@lexq/cli 0.1.33 → 0.1.35

package/dist/index.js

@@ -2327,13 +2327,240 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
 }
 
-// src/commands/integrations.ts
+// src/commands/replay.ts
 import "commander";
 import dedent10 from "dedent";
+function registerReplayCommands(program) {
+  const replay = program.command("replay").description("Decision Replay").addHelpText(
+    "after",
+    dedent10`
+
+        Re-evaluate past production executions against a candidate version.
+
+        Commands:
+          decision  Replay one execution and show the decision diff (sync, free)
+          start     Submit a window replay job — blast radius (async, billed)
+          list      List replay job history
+          get       Poll a job's status, summary, and changed samples
+          cancel    Cancel a PENDING/RUNNING job
+
+        External effects (webhooks, notifications) are always mocked during replay.
+      `
+  );
+  replay.command("decision").description("Replay a single execution against a candidate version").requiredOption("--trace-id <traceId>", "Trace ID of the past execution").requiredOption("--version-id <versionId>", "Candidate version to re-evaluate against").addHelpText(
+    "after",
+    dedent10`
+
+        Free of charge (TPS throttle only). Returns decisionChanged, effect
+        changes, fired rules on both sides, and a determinism verdict.
+
+        Example:
+          $ lexq replay decision --trace-id <tid> --version-id <vid>
+      `
+  ).action(async (opts) => {
+    try {
+      const globalOpts = program.opts();
+      const data = await apiRequest("POST", "replay/decisions", {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose,
+        body: { traceId: opts.traceId, candidateVersionId: opts.versionId }
+      });
+      printJson(data);
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+  replay.command("start").description("Submit a window replay job (blast radius)").requiredOption("--version-id <versionId>", "Candidate version to re-evaluate against").requiredOption("--from <date>", "Window start date (yyyy-MM-dd)").requiredOption("--to <date>", "Window end date (yyyy-MM-dd)").option("--max-records <number>", "Sample cap (hard cap 50k)").addHelpText(
+    "after",
+    dedent10`
+
+        Billed per replayed record (REPLAY metric). Poll with "lexq replay get".
+
+        Example:
+          $ lexq replay start --version-id <vid> --from 2026-06-01 --to 2026-06-30
+      `
+  ).action(async (opts) => {
+    try {
+      const globalOpts = program.opts();
+      const body = {
+        candidateVersionId: opts.versionId,
+        from: opts.from,
+        to: opts.to
+      };
+      if (opts.maxRecords) body.maxRecords = Number(opts.maxRecords);
+      const data = await apiRequest("POST", "replay/jobs", {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose,
+        body
+      });
+      printJson(data);
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+  replay.command("list").description("List replay jobs").option("--page <number>", "Page number", "0").option("--size <number>", "Page size", "20").action(async (opts) => {
+    try {
+      const globalOpts = program.opts();
+      const format = globalOpts.format ?? "json";
+      const data = await apiRequest("GET", "replay/jobs", {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose,
+        params: { page: opts.page, size: opts.size }
+      });
+      if (format === "table") {
+        printTable(
+          ["Job", "Version", "Window", "Status", "Progress", "Changed", "At"],
+          data.content.map((j) => [
+            j.jobId.substring(0, 12),
+            j.candidateVersionName ?? "\u2013",
+            `${j.fromDate}~${j.toDate}`,
+            j.status,
+            `${j.progress}%`,
+            `${j.changedCount}${j.capped ? " (capped)" : ""}`,
+            j.createdAt.substring(0, 16)
+          ]),
+          { truncate: 24 }
+        );
+        console.log(`
+${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
+      } else {
+        printJson(data);
+      }
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+  replay.command("get").description("Get replay job status and results").requiredOption("--id <jobId>", "Replay job ID").action(async (opts) => {
+    try {
+      const globalOpts = program.opts();
+      const data = await apiRequest("GET", `replay/jobs/${opts.id}`, {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose
+      });
+      printJson(data);
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+  replay.command("cancel").description("Cancel a PENDING/RUNNING replay job").requiredOption("--id <jobId>", "Replay job ID").action(async (opts) => {
+    try {
+      const globalOpts = program.opts();
+      const data = await apiRequest("POST", `replay/jobs/${opts.id}/cancel`, {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose
+      });
+      printJson(data);
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/provenance.ts
+import "commander";
+import dedent11 from "dedent";
+function registerProvenanceCommands(program) {
+  const provenance = program.command("provenance").description("Decision Provenance").addHelpText(
+    "after",
+    dedent11`
+
+        Trace who authored, published, and deployed the rules behind a decision.
+
+        Commands:
+          get            Get the lineage of one decision (PII facts masked)
+          reveal-audits  List the PII reveal audit ledger (metadata only)
+      `
+  );
+  provenance.command("get").description("Get decision lineage").requiredOption("--trace-id <traceId>", "Trace ID of the execution").action(async (opts) => {
+    try {
+      const globalOpts = program.opts();
+      const data = await apiRequest("GET", `provenance/${opts.traceId}`, {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose
+      });
+      printJson(data);
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+  provenance.command("reveal-audits").description("List PII reveal audits (who revealed what, when)").option("--trace-id <traceId>", "Filter by trace ID (exact)").option("--fact-key <factKey>", "Filter by fact key (partial, case-insensitive)").option("--revealed-by <operatorId>", "Filter by operator ID (exact)").option("--start-date <date>", "Start date (yyyy-MM-dd)").option("--end-date <date>", "End date (yyyy-MM-dd)").option("--page <number>", "Page number", "0").option("--size <number>", "Page size", "20").addHelpText(
+    "after",
+    dedent11`
+
+        Metadata only — revealed values are never stored or returned.
+
+        Example:
+          $ lexq provenance reveal-audits --start-date 2026-07-01 --format table
+      `
+  ).action(async (opts) => {
+    try {
+      const globalOpts = program.opts();
+      const format = globalOpts.format ?? "json";
+      const params = { page: opts.page, size: opts.size };
+      if (opts.traceId) params.traceId = opts.traceId;
+      if (opts.factKey) params.factKey = opts.factKey;
+      if (opts.revealedBy) params.revealedBy = opts.revealedBy;
+      if (opts.startDate) params.startDate = opts.startDate;
+      if (opts.endDate) params.endDate = opts.endDate;
+      const data = await apiRequest(
+        "GET",
+        "provenance/reveal-audits",
+        {
+          apiKey: globalOpts.apiKey,
+          baseUrl: globalOpts.baseUrl,
+          dryRun: globalOpts.dryRun,
+          verbose: globalOpts.verbose,
+          params
+        }
+      );
+      if (format === "table") {
+        printTable(
+          ["Revealed At", "By", "Fact Key", "Trace"],
+          data.content.map((a) => [
+            a.revealedAt.substring(0, 16),
+            a.revealedByName,
+            a.factKey,
+            a.traceId.substring(0, 12)
+          ]),
+          { truncate: 24 }
+        );
+        console.log(`
+${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
+      } else {
+        printJson(data);
+      }
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/integrations.ts
+import "commander";
+import dedent12 from "dedent";
 function registerIntegrationCommands(program) {
   const integrations = program.command("integrations").description("Manage external integrations").addHelpText(
     "after",
-    dedent10`
+    dedent12`
 
