npm - @lexq/cli - Versions diffs - 0.1.34 → 0.1.36 - Mend

@lexq/cli 0.1.34 → 0.1.36

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/index.js CHANGED Viewed

@@ -1144,14 +1144,15 @@ function registerFactCommands(program) {
       });
       if (format === "table") {
         printTable(
-          ["ID", "Key", "Name", "Type", "System", "Required"],
+          ["ID", "Key", "Name", "Type", "System", "Required", "PII"],
           data.content.map((f) => [
             f.id,
             f.key,
             f.name,
             f.type,
             f.isSystem ? "\u2713" : "\u2013",
-            f.isRequired ? "\u2713" : "\u2013"
+            f.isRequired ? "\u2713" : "\u2013",
+            f.isPii ? "\u2713" : "\u2013"
           ]),
           { truncate: 28 }
         );
@@ -1211,7 +1212,7 @@ ${data.length} unregistered`);
       process.exit(1);
     }
   });
-  facts.command("create").description("Create a new fact definition").option("--key <key>", "Fact key (lowercase, underscores)").option("--name <n>", "Display name").option("--type <type>", "Value type: STRING, NUMBER, BOOLEAN, LIST_STRING, LIST_NUMBER").option("--description <desc>", "Description").option("--required", "Mark as required", false).option("--json <body>", "Full request body as JSON (overrides other options)").addHelpText(
+  facts.command("create").description("Create a new fact definition").option("--key <key>", "Fact key (lowercase, underscores)").option("--name <n>", "Display name").option("--type <type>", "Value type: STRING, NUMBER, BOOLEAN, LIST_STRING, LIST_NUMBER").option("--description <desc>", "Description").option("--required", "Mark as required", false).option("--pii", "Mark as PII \u2014 value is masked on every read surface", false).option("--json <body>", "Full request body as JSON (overrides other options)").addHelpText(
     "after",
     dedent6`
@@ -1247,7 +1248,7 @@ ${data.length} unregistered`);
       process.exit(1);
     }
   });
-  facts.command("update").description("Update a fact definition").requiredOption("--id <factId>", "Fact definition ID").option("--name <n>", "Display name").option("--description <desc>", "Description").option("--required", "Mark as required").option("--no-required", "Mark as not required").option("--json <body>", "Full request body as JSON (overrides other options)").addHelpText(
+  facts.command("update").description("Update a fact definition").requiredOption("--id <factId>", "Fact definition ID").option("--name <n>", "Display name").option("--description <desc>", "Description").option("--required", "Mark as required").option("--no-required", "Mark as not required").option("--pii", "Mark as PII (enables masking)").option("--no-pii", "Unmark as PII (disables masking \u2014 value becomes visible)").option("--json <body>", "Full request body as JSON (overrides other options)").addHelpText(
     "after",
     dedent6`
@@ -1334,7 +1335,8 @@ function buildCreateBody2(opts) {
     key: opts.key,
     name: opts.name,
     type: opts.type,
-    isRequired: opts.required === true
+    isRequired: opts.required === true,
+    isPii: opts.pii === true
   };
   if (opts.description) body.description = opts.description;
   return body;
@@ -1344,6 +1346,7 @@ function buildUpdateBody2(opts) {
   if (opts.name) body.name = opts.name;
   if (opts.description !== void 0) body.description = opts.description;
   if (typeof opts.required === "boolean") body.isRequired = opts.required;
+  if (typeof opts.isPii === "boolean") body.isPii = opts.isPii;
   return body;
 }
@@ -2327,13 +2330,240 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
 }
-// src/commands/integrations.ts
+// src/commands/replay.ts
 import "commander";
 import dedent10 from "dedent";
+function registerReplayCommands(program) {
+  const replay = program.command("replay").description("Decision Replay").addHelpText(
+    "after",
+    dedent10`
+        Re-evaluate past production executions against a candidate version.
+        Commands:
+          decision  Replay one execution and show the decision diff (sync, free)
+          start     Submit a window replay job — blast radius (async, billed)
+          list      List replay job history
+          get       Poll a job's status, summary, and changed samples
+          cancel    Cancel a PENDING/RUNNING job
+        External effects (webhooks, notifications) are always mocked during replay.
+      `
+  );
+  replay.command("decision").description("Replay a single execution against a candidate version").requiredOption("--trace-id <traceId>", "Trace ID of the past execution").requiredOption("--version-id <versionId>", "Candidate version to re-evaluate against").addHelpText(
+    "after",
+    dedent10`
+        Free of charge (TPS throttle only). Returns decisionChanged, effect
+        changes, fired rules on both sides, and a determinism verdict.
+        Example:
+          $ lexq replay decision --trace-id <tid> --version-id <vid>
+      `
+  ).action(async (opts) => {
+    try {
+      const globalOpts = program.opts();
+      const data = await apiRequest("POST", "replay/decisions", {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose,
+        body: { traceId: opts.traceId, candidateVersionId: opts.versionId }
+      });
+      printJson(data);
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+  replay.command("start").description("Submit a window replay job (blast radius)").requiredOption("--version-id <versionId>", "Candidate version to re-evaluate against").requiredOption("--from <date>", "Window start date (yyyy-MM-dd)").requiredOption("--to <date>", "Window end date (yyyy-MM-dd)").option("--max-records <number>", "Sample cap (hard cap 50k)").addHelpText(
+    "after",
+    dedent10`
+        Billed per replayed record (REPLAY metric). Poll with "lexq replay get".
