@lexq/cli 0.1.35 → 0.1.37

package/dist/mcp/register.js

@@ -432,7 +432,7 @@ function registerFactTools(server, callApi) {
     "lexq_facts_list",
     {
       title: "List Fact Definitions",
-      description: "List all fact definitions (input variable schema). Shows key, type, and required status. Always check this before creating rules.",
+      description: "List all fact definitions (input variable schema). Shows key, type, required, and PII status. Always check this before creating rules.",
       inputSchema: {
         page: z4.number().int().min(0).default(0).describe("Page number"),
         size: z4.number().int().min(1).max(100).default(20).describe("Page size"),
@@ -455,7 +455,10 @@ function registerFactTools(server, callApi) {
         name: z4.string().describe("Display name"),
         type: z4.enum(["STRING", "NUMBER", "BOOLEAN", "LIST_STRING", "LIST_NUMBER"]).describe("Value type"),
         description: z4.string().optional().describe("Description"),
-        isRequired: z4.boolean().default(false).describe("Whether this fact is required for rule evaluation")
+        isRequired: z4.boolean().default(false).describe("Whether this fact is required for rule evaluation"),
+        isPii: z4.boolean().default(false).describe(
+          "Mark as PII \u2014 masked on every read surface, revealable only in the console (audited)"
+        )
       }
     },
     async (args) => callApi("POST", "schema/facts", { body: args })
@@ -464,12 +467,13 @@ function registerFactTools(server, callApi) {
     "lexq_facts_update",
     {
       title: "Update Fact Definition",
-      description: "Update a fact definition. Key and type cannot be changed. Only provided fields are updated. System facts only allow name and description changes.",
+      description: "Update a fact definition. Key and type cannot be changed. Only provided fields are updated. System facts only allow name, description, and PII changes.",
       inputSchema: {
         factId: z4.string().uuid().describe("Fact definition ID"),
         name: z4.string().optional().describe("Display name"),
         description: z4.string().optional().describe("Description"),
-        isRequired: z4.boolean().optional().describe("Required flag")
+        isRequired: z4.boolean().optional().describe("Required flag"),
+        isPii: z4.boolean().optional().describe("PII flag \u2014 enables/disables masking (changeable even on system facts)")
       }
     },
     async ({ factId, ...body }) => callApi("PUT", `schema/facts/${factId}`, { body })
@@ -867,8 +871,56 @@ function registerAnalyticsTools(server, callApi) {
   );
 }
 
-// src/mcp/tools/replay.ts
+// src/mcp/tools/profile.ts
 import { z as z7 } from "zod";
+var RELATIVE_THRESHOLD = "flagged = p50 \u2265 10\xD7 median of per-rule p50s within the group; absolute thresholds are intentionally not supported.";
+function profileParams(opts) {
+  const params = {};
+  if (opts.versionId) params.versionId = opts.versionId;
+  if (opts.from) params.from = opts.from;
+  if (opts.to) params.to = opts.to;
+  if (opts.cacheState) params.cacheState = opts.cacheState;
+  return params;
+}
+function registerProfileTools(server, callApi) {
+  server.registerTool(
+    "lexq_profile_overview",
+    {
+      title: "Group Latency Profile",
+      description: "Per-rule latency profile of a policy group over a time window: group TOTAL distribution split by cache state (HIT = compiled ruleset cache hit, MISS = deep-load + compile), a per-rule CONDITION/ACTION percentile table, and slow-rule flags. " + RELATIVE_THRESHOLD + " Every percentile is accompanied by its sample count n; percentiles are withheld (null) when n < 100, and baselines report INSUFFICIENT_COHORT when fewer than 3 rules qualify. Rule detail comes from a deterministic 1% sample of calls; TOTAL is recorded for every call. Defaults: last 24h, live version, cacheState HIT.",
+      inputSchema: {
+        groupId: z7.string().uuid().describe("Policy group ID"),
+        versionId: z7.string().uuid().optional().describe("Version to inspect (default: live version)"),
