安装情况增减，故支持 --groups 显式覆盖。
+const DS_GROUPS = [
+  [1, "业务表单", "weaver-formreport-service", "form"],
+  [2, "流程", "weaver-workflow-report-serviceworkflowreport", "workflow"],
+  [3, "任务", "weaver-project-servicetask", "task"],
+  [4, "日志", "weaver-elog-service", "elog"],
+  [5, "会议", "weaver-meeting-service", "meeting"],
+  [6, "日报", "weaver-blog-service", "blog"],
+  [7, "OKR", "weaver-wr-goal-service", "goal"],
+  [8, "流程列表", "weaver-workflow-list-service", "workflow"],
+  [9, "考勤", "weaver-attend-service", "attend"],
+  [10, "CRM", "weaver-crm-service", "customer"],
+  [11, "组织画像", "weaver-portrait-service", "portrait"],
+  [12, "工作流报告", "weaver-workflow-report-serviceworkflow_report", "workflow"],
+  [13, "绩效", "weaver-wr-performance-service", "kpi"],
+  [14, "项目", "weaver-project-service", "mainline"],
+  [15, "基础定时模块", "weaver-basic-schedule-service", "escheduler"],
+  [16, "知识画像", "weaver-doc-service", "document"],
+  [17, "HRM", "weaver-hrm-service", "hrm"],
+  [18, "e-builder报表", "weaver-edcreportd-service", null],
+  [19, "e-builder应用", "weaver-ebuilder-app-service", "ebuilder"],
+  [20, "e-builder表单", "weaver-ebuilder-form-service", "ebuilder"],
+  [21, "日程", "weaver-calendar-service", "calendar"],
+  [22, "文档", "weaver-doc-servicedocument", "document"],
+  [23, "文件", "weaver-file-service", "file"],
+  [24, "公文管理", "weaver-odoc-service", "odoc"],
+  [25, "SCRM", "weaver-crm-market-service", "scrm"],
+  [26, "协作区", "weaver-cowork-service", "cowork"],
+  [27, "数据源", "weaver-datasource-service", "datasource"],
+  [28, "计划报告", "weaver-wr-plan-service", "workreport"],
+  [29, "电子签", "weaver-signcenter-service", "signcontract"],
+  [30, "表单加密", "weaver-datasecurity", "datasecurity"],
+  [31, "人事", "weaver-hr-service", null],
+  [32, "动作流", "weaver-esb-setting-serviceesbCustom", "esb"],
+  [33, "发票云", "weaver-inc-biz-service", "inc"],
+  [34, "绩效核算", "weaver-ebuilder-contract-servicecmdatauFJXHS", "ebuilder"],
+  [35, "EB合同管理", "weaver-ebuilder-contract-service", null],
+  [36, "待办事项", "weaver-my-service", null],
+  [37, "签名", "weaver-signature-service", null],
+  [38, "邮件", "weaver-mail-base-service", "email"],
+  [39, "薪酬", "weaver-hrm-salary", "hrmsalary"],
+  [40, "系统安全", "weaver-security-framework-service", "security"],
+  [41, "公文交换中心", "weaver-odocexchange-service", "odocexchange"],
+  [42, "招聘管理", "weaver-recruit-service", "recruit"],
+  [43, "微搜", "weaver-esearch-search-service", null],
+  [44, "统一审批中心", "weaver-intunifytodo-server-config-service", "intunifytodos"],
+  [45, "公共数据源", "weaver-component-web-service", "common"],
+  [46, "数据分析", "weaver-analyze-service", "analyze"],
+  [47, "财务模块", "weaver-fna-expense-servicefexs", "fna"],
+  [48, "ESB连接器", "weaver-esb-setting-serviceesbConnect", "esb"],
+  [49, "AI连接器", "weaver-ai-application-service", "ai"],
+  [50, "外部流程", "weaver-workflow-core-serviceworkflowCoreOuterwf", "workflow"],
+  [51, "绩效考核", "weaver-wr-performance-eb-service", "ebuilder"],
+  [52, "问题定位平台", "weaver-tissot-service", "tissot"],
+  [53, "工作流基础效率", "weaver-workflow-report-serviceworkflowEffReport", "workflow"],
+  [54, "工作流操作者效率", "weaver-workflow-report-serviceworkflowEffOperateReport", "workflow"],
+  [55, "工作流节点效率", "weaver-workflow-report-serviceworkflowEffNodeReport", "workflow"],
+  [56, "规则引擎", "weaver-logicflow-service", "logicflow"],
+  [57, "工作流表单", "weaver-workflow-report-serviceworkflowFormReport", "workflow"],
+  [58, "统一认证中心", "weaver-intunifyauth-server-base-service", null],
+];
+
+// 必探的核心分组（技能文档「分组探查强制范围」：e-builder 表单 + 业务表单 必探；流程类业务词也常落在流程分组）
+const DS_CORE_GROUPS = [
+  "weaver-formreport-service",
+  "weaver-ebuilder-form-service",
+  "weaver-workflow-report-serviceworkflowreport",
+];
+// 语义命中规则：只是「关键词 → 分组名片段」的启发式，命中即并入扫描集（不做任何取数参数推导）
+const DS_FIND_SEMANTIC_RULES = [
+  { tag: "考勤/假期", re: /考勤|打卡|出勤|请假|假期|年假|事假|病假|加班|外勤|工时|调休|补卡|申诉/, groups: ["weaver-attend-service", "weaver-hr-service"] },
+  { tag: "流程/审批", re: /流程|审批|待办|已办|发起|抄送|传阅|征询|签字|节点|报销|申请单/, groups: ["weaver-workflow-report-serviceworkflowreport", "weaver-workflow-list-service"] },
+  { tag: "日报/周报", re: /日报|周报|月报|年报|工作总结/, groups: ["weaver-blog-service", "weaver-wr-plan-service"] },
+  { tag: "文档/附件", re: /文档|附件|文件夹|共享|资料/, groups: ["weaver-doc-servicedocument", "weaver-doc-service", "weaver-file-service"] },
+  { tag: "项目/任务", re: /项目|任务|工时|里程碑|延期|验收/, groups: ["weaver-project-service", "weaver-project-servicetask"] },
+  { tag: "客户/商机", re: /客户|商机|线索|联系人|公海|销售|CRM|营销/i, groups: ["weaver-crm-service", "weaver-crm-market-service"] },
+  { tag: "会议/日程", re: /会议|日程|日历|预约|会议室|预定/, groups: ["weaver-meeting-service", "weaver-calendar-service"] },
+  { tag: "人事/招聘", re: /招聘|入职|离职|offer|人才|员工|人员|通讯录|调岗|组织/i, groups: ["weaver-recruit-service", "weaver-hr-service", "weaver-hrm-service"] },
+  { tag: "薪酬/绩效", re: /薪酬|薪资|工资|社保|公积金|绩效|考核|KPI|OKR/i, groups: ["weaver-hrm-salary", "weaver-wr-performance-service", "weaver-wr-goal-service"] },
+  { tag: "合同/收款", re: /合同|签约|收款|回款|开票|发票|应收/, groups: ["weaver-ebuilder-contract-service", "weaver-ebuilder-contract-servicecmdatauFJXHS", "weaver-inc-biz-service"] },
+  { tag: "邮件/公文", re: /邮件|收件箱|公文|发文|档案|借阅/, groups: ["weaver-mail-base-service", "weaver-odoc-service"] },
+  { tag: "资产/日志", re: /资产|台账|日志|动作流|自动化/, groups: ["weaver-elog-service", "weaver-esb-setting-serviceesbCustom"] },
+];
+
+function dsGroupLabel(gid) { const g = DS_GROUPS.find((x) => x[2] === gid); return g ? g[1] : null; }
+function dsGroupMark(gid) { const g = DS_GROUPS.find((x) => x[2] === gid); return g ? g[3] : null; }
