npm - @lexq/cli - Versions diffs - 0.1.35 → 0.1.37 - Mend

@lexq/cli 0.1.35 → 0.1.37

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/index.js CHANGED Viewed

@@ -1144,14 +1144,15 @@ function registerFactCommands(program) {
       });
       if (format === "table") {
         printTable(
-          ["ID", "Key", "Name", "Type", "System", "Required"],
+          ["ID", "Key", "Name", "Type", "System", "Required", "PII"],
           data.content.map((f) => [
             f.id,
             f.key,
             f.name,
             f.type,
             f.isSystem ? "\u2713" : "\u2013",
-            f.isRequired ? "\u2713" : "\u2013"
+            f.isRequired ? "\u2713" : "\u2013",
+            f.isPii ? "\u2713" : "\u2013"
           ]),
           { truncate: 28 }
         );
@@ -1211,7 +1212,7 @@ ${data.length} unregistered`);
       process.exit(1);
     }
   });
-  facts.command("create").description("Create a new fact definition").option("--key <key>", "Fact key (lowercase, underscores)").option("--name <n>", "Display name").option("--type <type>", "Value type: STRING, NUMBER, BOOLEAN, LIST_STRING, LIST_NUMBER").option("--description <desc>", "Description").option("--required", "Mark as required", false).option("--json <body>", "Full request body as JSON (overrides other options)").addHelpText(
+  facts.command("create").description("Create a new fact definition").option("--key <key>", "Fact key (lowercase, underscores)").option("--name <n>", "Display name").option("--type <type>", "Value type: STRING, NUMBER, BOOLEAN, LIST_STRING, LIST_NUMBER").option("--description <desc>", "Description").option("--required", "Mark as required", false).option("--pii", "Mark as PII \u2014 value is masked on every read surface", false).option("--json <body>", "Full request body as JSON (overrides other options)").addHelpText(
     "after",
     dedent6`
@@ -1247,7 +1248,7 @@ ${data.length} unregistered`);
       process.exit(1);
     }
   });
-  facts.command("update").description("Update a fact definition").requiredOption("--id <factId>", "Fact definition ID").option("--name <n>", "Display name").option("--description <desc>", "Description").option("--required", "Mark as required").option("--no-required", "Mark as not required").option("--json <body>", "Full request body as JSON (overrides other options)").addHelpText(
+  facts.command("update").description("Update a fact definition").requiredOption("--id <factId>", "Fact definition ID").option("--name <n>", "Display name").option("--description <desc>", "Description").option("--required", "Mark as required").option("--no-required", "Mark as not required").option("--pii", "Mark as PII (enables masking)").option("--no-pii", "Unmark as PII (disables masking \u2014 value becomes visible)").option("--json <body>", "Full request body as JSON (overrides other options)").addHelpText(
     "after",
     dedent6`
@@ -1334,7 +1335,8 @@ function buildCreateBody2(opts) {
     key: opts.key,
     name: opts.name,
     type: opts.type,
-    isRequired: opts.required === true
+    isRequired: opts.required === true,
+    isPii: opts.pii === true
   };
   if (opts.description) body.description = opts.description;
   return body;
@@ -1344,6 +1346,7 @@ function buildUpdateBody2(opts) {
   if (opts.name) body.name = opts.name;
   if (opts.description !== void 0) body.description = opts.description;
   if (typeof opts.required === "boolean") body.isRequired = opts.required;
+  if (typeof opts.isPii === "boolean") body.isPii = opts.isPii;
   return body;
 }
@@ -2180,13 +2183,140 @@ function resolveBody(opts) {
   return {};
 }
-// src/commands/history.ts
+// src/commands/profile.ts
 import "commander";
 import dedent9 from "dedent";
+// src/types/enums.ts
+var ProfileCacheState = ["HIT", "MISS"];
+var FailureStatus = ["PENDING", "RESOLVED", "IGNORED"];
+var FailureAction = ["RETRY", "IGNORE", "RESOLVE"];
+var TaskCategory = ["INTEGRATION", "INTERNAL"];
+var TaskType = [
+  // Integration
+  "COUPON_ISSUE",
+  "COUPON_CANCEL",
+  "POINT_EARN",
+  "POINT_USE",
+  "POINT_REFUND",
+  "NOTIFICATION_SEND",
+  "CRM_SYNC_USER",
+  "CRM_ADD_TAG",
+  "WEBHOOK_EXECUTE",
+  // Internal
+  "IMAGE_PROCESSING",
+  "DAILY_SETTLEMENT",
+  "PLATFORM_WEBHOOK"
+];
+var PlatformEventType = [
+  "VERSION_PUBLISHED",
+  "DEPLOYED",
+  "ROLLED_BACK",
+  "UNDEPLOYED"
+];
+var WebhookPayloadFormat = ["GENERIC", "SLACK"];
+// src/commands/profile.ts
+var ms = (nanos) => nanos == null ? "\u2013" : (nanos / 1e6).toFixed(2);
+var msWithUnit = (nanos) => nanos == null ? "\u2013" : `${(nanos / 1e6).toFixed(2)}ms`;
+function registerProfileCommands(program) {
+  program.command("profile <groupId>").description("Per-rule latency profile with relative slow-rule flags").option("--rule <ruleId>", "Single-rule detail (distributions + 60s window series)").option("--version <versionId>", "Version to inspect (default: live version)").option("--from <instant>", "Window start, ISO-8601 instant (default: 24h ago)").option("--to <instant>", "Window end, ISO-8601 instant (default: now)").option("--cache <state>", "Cache dimension for the rule table: HIT | MISS (default: HIT)").addHelpText(
+    "after",
+    dedent9`
+        Slow-rule judgment is relative only: flagged = p50 ≥ 10× the median of
+        per-rule p50s within the group. Absolute ms thresholds are intentionally
+        not supported. Percentiles are withheld (–) when n < 100; TOTAL is
+        recorded for every call, rule detail from a deterministic 1% sample.