+        from: z7.string().optional().describe("Window start, ISO-8601 instant (e.g. 2026-07-01T00:00:00Z). Default: 24h ago"),
+        to: z7.string().optional().describe("Window end, ISO-8601 instant. Default: now"),
+        cacheState: z7.enum(["HIT", "MISS"]).optional().describe("Cache dimension for the rule table and judgment (default: HIT)")
+      }
+    },
+    async ({ groupId, versionId, from, to, cacheState }) => callApi("GET", `policy-groups/${groupId}/profile`, {
+      params: profileParams({ versionId, from, to, cacheState })
+    })
+  );
+  server.registerTool(
+    "lexq_profile_rule",
+    {
+      title: "Rule Latency Detail",
+      description: "Single-rule latency detail: merged phase \xD7 cacheState distributions plus a per-window time series (60s windows). Missing windows are genuine gaps \u2014 never interpolated. Series points carry each window's own values; percentiles in merged distributions are withheld (null) when n < 100. " + RELATIVE_THRESHOLD,
+      inputSchema: {
+        groupId: z7.string().uuid().describe("Policy group ID"),
+        ruleId: z7.string().uuid().describe("Rule ID (from lexq_profile_overview)"),
+        versionId: z7.string().uuid().optional().describe("Version to inspect (default: live version)"),
+        from: z7.string().optional().describe("Window start, ISO-8601 instant. Default: 24h ago"),
+        to: z7.string().optional().describe("Window end, ISO-8601 instant. Default: now")
+      }
+    },
+    async ({ groupId, ruleId, versionId, from, to }) => callApi("GET", `policy-groups/${groupId}/profile/rules/${ruleId}`, {
+      params: profileParams({ versionId, from, to })
+    })
+  );
+}
+
+// src/mcp/tools/replay.ts
+import { z as z8 } from "zod";
 function registerReplayTools(server, callApi) {
   server.registerTool(
     "lexq_replay_decision",
@@ -876,8 +928,8 @@ function registerReplayTools(server, callApi) {
       title: "Replay a Decision",
       description: "Re-evaluate a past execution (traceId) against a candidate version and return the decision diff (decisionChanged, effect changes, fired rules) plus a determinism verdict. Synchronous and free of charge (TPS throttle only). External effects (webhooks, notifications) are always mocked \u2014 nothing fires.",
       inputSchema: {
-        traceId: z7.string().describe("Trace ID of the past execution to replay"),
-        candidateVersionId: z7.string().uuid().describe("Version to re-evaluate against")
+        traceId: z8.string().describe("Trace ID of the past execution to replay"),
+        candidateVersionId: z8.string().uuid().describe("Version to re-evaluate against")
       }
     },
     async ({ traceId, candidateVersionId }) => callApi("POST", "replay/decisions", { body: { traceId, candidateVersionId } })
@@ -888,10 +940,10 @@ function registerReplayTools(server, callApi) {
       title: "Start Window Replay (Blast Radius)",
       description: "Submit an async job that replays a date window of past executions against a candidate version and measures the blast radius (how many decisions change). Billed per replayed record (REPLAY metric); VIEWER role cannot submit. Poll with lexq_replay_status.",
       inputSchema: {
-        candidateVersionId: z7.string().uuid().describe("Version to re-evaluate against"),
-        from: z7.string().describe("Window start date (yyyy-MM-dd)"),
-        to: z7.string().describe("Window end date (yyyy-MM-dd)"),
-        maxRecords: z7.number().int().min(1).optional().describe("Sample cap (server default applies; hard cap 50k)")
+        candidateVersionId: z8.string().uuid().describe("Version to re-evaluate against"),
+        from: z8.string().describe("Window start date (yyyy-MM-dd)"),
+        to: z8.string().describe("Window end date (yyyy-MM-dd)"),
+        maxRecords: z8.number().int().min(1).optional().describe("Sample cap (server default applies; hard cap 50k)")
       }
     },
     async ({ candidateVersionId, from, to, maxRecords }) => callApi("POST", "replay/jobs", { body: { candidateVersionId, from, to, maxRecords } })
@@ -902,7 +954,7 @@ function registerReplayTools(server, callApi) {
       title: "Get Replay Job Status",