         Integrations connect rule actions to external services (webhooks, coupons,
         points, notifications, CRM, messengers).
@@ -2403,7 +2630,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   integrations.command("save").description("Create or update an integration").requiredOption("--json <body>", "Request body as JSON string").addHelpText(
     "after",
-    dedent10`
+    dedent12`
 
         Examples:
           # Create
@@ -2453,7 +2680,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   integrations.command("delete").description("Delete an integration").requiredOption("--id <integrationId>", "Integration ID").option("--force", "Skip confirmation prompt").addHelpText(
     "after",
-    dedent10`
+    dedent12`
 
         Rules referencing this integration will fail at execution time.
         Use --force to skip confirmation.
@@ -2485,7 +2712,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   integrations.command("config-spec").description("Get integration configuration field specs").addHelpText(
     "after",
-    dedent10`
+    dedent12`
 
         Shows required and optional configuration fields for each integration type.
 
@@ -2511,7 +2738,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 
 // src/commands/logs.ts
 import "commander";
-import dedent11 from "dedent";
+import dedent13 from "dedent";
 
 // src/types/enums.ts
 var FailureStatus = ["PENDING", "RESOLVED", "IGNORED"];
@@ -2545,7 +2772,7 @@ var WebhookPayloadFormat = ["GENERIC", "SLACK"];
 function registerLogCommands(program) {
   const logs = program.command("logs").description("Failure logs").addHelpText(
     "after",
-    dedent11`
+    dedent13`
 
         System failure logs (DLQ) for background tasks — webhook calls, coupon issuance,
         point operations, notifications, and platform event webhooks.
@@ -2562,7 +2789,7 @@ function registerLogCommands(program) {
   );
   logs.command("list").description("List failure logs").option("--category <category>", "Filter by category (INTEGRATION, INTERNAL)").option("--task-type <taskType>", `Filter by task type (${TaskType.join(", ")})`).option("--status <status>", "Filter by status (PENDING, RESOLVED, IGNORED)").option("--keyword <keyword>", "Search keyword").option("--start-date <date>", "Start date (yyyy-MM-dd)").option("--end-date <date>", "End date (yyyy-MM-dd)").option("--page <number>", "Page number", "0").option("--size <number>", "Page size", "20").addHelpText(
     "after",
-    dedent11`
+    dedent13`
 
         Examples:
           $ lexq logs list --status PENDING --format table
@@ -2613,7 +2840,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   logs.command("get").description("Get failure log detail").requiredOption("--id <logId>", "Log ID").addHelpText(
     "after",
-    dedent11`
+    dedent13`
 
         Includes the full payload that was used for the failed operation.
         Use this to inspect what went wrong before deciding to RETRY or RESOLVE.
@@ -2635,7 +2862,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   logs.command("action").description("Process a failure log action (RETRY, IGNORE, RESOLVE)").requiredOption("--id <logId>", "Log ID").requiredOption("--action <action>", "Action: RETRY, IGNORE, or RESOLVE").addHelpText(
     "after",
-    dedent11`
+    dedent13`
 
         Actions:
           RETRY    Re-execute the failed operation with the original payload
@@ -2667,7 +2894,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   logs.command("bulk-action").description("Bulk process failure logs").requiredOption("--ids <logIds>", "Comma-separated log IDs").requiredOption("--action <action>", "Action: RETRY, IGNORE, or RESOLVE").addHelpText(
     "after",
-    dedent11`
+    dedent13`
 
         Processes each log individually. Failures are skipped with a warning.
 