+        Examples:
+          $ lexq profile <groupId>
+          $ lexq profile <groupId> --cache MISS --from 2026-07-01T00:00:00Z
+          $ lexq profile <groupId> --rule <ruleId> --version <versionId>
+      `
+  ).action(async (groupId, opts) => {
+    try {
+      const globalOpts = program.opts();
+      const format = globalOpts.format ?? "json";
+      if (opts.cache && !ProfileCacheState.includes(opts.cache)) {
+        throw new Error(`--cache must be one of: ${ProfileCacheState.join(" | ")}`);
+      }
+      const params = {};
+      if (opts.version) params.versionId = opts.version;
+      if (opts.from) params.from = opts.from;
+      if (opts.to) params.to = opts.to;
+      if (opts.cache) params.cacheState = opts.cache;
+      const clientOpts = {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose
+      };
+      if (opts.rule) {
+        const data2 = await apiRequest(
+          "GET",
+          `policy-groups/${groupId}/profile/rules/${opts.rule}`,
+          { ...clientOpts, params }
+        );
+        if (format === "table") {
+          console.error("note: --rule detail is nested; printing JSON (table not supported)");
+        }
+        printJson(data2);
+        return;
+      }
+      const data = await apiRequest("GET", `policy-groups/${groupId}/profile`, {
+        ...clientOpts,
+        params
+      });
+      if (format !== "table") {
+        printJson(data);
+        return;
+      }
+      console.log(`window   : ${data.from} ~ ${data.to}  (cache: ${data.ruleCacheState})`);
+      console.log(`version  : ${data.policyVersionId ?? "\u2013 (no live version)"}`);
+      for (const s of data.summary) {
+        const t = s.total;
+        console.log(
+          `TOTAL ${s.cacheState.padEnd(4)}: n=${t.n}  p50=${msWithUnit(t.p50Nanos)}  p95=${msWithUnit(t.p95Nanos)}  p99=${msWithUnit(t.p99Nanos)}`
+        );
+      }
+      for (const b of data.baselines) {
+        const base = b.status === "OK" ? `${msWithUnit(b.baselineP50Nanos)} (cohort ${b.cohortSize})` : `\u2013 (${b.status}, cohort ${b.cohortSize})`;
+        console.log(`baseline ${b.phase.padEnd(9)}: ${base}`);
+      }
+      if (data.droppedRows > 0) {
+        console.log(`\u26A0 droppedRows=${data.droppedRows} (corrupt histogram rows skipped)`);
+      }
+      printTable(
+        ["Rule", "Phase", "n", "p50(ms)", "p95(ms)", "p99(ms)", "\xD7base", "Flagged"],
+        data.rules.flatMap(
+          (rule) => rule.phases.map((p) => [
+            rule.ruleId.substring(0, 12),
+            p.phase,
+            String(p.stats.n),
+            ms(p.stats.p50Nanos),
+            ms(p.stats.p95Nanos),
+            ms(p.stats.p99Nanos),
+            p.baselineMultiple == null ? "\u2013" : `${p.baselineMultiple.toFixed(1)}\xD7`,
+            p.flagged ? "YES" : ""
+          ])
+        ),
+        { truncate: 24 }
+      );
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+}
+// src/commands/history.ts
+import "commander";
+import dedent10 from "dedent";
 function registerHistoryCommands(program) {
   const history = program.command("history").description("Execution history").addHelpText(
     "after",
-    dedent9`
+    dedent10`
         View and analyze policy execution logs from production traffic.
@@ -2200,7 +2330,7 @@ function registerHistoryCommands(program) {
   );
   history.command("list").description("List execution history").option("--trace-id <traceId>", "Filter by trace ID").option("--group-id <groupId>", "Filter by policy group").option("--version-id <versionId>", "Filter by version").option("--status <status>", "Filter by status (SUCCESS, NO_MATCH, ERROR, TIMEOUT)").option("--start-date <date>", "Start date (yyyy-MM-dd)").option("--end-date <date>", "End date (yyyy-MM-dd)").option("--page <number>", "Page number", "0").option("--size <number>", "Page size", "20").addHelpText(
     "after",
-    dedent9`
+    dedent10`
         Examples:
           $ lexq history list --status ERROR --format table
@@ -2254,7 +2384,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   history.command("get").description("Get execution detail").requiredOption("--id <traceId>", "Trace ID").addHelpText(
     "after",
-    dedent9`
+    dedent10`
         Returns the full execution detail including request facts, result traces,
         and decision traces (SELECTED, NO_MATCH, BLOCKED, etc.).
@@ -2280,7 +2410,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   history.command("stats").description("Get execution statistics").option("--group-id <groupId>", "Filter by policy group").option("--start-date <date>", "Start date (yyyy-MM-dd)").option("--end-date <date>", "End date (yyyy-MM-dd)").addHelpText(
     "after",
-    dedent9`
+    dedent10`
         Shows total executions, success/no-match/failure counts, success rate, and avg latency.
@@ -2329,11 +2459,11 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 // src/commands/replay.ts
 import "commander";
-import dedent10 from "dedent";
+import dedent11 from "dedent";
 function registerReplayCommands(program) {
   const replay = program.command("replay").description("Decision Replay").addHelpText(
     "after",
-    dedent10`
+    dedent11`
         Re-evaluate past production executions against a candidate version.
@@ -2349,7 +2479,7 @@ function registerReplayCommands(program) {
   );
   replay.command("decision").description("Replay a single execution against a candidate version").requiredOption("--trace-id <traceId>", "Trace ID of the past execution").requiredOption("--version-id <versionId>", "Candidate version to re-evaluate against").addHelpText(
     "after",
-    dedent10`
+    dedent11`
         Free of charge (TPS throttle only). Returns decisionChanged, effect
         changes, fired rules on both sides, and a determinism verdict.
@@ -2375,7 +2505,7 @@ function registerReplayCommands(program) {
   });
   replay.command("start").description("Submit a window replay job (blast radius)").requiredOption("--version-id <versionId>", "Candidate version to re-evaluate against").requiredOption("--from <date>", "Window start date (yyyy-MM-dd)").requiredOption("--to <date>", "Window end date (yyyy-MM-dd)").option("--max-records <number>", "Sample cap (hard cap 50k)").addHelpText(
     "after",
-    dedent10`
+    dedent11`
         Billed per replayed record (REPLAY metric). Poll with "lexq replay get".
@@ -2473,11 +2603,11 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 // src/commands/provenance.ts
 import "commander";
-import dedent11 from "dedent";
+import dedent12 from "dedent";
 function registerProvenanceCommands(program) {
   const provenance = program.command("provenance").description("Decision Provenance").addHelpText(
     "after",
-    dedent11`
+    dedent12`
         Trace who authored, published, and deployed the rules behind a decision.