       description: "Poll a window replay job. RUNNING shows progress 0\u2013100; COMPLETED fills summary and changedSamples; FAILED carries errorMessage. capped=true means the window exceeded the sample cap and only part was replayed.",
       inputSchema: {
-        jobId: z7.string().describe("Replay job ID from lexq_replay_start")
+        jobId: z8.string().describe("Replay job ID from lexq_replay_start")
       }
     },
     async ({ jobId }) => callApi("GET", `replay/jobs/${jobId}`)
@@ -913,8 +965,8 @@ function registerReplayTools(server, callApi) {
       title: "List Replay Jobs",
       description: "List window replay job history (reverse-chronological). Lightweight items \u2014 use lexq_replay_status for summary and changed samples.",
       inputSchema: {
-        page: z7.number().int().min(0).default(0).describe("Page number"),
-        size: z7.number().int().min(1).max(100).default(20).describe("Page size")
+        page: z8.number().int().min(0).default(0).describe("Page number"),
+        size: z8.number().int().min(1).max(100).default(20).describe("Page size")
       }
     },
     async ({ page, size }) => callApi("GET", "replay/jobs", { params: paginationParams(page, size) })
@@ -925,7 +977,7 @@ function registerReplayTools(server, callApi) {
       title: "Cancel Replay Job",
       description: "Cooperatively cancel a PENDING or RUNNING window replay job. Other states are rejected. VIEWER role cannot cancel.",
       inputSchema: {
-        jobId: z7.string().describe("Replay job ID")
+        jobId: z8.string().describe("Replay job ID")
       }
     },
     async ({ jobId }) => callApi("POST", `replay/jobs/${jobId}/cancel`)
@@ -933,7 +985,7 @@ function registerReplayTools(server, callApi) {
 }
 
 // src/mcp/tools/history.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 function registerHistoryTools(server, callApi) {
   server.registerTool(
     "lexq_history_list",
@@ -941,14 +993,14 @@ function registerHistoryTools(server, callApi) {
       title: "List Execution History",
       description: "List policy execution history. Shows trace ID, group, version, status, match result, and latency.",
       inputSchema: {
-        page: z8.number().int().min(0).default(0).describe("Page number"),
-        size: z8.number().int().min(1).max(100).default(20).describe("Page size"),
-        traceId: z8.string().optional().describe("Filter by trace ID"),
-        groupId: z8.string().uuid().optional().describe("Filter by policy group"),
-        versionId: z8.string().uuid().optional().describe("Filter by version"),
-        status: z8.enum(["SUCCESS", "NO_MATCH", "ERROR", "TIMEOUT"]).optional().describe("Filter by execution status"),
-        startDate: z8.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z8.string().optional().describe("End date (yyyy-MM-dd)")
+        page: z9.number().int().min(0).default(0).describe("Page number"),
+        size: z9.number().int().min(1).max(100).default(20).describe("Page size"),
+        traceId: z9.string().optional().describe("Filter by trace ID"),
+        groupId: z9.string().uuid().optional().describe("Filter by policy group"),
+        versionId: z9.string().uuid().optional().describe("Filter by version"),
+        status: z9.enum(["SUCCESS", "NO_MATCH", "ERROR", "TIMEOUT"]).optional().describe("Filter by execution status"),
+        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ page, size, traceId, groupId, versionId, status, startDate, endDate }) => {
@@ -968,7 +1020,7 @@ function registerHistoryTools(server, callApi) {
       title: "Get Execution Detail",
       description: "Get full execution detail including inputFacts, mutatedFacts, generatedVariables, executionTraces, and decisionTraces.",
       inputSchema: {
-        traceId: z8.string().describe("Trace ID from execution history")
+        traceId: z9.string().describe("Trace ID from execution history")
       }
     },
     async ({ traceId }) => callApi("GET", `execution/history/${traceId}`)
@@ -979,9 +1031,9 @@ function registerHistoryTools(server, callApi) {
       title: "Execution Statistics",