@@ -2695,11 +2922,11 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 
 // src/commands/webhook-subscriptions.ts
 import "commander";
-import dedent12 from "dedent";
+import dedent14 from "dedent";
 function registerWebhookSubscriptionCommands(program) {
   const webhooks = program.command("webhook-subscriptions").description("Manage platform event webhook subscriptions").addHelpText(
     "after",
-    dedent12`
+    dedent14`
 
         Receive notifications when deployment lifecycle events occur
         (publish, deploy, rollback, undeploy).
@@ -2773,7 +3000,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   webhooks.command("save").description("Create or update a webhook subscription").requiredOption("--json <body>", "Request body as JSON string").addHelpText(
     "after",
-    dedent12`
+    dedent14`
 
         Examples:
           # Create (Slack format)
@@ -2828,7 +3055,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   webhooks.command("delete").description("Delete a webhook subscription").requiredOption("--id <subscriptionId>", "Subscription ID").option("--force", "Skip confirmation prompt").addHelpText(
     "after",
-    dedent12`
+    dedent14`
 
         Use --force to skip the confirmation prompt.
 
@@ -2862,7 +3089,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   webhooks.command("test").description("Send a test event to verify webhook connectivity").requiredOption("--id <subscriptionId>", "Subscription ID").addHelpText(
     "after",
-    dedent12`
+    dedent14`
 
         Sends a test event to the webhook URL and reports the HTTP status code.
         Does not record failures in the failure log.
@@ -2898,7 +3125,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 
 // src/commands/serve.ts
 import "commander";
-import dedent15 from "dedent";
+import dedent17 from "dedent";
 
 // src/mcp/server.ts
 import { readFileSync as readFileSync3 } from "fs";
@@ -3220,7 +3447,7 @@ function registerVersionTools(server, callApi) {
 
 // src/mcp/tools/rules.ts
 import { z as z3 } from "zod";
-import dedent13 from "dedent";
+import dedent15 from "dedent";
 function registerRuleTools(server, callApi) {
   server.registerTool(
     "lexq_rules_list",
@@ -3251,7 +3478,7 @@ function registerRuleTools(server, callApi) {
     "lexq_rules_create",
     {
       title: "Create Rule",
-      description: dedent13`
+      description: dedent15`
         Create a rule in a DRAFT version. Requires name, condition tree, and actions array. priority is auto-assigned (appended last); use lexq_rules_reorder to change order.
 
         Before creating rules with new fact keys, call lexq_facts_list to check existing facts.
@@ -3593,13 +3820,13 @@ function registerDeployTools(server, callApi) {
 
 // src/mcp/tools/analytics.ts
 import { z as z6 } from "zod";
-import dedent14 from "dedent";
+import dedent16 from "dedent";
 function registerAnalyticsTools(server, callApi) {
   server.registerTool(
     "lexq_dry_run",
     {
       title: "Dry Run",
-      description: dedent14`
+      description: dedent16`
         Execute a single dry run against a version. Tests how rules evaluate given input facts without side effects.
         
         Returns:
@@ -3629,7 +3856,7 @@ function registerAnalyticsTools(server, callApi) {
     "lexq_dry_run_compare",
     {
       title: "Dry Run Compare",
-      description: dedent14`
+      description: dedent16`
         Compare dry run results between two versions using the same input facts. Useful for validating changes.
         
         Returns:
@@ -3665,22 +3892,33 @@ function registerAnalyticsTools(server, callApi) {
     "lexq_simulation_start",
     {
       title: "Start Simulation",
-      description: dedent14`
-        Start an Impact Simulation against historical or uploaded data.
+      description: dedent16`
+        Start an Impact Simulation against historical, uploaded, or inline data.
+
+        dataset.type and dataset.source are BOTH required, and must be paired:
+          HISTORICAL → source EXECUTION_LOGS, with dataset.from / dataset.to (yyyy-MM-dd)
+          UPLOADED   → source S3_BUCKET,      with dataset.path (the path returned by lexq_dataset_upload)
+          MANUAL     → source REQUEST_BODY,   with dataset.manualData (array of fact records)
 
-        dataset.type: "HISTORICAL" or "UPLOADED"
-        dataset.source (when HISTORICAL): "EXECUTION_LOGS"
-        dataset.from / dataset.to: date range (yyyy-MM-dd, when HISTORICAL)
         options.maxRecords: number (max 100000, default 10000)
-        options.baselinePolicyVersionId: uuid (optional, for comparison)
+        options.baselinePolicyVersionId: uuid (optional, for baseline comparison)
         options.includeRuleStats: boolean
+        options.metricConfig: optional — omit for plain execution count. To aggregate a fact, pass
+          { "targetVariable": "<fact>", "aggregationType": "COUNT" | "SUM" | "AVG" }
 