@@ -2503,7 +2633,7 @@ function registerProvenanceCommands(program) {
   });
   provenance.command("reveal-audits").description("List PII reveal audits (who revealed what, when)").option("--trace-id <traceId>", "Filter by trace ID (exact)").option("--fact-key <factKey>", "Filter by fact key (partial, case-insensitive)").option("--revealed-by <operatorId>", "Filter by operator ID (exact)").option("--start-date <date>", "Start date (yyyy-MM-dd)").option("--end-date <date>", "End date (yyyy-MM-dd)").option("--page <number>", "Page number", "0").option("--size <number>", "Page size", "20").addHelpText(
     "after",
-    dedent11`
+    dedent12`
         Metadata only — revealed values are never stored or returned.
@@ -2556,11 +2686,11 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 // src/commands/integrations.ts
 import "commander";
-import dedent12 from "dedent";
+import dedent13 from "dedent";
 function registerIntegrationCommands(program) {
   const integrations = program.command("integrations").description("Manage external integrations").addHelpText(
     "after",
-    dedent12`
+    dedent13`
         Integrations connect rule actions to external services (webhooks, coupons,
         points, notifications, CRM, messengers).
@@ -2630,7 +2760,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   integrations.command("save").description("Create or update an integration").requiredOption("--json <body>", "Request body as JSON string").addHelpText(
     "after",
-    dedent12`
+    dedent13`
         Examples:
           # Create
@@ -2680,7 +2810,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   integrations.command("delete").description("Delete an integration").requiredOption("--id <integrationId>", "Integration ID").option("--force", "Skip confirmation prompt").addHelpText(
     "after",
-    dedent12`
+    dedent13`
         Rules referencing this integration will fail at execution time.
         Use --force to skip confirmation.
@@ -2712,7 +2842,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   integrations.command("config-spec").description("Get integration configuration field specs").addHelpText(
     "after",
-    dedent12`
+    dedent13`
         Shows required and optional configuration fields for each integration type.
@@ -2738,41 +2868,11 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 // src/commands/logs.ts
 import "commander";
-import dedent13 from "dedent";
-// src/types/enums.ts
-var FailureStatus = ["PENDING", "RESOLVED", "IGNORED"];
-var FailureAction = ["RETRY", "IGNORE", "RESOLVE"];
-var TaskCategory = ["INTEGRATION", "INTERNAL"];
-var TaskType = [
-  // Integration
-  "COUPON_ISSUE",
-  "COUPON_CANCEL",
-  "POINT_EARN",
-  "POINT_USE",
-  "POINT_REFUND",
-  "NOTIFICATION_SEND",
-  "CRM_SYNC_USER",
-  "CRM_ADD_TAG",
-  "WEBHOOK_EXECUTE",
-  // Internal
-  "IMAGE_PROCESSING",
-  "DAILY_SETTLEMENT",
-  "PLATFORM_WEBHOOK"
-];
-var PlatformEventType = [
-  "VERSION_PUBLISHED",
-  "DEPLOYED",
-  "ROLLED_BACK",
-  "UNDEPLOYED"
-];
-var WebhookPayloadFormat = ["GENERIC", "SLACK"];
-// src/commands/logs.ts
+import dedent14 from "dedent";
 function registerLogCommands(program) {
   const logs = program.command("logs").description("Failure logs").addHelpText(
     "after",
-    dedent13`
+    dedent14`
         System failure logs (DLQ) for background tasks — webhook calls, coupon issuance,
         point operations, notifications, and platform event webhooks.
@@ -2789,7 +2889,7 @@ function registerLogCommands(program) {
   );
   logs.command("list").description("List failure logs").option("--category <category>", "Filter by category (INTEGRATION, INTERNAL)").option("--task-type <taskType>", `Filter by task type (${TaskType.join(", ")})`).option("--status <status>", "Filter by status (PENDING, RESOLVED, IGNORED)").option("--keyword <keyword>", "Search keyword").option("--start-date <date>", "Start date (yyyy-MM-dd)").option("--end-date <date>", "End date (yyyy-MM-dd)").option("--page <number>", "Page number", "0").option("--size <number>", "Page size", "20").addHelpText(
     "after",
-    dedent13`
+    dedent14`
         Examples:
           $ lexq logs list --status PENDING --format table
@@ -2840,7 +2940,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   logs.command("get").description("Get failure log detail").requiredOption("--id <logId>", "Log ID").addHelpText(
     "after",
-    dedent13`
+    dedent14`
         Includes the full payload that was used for the failed operation.
         Use this to inspect what went wrong before deciding to RETRY or RESOLVE.
@@ -2862,7 +2962,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   logs.command("action").description("Process a failure log action (RETRY, IGNORE, RESOLVE)").requiredOption("--id <logId>", "Log ID").requiredOption("--action <action>", "Action: RETRY, IGNORE, or RESOLVE").addHelpText(
     "after",
-    dedent13`
+    dedent14`
         Actions:
           RETRY    Re-execute the failed operation with the original payload
@@ -2894,7 +2994,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   logs.command("bulk-action").description("Bulk process failure logs").requiredOption("--ids <logIds>", "Comma-separated log IDs").requiredOption("--action <action>", "Action: RETRY, IGNORE, or RESOLVE").addHelpText(
     "after",
-    dedent13`
+    dedent14`
         Processes each log individually. Failures are skipped with a warning.
@@ -2922,11 +3022,11 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 // src/commands/webhook-subscriptions.ts
 import "commander";
-import dedent14 from "dedent";
+import dedent15 from "dedent";
 function registerWebhookSubscriptionCommands(program) {
   const webhooks = program.command("webhook-subscriptions").description("Manage platform event webhook subscriptions").addHelpText(
     "after",
-    dedent14`
+    dedent15`
         Receive notifications when deployment lifecycle events occur
         (publish, deploy, rollback, undeploy).
@@ -3000,7 +3100,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   webhooks.command("save").description("Create or update a webhook subscription").requiredOption("--json <body>", "Request body as JSON string").addHelpText(
     "after",
-    dedent14`
+    dedent15`
         Examples:
           # Create (Slack format)
@@ -3055,7 +3155,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   webhooks.command("delete").description("Delete a webhook subscription").requiredOption("--id <subscriptionId>", "Subscription ID").option("--force", "Skip confirmation prompt").addHelpText(
     "after",
-    dedent14`
+    dedent15`
         Use --force to skip the confirmation prompt.