+
+/** 进程内并发闸门：一次凭据、N 个 HTTP 并发（把「N 次 CLI 调用」压成 1 次调用的核心） */
+async function mapLimit(items, limit, fn) {
+  const out = new Array(items.length);
+  let next = 0;
+  const workers = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+    for (;;) {
+      const i = next++;
+      if (i >= items.length) return;
+      out[i] = await fn(items[i], i);
+    }
+  });
+  await Promise.all(workers);
+  return out;
+}
+
+async function cmdDsGroups(args, json) {
+  const pat = args.pattern ? String(args.pattern) : null;
+  const groups = DS_GROUPS
+    .filter((g) => !pat || String(g[2]).includes(pat) || String(g[1]).includes(pat))
+    .map((g) => ({ groupId: g[2], label: g[1], serviceMark: g[3] }));
+  if (json) {
+    return {
+      count: groups.length,
+      groups,
+      coreGroups: DS_CORE_GROUPS,
+      semanticRules: DS_FIND_SEMANTIC_RULES.map((r) => ({ tag: r.tag, groups: r.groups })),
+      note: "内置分组清单，仅用于 ds find 的默认扫描候选集；分组随环境变动时用 --groups 显式覆盖",
+    };
+  }
+  printHuman("内置分组清单 " + groups.length + " 个", groups, ["groupId", "label", "serviceMark"]);
+}
+
+/** 选扫描集：--groups 显式 > --all-groups 全量 > 核心分组 + 语义命中 */
+function pickFindGroups(args, keyword) {
+  if (args.groups) {
+    return { mode: "explicit", groups: String(args.groups).split(",").map((s) => s.trim()).filter(Boolean) };
+  }
+  if (args["all-groups"]) return { mode: "all", groups: DS_GROUPS.map((g) => g[2]) };
+  const max = Math.max(parseInt(args["max-groups"] || "6", 10) || 6, DS_CORE_GROUPS.length);
+  const picked = [];
+  const push = (gid) => { if (gid && !picked.includes(gid)) picked.push(gid); };
+  for (const gid of DS_CORE_GROUPS) push(gid);
+  for (const r of DS_FIND_SEMANTIC_RULES) if (r.re.test(keyword)) for (const gid of r.groups) push(gid);
+  return { mode: "core", groups: picked.slice(0, max) };
+}
+
+/** 进程内并发扫分组（每分组 1~N 页 listByPage）。
+ *  ⚠️ 端点当前忽略 name ⇒ 抓回来的是「全量窗口」，关键词过滤由调用方在本地做；
+ *     窗口大小 = pageSize × pages，**未命中只代表未落在窗口内**（后端支持 name 后即为精确结果）。
+ *  ⚠️ appId：EB 分组（weaver-ebuilder-form-service）**按应用分域**，需要时透传 */
+async function dsScanGroups(gidList, keyword, sourceType, pageSize, concurrency, appId, pages) {
+  return mapLimit(gidList, concurrency, async (gid) => {
+    const out = { groupId: gid, label: dsGroupLabel(gid), serviceMark: dsGroupMark(gid), records: [], error: null, total: null, pagesFetched: 0 };
+    try {
+      for (let p = 1; p <= pages; p++) {
+        const form = { name: keyword, pageNo: String(p), pageSize: String(pageSize), groupId: gid, sourceType, dataUsage: "" };
+        if (appId) form.appId = String(appId);
+        const r = await dsListByPage(form);
+        const recs = ((r.data || {}).records) || [];
+        if (out.total === null) out.total = (r.data || {}).total ?? null;   // 后端过滤生效时 = 过滤后总数
+        out.records = out.records.concat(recs);
+        out.pagesFetched++;
+        if (recs.length < pageSize) break;                                   // 已到末页
+      }
+    } catch (e) { out.error = String((e && e.message) || e); }
+    return out;
+  });
+}
+
+// 同一实体（如一个流程）会在多个「报表/效率」分组里重复出现 → 归并去重，并保留落选分组做溯源
+function dsGroupPriority(gid) {
+  if (gid === "weaver-ebuilder-form-service") return 100;
+  if (gid === "weaver-formreport-service") return 95;
+  if (gid === "weaver-workflow-report-serviceworkflowreport") return 90;
+  if (/workflowEff|workflowFormReport|workflow_report$/i.test(gid)) return 20;
+  return 50;
+}
+function mergeDsCandidates(scanResults, limit) {
+  const map = new Map();
+  for (const r of scanResults) {
+    for (const rec of r.records) {
+      const gid = rec.groupId || r.groupId;
+      const name = String(rec.originalName || rec.tableText || rec.name || "").trim();
+      const key = name.replace(/\s+/g, "").toLowerCase() || gid + "|" + rec.id;
+      const item = {
+        groupId: gid, groupLabel: r.label, serviceMark: rec.serviceMark ?? r.serviceMark ?? null,
+        tableId: String(rec.id ?? ""), name: String(rec.tableText || rec.name || name), originalName: name,
+        objType: rec.objType ?? null, physicalTable: rec.physicalTable ?? null, appId: rec.appId ?? null,
+        isPhysical: rec.isPhysical ?? null, detailTable: !!rec.detailTable, usage: rec.usage ?? null,
+        sourceType: rec.sourceType ?? null, alsoInGroups: [], _pri: dsGroupPriority(gid),
+      };
+      const prev = map.get(key);
+      if (!prev) { map.set(key, item); continue; }
+      const win = prev._pri >= item._pri ? prev : item;
+      const lose = prev._pri >= item._pri ? item : prev;
+      win.alsoInGroups = win.alsoInGroups.concat(
+        [{ groupId: lose.groupId, groupLabel: lose.groupLabel, tableId: lose.tableId, serviceMark: lose.serviceMark }],
+        lose.alsoInGroups || [],
+      );
+      map.set(key, win);
+    }
+  }
+  const list = [...map.values()].sort((a, b) => b._pri - a._pri || String(a.originalName).localeCompare(String(b.originalName)));
+  const n = parseInt(limit || "0", 10) || 0;
+  return (n > 0 ? list.slice(0, n) : list).map((x) => { const { _pri, ...rest } = x; return rest; });
+}
+// 路由建议：命中所在的分组分布本身就是通道信号（比“先定通道再找表”更先验）
+function dsRouteHint(cands) {
+  const has = (fn) => cands.some(fn);
+  if (has((c) => /workflow/i.test(c.groupId) || c.serviceMark === "workflow")) {
+    return { channel: "WORKFLOW", desc: "WORKFLOW 模块配置通道 —— 流程类问题一律走模块接口，不用 DSL，也不走数据源", reason: "命中流程类分组" };
+  }
+  if (has((c) => c.groupId === "weaver-ebuilder-form-service" || c.serviceMark === "ebuilder")) {