-        Example body:
+        Example (uploaded dataset):
         {
           "policyVersionId": "<uuid>",
-          "dataset": { "type": "HISTORICAL", "source": "EXECUTION_LOGS", "from": "2025-01-01", "to": "2025-01-31" },
+          "dataset": { "type": "UPLOADED", "source": "S3_BUCKET", "path": "<path from lexq_dataset_upload>" },
           "options": { "baselinePolicyVersionId": "<uuid>", "includeRuleStats": true, "maxRecords": 10000 }
         }
+
+        Example (historical):
+        {
+          "policyVersionId": "<uuid>",
+          "dataset": { "type": "HISTORICAL", "source": "EXECUTION_LOGS", "from": "2026-01-01", "to": "2026-01-31" },
+          "options": { "baselinePolicyVersionId": "<uuid>", "includeRuleStats": true }
+        }
       `,
       inputSchema: {
         body: z6.string().describe("JSON string of SimulationRequest")
@@ -3752,10 +3990,12 @@ function registerAnalyticsTools(server, callApi) {
     "lexq_dataset_upload",
     {
       title: "Upload Dataset",
-      description: dedent14`
+      description: dedent16`
         Upload inline CSV or JSON content as a simulation dataset.
-        The content is uploaded to S3 and a path is returned.
-        Use this path in simulation start with dataset type UPLOADED.
+        The content is uploaded to S3 and a path is returned in the "path" field.
+
+        To use the returned path in lexq_simulation_start, set:
+          dataset: { "type": "UPLOADED", "source": "S3_BUCKET", "path": "<returned path>" }
 
         CSV example:
         user_id,payment_amount
@@ -3769,9 +4009,25 @@ function registerAnalyticsTools(server, callApi) {
         filename: z6.string().default("dataset.csv").describe("Filename with extension (.csv or .json)")
       }
     },
-    async ({ content, filename }) => callApi("POST", "analytics/datasets/upload", {
-      upload: { content, filename, fieldName: "file" }
-    })
+    async ({ content, filename }) => {
+      const result = await callApi("POST", "analytics/datasets/upload", {
+        upload: { content, filename, fieldName: "file" }
+      });
+      if (!result.isError) {
+        try {
+          const uploaded = JSON.parse(result.content[0]?.text ?? "{}");
+          if (uploaded.path) {
+            const dataset = { type: "UPLOADED", source: "S3_BUCKET", path: uploaded.path };
+            result.content.push({
+              type: "text",
+              text: "Ready-to-use dataset block for lexq_simulation_start:\n" + JSON.stringify({ dataset }, null, 2)
+            });
+          }
+        } catch {
+        }
+      }
+      return result;
+    }
   );
   server.registerTool(
     "lexq_dataset_template",
@@ -3790,8 +4046,73 @@ function registerAnalyticsTools(server, callApi) {
   );
 }
 