@@ -3089,7 +3189,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   webhooks.command("test").description("Send a test event to verify webhook connectivity").requiredOption("--id <subscriptionId>", "Subscription ID").addHelpText(
     "after",
-    dedent14`
+    dedent15`
         Sends a test event to the webhook URL and reports the HTTP status code.
         Does not record failures in the failure log.
@@ -3125,7 +3225,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 // src/commands/serve.ts
 import "commander";
-import dedent17 from "dedent";
+import dedent18 from "dedent";
 // src/mcp/server.ts
 import { readFileSync as readFileSync3 } from "fs";
@@ -3138,7 +3238,12 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 function createCallApiFromConfig() {
   return async (method, path, opts) => {
     try {
-      const config = loadConfig();
+      const stored = loadConfig();
+      const config = {
+        ...stored,
+        baseUrl: process.env.PARTNER_BASE_URL ?? stored.baseUrl,
+        apiKey: process.env.LEXQ_API_KEY ?? stored.apiKey
+      };
       if (opts?.upload) {
         const url = new URL(
           path,
@@ -3447,7 +3552,7 @@ function registerVersionTools(server, callApi) {
 // src/mcp/tools/rules.ts
 import { z as z3 } from "zod";
-import dedent15 from "dedent";
+import dedent16 from "dedent";
 function registerRuleTools(server, callApi) {
   server.registerTool(
     "lexq_rules_list",
@@ -3478,7 +3583,7 @@ function registerRuleTools(server, callApi) {
     "lexq_rules_create",
     {
       title: "Create Rule",
-      description: dedent15`
+      description: dedent16`
         Create a rule in a DRAFT version. Requires name, condition tree, and actions array. priority is auto-assigned (appended last); use lexq_rules_reorder to change order.
         Before creating rules with new fact keys, call lexq_facts_list to check existing facts.
@@ -3611,7 +3716,7 @@ function registerFactTools(server, callApi) {
     "lexq_facts_list",
     {
       title: "List Fact Definitions",
-      description: "List all fact definitions (input variable schema). Shows key, type, and required status. Always check this before creating rules.",
+      description: "List all fact definitions (input variable schema). Shows key, type, required, and PII status. Always check this before creating rules.",
       inputSchema: {
         page: z4.number().int().min(0).default(0).describe("Page number"),
         size: z4.number().int().min(1).max(100).default(20).describe("Page size"),
@@ -3634,7 +3739,10 @@ function registerFactTools(server, callApi) {
         name: z4.string().describe("Display name"),
         type: z4.enum(["STRING", "NUMBER", "BOOLEAN", "LIST_STRING", "LIST_NUMBER"]).describe("Value type"),
         description: z4.string().optional().describe("Description"),
-        isRequired: z4.boolean().default(false).describe("Whether this fact is required for rule evaluation")
+        isRequired: z4.boolean().default(false).describe("Whether this fact is required for rule evaluation"),
+        isPii: z4.boolean().default(false).describe(
+          "Mark as PII \u2014 masked on every read surface, revealable only in the console (audited)"
+        )
       }
     },
     async (args) => callApi("POST", "schema/facts", { body: args })
@@ -3643,12 +3751,13 @@ function registerFactTools(server, callApi) {
     "lexq_facts_update",
     {
       title: "Update Fact Definition",
-      description: "Update a fact definition. Key and type cannot be changed. Only provided fields are updated. System facts only allow name and description changes.",
+      description: "Update a fact definition. Key and type cannot be changed. Only provided fields are updated. System facts only allow name, description, and PII changes.",
       inputSchema: {
         factId: z4.string().uuid().describe("Fact definition ID"),
         name: z4.string().optional().describe("Display name"),
         description: z4.string().optional().describe("Description"),
-        isRequired: z4.boolean().optional().describe("Required flag")
+        isRequired: z4.boolean().optional().describe("Required flag"),
+        isPii: z4.boolean().optional().describe("PII flag \u2014 enables/disables masking (changeable even on system facts)")
       }
     },
     async ({ factId, ...body }) => callApi("PUT", `schema/facts/${factId}`, { body })
@@ -3820,13 +3929,13 @@ function registerDeployTools(server, callApi) {
 // src/mcp/tools/analytics.ts
 import { z as z6 } from "zod";
-import dedent16 from "dedent";
+import dedent17 from "dedent";
 function registerAnalyticsTools(server, callApi) {
   server.registerTool(
     "lexq_dry_run",
     {
       title: "Dry Run",
-      description: dedent16`
+      description: dedent17`
         Execute a single dry run against a version. Tests how rules evaluate given input facts without side effects.
         Returns:
@@ -3856,7 +3965,7 @@ function registerAnalyticsTools(server, callApi) {
     "lexq_dry_run_compare",
     {
       title: "Dry Run Compare",
-      description: dedent16`
+      description: dedent17`
         Compare dry run results between two versions using the same input facts. Useful for validating changes.
         Returns:
@@ -3892,7 +4001,7 @@ function registerAnalyticsTools(server, callApi) {
     "lexq_simulation_start",
     {
       title: "Start Simulation",
-      description: dedent16`
+      description: dedent17`
         Start an Impact Simulation against historical, uploaded, or inline data.
         dataset.type and dataset.source are BOTH required, and must be paired:
@@ -3990,7 +4099,7 @@ function registerAnalyticsTools(server, callApi) {
     "lexq_dataset_upload",
     {
       title: "Upload Dataset",
-      description: dedent16`
+      description: dedent17`
         Upload inline CSV or JSON content as a simulation dataset.
         The content is uploaded to S3 and a path is returned in the "path" field.