+    return { channel: "DS_EB", desc: "数据源通道（EB 建模表单）—— 取数前必须先过 eb perm-page 权限校验，appId 取自那次校验", reason: "命中 EB 分组" };
+  }
+  if (has((c) => c.serviceMark === "form")) {
+    return { channel: "DS_FORM", desc: "数据源通道（业务表单 / 流程业务表单）", reason: "命中业务表单分组" };
+  }
+  if (has((c) => c.serviceMark === "task" || c.serviceMark === "mainline")) return { channel: "PROJECT/PMO", desc: "项目类：PMO 指标走 business/project-mgmt + DSL；明细/下拉选项走 PROJECT 模块", reason: "命中项目分组" };
+  if (has((c) => c.serviceMark === "attend")) return { channel: "EHR", desc: "EHR 模块配置通道（考勤/人事）", reason: "命中考勤分组" };
+  if (has((c) => c.serviceMark === "blog")) return { channel: "BLOG_DAILY", desc: "BLOG_DAILY 模块配置通道（日报）", reason: "命中日报分组" };
+  if (has((c) => c.serviceMark === "document")) return { channel: "DOCUMENT", desc: "DOCUMENT 模块配置通道（文档）", reason: "命中文档分组" };
+  if (has((c) => c.serviceMark === "customer" || c.serviceMark === "scrm")) return { channel: "CRM", desc: "CRM 模块配置通道（客户/商机/线索）", reason: "命中 CRM 分组" };
+  if (has((c) => c.serviceMark === "esb")) return { channel: "ESB", desc: "动作流（ESB）—— 无标准问数通道，需人工确认", reason: "仅命中动作流分组" };
+  return { channel: "DS", desc: "数据源通道（ds list / chart / stat / count）", reason: "通用" };
+}
+
+async function cmdDsFind(args, json) {
+  const keyword = String(args.name || args.keyword || "").trim();
+  if (!keyword) throw new Error("缺少必填参数 --name <关键词>");
+  const sourceType = args["source-type"] || "LOGIC";
+  // 端点忽略 name ⇒ 抓取窗口 = --size × --pages（后端支持 name 后，total 即为过滤后总数、pages 语义不变）
+  const pageSize = Math.min(Math.max(parseInt(args.size || "100", 10) || 100, 1), 2000);
+  const pages = Math.min(Math.max(parseInt(args.pages || "1", 10) || 1, 1), 50);
+  const concurrency = Math.max(1, parseInt(args.concurrency || "10", 10) || 10);
+  const appId = (typeof args["app-id"] === "string" && args["app-id"] !== "" && args["app-id"] !== "auto") ? args["app-id"] : null;
+  const picked = pickFindGroups(args, keyword);
+
+  const t0 = Date.now();
+  let scan = await dsScanGroups(picked.groups, keyword, sourceType, pageSize, concurrency, appId, pages);
+  // 后端 name 搜索是宽松的：实测部分分组会忽略 name 直接返回全量、或按描述命中 ⇒ 本地再按「表名包含关键词」过一遍。
+  // ⚠️ 端点忽略 name ⇒ 关键词过滤当前**只能在本地做**（见文件头 DS_LB_PATH 注释）。
+  //    落选项**不静默丢弃**，计数与样例放在 nameFilter 里；--loose 可完全关闭该过滤（保守用法）。
+  const kwNorm = keyword.replace(/\s+/g, "").toLowerCase();
+  const looseSample = [];
+  let looseDropped = 0;
+  let rowsScanned = 0;
+  const applyStrict = (rows) => rows.map((r) => {
+    rowsScanned += r.records.length;
+    if (args.loose) return r;
+    const keep = [], drop = [];
+    for (const rec of r.records) {
+      const nm = String(rec.originalName || rec.tableText || rec.name || "").replace(/\s+/g, "").toLowerCase();
+      (nm.includes(kwNorm) ? keep : drop).push(rec);
+    }
+    looseDropped += drop.length;
+    for (const d of drop.slice(0, 3)) {
+      if (looseSample.length < 6) looseSample.push({ groupId: r.groupId, name: String(d.originalName || d.tableText || d.name || "") });
+    }
+    return { ...r, records: keep };
+  });
+  scan = applyStrict(scan);
+  let escalated = false;
+  // 默认小集合全 miss → 自动升级为全分组扫一次（语义规则没覆盖到时兜底；全扫也是进程内并发）
+  // ⚠️ 端点忽略 name 时「miss」不代表表不存在（只是没落进窗口）⇒ 窗口较大时不再自动全扫，避免 58 组 × N 页的请求风暴
+  const escalateOk = pages * pageSize <= 2000;
+  if (!scan.some((r) => r.records.length) && picked.mode === "core" && !args["no-escalate"] && escalateOk) {
+    escalated = true;
+    const seen = new Set(picked.groups);
+    const extra = DS_GROUPS.map((g) => g[2]).filter((gid) => !seen.has(gid));
+    scan = scan.concat(applyStrict(await dsScanGroups(extra, keyword, sourceType, pageSize, concurrency, appId, pages)));
+  }
+  const elapsedMs = Date.now() - t0;
+
+  const okScan = scan.filter((r) => !r.error);
+  const errs = scan.filter((r) => r.error);
+  // 全部失败且像登录态问题 → 直接抛（不要把 401 伪装成“没找到表”）
+  if (!okScan.length && errs.length && errs.some((e) => /登录态失效|401/.test(e.error))) {
+    throw new Error("登录态失效：请重新登录 weaver-work-cli（`weaver-work-cli auth login --base-url <域名>`）后重试（本次未取到任何分组）");
+  }
+  const candidates = mergeDsCandidates(scan, args.limit);
+  const out = {
+    keyword, sourceType, scanMode: picked.mode + (escalated ? "+escalated" : ""),
+    scannedGroups: scan.length, hitGroups: scan.filter((r) => r.records.length).length,
+    escalated, elapsedMs, concurrency,
+    candidates, routeHint: dsRouteHint(candidates),
+    // 端点忽略 name：必须让调用方知道「未命中 ≠ 表不存在」
+    nameFilter: args.loose
+      ? { serverSide: false, filtered: false, pages, pageSize, rowsScanned, note: "--loose：未做本地过滤，直接采用后端返回" }
+      : {
+        serverSide: false, filtered: true, pages, pageSize, rowsScanned, dropped: looseDropped, sample: looseSample,
+        note: "端点 /api/dw/newetl/chatBi/ds/listByPage **当前忽略 name**（后端待升级）⇒ 本次为「抓 " + pages + " 页 × " + pageSize + " 行 + 本地按表名过滤」，共比对 " + rowsScanned + " 行；"
+          + "**未命中只代表未落在该窗口内，不等于该表不存在**（若该分组行数 > " + (pages * pageSize) + " 请调大 --size/--pages）。后端支持 name 后自动恢复精确过滤，无需改调用方式。",
+      },
+    scopeNote: scan.some((r) => r.groupId === "weaver-ebuilder-form-service")
+      ? (appId
+        ? "本次已带 --app-id=" + appId + "（EB 分组按应用分域，用于限定/对齐应用范围）"
+        : "⚠️ 本次未带 --app-id：EB 分组（weaver-ebuilder-form-service）按应用分域，如需限定某个应用请带 --app-id <该应用ID>")
+      : null,
+    errors: errs.map((e) => ({ groupId: e.groupId, error: e.error })),
+  };
+  if (json) return out;
+
+  console.log("== 找表「" + keyword + "」扫描 " + out.scannedGroups + " 组 / 抓取 " + rowsScanned + " 行 / 命中 " + out.hitGroups + " 组 (" + elapsedMs + "ms" + (escalated ? "，已升级全扫" : "") + ") ==");