-// src/mcp/tools/history.ts
+// src/mcp/tools/replay.ts
 import { z as z7 } from "zod";
+function registerReplayTools(server, callApi) {
+  server.registerTool(
+    "lexq_replay_decision",
+    {
+      title: "Replay a Decision",
+      description: "Re-evaluate a past execution (traceId) against a candidate version and return the decision diff (decisionChanged, effect changes, fired rules) plus a determinism verdict. Synchronous and free of charge (TPS throttle only). External effects (webhooks, notifications) are always mocked \u2014 nothing fires.",
+      inputSchema: {
+        traceId: z7.string().describe("Trace ID of the past execution to replay"),
+        candidateVersionId: z7.string().uuid().describe("Version to re-evaluate against")
+      }
+    },
+    async ({ traceId, candidateVersionId }) => callApi("POST", "replay/decisions", { body: { traceId, candidateVersionId } })
+  );
+  server.registerTool(
+    "lexq_replay_start",
+    {
+      title: "Start Window Replay (Blast Radius)",
+      description: "Submit an async job that replays a date window of past executions against a candidate version and measures the blast radius (how many decisions change). Billed per replayed record (REPLAY metric); VIEWER role cannot submit. Poll with lexq_replay_status.",
+      inputSchema: {
+        candidateVersionId: z7.string().uuid().describe("Version to re-evaluate against"),
+        from: z7.string().describe("Window start date (yyyy-MM-dd)"),
+        to: z7.string().describe("Window end date (yyyy-MM-dd)"),
+        maxRecords: z7.number().int().min(1).optional().describe("Sample cap (server default applies; hard cap 50k)")
+      }
+    },
+    async ({ candidateVersionId, from, to, maxRecords }) => callApi("POST", "replay/jobs", { body: { candidateVersionId, from, to, maxRecords } })
+  );
+  server.registerTool(
+    "lexq_replay_status",
+    {
+      title: "Get Replay Job Status",
+      description: "Poll a window replay job. RUNNING shows progress 0\u2013100; COMPLETED fills summary and changedSamples; FAILED carries errorMessage. capped=true means the window exceeded the sample cap and only part was replayed.",
+      inputSchema: {
+        jobId: z7.string().describe("Replay job ID from lexq_replay_start")
+      }
+    },
+    async ({ jobId }) => callApi("GET", `replay/jobs/${jobId}`)
+  );
+  server.registerTool(
+    "lexq_replay_list",
+    {
+      title: "List Replay Jobs",
+      description: "List window replay job history (reverse-chronological). Lightweight items \u2014 use lexq_replay_status for summary and changed samples.",
+      inputSchema: {
+        page: z7.number().int().min(0).default(0).describe("Page number"),
+        size: z7.number().int().min(1).max(100).default(20).describe("Page size")
+      }
+    },
+    async ({ page, size }) => callApi("GET", "replay/jobs", { params: paginationParams(page, size) })
+  );
+  server.registerTool(
+    "lexq_replay_cancel",
+    {
+      title: "Cancel Replay Job",
+      description: "Cooperatively cancel a PENDING or RUNNING window replay job. Other states are rejected. VIEWER role cannot cancel.",
+      inputSchema: {
+        jobId: z7.string().describe("Replay job ID")
+      }
+    },
+    async ({ jobId }) => callApi("POST", `replay/jobs/${jobId}/cancel`)
+  );
+}
+
+// src/mcp/tools/history.ts
+import { z as z8 } from "zod";
 function registerHistoryTools(server, callApi) {
   server.registerTool(
     "lexq_history_list",
@@ -3799,14 +4120,14 @@ function registerHistoryTools(server, callApi) {
       title: "List Execution History",
       description: "List policy execution history. Shows trace ID, group, version, status, match result, and latency.",
       inputSchema: {
-        page: z7.number().int().min(0).default(0).describe("Page number"),
-        size: z7.number().int().min(1).max(100).default(20).describe("Page size"),
-        traceId: z7.string().optional().describe("Filter by trace ID"),
-        groupId: z7.string().uuid().optional().describe("Filter by policy group"),
-        versionId: z7.string().uuid().optional().describe("Filter by version"),
-        status: z7.enum(["SUCCESS", "NO_MATCH", "ERROR", "TIMEOUT"]).optional().describe("Filter by execution status"),
-        startDate: z7.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z7.string().optional().describe("End date (yyyy-MM-dd)")
+        page: z8.number().int().min(0).default(0).describe("Page number"),
+        size: z8.number().int().min(1).max(100).default(20).describe("Page size"),
+        traceId: z8.string().optional().describe("Filter by trace ID"),
+        groupId: z8.string().uuid().optional().describe("Filter by policy group"),
+        versionId: z8.string().uuid().optional().describe("Filter by version"),
+        status: z8.enum(["SUCCESS", "NO_MATCH", "ERROR", "TIMEOUT"]).optional().describe("Filter by execution status"),
+        startDate: z8.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z8.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ page, size, traceId, groupId, versionId, status, startDate, endDate }) => {
@@ -3826,7 +4147,7 @@ function registerHistoryTools(server, callApi) {
       title: "Get Execution Detail",
       description: "Get full execution detail including inputFacts, mutatedFacts, generatedVariables, executionTraces, and decisionTraces.",
       inputSchema: {
-        traceId: z7.string().describe("Trace ID from execution history")
+        traceId: z8.string().describe("Trace ID from execution history")
       }
     },
     async ({ traceId }) => callApi("GET", `execution/history/${traceId}`)
@@ -3837,9 +4158,9 @@ function registerHistoryTools(server, callApi) {
       title: "Execution Statistics",
       description: "Get execution KPIs: total executions, success/failure counts, success rate, and average latency.",
       inputSchema: {
-        groupId: z7.string().uuid().optional().describe("Filter by policy group"),
-        startDate: z7.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z7.string().optional().describe("End date (yyyy-MM-dd)")
+        groupId: z8.string().uuid().optional().describe("Filter by policy group"),
+        startDate: z8.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z8.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ groupId, startDate, endDate }) => {
@@ -3852,8 +4173,49 @@ function registerHistoryTools(server, callApi) {
   );
 }
 