@@ -4046,8 +4155,56 @@ function registerAnalyticsTools(server, callApi) {
   );
 }
-// src/mcp/tools/replay.ts
+// src/mcp/tools/profile.ts
 import { z as z7 } from "zod";
+var RELATIVE_THRESHOLD = "flagged = p50 \u2265 10\xD7 median of per-rule p50s within the group; absolute thresholds are intentionally not supported.";
+function profileParams(opts) {
+  const params = {};
+  if (opts.versionId) params.versionId = opts.versionId;
+  if (opts.from) params.from = opts.from;
+  if (opts.to) params.to = opts.to;
+  if (opts.cacheState) params.cacheState = opts.cacheState;
+  return params;
+}
+function registerProfileTools(server, callApi) {
+  server.registerTool(
+    "lexq_profile_overview",
+    {
+      title: "Group Latency Profile",
+      description: "Per-rule latency profile of a policy group over a time window: group TOTAL distribution split by cache state (HIT = compiled ruleset cache hit, MISS = deep-load + compile), a per-rule CONDITION/ACTION percentile table, and slow-rule flags. " + RELATIVE_THRESHOLD + " Every percentile is accompanied by its sample count n; percentiles are withheld (null) when n < 100, and baselines report INSUFFICIENT_COHORT when fewer than 3 rules qualify. Rule detail comes from a deterministic 1% sample of calls; TOTAL is recorded for every call. Defaults: last 24h, live version, cacheState HIT.",
+      inputSchema: {
+        groupId: z7.string().uuid().describe("Policy group ID"),
+        versionId: z7.string().uuid().optional().describe("Version to inspect (default: live version)"),
+        from: z7.string().optional().describe("Window start, ISO-8601 instant (e.g. 2026-07-01T00:00:00Z). Default: 24h ago"),
+        to: z7.string().optional().describe("Window end, ISO-8601 instant. Default: now"),
+        cacheState: z7.enum(["HIT", "MISS"]).optional().describe("Cache dimension for the rule table and judgment (default: HIT)")
+      }
+    },
+    async ({ groupId, versionId, from, to, cacheState }) => callApi("GET", `policy-groups/${groupId}/profile`, {
+      params: profileParams({ versionId, from, to, cacheState })
+    })
+  );
+  server.registerTool(
+    "lexq_profile_rule",
+    {
+      title: "Rule Latency Detail",
+      description: "Single-rule latency detail: merged phase \xD7 cacheState distributions plus a per-window time series (60s windows). Missing windows are genuine gaps \u2014 never interpolated. Series points carry each window's own values; percentiles in merged distributions are withheld (null) when n < 100. " + RELATIVE_THRESHOLD,
+      inputSchema: {
+        groupId: z7.string().uuid().describe("Policy group ID"),
+        ruleId: z7.string().uuid().describe("Rule ID (from lexq_profile_overview)"),
+        versionId: z7.string().uuid().optional().describe("Version to inspect (default: live version)"),
+        from: z7.string().optional().describe("Window start, ISO-8601 instant. Default: 24h ago"),
+        to: z7.string().optional().describe("Window end, ISO-8601 instant. Default: now")
+      }
+    },
+    async ({ groupId, ruleId, versionId, from, to }) => callApi("GET", `policy-groups/${groupId}/profile/rules/${ruleId}`, {
+      params: profileParams({ versionId, from, to })
+    })
+  );
+}
+// src/mcp/tools/replay.ts
+import { z as z8 } from "zod";
 function registerReplayTools(server, callApi) {
   server.registerTool(
     "lexq_replay_decision",
@@ -4055,8 +4212,8 @@ function registerReplayTools(server, callApi) {
       title: "Replay a Decision",
       description: "Re-evaluate a past execution (traceId) against a candidate version and return the decision diff (decisionChanged, effect changes, fired rules) plus a determinism verdict. Synchronous and free of charge (TPS throttle only). External effects (webhooks, notifications) are always mocked \u2014 nothing fires.",
       inputSchema: {
-        traceId: z7.string().describe("Trace ID of the past execution to replay"),
-        candidateVersionId: z7.string().uuid().describe("Version to re-evaluate against")
+        traceId: z8.string().describe("Trace ID of the past execution to replay"),
+        candidateVersionId: z8.string().uuid().describe("Version to re-evaluate against")
       }
     },
     async ({ traceId, candidateVersionId }) => callApi("POST", "replay/decisions", { body: { traceId, candidateVersionId } })
@@ -4067,10 +4224,10 @@ function registerReplayTools(server, callApi) {
       title: "Start Window Replay (Blast Radius)",
       description: "Submit an async job that replays a date window of past executions against a candidate version and measures the blast radius (how many decisions change). Billed per replayed record (REPLAY metric); VIEWER role cannot submit. Poll with lexq_replay_status.",
       inputSchema: {
-        candidateVersionId: z7.string().uuid().describe("Version to re-evaluate against"),
-        from: z7.string().describe("Window start date (yyyy-MM-dd)"),
-        to: z7.string().describe("Window end date (yyyy-MM-dd)"),
-        maxRecords: z7.number().int().min(1).optional().describe("Sample cap (server default applies; hard cap 50k)")
+        candidateVersionId: z8.string().uuid().describe("Version to re-evaluate against"),
+        from: z8.string().describe("Window start date (yyyy-MM-dd)"),
+        to: z8.string().describe("Window end date (yyyy-MM-dd)"),
+        maxRecords: z8.number().int().min(1).optional().describe("Sample cap (server default applies; hard cap 50k)")
       }
     },
     async ({ candidateVersionId, from, to, maxRecords }) => callApi("POST", "replay/jobs", { body: { candidateVersionId, from, to, maxRecords } })
@@ -4081,7 +4238,7 @@ function registerReplayTools(server, callApi) {
       title: "Get Replay Job Status",
       description: "Poll a window replay job. RUNNING shows progress 0\u2013100; COMPLETED fills summary and changedSamples; FAILED carries errorMessage. capped=true means the window exceeded the sample cap and only part was replayed.",
       inputSchema: {
-        jobId: z7.string().describe("Replay job ID from lexq_replay_start")
+        jobId: z8.string().describe("Replay job ID from lexq_replay_start")
       }
     },
     async ({ jobId }) => callApi("GET", `replay/jobs/${jobId}`)
@@ -4092,8 +4249,8 @@ function registerReplayTools(server, callApi) {
       title: "List Replay Jobs",
       description: "List window replay job history (reverse-chronological). Lightweight items \u2014 use lexq_replay_status for summary and changed samples.",
       inputSchema: {
-        page: z7.number().int().min(0).default(0).describe("Page number"),
-        size: z7.number().int().min(1).max(100).default(20).describe("Page size")
+        page: z8.number().int().min(0).default(0).describe("Page number"),
+        size: z8.number().int().min(1).max(100).default(20).describe("Page size")
       }
     },
     async ({ page, size }) => callApi("GET", "replay/jobs", { params: paginationParams(page, size) })
@@ -4104,7 +4261,7 @@ function registerReplayTools(server, callApi) {
       title: "Cancel Replay Job",