+  if (!candidates.length) {
+    console.log("(未命中) ⚠️ 端点当前忽略 name，本次是「抓 " + pages + " 页 × " + pageSize + " 行 + 本地过滤」比对 " + rowsScanned + " 行；");
+    console.log("         **未命中 ≠ 该表不存在** —— 该分组行数若超过 " + (pages * pageSize) + "，请调大 --size（≤2000）/--pages（≤50）再试；");
+    console.log("         也可显式指定 --groups a,b / --all-groups；分组清单见 ds groups。");
+  } else {
+    for (const c of candidates) {
+      const extra = c.alsoInGroups && c.alsoInGroups.length ? "  [同实体亦见于: " + c.alsoInGroups.map((x) => x.groupId).join(", ") + "]" : "";
+      console.log([c.groupId, c.tableId, c.originalName || c.name, c.physicalTable ? "物理表=" + c.physicalTable : "", c.appId ? "appId=" + c.appId : ""].filter(Boolean).join("\t") + extra);
+    }
+  }
+  console.log("路由建议: " + out.routeHint.channel + " —— " + out.routeHint.desc);
+  if (out.scopeNote) console.log("范围提示: " + out.scopeNote);
+  if (errs.length) console.log("⚠ 有 " + errs.length + " 个分组请求失败（--json 看详情）");
+}
+
+// describe：一次并发取回「字段 + 词库」（两者入参同为 (groupId, tableId)，彼此无依赖）
+// ⚠️ 本命令**不做权限校验** —— EB 建模表单取数前的权限闸门仍必须**单独**执行 `e10-data eb perm-page`
+//    （appId 只从那次调用取）。原因：数据源通道本身不拦权限，权限判定与取数必须分开。
+function collectFieldNodes(list, out, subName) {
+  for (const f of list || []) {
+    if (!f) continue;
+    if (f.isDetailtable) {
+      const node = { subTableName: f.name, fields: [] };
+      collectFieldNodes(f.fields, node.fields, f.name);
+      out.push({ __detail: true, ...node });
+    } else {
+      out.push({
+        name: f.name, text: f.text ?? null, type: f.type ?? null, dbFieldType: f.dbFieldType ?? null,
+        isPK: !!f.mainPrimaryKey, subTable: subName || null,
+        dataKey: (f.config && f.config.dataKey) || null,
+        formTableId: (f.config && f.config.formTableId) || null,
+      });
+    }
+  }
+}
+function normalizeFieldsResp(r) {
+  const node = (r.data || [])[0] || {};
+  const flat = [];
+  collectFieldNodes(node.fields, flat, null);
+  const main = flat.filter((x) => !x.__detail);
+  const detail = flat.filter((x) => x.__detail).map((x) => ({ subTableName: x.subTableName, fieldCount: x.fields.length, fields: x.fields }));
+  return {
+    tableName: node.name ?? null, tableId: node.id ?? null,
+    mainCount: main.length, detailCount: detail.reduce((a, b) => a + b.fieldCount, 0), main, detail,
+  };
+}
+// 关联字段提取「表来源判定」的预判：groupId/serviceMark 已隐含表来源大类，不必再花 1~6 次 DSL 去反推
+function dsRelatedHint(gid, detailCount) {
+  if (gid === "weaver-ebuilder-form-service") {
+    return { likelyApplicable: true, tableOrigin: "eb", note: "EB 表：按 ebdf_obj ⋈ form_table ⋈ form 三表 JOIN 定位，再用 form_field / form_table_field 提关联字段；明细子表走 sub_form（本表明细字段 " + detailCount + " 个）" };
+  }
+  if (/^weaver-workflow/.test(gid)) return { likelyApplicable: true, tableOrigin: "flow", note: "流程相关表：按 ec_weaver_wfp_fusion 的 form_field / form_table_field 提关联字段" };
+  if (gid === "weaver-formreport-service") {
+    return { likelyApplicable: false, tableOrigin: "form-report", note: "业务表单（formreport）：表名是中文显示名、非物理表名 ⇒ relate-fields-extract 的 ①ETL ②SQL视图 ③④EB ⑤⑥流程 六类判定全部不适用，该跳必然空转，**不要发起**" };
+  }
+  return { likelyApplicable: false, tableOrigin: "unknown", note: "非 EB / 非流程表，关联字段提取通常不适用；如确需先按表名形态（sv_ / uf_ / 系统表名）人工确认" };
+}
+
+async function cmdDsDescribe(args, json) {
+  const gid = need("group", args);
+  const tid = String(need("table", args));
+  const sourceType = args["source-type"] || "LOGIC";
+  const t0 = Date.now();
+
+  const tasks = [
+    (async () => {
+      try {
+        const form = dsFieldsForm(gid, tid, sourceType);
+        if (typeof args["app-id"] === "string" && args["app-id"] !== "" && args["app-id"] !== "auto") form.appId = args["app-id"];
+        return { key: "fields", value: normalizeFieldsResp(await postMultipart("/api/ebuilder/common/ds/fields", form)) };
+      } catch (e) { return { key: "fields", error: String((e && e.message) || e) }; }
+    })(),
+    (async () => {
+      const skillKey = args.skill || "data-source-query";
+      try {
+        const q = new URLSearchParams({ skillKey, sourceType, sourceGroupId: gid, sourceTableId: tid });
+        const r = await getUrl("/api/dw/newetl/chatBi/skill/getChatDocsBySkillKey?" + q.toString());
+        const data = r.data;
+        const missing = !data || !Array.isArray(data.nouns);
+        return {
+          key: "lexicon",
+          value: {
+            skillKey, sourceType, sourceGroupId: gid, sourceTableId: tid,
+            noLexicon: missing, count: missing ? 0 : data.nouns.length,
+            nouns: missing ? [] : data.nouns.map((n) => ({ keyword: n.keyword ?? null, synonyms: n.synonyms ?? null, wordExplain: n.wordExplain ?? null })),
+            note: missing
+              ? "该数据集无词库（后端：" + (r.msg || "未返回 nouns") + "）—— 四参数均取自本次调用，故为**确定结论**；按铁律如实说明『该数据集暂无名词解释』，不自动建库、不新增名词"
+              : "词库命中：须先把每条规则逐条映射到 --where / --fields / --group-by / --stat 并自检无遗漏，再生成查询",
+          },
+        };
+      } catch (e) { return { key: "lexicon", error: String((e && e.message) || e) }; }
+    })(),
+  ];
+
+  const settled = await Promise.all(tasks);
+  const out = { groupId: gid, groupLabel: dsGroupLabel(gid), tableId: tid, sourceType, branches: settled.length };
+  const errors = [];
+  for (const s of settled) {
+    if (s.error) { out[s.key] = { error: s.error }; errors.push({ branch: s.key, error: s.error }); }
+    else out[s.key] = s.value;
+  }
+  out.relatedFields = dsRelatedHint(gid, (out.fields && out.fields.detailCount) || 0);