+        Example:
+          $ lexq replay start --version-id <vid> --from 2026-06-01 --to 2026-06-30
+      `
+  ).action(async (opts) => {
+    try {
+      const globalOpts = program.opts();
+      const body = {
+        candidateVersionId: opts.versionId,
+        from: opts.from,
+        to: opts.to
+      };
+      if (opts.maxRecords) body.maxRecords = Number(opts.maxRecords);
+      const data = await apiRequest("POST", "replay/jobs", {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose,
+        body
+      });
+      printJson(data);
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+  replay.command("list").description("List replay jobs").option("--page <number>", "Page number", "0").option("--size <number>", "Page size", "20").action(async (opts) => {
+    try {
+      const globalOpts = program.opts();
+      const format = globalOpts.format ?? "json";
+      const data = await apiRequest("GET", "replay/jobs", {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose,
+        params: { page: opts.page, size: opts.size }
+      });
+      if (format === "table") {
+        printTable(
+          ["Job", "Version", "Window", "Status", "Progress", "Changed", "At"],
+          data.content.map((j) => [
+            j.jobId.substring(0, 12),
+            j.candidateVersionName ?? "\u2013",
+            `${j.fromDate}~${j.toDate}`,
+            j.status,
+            `${j.progress}%`,
+            `${j.changedCount}${j.capped ? " (capped)" : ""}`,
+            j.createdAt.substring(0, 16)
+          ]),
+          { truncate: 24 }
+        );
+        console.log(`
+${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
+      } else {
+        printJson(data);
+      }
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+  replay.command("get").description("Get replay job status and results").requiredOption("--id <jobId>", "Replay job ID").action(async (opts) => {
+    try {
+      const globalOpts = program.opts();
+      const data = await apiRequest("GET", `replay/jobs/${opts.id}`, {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose
+      });
+      printJson(data);
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+  replay.command("cancel").description("Cancel a PENDING/RUNNING replay job").requiredOption("--id <jobId>", "Replay job ID").action(async (opts) => {
+    try {
+      const globalOpts = program.opts();
+      const data = await apiRequest("POST", `replay/jobs/${opts.id}/cancel`, {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose
+      });
+      printJson(data);
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+}
+// src/commands/provenance.ts
+import "commander";
+import dedent11 from "dedent";
+function registerProvenanceCommands(program) {
+  const provenance = program.command("provenance").description("Decision Provenance").addHelpText(
+    "after",
+    dedent11`
+        Trace who authored, published, and deployed the rules behind a decision.
+        Commands:
+          get            Get the lineage of one decision (PII facts masked)
+          reveal-audits  List the PII reveal audit ledger (metadata only)
+      `
+  );
+  provenance.command("get").description("Get decision lineage").requiredOption("--trace-id <traceId>", "Trace ID of the execution").action(async (opts) => {
+    try {
+      const globalOpts = program.opts();
+      const data = await apiRequest("GET", `provenance/${opts.traceId}`, {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose
+      });
+      printJson(data);
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+  provenance.command("reveal-audits").description("List PII reveal audits (who revealed what, when)").option("--trace-id <traceId>", "Filter by trace ID (exact)").option("--fact-key <factKey>", "Filter by fact key (partial, case-insensitive)").option("--revealed-by <operatorId>", "Filter by operator ID (exact)").option("--start-date <date>", "Start date (yyyy-MM-dd)").option("--end-date <date>", "End date (yyyy-MM-dd)").option("--page <number>", "Page number", "0").option("--size <number>", "Page size", "20").addHelpText(
+    "after",
+    dedent11`
+        Metadata only — revealed values are never stored or returned.
+        Example:
+          $ lexq provenance reveal-audits --start-date 2026-07-01 --format table
+      `
+  ).action(async (opts) => {
+    try {
+      const globalOpts = program.opts();
+      const format = globalOpts.format ?? "json";
+      const params = { page: opts.page, size: opts.size };
+      if (opts.traceId) params.traceId = opts.traceId;
+      if (opts.factKey) params.factKey = opts.factKey;
+      if (opts.revealedBy) params.revealedBy = opts.revealedBy;
+      if (opts.startDate) params.startDate = opts.startDate;
+      if (opts.endDate) params.endDate = opts.endDate;
+      const data = await apiRequest(
+        "GET",
+        "provenance/reveal-audits",
+        {
+          apiKey: globalOpts.apiKey,
+          baseUrl: globalOpts.baseUrl,
+          dryRun: globalOpts.dryRun,
+          verbose: globalOpts.verbose,
+          params
+        }
+      );
+      if (format === "table") {
+        printTable(
+          ["Revealed At", "By", "Fact Key", "Trace"],
+          data.content.map((a) => [
+            a.revealedAt.substring(0, 16),
+            a.revealedByName,
+            a.factKey,
+            a.traceId.substring(0, 12)
+          ]),
+          { truncate: 24 }
+        );
+        console.log(`
+${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
+      } else {
+        printJson(data);
+      }
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+}
+// src/commands/integrations.ts
+import "commander";
+import dedent12 from "dedent";
 function registerIntegrationCommands(program) {
   const integrations = program.command("integrations").description("Manage external integrations").addHelpText(
     "after",
-    dedent10`
+    dedent12`
         Integrations connect rule actions to external services (webhooks, coupons,
         points, notifications, CRM, messengers).
@@ -2403,7 +2633,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   integrations.command("save").description("Create or update an integration").requiredOption("--json <body>", "Request body as JSON string").addHelpText(
     "after",
-    dedent10`
+    dedent12`
         Examples:
           # Create
@@ -2453,7 +2683,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   integrations.command("delete").description("Delete an integration").requiredOption("--id <integrationId>", "Integration ID").option("--force", "Skip confirmation prompt").addHelpText(
     "after",
-    dedent10`
+    dedent12`
         Rules referencing this integration will fail at execution time.
         Use --force to skip confirmation.
@@ -2485,7 +2715,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   integrations.command("config-spec").description("Get integration configuration field specs").addHelpText(
     "after",
-    dedent10`
+    dedent12`
         Shows required and optional configuration fields for each integration type.
@@ -2511,7 +2741,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 // src/commands/logs.ts
 import "commander";
-import dedent11 from "dedent";
+import dedent13 from "dedent";
 // src/types/enums.ts
 var FailureStatus = ["PENDING", "RESOLVED", "IGNORED"];
@@ -2545,7 +2775,7 @@ var WebhookPayloadFormat = ["GENERIC", "SLACK"];
 function registerLogCommands(program) {
   const logs = program.command("logs").description("Failure logs").addHelpText(
     "after",
-    dedent11`
+    dedent13`
         System failure logs (DLQ) for background tasks — webhook calls, coupon issuance,
         point operations, notifications, and platform event webhooks.