       description: "Cooperatively cancel a PENDING or RUNNING window replay job. Other states are rejected. VIEWER role cannot cancel.",
       inputSchema: {
-        jobId: z7.string().describe("Replay job ID")
+        jobId: z8.string().describe("Replay job ID")
       }
     },
     async ({ jobId }) => callApi("POST", `replay/jobs/${jobId}/cancel`)
@@ -4112,7 +4269,7 @@ function registerReplayTools(server, callApi) {
 }
 // src/mcp/tools/history.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 function registerHistoryTools(server, callApi) {
   server.registerTool(
     "lexq_history_list",
@@ -4120,14 +4277,14 @@ function registerHistoryTools(server, callApi) {
       title: "List Execution History",
       description: "List policy execution history. Shows trace ID, group, version, status, match result, and latency.",
       inputSchema: {
-        page: z8.number().int().min(0).default(0).describe("Page number"),
-        size: z8.number().int().min(1).max(100).default(20).describe("Page size"),
-        traceId: z8.string().optional().describe("Filter by trace ID"),
-        groupId: z8.string().uuid().optional().describe("Filter by policy group"),
-        versionId: z8.string().uuid().optional().describe("Filter by version"),
-        status: z8.enum(["SUCCESS", "NO_MATCH", "ERROR", "TIMEOUT"]).optional().describe("Filter by execution status"),
-        startDate: z8.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z8.string().optional().describe("End date (yyyy-MM-dd)")
+        page: z9.number().int().min(0).default(0).describe("Page number"),
+        size: z9.number().int().min(1).max(100).default(20).describe("Page size"),
+        traceId: z9.string().optional().describe("Filter by trace ID"),
+        groupId: z9.string().uuid().optional().describe("Filter by policy group"),
+        versionId: z9.string().uuid().optional().describe("Filter by version"),
+        status: z9.enum(["SUCCESS", "NO_MATCH", "ERROR", "TIMEOUT"]).optional().describe("Filter by execution status"),
+        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ page, size, traceId, groupId, versionId, status, startDate, endDate }) => {
@@ -4147,7 +4304,7 @@ function registerHistoryTools(server, callApi) {
       title: "Get Execution Detail",
       description: "Get full execution detail including inputFacts, mutatedFacts, generatedVariables, executionTraces, and decisionTraces.",
       inputSchema: {
-        traceId: z8.string().describe("Trace ID from execution history")
+        traceId: z9.string().describe("Trace ID from execution history")
       }
     },
     async ({ traceId }) => callApi("GET", `execution/history/${traceId}`)
@@ -4158,9 +4315,9 @@ function registerHistoryTools(server, callApi) {
       title: "Execution Statistics",
       description: "Get execution KPIs: total executions, success/failure counts, success rate, and average latency.",
       inputSchema: {
-        groupId: z8.string().uuid().optional().describe("Filter by policy group"),
-        startDate: z8.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z8.string().optional().describe("End date (yyyy-MM-dd)")
+        groupId: z9.string().uuid().optional().describe("Filter by policy group"),
+        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ groupId, startDate, endDate }) => {
@@ -4174,7 +4331,7 @@ function registerHistoryTools(server, callApi) {
 }
 // src/mcp/tools/provenance.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 function registerProvenanceTools(server, callApi) {
   server.registerTool(
     "lexq_provenance_get",
@@ -4182,7 +4339,7 @@ function registerProvenanceTools(server, callApi) {
       title: "Get Decision Provenance",
       description: "Get the lineage of a single decision: what was decided, deterministic why per rule, input facts (PII facts are masked as \u2022\u2022\u2022\u2022\u2022\u2022 with maskedKeys listing them \u2014 values are revealable only in the console, audited), the authored/published/deployed responsibility chain, and the rule snapshot fingerprint.",
       inputSchema: {
-        traceId: z9.string().describe("Trace ID of the execution")
+        traceId: z10.string().describe("Trace ID of the execution")
       }
     },
     async ({ traceId }) => callApi("GET", `provenance/${traceId}`)
@@ -4193,13 +4350,13 @@ function registerProvenanceTools(server, callApi) {
       title: "List PII Reveal Audits",
       description: "List the PII reveal audit ledger \u2014 who revealed which fact of which trace, and when. Metadata only; revealed values are never stored or returned. Use for monthly access-log inspection and SIEM collection.",
       inputSchema: {
-        page: z9.number().int().min(0).default(0).describe("Page number"),
-        size: z9.number().int().min(1).max(100).default(20).describe("Page size"),
-        traceId: z9.string().optional().describe("Filter by trace ID (exact match)"),
-        revealedBy: z9.string().optional().describe("Filter by operator ID (exact match)"),
-        factKey: z9.string().optional().describe("Filter by fact key (partial match, case-insensitive)"),
-        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
+        page: z10.number().int().min(0).default(0).describe("Page number"),
+        size: z10.number().int().min(1).max(100).default(20).describe("Page size"),
+        traceId: z10.string().optional().describe("Filter by trace ID (exact match)"),
+        revealedBy: z10.string().optional().describe("Filter by operator ID (exact match)"),
+        factKey: z10.string().optional().describe("Filter by fact key (partial match, case-insensitive)"),
+        startDate: z10.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z10.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ page, size, traceId, revealedBy, factKey, startDate, endDate }) => {
@@ -4215,7 +4372,7 @@ function registerProvenanceTools(server, callApi) {
 }
 // src/mcp/tools/integrations.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 function registerIntegrationTools(server, callApi) {
   server.registerTool(
     "lexq_integrations_list",
@@ -4223,9 +4380,9 @@ function registerIntegrationTools(server, callApi) {
       title: "List Integrations",
       description: "List all external integrations (webhooks, CRM, notification, etc.).",
       inputSchema: {
-        page: z10.number().int().min(0).default(0).describe("Page number"),
-        size: z10.number().int().min(1).max(100).default(20).describe("Page size"),
-        type: z10.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).optional().describe("Filter by integration type")
+        page: z11.number().int().min(0).default(0).describe("Page number"),
+        size: z11.number().int().min(1).max(100).default(20).describe("Page size"),
+        type: z11.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).optional().describe("Filter by integration type")
       }
     },
     async ({ page, size, type }) => {
@@ -4240,7 +4397,7 @@ function registerIntegrationTools(server, callApi) {
       title: "Get Integration",
       description: "Get integration detail by ID.",
       inputSchema: {