+  out.channelHint = dsRouteHint([{ groupId: gid, serviceMark: dsGroupMark(gid) }]);
+  // ⚠️ 权限闸门**不在本命令范围**：EB 建模表单取数前必须另行执行 `e10-data eb perm-page`（appId 只从那次校验取）
+  out.permissionNote = gid === "weaver-ebuilder-form-service"
+    ? "该分组是 EB 建模表单：取数前必须另行执行 `e10-data eb perm-page --obj-id <tableId> --form-table <物理表名>` 判权限并取 appId（--form-table 用 ds find / ds tables 返回的 physicalTable）"
+    : "非 EB 分组，数据源通道无需 eb perm-page 前置校验";
+  out.elapsedMs = Date.now() - t0;
+  if (errors.length && args.require) throw new Error("describe 存在失败分支，--require 下不继续：" + JSON.stringify(errors));
+  if (json) return out;
+
+  const f = out.fields || {};
+  console.log("== describe " + gid + " / " + tid + " (" + out.elapsedMs + "ms，并发 " + settled.length + " 路) ==");
+  if (f.error) console.log("字段: 失败 " + f.error);
+  else console.log("字段: 主表 " + f.mainCount + " 个，明细 " + f.detailCount + " 个（表名 " + (f.tableName ?? "-") + "）");
+  const lx = out.lexicon || {};
+  if (lx.error) console.log("词库: 失败 " + lx.error);
+  else console.log("词库: " + (lx.noLexicon ? "该数据集无词库" : "命中 " + lx.count + " 条（skill=" + lx.skillKey + "）"));
+  console.log("关联字段: " + (out.relatedFields.likelyApplicable ? "适用（" + out.relatedFields.tableOrigin + "）" : "不适用（" + out.relatedFields.tableOrigin + "）") + " —— " + out.relatedFields.note);
+  console.log("通道提示: " + out.channelHint.channel + " —— " + out.channelHint.desc);
+  console.log("权限: 不在本命令范围 —— " + out.permissionNote);
+}
+
 // ---------------- eb：EB 建模表单权限校验 ----------------
 // chatBi EB 配置映射分页查询：EB 表权限前置校验的 CLI 通道
 // （替代原「DSL 查 dw.chat_bi_eb_config_map + 客户端拼 (all_scop=1 OR target_id=本人)」写法）
@@ -1412,6 +2002,338 @@ async function cmdConf(sub, args, json, pos) {
   }
 }
 
+// ---------------- module：模块配置接口调用（配置中心驱动，2026-09-28 新增）----------------
+// 用途：**已确定「哪个模块的哪条具体接口」之后**，用本命令一条命令完成取数：
+//   复用本 CLI 已加载的凭据 → 精取该条 confAttrs（confType=api，按 confGroup 二级定位）
+//   → 按 http_method / input_params 组参 → 发请求（自动禁代理 + Cookie/eteamsid/UA 三件套）
+//   → 按外层结构提取精简结果（datajson / data / records / 裸数组皆可）。
+// 与技能自带 python 调用器 call_module.py **等价**（参数名、退出码、提取口径全对齐），区别：
+//   · 复用本 CLI 的凭据缓存与 conf 通道（不额外起 python，也不重复取凭据）；
+//   · 全程零临时文件（body 由内存直发，不落盘）。
+// 退出码（照 call_module.py 语义，见 main().catch 的 exitCode 处理）：
+//   0 正常（**空结果也算正常**）/ 2 未登录·凭据失效 / 3 非 JSON·confAttrs 异常
+//   / 4 权限受限（终端态：立即终止）/ 6 命中 HRM 路径黑名单 / 7 请求失败 / 8 用法错误
+const MODULE_HRM_PATTERNS = ["/api/hrm/", "/api/bs/hrm/", "/api/app/hrm/"];
+const MODULE_PERM_WORDS = ["没有权限", "无权限", "权限不足", "未授权", "无权访问", "无查询权限"];
+const MODULE_INVOICE_TOKEN_PATH = "/api/inc/proxy/getToken?appType=1";
+const MODULE_EXIT = { OK: 0, AUTH: 2, JSON: 3, PERM: 4, HRM: 6, HTTP: 7, USAGE: 8 };
+
+/** 带退出码的错误：main().catch 按 e.exitCode 退出（未设置仍为 1） */
+class ModuleExit extends Error {
+  constructor(code, message) { super(message); this.exitCode = code; }
+}
+
+/** json 模式下先向 stdout 打一份结构化错误信封，再带退出码抛出（对齐 call_module.py 的输出约定） */
+function moduleDie(json, code, msg) {
+  if (json) console.log(JSON.stringify({ ok: false, exit: code, error: msg }, null, 1));
+  throw new ModuleExit(code, msg);
+}
+
+/** 模块接口调用的 User-Agent：`AgentType=<agentType>,IsAgent=true`
+ *  优先取登录态自带的 UA（weaver-work-cli export-weaver-env 的 WEAVER_USER_AGENT），但**必须是 AgentType 形态**；
+ *  缺失 / 形态不符 / 混入非 ASCII（会致请求头编码失败）时，从 cookie 的 agentType= 推导，再退回 workbuddy。 */
+function moduleUserAgent() {
+  const raw = String((auth && auth.userAgent) || "").trim();
+  if (raw && !/[^\x00-\x7F]/.test(raw) && /agenttype=/i.test(raw)) return raw;
+  const m = String((auth && auth.cookie) || "").match(/agentType=([^;]+)/i);
+  return "AgentType=" + (m ? m[1].trim() : "workbuddy") + ",IsAgent=true";
+}
+
+/** 业务参数 → query 串（数组按多值展开、对象 JSON 化；对齐 urlencode(..., doseq=True)） */
+function moduleQueryString(obj) {
+  const sp = new URLSearchParams();
+  for (const [k, v] of Object.entries(obj || {})) {
+    if (v === undefined || v === null) continue;
+    if (Array.isArray(v)) for (const x of v) sp.append(k, x !== null && typeof x === "object" ? JSON.stringify(x) : String(x));
+    else sp.append(k, typeof v === "object" ? JSON.stringify(v) : String(v));
+  }
+  return sp.toString();
+}
+
+/** 发请求（带超时）；网络层失败 → 退出码 7 */
+async function moduleFetch(method, pathAndQuery, headers, body, timeoutMs) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+  try {
+    const resp = await fetch(BASE + pathAndQuery, {
+      method,
+      headers,
+      ...(body !== undefined ? { body } : {}),
+      signal: ctrl.signal,
+    });
+    return { status: resp.status, text: await resp.text() };
+  } catch (e) {
+    const aborted = String((e && e.name) || "") === "AbortError";
+    throw new ModuleExit(MODULE_EXIT.HTTP, "请求失败：" + (aborted ? "超时 " + timeoutMs + "ms" : String((e && e.message) || e)));
+  } finally { clearTimeout(timer); }
+}
+
+/** 按已知外层形态找列表：datajson.data / datajson.datas / data.data / data.records / data / datas / list */
+function moduleRowsOf(obj) {
+  const numish = (v) => (typeof v === "number" || typeof v === "string") ? v : null;
+  if (Array.isArray(obj)) return { rows: obj, total: null };
+  if (!obj || typeof obj !== "object") return { rows: null, total: null };
+  for (const k of ["datajson", "data", "result"]) {
+    const v = obj[k];
+    if (Array.isArray(v)) return { rows: v, total: null };
+    if (v && typeof v === "object") {
+      for (const kk of ["data", "datas", "records", "list", "items", "rows"]) {
+        if (Array.isArray(v[kk])) return { rows: v[kk], total: numish(v.total) };