       description: "Get execution KPIs: total executions, success/failure counts, success rate, and average latency.",
       inputSchema: {
-        groupId: z8.string().uuid().optional().describe("Filter by policy group"),
-        startDate: z8.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z8.string().optional().describe("End date (yyyy-MM-dd)")
+        groupId: z9.string().uuid().optional().describe("Filter by policy group"),
+        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ groupId, startDate, endDate }) => {
@@ -995,7 +1047,7 @@ function registerHistoryTools(server, callApi) {
 }
 
 // src/mcp/tools/provenance.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 function registerProvenanceTools(server, callApi) {
   server.registerTool(
     "lexq_provenance_get",
@@ -1003,7 +1055,7 @@ function registerProvenanceTools(server, callApi) {
       title: "Get Decision Provenance",
       description: "Get the lineage of a single decision: what was decided, deterministic why per rule, input facts (PII facts are masked as \u2022\u2022\u2022\u2022\u2022\u2022 with maskedKeys listing them \u2014 values are revealable only in the console, audited), the authored/published/deployed responsibility chain, and the rule snapshot fingerprint.",
       inputSchema: {
-        traceId: z9.string().describe("Trace ID of the execution")
+        traceId: z10.string().describe("Trace ID of the execution")
       }
     },
     async ({ traceId }) => callApi("GET", `provenance/${traceId}`)
@@ -1014,13 +1066,13 @@ function registerProvenanceTools(server, callApi) {
       title: "List PII Reveal Audits",
       description: "List the PII reveal audit ledger \u2014 who revealed which fact of which trace, and when. Metadata only; revealed values are never stored or returned. Use for monthly access-log inspection and SIEM collection.",
       inputSchema: {
-        page: z9.number().int().min(0).default(0).describe("Page number"),
-        size: z9.number().int().min(1).max(100).default(20).describe("Page size"),
-        traceId: z9.string().optional().describe("Filter by trace ID (exact match)"),
-        revealedBy: z9.string().optional().describe("Filter by operator ID (exact match)"),
-        factKey: z9.string().optional().describe("Filter by fact key (partial match, case-insensitive)"),
-        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
+        page: z10.number().int().min(0).default(0).describe("Page number"),
+        size: z10.number().int().min(1).max(100).default(20).describe("Page size"),
+        traceId: z10.string().optional().describe("Filter by trace ID (exact match)"),
+        revealedBy: z10.string().optional().describe("Filter by operator ID (exact match)"),
+        factKey: z10.string().optional().describe("Filter by fact key (partial match, case-insensitive)"),
+        startDate: z10.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z10.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ page, size, traceId, revealedBy, factKey, startDate, endDate }) => {
@@ -1036,7 +1088,7 @@ function registerProvenanceTools(server, callApi) {
 }
 
 // src/mcp/tools/integrations.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 function registerIntegrationTools(server, callApi) {
   server.registerTool(
     "lexq_integrations_list",
@@ -1044,9 +1096,9 @@ function registerIntegrationTools(server, callApi) {
       title: "List Integrations",
       description: "List all external integrations (webhooks, CRM, notification, etc.).",
       inputSchema: {
-        page: z10.number().int().min(0).default(0).describe("Page number"),
-        size: z10.number().int().min(1).max(100).default(20).describe("Page size"),
-        type: z10.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).optional().describe("Filter by integration type")
+        page: z11.number().int().min(0).default(0).describe("Page number"),
+        size: z11.number().int().min(1).max(100).default(20).describe("Page size"),
+        type: z11.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).optional().describe("Filter by integration type")
       }
     },
     async ({ page, size, type }) => {