@@ -2562,7 +2792,7 @@ function registerLogCommands(program) {
   );
   logs.command("list").description("List failure logs").option("--category <category>", "Filter by category (INTEGRATION, INTERNAL)").option("--task-type <taskType>", `Filter by task type (${TaskType.join(", ")})`).option("--status <status>", "Filter by status (PENDING, RESOLVED, IGNORED)").option("--keyword <keyword>", "Search keyword").option("--start-date <date>", "Start date (yyyy-MM-dd)").option("--end-date <date>", "End date (yyyy-MM-dd)").option("--page <number>", "Page number", "0").option("--size <number>", "Page size", "20").addHelpText(
     "after",
-    dedent11`
+    dedent13`
         Examples:
           $ lexq logs list --status PENDING --format table
@@ -2613,7 +2843,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   logs.command("get").description("Get failure log detail").requiredOption("--id <logId>", "Log ID").addHelpText(
     "after",
-    dedent11`
+    dedent13`
         Includes the full payload that was used for the failed operation.
         Use this to inspect what went wrong before deciding to RETRY or RESOLVE.
@@ -2635,7 +2865,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   logs.command("action").description("Process a failure log action (RETRY, IGNORE, RESOLVE)").requiredOption("--id <logId>", "Log ID").requiredOption("--action <action>", "Action: RETRY, IGNORE, or RESOLVE").addHelpText(
     "after",
-    dedent11`
+    dedent13`
         Actions:
           RETRY    Re-execute the failed operation with the original payload
@@ -2667,7 +2897,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   logs.command("bulk-action").description("Bulk process failure logs").requiredOption("--ids <logIds>", "Comma-separated log IDs").requiredOption("--action <action>", "Action: RETRY, IGNORE, or RESOLVE").addHelpText(
     "after",
-    dedent11`
+    dedent13`
         Processes each log individually. Failures are skipped with a warning.
@@ -2695,11 +2925,11 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 // src/commands/webhook-subscriptions.ts
 import "commander";
-import dedent12 from "dedent";
+import dedent14 from "dedent";
 function registerWebhookSubscriptionCommands(program) {
   const webhooks = program.command("webhook-subscriptions").description("Manage platform event webhook subscriptions").addHelpText(
     "after",
-    dedent12`
+    dedent14`
         Receive notifications when deployment lifecycle events occur
         (publish, deploy, rollback, undeploy).
@@ -2773,7 +3003,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   webhooks.command("save").description("Create or update a webhook subscription").requiredOption("--json <body>", "Request body as JSON string").addHelpText(
     "after",
-    dedent12`
+    dedent14`
         Examples:
           # Create (Slack format)
@@ -2828,7 +3058,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   webhooks.command("delete").description("Delete a webhook subscription").requiredOption("--id <subscriptionId>", "Subscription ID").option("--force", "Skip confirmation prompt").addHelpText(
     "after",
-    dedent12`
+    dedent14`
         Use --force to skip the confirmation prompt.
@@ -2862,7 +3092,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   webhooks.command("test").description("Send a test event to verify webhook connectivity").requiredOption("--id <subscriptionId>", "Subscription ID").addHelpText(
     "after",
-    dedent12`
+    dedent14`
         Sends a test event to the webhook URL and reports the HTTP status code.
         Does not record failures in the failure log.
@@ -2898,7 +3128,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 // src/commands/serve.ts
 import "commander";
-import dedent15 from "dedent";
+import dedent17 from "dedent";
 // src/mcp/server.ts
 import { readFileSync as readFileSync3 } from "fs";
@@ -2911,7 +3141,12 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 function createCallApiFromConfig() {
   return async (method, path, opts) => {
     try {
-      const config = loadConfig();
+      const stored = loadConfig();
+      const config = {
+        ...stored,
+        baseUrl: process.env.PARTNER_BASE_URL ?? stored.baseUrl,
+        apiKey: process.env.LEXQ_API_KEY ?? stored.apiKey
+      };
       if (opts?.upload) {
         const url = new URL(
           path,
@@ -3220,7 +3455,7 @@ function registerVersionTools(server, callApi) {
 // src/mcp/tools/rules.ts
 import { z as z3 } from "zod";
-import dedent13 from "dedent";
+import dedent15 from "dedent";
 function registerRuleTools(server, callApi) {
   server.registerTool(
     "lexq_rules_list",
@@ -3251,7 +3486,7 @@ function registerRuleTools(server, callApi) {
     "lexq_rules_create",
     {
       title: "Create Rule",
-      description: dedent13`
+      description: dedent15`
         Create a rule in a DRAFT version. Requires name, condition tree, and actions array. priority is auto-assigned (appended last); use lexq_rules_reorder to change order.
         Before creating rules with new fact keys, call lexq_facts_list to check existing facts.