+      }
+      return { rows: null, total: null };
+    }
+  }
+  for (const kk of ["datas", "list", "records", "items", "rows"]) {
+    if (Array.isArray(obj[kk])) return { rows: obj[kk], total: numish(obj.total) };
+  }
+  return { rows: null, total: null };
+}
+
+/** 取载荷（datajson 优先，其次 data，否则根）与来源名 */
+function modulePayloadOf(obj) {
+  if (obj && typeof obj === "object" && !Array.isArray(obj)) {
+    for (const k of ["datajson", "data"]) {
+      if (obj[k] !== undefined && obj[k] !== null) return { value: obj[k], via: k };
+    }
+  }
+  return { value: obj, via: "(root)" };
+}
+
+/** 权限/二次验证标志位识别（权限受限 ≠ 无数据；二次验证 ≠ 无数据） */
+function moduleFlagsOf(obj, payload) {
+  const flags = [];
+  if (payload && typeof payload === "object" && !Array.isArray(payload) && payload.hasSearchRight === false) {
+    flags.push("hasSearchRight=false（权限受限，其余字段必为空 → 立即终止，不得交付为「无数据」）");
+  }
+  if (payload && typeof payload === "object" && !Array.isArray(payload) && payload.pageUid === "checkSecondFail") {
+    flags.push("pageUid=checkSecondFail（二次身份验证：total 可信、明细恒 0 行 → 如实说明，不得当无数据）");
+  }
+  let txt = "";
+  try { txt = JSON.stringify(obj).slice(0, 4000); } catch { txt = ""; }
+  if (MODULE_PERM_WORDS.some((w) => txt.includes(w))) flags.push("响应含权限关键词 → 按「无权限即终止」处理");
+  return flags;
+}
+
+/** INVOICE 业务接口的发票云 Token（内存透传；🚫 不打印、不落盘） */
+async function moduleInvoiceToken(json, timeoutMs) {
+  const headers = {
+    "accept": "application/json, text/plain, */*",
+    "langType": "zh_CN",
+    "cookie": auth.cookie,
+    "eteamsid": auth.eteamsid,
+    "user-agent": moduleUserAgent(),
+  };
+  const { status, text } = await moduleFetch("GET", MODULE_INVOICE_TOKEN_PATH, headers, undefined, timeoutMs);
+  let tk = null;
+  try { const j = parseJsonSafe(text); tk = j && j.data && j.data.token; } catch {}
+  if (!tk) moduleDie(json, MODULE_EXIT.HTTP, "未取到发票云 Token（INVOICE 业务接口必需；HTTP " + status + "）");
+  return tk;
+}
+
+async function cmdModuleCall(args, json) {
+  // ---- 必填与选项（缺参一律退出码 8，对齐 call_module.py）----
+  if (!args["conf-key"] || args["conf-key"] === true) {
+    moduleDie(json, MODULE_EXIT.USAGE, "缺必填参数 --conf-key（用法: module call --conf-key <confKey> --group <模块>）");
+  }
+  if (!args.group || args.group === true) {
+    moduleDie(json, MODULE_EXIT.USAGE, "缺必填参数 --group（模块唯一标识，如 WORKFLOW / EHR / DOCUMENT）");
+  }
+  const confKey = String(args["conf-key"]);
+  const group = String(args.group);
+  const timeoutMs = Math.max(1, parseInt(args.timeout || "60", 10) || 60) * 1000;
+  const limit = (args.limit === undefined || args.limit === true) ? 50 : (parseInt(String(args.limit), 10) || 0);
+  const fields = (typeof args.fields === "string" && args.fields) ? args.fields.split(",").map((s) => s.trim()).filter(Boolean) : null;
+
+  // ---- ① 精取该条接口配置（confType 固定 api；confGroup 二级定位必带）----
+  let rec;
+  try { rec = await confGetData("api", confKey, false, group); }
+  catch (e) {
+    const m = String((e && e.message) || e);
+    moduleDie(json, /登录态失效|未取得登录凭据/.test(m) ? MODULE_EXIT.AUTH : MODULE_EXIT.JSON,
+      "conf get 失败：" + m + "（先核对 confKey / confGroup；登录态问题请重新登录）");
+  }
+  let attrs = rec.confAttrs;
+  if (typeof attrs === "string") {
+    try { attrs = parseJsonSafe(attrs, "confAttrs"); }
+    catch { moduleDie(json, MODULE_EXIT.JSON, "confAttrs 二次解析失败（非 JSON 字符串）: " + confKey); }
+  }
+  if (!attrs || typeof attrs !== "object" || Array.isArray(attrs)) {
+    moduleDie(json, MODULE_EXIT.JSON, "confAttrs 缺失或形态异常: " + confKey + "（--group " + group + "）");
+  }
+  const apiPath = String(attrs.api_path || rec.confValue || "");
+  if (!apiPath) moduleDie(json, MODULE_EXIT.JSON, "confAttrs 未提供 api_path / confValue: " + confKey);
+
+  // ---- ② HRM 路径黑名单（人员/部门/岗位只走 weaver-work-cli 的 hrm 子命令）----
+  if (MODULE_HRM_PATTERNS.some((p) => apiPath.includes(p))) {
+    moduleDie(json, MODULE_EXIT.HRM,
+      "该接口命中 HRM 路径黑名单（" + apiPath + "）→ 人员/部门/岗位一律走 weaver-work-cli 的 hrm 子命令，禁止直调");
+  }
+
+  const apiName = attrs.api_name || rec.confName || confKey;
+
+  // ---- ③ --show-params：只给入/出参说明与请求示例，不调接口（用于正确组参）----
+  if (args["show-params"]) {
+    const out = {
+      confKey, module: group, api_name: apiName,
+      http_method: attrs.http_method ?? null, api_path: apiPath,
+      business_desc: attrs.business_desc ?? null,
+      api_params: attrs.api_params ?? null,
+      input_params: attrs.input_params ?? null,
+      output_params: attrs.output_params ?? null,
+      request_example: attrs.request_example ?? null,
+    };
+    console.log(JSON.stringify(out, null, 1));
+    return;
+  }
+
+  // ---- ④ 组参：--args（@文件 / 内联）+ --query（k=v&k2=v2）+ --header / --headers ----
+  let bizArgs = {};
+  if (args.args !== undefined && args.args !== true) {
+    try { bizArgs = readJsonArg(String(args.args), "--args"); }
+    catch (e) { moduleDie(json, MODULE_EXIT.USAGE, "--args 读取/解析失败：" + ((e && e.message) || e)); }
+  }
+  if (!bizArgs || typeof bizArgs !== "object" || Array.isArray(bizArgs)) {
+    moduleDie(json, MODULE_EXIT.USAGE, "--args 必须是 JSON 对象");
+  }
+  if (typeof args.query === "string" && args.query) {
+    for (const pair of args.query.split("&")) {
+      if (!pair) continue;
+      const i = pair.indexOf("=");
+      if (i > 0) bizArgs[pair.slice(0, i)] = pair.slice(i + 1);
+    }
+  }
+  const extraHeaders = {};
+  if (args.headers !== undefined && args.headers !== true) {
+    let h;
+    try { h = readJsonArg(String(args.headers), "--headers"); }