@@ -1061,7 +1113,7 @@ function registerIntegrationTools(server, callApi) {
       title: "Get Integration",
       description: "Get integration detail by ID.",
       inputSchema: {
-        integrationId: z10.string().uuid().describe("Integration ID")
+        integrationId: z11.string().uuid().describe("Integration ID")
       }
     },
     async ({ integrationId }) => callApi("GET", `integrations/${integrationId}`)
@@ -1072,13 +1124,13 @@ function registerIntegrationTools(server, callApi) {
       title: "Save Integration",
       description: "Create or update an integration. Provide id to update an existing one; omit id to create new. Types: COUPON, POINT, NOTIFICATION, CRM, MESSENGER, WEBHOOK.",
       inputSchema: {
-        id: z10.string().uuid().optional().describe("Integration ID (omit to create, provide to update)"),
-        type: z10.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).describe("Integration type"),
-        name: z10.string().describe("Integration name"),
-        baseUrl: z10.string().describe("Base URL of the external service"),
-        credential: z10.string().optional().describe("API key or token for the service"),
-        additionalConfig: z10.string().optional().describe("JSON string of additional config key-value pairs"),
-        isActive: z10.boolean().default(true).describe("Whether the integration is active")
+        id: z11.string().uuid().optional().describe("Integration ID (omit to create, provide to update)"),
+        type: z11.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).describe("Integration type"),
+        name: z11.string().describe("Integration name"),
+        baseUrl: z11.string().describe("Base URL of the external service"),
+        credential: z11.string().optional().describe("API key or token for the service"),
+        additionalConfig: z11.string().optional().describe("JSON string of additional config key-value pairs"),
+        isActive: z11.boolean().default(true).describe("Whether the integration is active")
       }
     },
     async ({ additionalConfig, ...rest }) => {
@@ -1093,7 +1145,7 @@ function registerIntegrationTools(server, callApi) {
       title: "Delete Integration",
       description: "Delete an integration by ID.",
       inputSchema: {
-        integrationId: z10.string().uuid().describe("Integration ID")
+        integrationId: z11.string().uuid().describe("Integration ID")
       }
     },
     async ({ integrationId }) => callApi("DELETE", `integrations/${integrationId}`)
@@ -1110,7 +1162,7 @@ function registerIntegrationTools(server, callApi) {
 }
 
 // src/mcp/tools/logs.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 
 // src/types/enums.ts
 var FailureStatus = ["PENDING", "RESOLVED", "IGNORED"];
@@ -1148,14 +1200,14 @@ function registerLogTools(server, callApi) {
       title: "List Failure Logs",
       description: "List system failure logs from background tasks (webhook calls, coupon issuance, etc.).",
       inputSchema: {
-        page: z11.number().int().min(0).default(0).describe("Page number"),
-        size: z11.number().int().min(1).max(100).default(20).describe("Page size"),
-        category: z11.enum(TaskCategory).optional().describe("Task category"),
-        taskType: z11.enum(TaskType).optional().describe("Task type"),
-        status: z11.enum(FailureStatus).optional().describe("Log status"),
-        keyword: z11.string().optional().describe("Search in refId, refSubId, errorMessage"),
-        startDate: z11.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z11.string().optional().describe("End date (yyyy-MM-dd)")
+        page: z12.number().int().min(0).default(0).describe("Page number"),
+        size: z12.number().int().min(1).max(100).default(20).describe("Page size"),
+        category: z12.enum(TaskCategory).optional().describe("Task category"),
+        taskType: z12.enum(TaskType).optional().describe("Task type"),
+        status: z12.enum(FailureStatus).optional().describe("Log status"),
+        keyword: z12.string().optional().describe("Search in refId, refSubId, errorMessage"),