-        integrationId: z10.string().uuid().describe("Integration ID")
+        integrationId: z11.string().uuid().describe("Integration ID")
       }
     },
     async ({ integrationId }) => callApi("GET", `integrations/${integrationId}`)
@@ -4251,13 +4408,13 @@ function registerIntegrationTools(server, callApi) {
       title: "Save Integration",
       description: "Create or update an integration. Provide id to update an existing one; omit id to create new. Types: COUPON, POINT, NOTIFICATION, CRM, MESSENGER, WEBHOOK.",
       inputSchema: {
-        id: z10.string().uuid().optional().describe("Integration ID (omit to create, provide to update)"),
-        type: z10.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).describe("Integration type"),
-        name: z10.string().describe("Integration name"),
-        baseUrl: z10.string().describe("Base URL of the external service"),
-        credential: z10.string().optional().describe("API key or token for the service"),
-        additionalConfig: z10.string().optional().describe("JSON string of additional config key-value pairs"),
-        isActive: z10.boolean().default(true).describe("Whether the integration is active")
+        id: z11.string().uuid().optional().describe("Integration ID (omit to create, provide to update)"),
+        type: z11.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).describe("Integration type"),
+        name: z11.string().describe("Integration name"),
+        baseUrl: z11.string().describe("Base URL of the external service"),
+        credential: z11.string().optional().describe("API key or token for the service"),
+        additionalConfig: z11.string().optional().describe("JSON string of additional config key-value pairs"),
+        isActive: z11.boolean().default(true).describe("Whether the integration is active")
       }
     },
     async ({ additionalConfig, ...rest }) => {
@@ -4272,7 +4429,7 @@ function registerIntegrationTools(server, callApi) {
       title: "Delete Integration",
       description: "Delete an integration by ID.",
       inputSchema: {
-        integrationId: z10.string().uuid().describe("Integration ID")
+        integrationId: z11.string().uuid().describe("Integration ID")
       }
     },
     async ({ integrationId }) => callApi("DELETE", `integrations/${integrationId}`)
@@ -4289,7 +4446,7 @@ function registerIntegrationTools(server, callApi) {
 }
 // src/mcp/tools/logs.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 function registerLogTools(server, callApi) {
   server.registerTool(
     "lexq_logs_list",
@@ -4297,14 +4454,14 @@ function registerLogTools(server, callApi) {
       title: "List Failure Logs",
       description: "List system failure logs from background tasks (webhook calls, coupon issuance, etc.).",
       inputSchema: {
-        page: z11.number().int().min(0).default(0).describe("Page number"),
-        size: z11.number().int().min(1).max(100).default(20).describe("Page size"),
-        category: z11.enum(TaskCategory).optional().describe("Task category"),
-        taskType: z11.enum(TaskType).optional().describe("Task type"),
-        status: z11.enum(FailureStatus).optional().describe("Log status"),
-        keyword: z11.string().optional().describe("Search in refId, refSubId, errorMessage"),
-        startDate: z11.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z11.string().optional().describe("End date (yyyy-MM-dd)")
+        page: z12.number().int().min(0).default(0).describe("Page number"),
+        size: z12.number().int().min(1).max(100).default(20).describe("Page size"),
+        category: z12.enum(TaskCategory).optional().describe("Task category"),
+        taskType: z12.enum(TaskType).optional().describe("Task type"),
+        status: z12.enum(FailureStatus).optional().describe("Log status"),
+        keyword: z12.string().optional().describe("Search in refId, refSubId, errorMessage"),
+        startDate: z12.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z12.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ page, size, category, taskType, status, keyword, startDate, endDate }) => {
@@ -4324,7 +4481,7 @@ function registerLogTools(server, callApi) {
       title: "Get Failure Log",
       description: "Get failure log detail by ID.",
       inputSchema: {
-        logId: z11.string().uuid().describe("Failure log ID")
+        logId: z12.string().uuid().describe("Failure log ID")
       }
     },
     async ({ logId }) => callApi("GET", `failure-logs/${logId}`)
@@ -4335,8 +4492,8 @@ function registerLogTools(server, callApi) {
       title: "Process Failure Log",
       description: "Process a single failure log: RETRY (re-execute with original payload), RESOLVE (mark as manually fixed), or IGNORE (skip intentionally).",
       inputSchema: {
-        logId: z11.string().uuid().describe("Failure log ID"),
-        action: z11.enum(FailureAction).describe("Action to take")
+        logId: z12.string().uuid().describe("Failure log ID"),
+        action: z12.enum(FailureAction).describe("Action to take")
       }
     },
     async ({ logId, action }) => callApi("POST", `failure-logs/${logId}/actions`, {
@@ -4349,8 +4506,8 @@ function registerLogTools(server, callApi) {
       title: "Bulk Process Failure Logs",
       description: "Process multiple failure logs at once. Provide an array of log IDs and the action.",
       inputSchema: {
-        logIds: z11.array(z11.string().uuid()).describe("Array of failure log IDs"),
-        action: z11.enum(FailureAction).describe("Action to apply to all logs")
+        logIds: z12.array(z12.string().uuid()).describe("Array of failure log IDs"),
+        action: z12.enum(FailureAction).describe("Action to apply to all logs")
       }
     },
     async ({ logIds, action }) => callApi("POST", "failure-logs/bulk-actions", {
@@ -4360,7 +4517,7 @@ function registerLogTools(server, callApi) {
 }
 // src/mcp/tools/webhook-subscriptions.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function registerWebhookSubscriptionTools(server, callApi) {
   server.registerTool(
     "lexq_webhook_subscriptions_list",
@@ -4368,8 +4525,8 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "List Webhook Subscriptions",
       description: "List platform event webhook subscriptions. These receive deployment lifecycle notifications (publish, deploy, rollback, undeploy).",
       inputSchema: {
-        page: z12.number().int().min(0).default(0).describe("Page number"),
-        size: z12.number().int().min(1).max(100).default(20).describe("Page size")
+        page: z13.number().int().min(0).default(0).describe("Page number"),
+        size: z13.number().int().min(1).max(100).default(20).describe("Page size")
       }
     },
     async ({ page, size }) => {
@@ -4383,7 +4540,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Get Webhook Subscription",
       description: "Get webhook subscription detail by ID.",
       inputSchema: {
-        id: z12.string().uuid().describe("Webhook subscription ID")
+        id: z13.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("GET", `webhook-subscriptions/${id}`)