@@ -3384,7 +3619,7 @@ function registerFactTools(server, callApi) {
     "lexq_facts_list",
     {
       title: "List Fact Definitions",
-      description: "List all fact definitions (input variable schema). Shows key, type, and required status. Always check this before creating rules.",
+      description: "List all fact definitions (input variable schema). Shows key, type, required, and PII status. Always check this before creating rules.",
       inputSchema: {
         page: z4.number().int().min(0).default(0).describe("Page number"),
         size: z4.number().int().min(1).max(100).default(20).describe("Page size"),
@@ -3407,7 +3642,10 @@ function registerFactTools(server, callApi) {
         name: z4.string().describe("Display name"),
         type: z4.enum(["STRING", "NUMBER", "BOOLEAN", "LIST_STRING", "LIST_NUMBER"]).describe("Value type"),
         description: z4.string().optional().describe("Description"),
-        isRequired: z4.boolean().default(false).describe("Whether this fact is required for rule evaluation")
+        isRequired: z4.boolean().default(false).describe("Whether this fact is required for rule evaluation"),
+        isPii: z4.boolean().default(false).describe(
+          "Mark as PII \u2014 masked on every read surface, revealable only in the console (audited)"
+        )
       }
     },
     async (args) => callApi("POST", "schema/facts", { body: args })
@@ -3416,12 +3654,13 @@ function registerFactTools(server, callApi) {
     "lexq_facts_update",
     {
       title: "Update Fact Definition",
-      description: "Update a fact definition. Key and type cannot be changed. Only provided fields are updated. System facts only allow name and description changes.",
+      description: "Update a fact definition. Key and type cannot be changed. Only provided fields are updated. System facts only allow name, description, and PII changes.",
       inputSchema: {
         factId: z4.string().uuid().describe("Fact definition ID"),
         name: z4.string().optional().describe("Display name"),
         description: z4.string().optional().describe("Description"),
-        isRequired: z4.boolean().optional().describe("Required flag")
+        isRequired: z4.boolean().optional().describe("Required flag"),
+        isPii: z4.boolean().optional().describe("PII flag \u2014 enables/disables masking (changeable even on system facts)")
       }
     },
     async ({ factId, ...body }) => callApi("PUT", `schema/facts/${factId}`, { body })
@@ -3593,13 +3832,13 @@ function registerDeployTools(server, callApi) {
 // src/mcp/tools/analytics.ts
 import { z as z6 } from "zod";
-import dedent14 from "dedent";
+import dedent16 from "dedent";
 function registerAnalyticsTools(server, callApi) {
   server.registerTool(
     "lexq_dry_run",
     {
       title: "Dry Run",
-      description: dedent14`
+      description: dedent16`
         Execute a single dry run against a version. Tests how rules evaluate given input facts without side effects.
         Returns:
@@ -3629,7 +3868,7 @@ function registerAnalyticsTools(server, callApi) {
     "lexq_dry_run_compare",
     {
       title: "Dry Run Compare",
-      description: dedent14`
+      description: dedent16`
         Compare dry run results between two versions using the same input facts. Useful for validating changes.
         Returns:
@@ -3665,22 +3904,33 @@ function registerAnalyticsTools(server, callApi) {
     "lexq_simulation_start",
     {
       title: "Start Simulation",
-      description: dedent14`
-        Start an Impact Simulation against historical or uploaded data.
+      description: dedent16`
+        Start an Impact Simulation against historical, uploaded, or inline data.
+        dataset.type and dataset.source are BOTH required, and must be paired:
+          HISTORICAL → source EXECUTION_LOGS, with dataset.from / dataset.to (yyyy-MM-dd)
+          UPLOADED   → source S3_BUCKET,      with dataset.path (the path returned by lexq_dataset_upload)
+          MANUAL     → source REQUEST_BODY,   with dataset.manualData (array of fact records)
-        dataset.type: "HISTORICAL" or "UPLOADED"
-        dataset.source (when HISTORICAL): "EXECUTION_LOGS"
-        dataset.from / dataset.to: date range (yyyy-MM-dd, when HISTORICAL)
         options.maxRecords: number (max 100000, default 10000)
-        options.baselinePolicyVersionId: uuid (optional, for comparison)
+        options.baselinePolicyVersionId: uuid (optional, for baseline comparison)
         options.includeRuleStats: boolean
+        options.metricConfig: optional — omit for plain execution count. To aggregate a fact, pass
+          { "targetVariable": "<fact>", "aggregationType": "COUNT" | "SUM" | "AVG" }
-        Example body:
+        Example (uploaded dataset):
         {
           "policyVersionId": "<uuid>",
-          "dataset": { "type": "HISTORICAL", "source": "EXECUTION_LOGS", "from": "2025-01-01", "to": "2025-01-31" },
+          "dataset": { "type": "UPLOADED", "source": "S3_BUCKET", "path": "<path from lexq_dataset_upload>" },
           "options": { "baselinePolicyVersionId": "<uuid>", "includeRuleStats": true, "maxRecords": 10000 }
         }
+        Example (historical):
+        {
+          "policyVersionId": "<uuid>",
+          "dataset": { "type": "HISTORICAL", "source": "EXECUTION_LOGS", "from": "2026-01-01", "to": "2026-01-31" },
+          "options": { "baselinePolicyVersionId": "<uuid>", "includeRuleStats": true }
+        }
       `,
       inputSchema: {
         body: z6.string().describe("JSON string of SimulationRequest")
@@ -3752,10 +4002,12 @@ function registerAnalyticsTools(server, callApi) {
     "lexq_dataset_upload",
     {
       title: "Upload Dataset",
-      description: dedent14`
+      description: dedent16`
         Upload inline CSV or JSON content as a simulation dataset.
-        The content is uploaded to S3 and a path is returned.
-        Use this path in simulation start with dataset type UPLOADED.
+        The content is uploaded to S3 and a path is returned in the "path" field.