+    catch (e) { moduleDie(json, MODULE_EXIT.USAGE, "--headers 读取/解析失败：" + ((e && e.message) || e)); }
+    if (h && typeof h === "object" && !Array.isArray(h)) Object.assign(extraHeaders, h);
+  }
+  if (typeof args.header === "string" && args.header.includes(":")) {
+    const i = args.header.indexOf(":");
+    extraHeaders[args.header.slice(0, i).trim()] = args.header.slice(i + 1).trim();
+  }
+
+  const declared = String(args.method || attrs.http_method || "POST").toUpperCase();
+  if (declared !== "GET" && declared !== "POST" && declared !== "FORM") {
+    moduleDie(json, MODULE_EXIT.USAGE, "--method 只支持 GET / POST / FORM（当前: " + args.method + "）");
+  }
+  const effMethod = declared === "FORM" ? "POST" : declared;
+  const isForm = declared === "FORM" || /x-www-form-urlencoded/i.test(String(attrs.api_definition || ""));
+
+  let qs = "", body;
+  if (effMethod === "GET") {
+    const q = moduleQueryString(bizArgs);
+    qs = q ? "?" + q : "";
+  } else {
+    body = isForm ? moduleQueryString(bizArgs) : JSON.stringify(bizArgs);
+  }
+
+  // ---- ⑤ --dry-run：只组装不发送（凭据一律脱敏）----
+  if (args["dry-run"]) {
+    const masked = {};
+    for (const [k, v] of Object.entries(extraHeaders)) masked[k] = /^token$/i.test(k) ? "<脱敏>" : v;
+    const out = {
+      ok: true, confKey, api_name: apiName, method: effMethod,
+      url: "<baseUrl>" + apiPath + qs,
+      body: bizArgs,
+      headers: {
+        Cookie: "<脱敏>", eteamsid: "<脱敏>", "User-Agent": "<AgentType=…,IsAgent=true>",
+        "Content-Type": effMethod === "POST" ? (isForm ? "application/x-www-form-urlencoded" : "application/json;charset=UTF-8") : null,
+        ...masked,
+      },
+      note: "--dry-run：未发送请求",
+    };
+    console.log(JSON.stringify(out, null, 1));
+    return;
+  }
+
+  // ---- ⑥ 发请求 ----
+  const headers = {
+    "accept": "application/json, text/plain, */*",
+    "langType": "zh_CN",
+    "cookie": auth.cookie,
+    "eteamsid": auth.eteamsid,
+    "ebbusinessid": EB_BIZ_ID,
+    "user-agent": moduleUserAgent(),
+    "timezoneoffset": "-480",
+  };
+  if (effMethod === "POST") headers["Content-Type"] = isForm ? "application/x-www-form-urlencoded" : "application/json;charset=UTF-8";
+  // INVOICE：业务接口除通用三件套外必须带发票云 token（先取换、再允许 --header 覆盖）
+  if (group.toUpperCase() === "INVOICE" || String(attrs.module_key || "").toUpperCase() === "INVOICE") {
+    headers["token"] = await moduleInvoiceToken(json, timeoutMs);
+  }
+  Object.assign(headers, extraHeaders);
+
+  const { status, text } = await moduleFetch(effMethod, apiPath + qs, headers, body, timeoutMs);
+
+  if (status === 401) {
+    moduleDie(json, MODULE_EXIT.AUTH,
+      "登录态失效(HTTP 401)：凭据来源＝" + ((auth && auth.source) || "未知") + "；请执行 `weaver-work-cli auth login --base-url <域名>` 重新登录");
+  }
+
+  let obj = null;
+  try { obj = parseJsonSafe(text); } catch {}
+  if (obj === null) {
+    // 非 JSON：原样输出前 2000 字符（2xx 视为正常，其余按请求失败）
+    if (json) console.log(JSON.stringify({ ok: status >= 200 && status < 300, api_name: apiName, http: status, nonJson: text.slice(0, 2000) }, null, 1));
+    else console.log(text.slice(0, 2000));
+    if (status < 200 || status >= 300) throw new ModuleExit(MODULE_EXIT.HTTP, "HTTP " + status + " 且响应非 JSON（已原样输出前 2000 字符）");
+    return;
+  }
+
+  // ---- ⑦ --raw：原样输出响应体 ----
+  if (args.raw) {
+    console.log(JSON.stringify(obj, null, 1));
+    return;
+  }
+
+  // ---- ⑧ 提取精简结果 ----
+  const payload = modulePayloadOf(obj);
+  const flags = moduleFlagsOf(obj, payload.value);
+  const { rows, total } = moduleRowsOf(obj);
+  const out = { ok: true, api_name: apiName, http: status, via: payload.via };
+  let projected = null;
+  if (rows !== null) {
+    const shown = limit > 0 ? rows.slice(0, limit) : rows;
+    projected = fields
+      ? shown.map((r) => {
+        const o = {};
+        if (r && typeof r === "object") for (const k of fields) if (k in r) o[k] = r[k];
+        return o;
+      })
+      : shown;
+    out.total = total;
+    out.rows = rows.length;
+    out.shown = projected.length;
+    out.data = projected;
+  } else {
+    out.data = payload.value;
+  }
+  if (flags.length) out.flags = flags;
+
+  if (json) {
+    console.log(JSON.stringify(out, null, 1));
+  } else {
+    console.log("== " + apiName + " ==");
+    console.log(effMethod + " " + apiPath + " → HTTP " + status + "（via=" + payload.via + "）");
+    if (rows !== null) {
+      console.log("rows=" + rows.length
+        + (total !== null && total !== undefined ? " / total=" + total : "")
+        + (limit > 0 && rows.length > limit ? "（已截断到 " + limit + " 行）" : ""));
+      printHuman("", projected);
+    } else {
+      console.log(JSON.stringify(payload.value, null, 1));
+    }
+    for (const f of flags) console.log("[!] " + f);
+  }
+
+  // 权限受限是终端态：结果照常给出（供调用方留证），但退出码必须是非 0（对齐 call_module.py）
+  if (flags.some((f) => f.startsWith("hasSearchRight=false"))) {
+    throw new ModuleExit(MODULE_EXIT.PERM, "权限受限：hasSearchRight=false（立即终止，不重试、不换参、不交付为「无数据」）");
+  }
+}
+
 // ---------------- attend：考勤 REST 接口 ----------------
 // 2026-09-07：封装 /api/attend/web/attendInfoV2/getAttendInfoStatis（假期余额统计，hr-attendance 场景六病假/事假）。
 // 请求参数 {beginDate, endDate, userId}；返回 data.vacationBalanceList[]：{id,title,data:[{name,value,key}]}，
@@ -1459,7 +2381,7 @@ async function expGet(url) {
   });
   const raw = await resp.text();
   let j; try { j = parseJsonSafe(raw); } catch { throw new Error("HTTP " + resp.status + " 非JSON响应: " + raw.slice(0, 300)); }