@@ -4394,13 +4551,13 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Save Webhook Subscription",
       description: 'Create or update a webhook subscription. Omit id to create, provide id to update. Events: VERSION_PUBLISHED, DEPLOYED, ROLLED_BACK, UNDEPLOYED. Formats: GENERIC (full JSON), SLACK ({"text": "..."}).',
       inputSchema: {
-        id: z12.string().uuid().optional().describe("Subscription ID (omit to create, provide to update)"),
-        name: z12.string().min(1).describe("Subscription name (unique per tenant)"),
-        webhookUrl: z12.string().url().describe("Webhook endpoint URL"),
-        subscribedEvents: z12.array(z12.enum(PlatformEventType)).min(1).describe("Events to subscribe to"),
-        payloadFormat: z12.enum(WebhookPayloadFormat).optional().default("GENERIC").describe("Payload format"),
-        secret: z12.string().optional().describe("HMAC-SHA256 signing secret"),
-        isActive: z12.boolean().optional().default(true).describe("Whether the subscription is active")
+        id: z13.string().uuid().optional().describe("Subscription ID (omit to create, provide to update)"),
+        name: z13.string().min(1).describe("Subscription name (unique per tenant)"),
+        webhookUrl: z13.string().url().describe("Webhook endpoint URL"),
+        subscribedEvents: z13.array(z13.enum(PlatformEventType)).min(1).describe("Events to subscribe to"),
+        payloadFormat: z13.enum(WebhookPayloadFormat).optional().default("GENERIC").describe("Payload format"),
+        secret: z13.string().optional().describe("HMAC-SHA256 signing secret"),
+        isActive: z13.boolean().optional().default(true).describe("Whether the subscription is active")
       }
     },
     async ({ ...body }) => callApi("POST", "webhook-subscriptions", { body })
@@ -4411,7 +4568,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Delete Webhook Subscription",
       description: "Delete a webhook subscription by ID.",
       inputSchema: {
-        id: z12.string().uuid().describe("Webhook subscription ID")
+        id: z13.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("DELETE", `webhook-subscriptions/${id}`)
@@ -4422,7 +4579,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Test Webhook Subscription",
       description: "Send a test event to verify webhook connectivity. Returns the HTTP status code and success/failure message.",
       inputSchema: {
-        id: z12.string().uuid().describe("Webhook subscription ID")
+        id: z13.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("POST", `webhook-subscriptions/${id}/test`)
@@ -4430,7 +4587,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
 }
 // src/mcp/tools/domain-templates.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 function registerDomainTemplateTools(server, callApi) {
   server.registerTool(
     "lexq_domain_templates_list",
@@ -4447,7 +4604,7 @@ function registerDomainTemplateTools(server, callApi) {
       title: "Preview Domain Template",
       description: "Preview exactly what a domain template will provision before applying it: the fact definitions it registers, the sample rules it creates, and an apply plan. This is a read-only dry run \u2014 nothing is created. Only ACTIVE templates can be previewed.",
       inputSchema: {
-        template: z13.string().describe(
+        template: z14.string().describe(
           "Domain template key (e.g. ECOMMERCE). Use lexq_domain_templates_list to see available keys \u2014 currently only ECOMMERCE is ACTIVE."
         )
       }
@@ -4460,8 +4617,8 @@ function registerDomainTemplateTools(server, callApi) {
       title: "Apply Domain Template",
       description: "Apply a domain template to the current tenant. Creates the template's fact definitions and a new policy group pre-populated with its sample rules as a DRAFT version. Existing facts are skipped \u2014 apply is additive and never overwrites existing schema. Run lexq_domain_templates_preview first to review what will be created. Only ACTIVE templates can be applied.",
       inputSchema: {
-        template: z13.string().describe("Domain template key to apply (e.g. ECOMMERCE)."),
-        customName: z13.string().optional().describe(
+        template: z14.string().describe("Domain template key to apply (e.g. ECOMMERCE)."),
+        customName: z14.string().optional().describe(
           "Optional custom name for the policy group that gets created. If omitted, the template's default name is used."
         )
       }
@@ -4483,6 +4640,7 @@ function registerAllTools(server, callApi) {
   registerFactTools(server, callApi);
   registerDeployTools(server, callApi);
   registerAnalyticsTools(server, callApi);
+  registerProfileTools(server, callApi);
   registerReplayTools(server, callApi);
   registerHistoryTools(server, callApi);
   registerProvenanceTools(server, callApi);
@@ -4517,7 +4675,7 @@ async function startMcpServer() {
 function registerServeCommand(program) {
   program.command("serve").description("Start LexQ as a server for AI agent integrations").option("--mcp", "Start as MCP (Model Context Protocol) server over stdio").addHelpText(
     "after",
-    dedent17`
+    dedent18`
         Example:
           $ lexq serve --mcp
@@ -4548,11 +4706,11 @@ function registerServeCommand(program) {
 // src/commands/domain-templates.ts
 import "commander";
-import dedent18 from "dedent";
+import dedent19 from "dedent";
 function registerDomainTemplateCommands(program) {
   const templates = program.command("domain-templates").description("Browse and apply domain templates").addHelpText(
     "after",
-    dedent18`
+    dedent19`
         A domain template is an industry-specific starter pack of fact
         definitions and sample rules. Applying one provisions a ready-to-use
@@ -4600,7 +4758,7 @@ function registerDomainTemplateCommands(program) {
   });
   templates.command("preview").description("Preview what a domain template provisions").requiredOption("--template <key>", "Domain template key (e.g. ECOMMERCE)").addHelpText(
     "after",
-    dedent18`
+    dedent19`
         Read-only dry run — shows the fact definitions and sample rules the
         template will create. Nothing is provisioned.
@@ -4629,7 +4787,7 @@ function registerDomainTemplateCommands(program) {
   });
   templates.command("apply").description("Apply a domain template to the current tenant").requiredOption("--template <key>", "Domain template key (e.g. ECOMMERCE)").option("--name <n>", "Custom name for the policy group that gets created").option("--force", "Skip confirmation prompt").addHelpText(
     "after",
-    dedent18`
+    dedent19`
         Creates the template's fact definitions and a new DRAFT policy group
         populated with its sample rules. Existing facts are skipped — apply is
@@ -4704,6 +4862,7 @@ function createCli() {
   registerDomainTemplateCommands(program);
   registerDeployCommands(program);
   registerAnalyticsCommands(program);
+  registerProfileCommands(program);
   registerHistoryCommands(program);
   registerReplayCommands(program);
   registerProvenanceCommands(program);