+// src/mcp/tools/provenance.ts
+import { z as z9 } from "zod";
+function registerProvenanceTools(server, callApi) {
+  server.registerTool(
+    "lexq_provenance_get",
+    {
+      title: "Get Decision Provenance",
+      description: "Get the lineage of a single decision: what was decided, deterministic why per rule, input facts (PII facts are masked as \u2022\u2022\u2022\u2022\u2022\u2022 with maskedKeys listing them \u2014 values are revealable only in the console, audited), the authored/published/deployed responsibility chain, and the rule snapshot fingerprint.",
+      inputSchema: {
+        traceId: z9.string().describe("Trace ID of the execution")
+      }
+    },
+    async ({ traceId }) => callApi("GET", `provenance/${traceId}`)
+  );
+  server.registerTool(
+    "lexq_pii_reveals_list",
+    {
+      title: "List PII Reveal Audits",
+      description: "List the PII reveal audit ledger \u2014 who revealed which fact of which trace, and when. Metadata only; revealed values are never stored or returned. Use for monthly access-log inspection and SIEM collection.",
+      inputSchema: {
+        page: z9.number().int().min(0).default(0).describe("Page number"),
+        size: z9.number().int().min(1).max(100).default(20).describe("Page size"),
+        traceId: z9.string().optional().describe("Filter by trace ID (exact match)"),
+        revealedBy: z9.string().optional().describe("Filter by operator ID (exact match)"),
+        factKey: z9.string().optional().describe("Filter by fact key (partial match, case-insensitive)"),
+        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
+      }
+    },
+    async ({ page, size, traceId, revealedBy, factKey, startDate, endDate }) => {
+      const params = paginationParams(page, size);
+      if (traceId) params.traceId = traceId;
+      if (revealedBy) params.revealedBy = revealedBy;
+      if (factKey) params.factKey = factKey;
+      if (startDate) params.startDate = startDate;
+      if (endDate) params.endDate = endDate;
+      return callApi("GET", "provenance/reveal-audits", { params });
+    }
+  );
+}
+
 // src/mcp/tools/integrations.ts
-import { z as z8 } from "zod";
+import { z as z10 } from "zod";
 function registerIntegrationTools(server, callApi) {
   server.registerTool(
     "lexq_integrations_list",
@@ -3861,9 +4223,9 @@ function registerIntegrationTools(server, callApi) {
       title: "List Integrations",
       description: "List all external integrations (webhooks, CRM, notification, etc.).",
       inputSchema: {
-        page: z8.number().int().min(0).default(0).describe("Page number"),
-        size: z8.number().int().min(1).max(100).default(20).describe("Page size"),
-        type: z8.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).optional().describe("Filter by integration type")
+        page: z10.number().int().min(0).default(0).describe("Page number"),
+        size: z10.number().int().min(1).max(100).default(20).describe("Page size"),
+        type: z10.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).optional().describe("Filter by integration type")
       }
     },
     async ({ page, size, type }) => {
@@ -3878,7 +4240,7 @@ function registerIntegrationTools(server, callApi) {
       title: "Get Integration",
       description: "Get integration detail by ID.",
       inputSchema: {
-        integrationId: z8.string().uuid().describe("Integration ID")
+        integrationId: z10.string().uuid().describe("Integration ID")
       }
     },
     async ({ integrationId }) => callApi("GET", `integrations/${integrationId}`)
@@ -3889,13 +4251,13 @@ function registerIntegrationTools(server, callApi) {
       title: "Save Integration",
       description: "Create or update an integration. Provide id to update an existing one; omit id to create new. Types: COUPON, POINT, NOTIFICATION, CRM, MESSENGER, WEBHOOK.",
       inputSchema: {
-        id: z8.string().uuid().optional().describe("Integration ID (omit to create, provide to update)"),
-        type: z8.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).describe("Integration type"),
-        name: z8.string().describe("Integration name"),
-        baseUrl: z8.string().describe("Base URL of the external service"),
-        credential: z8.string().optional().describe("API key or token for the service"),
-        additionalConfig: z8.string().optional().describe("JSON string of additional config key-value pairs"),
-        isActive: z8.boolean().default(true).describe("Whether the integration is active")
+        id: z10.string().uuid().optional().describe("Integration ID (omit to create, provide to update)"),
+        type: z10.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).describe("Integration type"),
+        name: z10.string().describe("Integration name"),
+        baseUrl: z10.string().describe("Base URL of the external service"),
+        credential: z10.string().optional().describe("API key or token for the service"),
+        additionalConfig: z10.string().optional().describe("JSON string of additional config key-value pairs"),
+        isActive: z10.boolean().default(true).describe("Whether the integration is active")
       }
     },
     async ({ additionalConfig, ...rest }) => {
@@ -3910,7 +4272,7 @@ function registerIntegrationTools(server, callApi) {
       title: "Delete Integration",
       description: "Delete an integration by ID.",
       inputSchema: {
-        integrationId: z8.string().uuid().describe("Integration ID")
+        integrationId: z10.string().uuid().describe("Integration ID")
       }
     },
     async ({ integrationId }) => callApi("DELETE", `integrations/${integrationId}`)
@@ -3927,7 +4289,7 @@ function registerIntegrationTools(server, callApi) {
 }
 
 // src/mcp/tools/logs.ts
-import { z as z9 } from "zod";
+import { z as z11 } from "zod";
 function registerLogTools(server, callApi) {
   server.registerTool(
     "lexq_logs_list",
@@ -3935,14 +4297,14 @@ function registerLogTools(server, callApi) {
       title: "List Failure Logs",
       description: "List system failure logs from background tasks (webhook calls, coupon issuance, etc.).",
       inputSchema: {
-        page: z9.number().int().min(0).default(0).describe("Page number"),
-        size: z9.number().int().min(1).max(100).default(20).describe("Page size"),
-        category: z9.enum(TaskCategory).optional().describe("Task category"),
-        taskType: z9.enum(TaskType).optional().describe("Task type"),
-        status: z9.enum(FailureStatus).optional().describe("Log status"),
-        keyword: z9.string().optional().describe("Search in refId, refSubId, errorMessage"),
-        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
+        page: z11.number().int().min(0).default(0).describe("Page number"),
+        size: z11.number().int().min(1).max(100).default(20).describe("Page size"),
+        category: z11.enum(TaskCategory).optional().describe("Task category"),
+        taskType: z11.enum(TaskType).optional().describe("Task type"),
+        status: z11.enum(FailureStatus).optional().describe("Log status"),
+        keyword: z11.string().optional().describe("Search in refId, refSubId, errorMessage"),
+        startDate: z11.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z11.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ page, size, category, taskType, status, keyword, startDate, endDate }) => {
@@ -3962,7 +4324,7 @@ function registerLogTools(server, callApi) {
       title: "Get Failure Log",
       description: "Get failure log detail by ID.",
       inputSchema: {
-        logId: z9.string().uuid().describe("Failure log ID")
+        logId: z11.string().uuid().describe("Failure log ID")
       }
     },
     async ({ logId }) => callApi("GET", `failure-logs/${logId}`)
@@ -3973,8 +4335,8 @@ function registerLogTools(server, callApi) {
       title: "Process Failure Log",
       description: "Process a single failure log: RETRY (re-execute with original payload), RESOLVE (mark as manually fixed), or IGNORE (skip intentionally).",
       inputSchema: {
-        logId: z9.string().uuid().describe("Failure log ID"),
-        action: z9.enum(FailureAction).describe("Action to take")
+        logId: z11.string().uuid().describe("Failure log ID"),
+        action: z11.enum(FailureAction).describe("Action to take")
       }
     },
     async ({ logId, action }) => callApi("POST", `failure-logs/${logId}/actions`, {
@@ -3987,8 +4349,8 @@ function registerLogTools(server, callApi) {
       title: "Bulk Process Failure Logs",
       description: "Process multiple failure logs at once. Provide an array of log IDs and the action.",
       inputSchema: {
-        logIds: z9.array(z9.string().uuid()).describe("Array of failure log IDs"),
-        action: z9.enum(FailureAction).describe("Action to apply to all logs")
+        logIds: z11.array(z11.string().uuid()).describe("Array of failure log IDs"),
+        action: z11.enum(FailureAction).describe("Action to apply to all logs")
       }
     },
     async ({ logIds, action }) => callApi("POST", "failure-logs/bulk-actions", {
@@ -3998,7 +4360,7 @@ function registerLogTools(server, callApi) {
 }
 