+        startDate: z12.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z12.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ page, size, category, taskType, status, keyword, startDate, endDate }) => {
@@ -1175,7 +1227,7 @@ function registerLogTools(server, callApi) {
       title: "Get Failure Log",
       description: "Get failure log detail by ID.",
       inputSchema: {
-        logId: z11.string().uuid().describe("Failure log ID")
+        logId: z12.string().uuid().describe("Failure log ID")
       }
     },
     async ({ logId }) => callApi("GET", `failure-logs/${logId}`)
@@ -1186,8 +1238,8 @@ function registerLogTools(server, callApi) {
       title: "Process Failure Log",
       description: "Process a single failure log: RETRY (re-execute with original payload), RESOLVE (mark as manually fixed), or IGNORE (skip intentionally).",
       inputSchema: {
-        logId: z11.string().uuid().describe("Failure log ID"),
-        action: z11.enum(FailureAction).describe("Action to take")
+        logId: z12.string().uuid().describe("Failure log ID"),
+        action: z12.enum(FailureAction).describe("Action to take")
       }
     },
     async ({ logId, action }) => callApi("POST", `failure-logs/${logId}/actions`, {
@@ -1200,8 +1252,8 @@ function registerLogTools(server, callApi) {
       title: "Bulk Process Failure Logs",
       description: "Process multiple failure logs at once. Provide an array of log IDs and the action.",
       inputSchema: {
-        logIds: z11.array(z11.string().uuid()).describe("Array of failure log IDs"),
-        action: z11.enum(FailureAction).describe("Action to apply to all logs")
+        logIds: z12.array(z12.string().uuid()).describe("Array of failure log IDs"),
+        action: z12.enum(FailureAction).describe("Action to apply to all logs")
       }
     },
     async ({ logIds, action }) => callApi("POST", "failure-logs/bulk-actions", {
@@ -1211,7 +1263,7 @@ function registerLogTools(server, callApi) {
 }
 
 // src/mcp/tools/webhook-subscriptions.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function registerWebhookSubscriptionTools(server, callApi) {
   server.registerTool(
     "lexq_webhook_subscriptions_list",
@@ -1219,8 +1271,8 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "List Webhook Subscriptions",
       description: "List platform event webhook subscriptions. These receive deployment lifecycle notifications (publish, deploy, rollback, undeploy).",
       inputSchema: {
-        page: z12.number().int().min(0).default(0).describe("Page number"),
-        size: z12.number().int().min(1).max(100).default(20).describe("Page size")
+        page: z13.number().int().min(0).default(0).describe("Page number"),
+        size: z13.number().int().min(1).max(100).default(20).describe("Page size")
       }
     },
     async ({ page, size }) => {
@@ -1234,7 +1286,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Get Webhook Subscription",
       description: "Get webhook subscription detail by ID.",
       inputSchema: {
-        id: z12.string().uuid().describe("Webhook subscription ID")
+        id: z13.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("GET", `webhook-subscriptions/${id}`)
@@ -1245,13 +1297,13 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Save Webhook Subscription",
       description: 'Create or update a webhook subscription. Omit id to create, provide id to update. Events: VERSION_PUBLISHED, DEPLOYED, ROLLED_BACK, UNDEPLOYED. Formats: GENERIC (full JSON), SLACK ({"text": "..."}).',
       inputSchema: {
-        id: z12.string().uuid().optional().describe("Subscription ID (omit to create, provide to update)"),
-        name: z12.string().min(1).describe("Subscription name (unique per tenant)"),
-        webhookUrl: z12.string().url().describe("Webhook endpoint URL"),
-        subscribedEvents: z12.array(z12.enum(PlatformEventType)).min(1).describe("Events to subscribe to"),
-        payloadFormat: z12.enum(WebhookPayloadFormat).optional().default("GENERIC").describe("Payload format"),
-        secret: z12.string().optional().describe("HMAC-SHA256 signing secret"),
-        isActive: z12.boolean().optional().default(true).describe("Whether the subscription is active")