+        To use the returned path in lexq_simulation_start, set:
+          dataset: { "type": "UPLOADED", "source": "S3_BUCKET", "path": "<returned path>" }
         CSV example:
         user_id,payment_amount
@@ -3769,9 +4021,25 @@ function registerAnalyticsTools(server, callApi) {
         filename: z6.string().default("dataset.csv").describe("Filename with extension (.csv or .json)")
       }
     },
-    async ({ content, filename }) => callApi("POST", "analytics/datasets/upload", {
-      upload: { content, filename, fieldName: "file" }
-    })
+    async ({ content, filename }) => {
+      const result = await callApi("POST", "analytics/datasets/upload", {
+        upload: { content, filename, fieldName: "file" }
+      });
+      if (!result.isError) {
+        try {
+          const uploaded = JSON.parse(result.content[0]?.text ?? "{}");
+          if (uploaded.path) {
+            const dataset = { type: "UPLOADED", source: "S3_BUCKET", path: uploaded.path };
+            result.content.push({
+              type: "text",
+              text: "Ready-to-use dataset block for lexq_simulation_start:\n" + JSON.stringify({ dataset }, null, 2)
+            });
+          }
+        } catch {
+        }
+      }
+      return result;
+    }
   );
   server.registerTool(
     "lexq_dataset_template",
@@ -3790,8 +4058,73 @@ function registerAnalyticsTools(server, callApi) {
   );
 }
-// src/mcp/tools/history.ts
+// src/mcp/tools/replay.ts
 import { z as z7 } from "zod";
+function registerReplayTools(server, callApi) {
+  server.registerTool(
+    "lexq_replay_decision",
+    {
+      title: "Replay a Decision",
+      description: "Re-evaluate a past execution (traceId) against a candidate version and return the decision diff (decisionChanged, effect changes, fired rules) plus a determinism verdict. Synchronous and free of charge (TPS throttle only). External effects (webhooks, notifications) are always mocked \u2014 nothing fires.",
+      inputSchema: {
+        traceId: z7.string().describe("Trace ID of the past execution to replay"),
+        candidateVersionId: z7.string().uuid().describe("Version to re-evaluate against")
+      }
+    },
+    async ({ traceId, candidateVersionId }) => callApi("POST", "replay/decisions", { body: { traceId, candidateVersionId } })
+  );
+  server.registerTool(
+    "lexq_replay_start",
+    {
+      title: "Start Window Replay (Blast Radius)",
+      description: "Submit an async job that replays a date window of past executions against a candidate version and measures the blast radius (how many decisions change). Billed per replayed record (REPLAY metric); VIEWER role cannot submit. Poll with lexq_replay_status.",
+      inputSchema: {
+        candidateVersionId: z7.string().uuid().describe("Version to re-evaluate against"),
+        from: z7.string().describe("Window start date (yyyy-MM-dd)"),
+        to: z7.string().describe("Window end date (yyyy-MM-dd)"),
+        maxRecords: z7.number().int().min(1).optional().describe("Sample cap (server default applies; hard cap 50k)")
+      }
+    },
+    async ({ candidateVersionId, from, to, maxRecords }) => callApi("POST", "replay/jobs", { body: { candidateVersionId, from, to, maxRecords } })
+  );
+  server.registerTool(
+    "lexq_replay_status",
+    {
+      title: "Get Replay Job Status",
+      description: "Poll a window replay job. RUNNING shows progress 0\u2013100; COMPLETED fills summary and changedSamples; FAILED carries errorMessage. capped=true means the window exceeded the sample cap and only part was replayed.",
+      inputSchema: {
+        jobId: z7.string().describe("Replay job ID from lexq_replay_start")
+      }
+    },
+    async ({ jobId }) => callApi("GET", `replay/jobs/${jobId}`)
+  );
+  server.registerTool(
+    "lexq_replay_list",
+    {
+      title: "List Replay Jobs",
+      description: "List window replay job history (reverse-chronological). Lightweight items \u2014 use lexq_replay_status for summary and changed samples.",
+      inputSchema: {
+        page: z7.number().int().min(0).default(0).describe("Page number"),
+        size: z7.number().int().min(1).max(100).default(20).describe("Page size")
+      }
+    },
+    async ({ page, size }) => callApi("GET", "replay/jobs", { params: paginationParams(page, size) })
+  );
+  server.registerTool(
+    "lexq_replay_cancel",
+    {
+      title: "Cancel Replay Job",
+      description: "Cooperatively cancel a PENDING or RUNNING window replay job. Other states are rejected. VIEWER role cannot cancel.",
+      inputSchema: {
+        jobId: z7.string().describe("Replay job ID")
+      }
+    },
+    async ({ jobId }) => callApi("POST", `replay/jobs/${jobId}/cancel`)
+  );
+}
+// src/mcp/tools/history.ts
+import { z as z8 } from "zod";
 function registerHistoryTools(server, callApi) {
   server.registerTool(
     "lexq_history_list",
@@ -3799,14 +4132,14 @@ function registerHistoryTools(server, callApi) {
       title: "List Execution History",
       description: "List policy execution history. Shows trace ID, group, version, status, match result, and latency.",
       inputSchema: {
-        page: z7.number().int().min(0).default(0).describe("Page number"),
-        size: z7.number().int().min(1).max(100).default(20).describe("Page size"),
-        traceId: z7.string().optional().describe("Filter by trace ID"),
-        groupId: z7.string().uuid().optional().describe("Filter by policy group"),
-        versionId: z7.string().uuid().optional().describe("Filter by version"),
-        status: z7.enum(["SUCCESS", "NO_MATCH", "ERROR", "TIMEOUT"]).optional().describe("Filter by execution status"),
-        startDate: z7.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z7.string().optional().describe("End date (yyyy-MM-dd)")
+        page: z8.number().int().min(0).default(0).describe("Page number"),
+        size: z8.number().int().min(1).max(100).default(20).describe("Page size"),
+        traceId: z8.string().optional().describe("Filter by trace ID"),
+        groupId: z8.string().uuid().optional().describe("Filter by policy group"),
+        versionId: z8.string().uuid().optional().describe("Filter by version"),
+        status: z8.enum(["SUCCESS", "NO_MATCH", "ERROR", "TIMEOUT"]).optional().describe("Filter by execution status"),
+        startDate: z8.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z8.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ page, size, traceId, groupId, versionId, status, startDate, endDate }) => {
@@ -3826,7 +4159,7 @@ function registerHistoryTools(server, callApi) {
       title: "Get Execution Detail",
       description: "Get full execution detail including inputFacts, mutatedFacts, generatedVariables, executionTraces, and decisionTraces.",
       inputSchema: {
-        traceId: z7.string().describe("Trace ID from execution history")
+        traceId: z8.string().describe("Trace ID from execution history")
       }
     },
     async ({ traceId }) => callApi("GET", `execution/history/${traceId}`)
@@ -3837,9 +4170,9 @@ function registerHistoryTools(server, callApi) {
       title: "Execution Statistics",
       description: "Get execution KPIs: total executions, success/failure counts, success rate, and average latency.",