 // src/mcp/tools/webhook-subscriptions.ts
-import { z as z10 } from "zod";
+import { z as z12 } from "zod";
 function registerWebhookSubscriptionTools(server, callApi) {
   server.registerTool(
     "lexq_webhook_subscriptions_list",
@@ -4006,8 +4368,8 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "List Webhook Subscriptions",
       description: "List platform event webhook subscriptions. These receive deployment lifecycle notifications (publish, deploy, rollback, undeploy).",
       inputSchema: {
-        page: z10.number().int().min(0).default(0).describe("Page number"),
-        size: z10.number().int().min(1).max(100).default(20).describe("Page size")
+        page: z12.number().int().min(0).default(0).describe("Page number"),
+        size: z12.number().int().min(1).max(100).default(20).describe("Page size")
       }
     },
     async ({ page, size }) => {
@@ -4021,7 +4383,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Get Webhook Subscription",
       description: "Get webhook subscription detail by ID.",
       inputSchema: {
-        id: z10.string().uuid().describe("Webhook subscription ID")
+        id: z12.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("GET", `webhook-subscriptions/${id}`)
@@ -4032,13 +4394,13 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Save Webhook Subscription",
       description: 'Create or update a webhook subscription. Omit id to create, provide id to update. Events: VERSION_PUBLISHED, DEPLOYED, ROLLED_BACK, UNDEPLOYED. Formats: GENERIC (full JSON), SLACK ({"text": "..."}).',
       inputSchema: {
-        id: z10.string().uuid().optional().describe("Subscription ID (omit to create, provide to update)"),
-        name: z10.string().min(1).describe("Subscription name (unique per tenant)"),
-        webhookUrl: z10.string().url().describe("Webhook endpoint URL"),
-        subscribedEvents: z10.array(z10.enum(PlatformEventType)).min(1).describe("Events to subscribe to"),
-        payloadFormat: z10.enum(WebhookPayloadFormat).optional().default("GENERIC").describe("Payload format"),
-        secret: z10.string().optional().describe("HMAC-SHA256 signing secret"),
-        isActive: z10.boolean().optional().default(true).describe("Whether the subscription is active")
+        id: z12.string().uuid().optional().describe("Subscription ID (omit to create, provide to update)"),
+        name: z12.string().min(1).describe("Subscription name (unique per tenant)"),
+        webhookUrl: z12.string().url().describe("Webhook endpoint URL"),
+        subscribedEvents: z12.array(z12.enum(PlatformEventType)).min(1).describe("Events to subscribe to"),
+        payloadFormat: z12.enum(WebhookPayloadFormat).optional().default("GENERIC").describe("Payload format"),
+        secret: z12.string().optional().describe("HMAC-SHA256 signing secret"),
+        isActive: z12.boolean().optional().default(true).describe("Whether the subscription is active")
       }
     },
     async ({ ...body }) => callApi("POST", "webhook-subscriptions", { body })
@@ -4049,7 +4411,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Delete Webhook Subscription",
       description: "Delete a webhook subscription by ID.",
       inputSchema: {
-        id: z10.string().uuid().describe("Webhook subscription ID")
+        id: z12.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("DELETE", `webhook-subscriptions/${id}`)
@@ -4060,7 +4422,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Test Webhook Subscription",
       description: "Send a test event to verify webhook connectivity. Returns the HTTP status code and success/failure message.",
       inputSchema: {
-        id: z10.string().uuid().describe("Webhook subscription ID")
+        id: z12.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("POST", `webhook-subscriptions/${id}/test`)
@@ -4068,7 +4430,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
 }
 