+        id: z13.string().uuid().optional().describe("Subscription ID (omit to create, provide to update)"),
+        name: z13.string().min(1).describe("Subscription name (unique per tenant)"),
+        webhookUrl: z13.string().url().describe("Webhook endpoint URL"),
+        subscribedEvents: z13.array(z13.enum(PlatformEventType)).min(1).describe("Events to subscribe to"),
+        payloadFormat: z13.enum(WebhookPayloadFormat).optional().default("GENERIC").describe("Payload format"),
+        secret: z13.string().optional().describe("HMAC-SHA256 signing secret"),
+        isActive: z13.boolean().optional().default(true).describe("Whether the subscription is active")
       }
     },
     async ({ ...body }) => callApi("POST", "webhook-subscriptions", { body })
@@ -1262,7 +1314,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Delete Webhook Subscription",
       description: "Delete a webhook subscription by ID.",
       inputSchema: {
-        id: z12.string().uuid().describe("Webhook subscription ID")
+        id: z13.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("DELETE", `webhook-subscriptions/${id}`)
@@ -1273,7 +1325,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Test Webhook Subscription",
       description: "Send a test event to verify webhook connectivity. Returns the HTTP status code and success/failure message.",
       inputSchema: {
-        id: z12.string().uuid().describe("Webhook subscription ID")
+        id: z13.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("POST", `webhook-subscriptions/${id}/test`)
@@ -1281,7 +1333,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
 }
 
 // src/mcp/tools/domain-templates.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 function registerDomainTemplateTools(server, callApi) {
   server.registerTool(
     "lexq_domain_templates_list",
@@ -1298,7 +1350,7 @@ function registerDomainTemplateTools(server, callApi) {
       title: "Preview Domain Template",
       description: "Preview exactly what a domain template will provision before applying it: the fact definitions it registers, the sample rules it creates, and an apply plan. This is a read-only dry run \u2014 nothing is created. Only ACTIVE templates can be previewed.",
       inputSchema: {
-        template: z13.string().describe(
+        template: z14.string().describe(
           "Domain template key (e.g. ECOMMERCE). Use lexq_domain_templates_list to see available keys \u2014 currently only ECOMMERCE is ACTIVE."
         )
       }
@@ -1311,8 +1363,8 @@ function registerDomainTemplateTools(server, callApi) {
       title: "Apply Domain Template",
       description: "Apply a domain template to the current tenant. Creates the template's fact definitions and a new policy group pre-populated with its sample rules as a DRAFT version. Existing facts are skipped \u2014 apply is additive and never overwrites existing schema. Run lexq_domain_templates_preview first to review what will be created. Only ACTIVE templates can be applied.",
       inputSchema: {
-        template: z13.string().describe("Domain template key to apply (e.g. ECOMMERCE)."),
-        customName: z13.string().optional().describe(
+        template: z14.string().describe("Domain template key to apply (e.g. ECOMMERCE)."),
+        customName: z14.string().optional().describe(
           "Optional custom name for the policy group that gets created. If omitted, the template's default name is used."
         )
       }
@@ -1334,6 +1386,7 @@ function registerAllTools(server, callApi) {
   registerFactTools(server, callApi);
   registerDeployTools(server, callApi);
   registerAnalyticsTools(server, callApi);
+  registerProfileTools(server, callApi);
   registerReplayTools(server, callApi);
   registerHistoryTools(server, callApi);
   registerProvenanceTools(server, callApi);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lexq/cli",
-  "version": "0.1.35",
+  "version": "0.1.37",
   "description": "LexQ CLI — manage policies, simulate rules, and deploy from the terminal. Built for humans and AI agents.",
   "type": "module",
   "bin": {