       inputSchema: {
-        groupId: z7.string().uuid().optional().describe("Filter by policy group"),
-        startDate: z7.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z7.string().optional().describe("End date (yyyy-MM-dd)")
+        groupId: z8.string().uuid().optional().describe("Filter by policy group"),
+        startDate: z8.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z8.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ groupId, startDate, endDate }) => {
@@ -3852,8 +4185,49 @@ function registerHistoryTools(server, callApi) {
   );
 }
+// src/mcp/tools/provenance.ts
+import { z as z9 } from "zod";
+function registerProvenanceTools(server, callApi) {
+  server.registerTool(
+    "lexq_provenance_get",
+    {
+      title: "Get Decision Provenance",
+      description: "Get the lineage of a single decision: what was decided, deterministic why per rule, input facts (PII facts are masked as \u2022\u2022\u2022\u2022\u2022\u2022 with maskedKeys listing them \u2014 values are revealable only in the console, audited), the authored/published/deployed responsibility chain, and the rule snapshot fingerprint.",
+      inputSchema: {
+        traceId: z9.string().describe("Trace ID of the execution")
+      }
+    },
+    async ({ traceId }) => callApi("GET", `provenance/${traceId}`)
+  );
+  server.registerTool(
+    "lexq_pii_reveals_list",
+    {
+      title: "List PII Reveal Audits",
+      description: "List the PII reveal audit ledger \u2014 who revealed which fact of which trace, and when. Metadata only; revealed values are never stored or returned. Use for monthly access-log inspection and SIEM collection.",
+      inputSchema: {
+        page: z9.number().int().min(0).default(0).describe("Page number"),
+        size: z9.number().int().min(1).max(100).default(20).describe("Page size"),
+        traceId: z9.string().optional().describe("Filter by trace ID (exact match)"),
+        revealedBy: z9.string().optional().describe("Filter by operator ID (exact match)"),
+        factKey: z9.string().optional().describe("Filter by fact key (partial match, case-insensitive)"),
+        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
+      }
+    },
+    async ({ page, size, traceId, revealedBy, factKey, startDate, endDate }) => {
+      const params = paginationParams(page, size);
+      if (traceId) params.traceId = traceId;
+      if (revealedBy) params.revealedBy = revealedBy;
+      if (factKey) params.factKey = factKey;
+      if (startDate) params.startDate = startDate;
+      if (endDate) params.endDate = endDate;
+      return callApi("GET", "provenance/reveal-audits", { params });
+    }
+  );
+}
 // src/mcp/tools/integrations.ts
-import { z as z8 } from "zod";
+import { z as z10 } from "zod";
 function registerIntegrationTools(server, callApi) {
   server.registerTool(
     "lexq_integrations_list",
@@ -3861,9 +4235,9 @@ function registerIntegrationTools(server, callApi) {
       title: "List Integrations",
       description: "List all external integrations (webhooks, CRM, notification, etc.).",
       inputSchema: {
-        page: z8.number().int().min(0).default(0).describe("Page number"),
-        size: z8.number().int().min(1).max(100).default(20).describe("Page size"),
-        type: z8.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).optional().describe("Filter by integration type")
+        page: z10.number().int().min(0).default(0).describe("Page number"),
+        size: z10.number().int().min(1).max(100).default(20).describe("Page size"),
+        type: z10.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).optional().describe("Filter by integration type")
       }
     },
     async ({ page, size, type }) => {
@@ -3878,7 +4252,7 @@ function registerIntegrationTools(server, callApi) {
       title: "Get Integration",
       description: "Get integration detail by ID.",
       inputSchema: {
-        integrationId: z8.string().uuid().describe("Integration ID")
+        integrationId: z10.string().uuid().describe("Integration ID")
       }
     },
     async ({ integrationId }) => callApi("GET", `integrations/${integrationId}`)
@@ -3889,13 +4263,13 @@ function registerIntegrationTools(server, callApi) {
       title: "Save Integration",
       description: "Create or update an integration. Provide id to update an existing one; omit id to create new. Types: COUPON, POINT, NOTIFICATION, CRM, MESSENGER, WEBHOOK.",
       inputSchema: {
-        id: z8.string().uuid().optional().describe("Integration ID (omit to create, provide to update)"),
-        type: z8.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).describe("Integration type"),
-        name: z8.string().describe("Integration name"),
-        baseUrl: z8.string().describe("Base URL of the external service"),
-        credential: z8.string().optional().describe("API key or token for the service"),
-        additionalConfig: z8.string().optional().describe("JSON string of additional config key-value pairs"),
-        isActive: z8.boolean().default(true).describe("Whether the integration is active")
+        id: z10.string().uuid().optional().describe("Integration ID (omit to create, provide to update)"),
+        type: z10.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).describe("Integration type"),
+        name: z10.string().describe("Integration name"),
+        baseUrl: z10.string().describe("Base URL of the external service"),
+        credential: z10.string().optional().describe("API key or token for the service"),
+        additionalConfig: z10.string().optional().describe("JSON string of additional config key-value pairs"),
+        isActive: z10.boolean().default(true).describe("Whether the integration is active")
       }
     },
     async ({ additionalConfig, ...rest }) => {
@@ -3910,7 +4284,7 @@ function registerIntegrationTools(server, callApi) {
       title: "Delete Integration",
       description: "Delete an integration by ID.",
       inputSchema: {
-        integrationId: z8.string().uuid().describe("Integration ID")
+        integrationId: z10.string().uuid().describe("Integration ID")
       }
     },
     async ({ integrationId }) => callApi("DELETE", `integrations/${integrationId}`)
@@ -3927,7 +4301,7 @@ function registerIntegrationTools(server, callApi) {
 }
 // src/mcp/tools/logs.ts
-import { z as z9 } from "zod";
+import { z as z11 } from "zod";
 function registerLogTools(server, callApi) {
   server.registerTool(
     "lexq_logs_list",
@@ -3935,14 +4309,14 @@ function registerLogTools(server, callApi) {
       title: "List Failure Logs",
       description: "List system failure logs from background tasks (webhook calls, coupon issuance, etc.).",
       inputSchema: {
-        page: z9.number().int().min(0).default(0).describe("Page number"),
-        size: z9.number().int().min(1).max(100).default(20).describe("Page size"),
-        category: z9.enum(TaskCategory).optional().describe("Task category"),
-        taskType: z9.enum(TaskType).optional().describe("Task type"),
-        status: z9.enum(FailureStatus).optional().describe("Log status"),
-        keyword: z9.string().optional().describe("Search in refId, refSubId, errorMessage"),
-        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