 // src/mcp/tools/domain-templates.ts
-import { z as z11 } from "zod";
+import { z as z13 } from "zod";
 function registerDomainTemplateTools(server, callApi) {
   server.registerTool(
     "lexq_domain_templates_list",
@@ -4085,7 +4447,7 @@ function registerDomainTemplateTools(server, callApi) {
       title: "Preview Domain Template",
       description: "Preview exactly what a domain template will provision before applying it: the fact definitions it registers, the sample rules it creates, and an apply plan. This is a read-only dry run \u2014 nothing is created. Only ACTIVE templates can be previewed.",
       inputSchema: {
-        template: z11.string().describe(
+        template: z13.string().describe(
           "Domain template key (e.g. ECOMMERCE). Use lexq_domain_templates_list to see available keys \u2014 currently only ECOMMERCE is ACTIVE."
         )
       }
@@ -4098,8 +4460,8 @@ function registerDomainTemplateTools(server, callApi) {
       title: "Apply Domain Template",
       description: "Apply a domain template to the current tenant. Creates the template's fact definitions and a new policy group pre-populated with its sample rules as a DRAFT version. Existing facts are skipped \u2014 apply is additive and never overwrites existing schema. Run lexq_domain_templates_preview first to review what will be created. Only ACTIVE templates can be applied.",
       inputSchema: {
-        template: z11.string().describe("Domain template key to apply (e.g. ECOMMERCE)."),
-        customName: z11.string().optional().describe(
+        template: z13.string().describe("Domain template key to apply (e.g. ECOMMERCE)."),
+        customName: z13.string().optional().describe(
           "Optional custom name for the policy group that gets created. If omitted, the template's default name is used."
         )
       }
@@ -4121,7 +4483,9 @@ function registerAllTools(server, callApi) {
   registerFactTools(server, callApi);
   registerDeployTools(server, callApi);
   registerAnalyticsTools(server, callApi);
+  registerReplayTools(server, callApi);
   registerHistoryTools(server, callApi);
+  registerProvenanceTools(server, callApi);
   registerIntegrationTools(server, callApi);
   registerLogTools(server, callApi);
   registerDomainTemplateTools(server, callApi);
@@ -4153,12 +4517,12 @@ async function startMcpServer() {
 function registerServeCommand(program) {
   program.command("serve").description("Start LexQ as a server for AI agent integrations").option("--mcp", "Start as MCP (Model Context Protocol) server over stdio").addHelpText(
     "after",
-    dedent15`
+    dedent17`
 
         Example:
           $ lexq serve --mcp
 
-          Starts a stdio MCP server that exposes 60 tools for policy management.
+          Starts a stdio MCP server that exposes the full LexQ toolset for policy management.
           Used by Claude Desktop, Claude.ai, Cursor, and other MCP-compatible clients.
 
         Claude Desktop config (~/.claude/claude_desktop_config.json):
@@ -4184,11 +4548,11 @@ function registerServeCommand(program) {
 
 // src/commands/domain-templates.ts
 import "commander";
-import dedent16 from "dedent";
+import dedent18 from "dedent";
 function registerDomainTemplateCommands(program) {
   const templates = program.command("domain-templates").description("Browse and apply domain templates").addHelpText(
     "after",
-    dedent16`
+    dedent18`
 
         A domain template is an industry-specific starter pack of fact
         definitions and sample rules. Applying one provisions a ready-to-use
@@ -4236,7 +4600,7 @@ function registerDomainTemplateCommands(program) {
   });
   templates.command("preview").description("Preview what a domain template provisions").requiredOption("--template <key>", "Domain template key (e.g. ECOMMERCE)").addHelpText(
     "after",
-    dedent16`
+    dedent18`
 
         Read-only dry run — shows the fact definitions and sample rules the
         template will create. Nothing is provisioned.
@@ -4265,7 +4629,7 @@ function registerDomainTemplateCommands(program) {
   });
   templates.command("apply").description("Apply a domain template to the current tenant").requiredOption("--template <key>", "Domain template key (e.g. ECOMMERCE)").option("--name <n>", "Custom name for the policy group that gets created").option("--force", "Skip confirmation prompt").addHelpText(
     "after",
-    dedent16`
+    dedent18`
 
         Creates the template's fact definitions and a new DRAFT policy group
         populated with its sample rules. Existing facts are skipped — apply is
@@ -4327,7 +4691,10 @@ function createCli() {
   const program = new Command();
   program.name("lexq").description(
     "Command-line interface for the LexQ Decision Operations Platform. Manage policies, run Impact Simulation, and deploy from your terminal."
-  ).version(getVersion2(), "-V, --version").option("--format <format>", "Output format: json or table", "json").option("--api-key <key>", "Override stored API key").option("--base-url <url>", "Override API base URL").option("--dry-run", "Preview the HTTP request without executing").option("--verbose", "Show request/response details").option("--no-color", "Disable colored output");
+  ).version(getVersion2(), "-V, --version").option("--format <format>", "Output format: json or table", "json").option("--api-key <key>", "Override stored API key").option(
+    "--base-url <url>",
+    "Override API base URL \u2014 must include the API prefix, e.g. http://localhost:8080/api/v1/partners"
+  ).option("--dry-run", "Preview the HTTP request without executing").option("--verbose", "Show request/response details").option("--no-color", "Disable colored output");
   registerAuthCommands(program);
   registerStatusCommand(program);
   registerGroupCommands(program);
@@ -4338,6 +4705,8 @@ function createCli() {
   registerDeployCommands(program);
   registerAnalyticsCommands(program);
   registerHistoryCommands(program);
+  registerReplayCommands(program);
+  registerProvenanceCommands(program);
   registerIntegrationCommands(program);
   registerLogCommands(program);
   registerWebhookSubscriptionCommands(program);