-  if (resp.status === 401 || (j && String(j.code) === "-1" && /token|登录|失效/i.test(String(j.msg || "")))) throw new Error("登录态失效，请重新 e10-login oidc 登录");
+  if (resp.status === 401 || (j && String(j.code) === "-1" && /token|登录|失效/i.test(String(j.msg || "")))) throw new Error("登录态失效，请重新登录 weaver-work-cli（`weaver-work-cli auth login --base-url <域名>`）");
   return { raw, j };
 }
 function rawNum(raw, key) {
@@ -1531,7 +2453,7 @@ async function rawGet(url) {
     method: "GET",
     headers: { "accept": "*/*", "langType": "zh_CN", "cookie": auth.cookie, "eteamsid": auth.eteamsid, "ebbusinessid": EB_BIZ_ID, "user-agent": UA },
   });
-  if (resp.status === 401) throw new Error("登录态失效，请重新 e10-login oidc 登录");
+  if (resp.status === 401) throw new Error("登录态失效，请重新登录 weaver-work-cli（`weaver-work-cli auth login --base-url <域名>`）");
   return Buffer.from(await resp.arrayBuffer());
 }
 async function expStatus(args, json) {
@@ -1793,6 +2715,23 @@ login   登录（**唯一不需要已有凭据**的命令族；其余命令都
 query   DSL 数据查询 executeQueryDsl
   query  --conn <connId> --model <ebuilder|flow|eteams|attend|hr|document|dw|blog> --schema <数据库> [--table-id <流程ID>] [--debug true|false] --dsl @file.json|'{...}'
 ds      数据源（业务模块）取数与元数据
+  ds groups  [--pattern <关键词>] [--json]        # 内置分组清单（仅用于 find 的默认扫描集）
+  ds find    --name <关键词> [--groups g1,g2] [--all-groups] [--max-groups N] [--limit N]
+             [--app-id <id>] [--size 100] [--pages N] [--concurrency 10] [--no-escalate] [--loose] [--source-type LOGIC]
+             # 跨分组找表：**进程内并发**扇出（一次凭据），产物=候选表清单 + 路由建议，**不取数**
+             #   默认扫描集 = 核心 3 组（业务表单/e-builder表单/流程）+ 语义命中组，≤ --max-groups
+             #   默认集合全 miss 时自动升级为全分组扫一次（--no-escalate 可关；窗口 >2000 行时不自动升级）
+             #   --all-groups = 直接扫全部内置分组（进程内并发，实测 ~5.5s）
+             #   --app-id：EB 分组（weaver-ebuilder-form-service）按应用分域，需限定应用时带上
+             #   ⚠️ 端点 /api/dw/newetl/chatBi/ds/listByPage **当前忽略 name**（后端待升级）⇒ 本次是
+             #      「抓 --pages 页 × --size 行 + 本地按表名过滤」：**未命中 ≠ 该表不存在**，
+             #      分组行数大时请调大 --size（≤2000）/--pages（≤50）。后端支持 name 后自动精确、无需改调用
+             #   输出按「实体」归并去重（同一流程会在多个报表/效率分组重复出现）
+  ds describe --group <gid> --table <tid> [--app-id <id>] [--skill <skillKey，默认 data-source-query>]
+             [--require] [--source-type LOGIC]
+             # 一次**并发**取回两件套：字段 + 词库（两者入参同为 (groupId, tableId)，互不依赖）
+             #   ⚠️ **不做权限校验**：EB 分组取数前仍必须单独执行 eb perm-page（appId 只从那次调用取）
+             #   --require：任一路失败即报错退出
   ds tables  --group <gid> [--name 关键词] [--app-id <id>]
   ds fields  --group <gid> --table <tid> [--app-id <id>]
   ds fields-dsl  --group <gid> --table <tid> [--app-id <id>]   # 同 fields，接口 /api/dw/newetl/chatBi/ds/fieldsForDSL
@@ -1851,6 +2790,20 @@ eb      EB 建模表单权限校验（chatBi EB 配置映射分页查询，替
       # obj-id / form-table 必填（本地强校验；缺失后端只回空、不报错）
       # obj-id / app-id 必须字符串传参（19 位大整数，Number 舍入 → 静默 total=0）
       # total>=1 = 有权限，并回带该行 appId；--require 时 total=0 直接报错退出
+module  模块配置接口调用（配置中心驱动；**已确定「哪个模块的哪条具体接口」之后**用它取数，2026-09-28 新增）
+  module call --conf-key <confKey> --group <模块> [--args '<JSON>'|--args @params.json]
+              [--query "k=v&k2=v2"] [--method GET|POST|FORM] [--header 'K: V'|--headers '<JSON>'|@file]
+              [--limit 50] [--fields a,b] [--raw] [--show-params] [--dry-run] [--timeout 60] [--json]
+      # 一条命令完成：精取该条 confAttrs → 按 http_method/input_params 组参 → 发请求
+      #   （自动禁代理 + Cookie/eteamsid/UA 三件套）→ 按外层结构（datajson/data/records/裸数组）提取精简结果
+      # 与技能自带 python 调用器 call_module.py 等价（参数名/退出码/提取口径全对齐），但复用本 CLI 凭据缓存与
+      #   conf 通道、零临时文件 —— 调用器首选本命令，call_module.py 仅作兜底
+      # --show-params：只打印入/出参说明与请求示例（不调接口），用于正确组参
+      # --dry-run：只组装请求不发送（凭据脱敏）；--limit 0 = 不截断
+      # --query 多对用 & 连接；INVOICE 自动换取发票云 token（内存透传，不打印不落盘）
+      # 退出码：0 正常（**空结果也算正常**）｜2 未登录·凭据失效｜3 非 JSON·confAttrs 异常
+      #         ｜4 权限受限（hasSearchRight=false，终端态）｜6 命中 HRM 路径黑名单｜7 请求失败｜8 用法错误
+      # 示例: module call --conf-key POST_EHR_GET_ATTEND_INFO_STATIS --group EHR --args @params.json --json
 认证: 加解密由 e10-login 负责（本 CLI 不参与）；凭据出口 = e10-login auth/whoami（自动同步镜像）；皆无请先 e10-login oidc
       （无浏览器/无 python 环境：login xiaoe-env 用环境变量 token 直接登录）`);
 }
@@ -1869,6 +2822,9 @@ async function main() {
   if (family === "ds") {
     if (!sub) { usage(); process.exit(1); }
     switch (sub) {
+      case "groups": result = await cmdDsGroups(args, json); break;
+      case "find": result = await cmdDsFind(args, json); break;
+      case "describe": result = await cmdDsDescribe(args, json); break;
       case "tables": result = await cmdTables(args, json); break;
       case "fields": result = await cmdFields(args, json); break;
       case "fields-dsl": result = await cmdFieldsForDSL(args, json); break;
@@ -1918,7 +2874,17 @@ async function main() {
       case "perm-page": result = await cmdEbPermPage(args, json); break;
       default: usage(); process.exit(1);
     }
+  } else if (family === "module") {
+    if (!sub) { usage(); process.exit(1); }
+    switch (sub) {
+      case "call": result = await cmdModuleCall(args, json); break;
+      default: usage(); process.exit(1);
+    }
   } else { usage(); process.exit(1); }
   if (json && result !== undefined) console.log(JSON.stringify(result, null, 1));
 }
-main().catch((e) => { console.error("ERROR: " + e.message); process.exit(1); });
+// 退出码：默认 1（用法/未知错误）；错误对象带 exitCode 时按其退出（module call 用到 2/3/4/6/7/8）
+main().catch((e) => {
+  console.error("ERROR: " + ((e && e.message) || e));
+  process.exit(Number.isInteger(e && e.exitCode) ? e.exitCode : 1);
+});