+        page: z11.number().int().min(0).default(0).describe("Page number"),
+        size: z11.number().int().min(1).max(100).default(20).describe("Page size"),
+        category: z11.enum(TaskCategory).optional().describe("Task category"),
+        taskType: z11.enum(TaskType).optional().describe("Task type"),
+        status: z11.enum(FailureStatus).optional().describe("Log status"),
+        keyword: z11.string().optional().describe("Search in refId, refSubId, errorMessage"),
+        startDate: z11.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z11.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ page, size, category, taskType, status, keyword, startDate, endDate }) => {
@@ -3962,7 +4336,7 @@ function registerLogTools(server, callApi) {
       title: "Get Failure Log",
       description: "Get failure log detail by ID.",
       inputSchema: {
-        logId: z9.string().uuid().describe("Failure log ID")
+        logId: z11.string().uuid().describe("Failure log ID")
       }
     },
     async ({ logId }) => callApi("GET", `failure-logs/${logId}`)
@@ -3973,8 +4347,8 @@ function registerLogTools(server, callApi) {
       title: "Process Failure Log",
       description: "Process a single failure log: RETRY (re-execute with original payload), RESOLVE (mark as manually fixed), or IGNORE (skip intentionally).",
       inputSchema: {
-        logId: z9.string().uuid().describe("Failure log ID"),
-        action: z9.enum(FailureAction).describe("Action to take")
+        logId: z11.string().uuid().describe("Failure log ID"),
+        action: z11.enum(FailureAction).describe("Action to take")
       }
     },
     async ({ logId, action }) => callApi("POST", `failure-logs/${logId}/actions`, {
@@ -3987,8 +4361,8 @@ function registerLogTools(server, callApi) {
       title: "Bulk Process Failure Logs",
       description: "Process multiple failure logs at once. Provide an array of log IDs and the action.",
       inputSchema: {
-        logIds: z9.array(z9.string().uuid()).describe("Array of failure log IDs"),
-        action: z9.enum(FailureAction).describe("Action to apply to all logs")
+        logIds: z11.array(z11.string().uuid()).describe("Array of failure log IDs"),
+        action: z11.enum(FailureAction).describe("Action to apply to all logs")
       }
     },
     async ({ logIds, action }) => callApi("POST", "failure-logs/bulk-actions", {
@@ -3998,7 +4372,7 @@ function registerLogTools(server, callApi) {
 }
 // src/mcp/tools/webhook-subscriptions.ts
-import { z as z10 } from "zod";
+import { z as z12 } from "zod";
 function registerWebhookSubscriptionTools(server, callApi) {
   server.registerTool(
     "lexq_webhook_subscriptions_list",
@@ -4006,8 +4380,8 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "List Webhook Subscriptions",
       description: "List platform event webhook subscriptions. These receive deployment lifecycle notifications (publish, deploy, rollback, undeploy).",
       inputSchema: {
-        page: z10.number().int().min(0).default(0).describe("Page number"),
-        size: z10.number().int().min(1).max(100).default(20).describe("Page size")
+        page: z12.number().int().min(0).default(0).describe("Page number"),
+        size: z12.number().int().min(1).max(100).default(20).describe("Page size")
       }
     },
     async ({ page, size }) => {
@@ -4021,7 +4395,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Get Webhook Subscription",
       description: "Get webhook subscription detail by ID.",
       inputSchema: {
-        id: z10.string().uuid().describe("Webhook subscription ID")
+        id: z12.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("GET", `webhook-subscriptions/${id}`)
@@ -4032,13 +4406,13 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Save Webhook Subscription",
       description: 'Create or update a webhook subscription. Omit id to create, provide id to update. Events: VERSION_PUBLISHED, DEPLOYED, ROLLED_BACK, UNDEPLOYED. Formats: GENERIC (full JSON), SLACK ({"text": "..."}).',
       inputSchema: {
-        id: z10.string().uuid().optional().describe("Subscription ID (omit to create, provide to update)"),
-        name: z10.string().min(1).describe("Subscription name (unique per tenant)"),
-        webhookUrl: z10.string().url().describe("Webhook endpoint URL"),
-        subscribedEvents: z10.array(z10.enum(PlatformEventType)).min(1).describe("Events to subscribe to"),
-        payloadFormat: z10.enum(WebhookPayloadFormat).optional().default("GENERIC").describe("Payload format"),
-        secret: z10.string().optional().describe("HMAC-SHA256 signing secret"),
-        isActive: z10.boolean().optional().default(true).describe("Whether the subscription is active")
+        id: z12.string().uuid().optional().describe("Subscription ID (omit to create, provide to update)"),
+        name: z12.string().min(1).describe("Subscription name (unique per tenant)"),
+        webhookUrl: z12.string().url().describe("Webhook endpoint URL"),
+        subscribedEvents: z12.array(z12.enum(PlatformEventType)).min(1).describe("Events to subscribe to"),
+        payloadFormat: z12.enum(WebhookPayloadFormat).optional().default("GENERIC").describe("Payload format"),
+        secret: z12.string().optional().describe("HMAC-SHA256 signing secret"),
+        isActive: z12.boolean().optional().default(true).describe("Whether the subscription is active")
       }
     },
     async ({ ...body }) => callApi("POST", "webhook-subscriptions", { body })
@@ -4049,7 +4423,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Delete Webhook Subscription",
       description: "Delete a webhook subscription by ID.",
       inputSchema: {
-        id: z10.string().uuid().describe("Webhook subscription ID")
+        id: z12.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("DELETE", `webhook-subscriptions/${id}`)
@@ -4060,7 +4434,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Test Webhook Subscription",
       description: "Send a test event to verify webhook connectivity. Returns the HTTP status code and success/failure message.",
       inputSchema: {
-        id: z10.string().uuid().describe("Webhook subscription ID")
+        id: z12.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("POST", `webhook-subscriptions/${id}/test`)
@@ -4068,7 +4442,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
 }
 // src/mcp/tools/domain-templates.ts
-import { z as z11 } from "zod";
+import { z as z13 } from "zod";
 function registerDomainTemplateTools(server, callApi) {
   server.registerTool(
     "lexq_domain_templates_list",
@@ -4085,7 +4459,7 @@ function registerDomainTemplateTools(server, callApi) {
       title: "Preview Domain Template",
       description: "Preview exactly what a domain template will provision before applying it: the fact definitions it registers, the sample rules it creates, and an apply plan. This is a read-only dry run \u2014 nothing is created. Only ACTIVE templates can be previewed.",
       inputSchema: {
-        template: z11.string().describe(
+        template: z13.string().describe(
           "Domain template key (e.g. ECOMMERCE). Use lexq_domain_templates_list to see available keys \u2014 currently only ECOMMERCE is ACTIVE."
         )
       }
@@ -4098,8 +4472,8 @@ function registerDomainTemplateTools(server, callApi) {
       title: "Apply Domain Template",
       description: "Apply a domain template to the current tenant. Creates the template's fact definitions and a new policy group pre-populated with its sample rules as a DRAFT version. Existing facts are skipped \u2014 apply is additive and never overwrites existing schema. Run lexq_domain_templates_preview first to review what will be created. Only ACTIVE templates can be applied.",
       inputSchema: {
-        template: z11.string().describe("Domain template key to apply (e.g. ECOMMERCE)."),
-        customName: z11.string().optional().describe(
+        template: z13.string().describe("Domain template key to apply (e.g. ECOMMERCE)."),
+        customName: z13.string().optional().describe(
           "Optional custom name for the policy group that gets created. If omitted, the template's default name is used."
         )
       }
@@ -4121,7 +4495,9 @@ function registerAllTools(server, callApi) {
   registerFactTools(server, callApi);
   registerDeployTools(server, callApi);
   registerAnalyticsTools(server, callApi);
+  registerReplayTools(server, callApi);
   registerHistoryTools(server, callApi);
+  registerProvenanceTools(server, callApi);
   registerIntegrationTools(server, callApi);
   registerLogTools(server, callApi);
   registerDomainTemplateTools(server, callApi);
@@ -4153,12 +4529,12 @@ async function startMcpServer() {
 function registerServeCommand(program) {
   program.command("serve").description("Start LexQ as a server for AI agent integrations").option("--mcp", "Start as MCP (Model Context Protocol) server over stdio").addHelpText(
     "after",
-    dedent15`
+    dedent17`
         Example:
           $ lexq serve --mcp
-          Starts a stdio MCP server that exposes 60 tools for policy management.
+          Starts a stdio MCP server that exposes the full LexQ toolset for policy management.
           Used by Claude Desktop, Claude.ai, Cursor, and other MCP-compatible clients.
         Claude Desktop config (~/.claude/claude_desktop_config.json):
@@ -4184,11 +4560,11 @@ function registerServeCommand(program) {
 // src/commands/domain-templates.ts
 import "commander";
-import dedent16 from "dedent";
+import dedent18 from "dedent";
 function registerDomainTemplateCommands(program) {
   const templates = program.command("domain-templates").description("Browse and apply domain templates").addHelpText(
     "after",
-    dedent16`
+    dedent18`
         A domain template is an industry-specific starter pack of fact
         definitions and sample rules. Applying one provisions a ready-to-use
@@ -4236,7 +4612,7 @@ function registerDomainTemplateCommands(program) {
   });
   templates.command("preview").description("Preview what a domain template provisions").requiredOption("--template <key>", "Domain template key (e.g. ECOMMERCE)").addHelpText(
     "after",
-    dedent16`
+    dedent18`
         Read-only dry run — shows the fact definitions and sample rules the
         template will create. Nothing is provisioned.
@@ -4265,7 +4641,7 @@ function registerDomainTemplateCommands(program) {
   });
   templates.command("apply").description("Apply a domain template to the current tenant").requiredOption("--template <key>", "Domain template key (e.g. ECOMMERCE)").option("--name <n>", "Custom name for the policy group that gets created").option("--force", "Skip confirmation prompt").addHelpText(
     "after",
-    dedent16`
+    dedent18`
         Creates the template's fact definitions and a new DRAFT policy group
         populated with its sample rules. Existing facts are skipped — apply is
@@ -4327,7 +4703,10 @@ function createCli() {
   const program = new Command();
   program.name("lexq").description(
     "Command-line interface for the LexQ Decision Operations Platform. Manage policies, run Impact Simulation, and deploy from your terminal."
-  ).version(getVersion2(), "-V, --version").option("--format <format>", "Output format: json or table", "json").option("--api-key <key>", "Override stored API key").option("--base-url <url>", "Override API base URL").option("--dry-run", "Preview the HTTP request without executing").option("--verbose", "Show request/response details").option("--no-color", "Disable colored output");
+  ).version(getVersion2(), "-V, --version").option("--format <format>", "Output format: json or table", "json").option("--api-key <key>", "Override stored API key").option(
+    "--base-url <url>",
+    "Override API base URL \u2014 must include the API prefix, e.g. http://localhost:8080/api/v1/partners"
+  ).option("--dry-run", "Preview the HTTP request without executing").option("--verbose", "Show request/response details").option("--no-color", "Disable colored output");
   registerAuthCommands(program);
   registerStatusCommand(program);
   registerGroupCommands(program);
@@ -4338,6 +4717,8 @@ function createCli() {
   registerDeployCommands(program);
   registerAnalyticsCommands(program);
   registerHistoryCommands(program);
+  registerReplayCommands(program);
+  registerProvenanceCommands(program);
   registerIntegrationCommands(program);
   registerLogCommands(program);
   registerWebhookSubscriptionCommands(program);