@lexq/cli 0.1.36 → 0.1.37

package/dist/index.js

@@ -2183,13 +2183,140 @@ function resolveBody(opts) {
   return {};
 }
 
-// src/commands/history.ts
+// src/commands/profile.ts
 import "commander";
 import dedent9 from "dedent";
+
+// src/types/enums.ts
+var ProfileCacheState = ["HIT", "MISS"];
+var FailureStatus = ["PENDING", "RESOLVED", "IGNORED"];
+var FailureAction = ["RETRY", "IGNORE", "RESOLVE"];
+var TaskCategory = ["INTEGRATION", "INTERNAL"];
+var TaskType = [
+  // Integration
+  "COUPON_ISSUE",
+  "COUPON_CANCEL",
+  "POINT_EARN",
+  "POINT_USE",
+  "POINT_REFUND",
+  "NOTIFICATION_SEND",
+  "CRM_SYNC_USER",
+  "CRM_ADD_TAG",
+  "WEBHOOK_EXECUTE",
+  // Internal
+  "IMAGE_PROCESSING",
+  "DAILY_SETTLEMENT",
+  "PLATFORM_WEBHOOK"
+];
+var PlatformEventType = [
+  "VERSION_PUBLISHED",
+  "DEPLOYED",
+  "ROLLED_BACK",
+  "UNDEPLOYED"
+];
+var WebhookPayloadFormat = ["GENERIC", "SLACK"];
+
+// src/commands/profile.ts
+var ms = (nanos) => nanos == null ? "\u2013" : (nanos / 1e6).toFixed(2);
+var msWithUnit = (nanos) => nanos == null ? "\u2013" : `${(nanos / 1e6).toFixed(2)}ms`;
+function registerProfileCommands(program) {
+  program.command("profile <groupId>").description("Per-rule latency profile with relative slow-rule flags").option("--rule <ruleId>", "Single-rule detail (distributions + 60s window series)").option("--version <versionId>", "Version to inspect (default: live version)").option("--from <instant>", "Window start, ISO-8601 instant (default: 24h ago)").option("--to <instant>", "Window end, ISO-8601 instant (default: now)").option("--cache <state>", "Cache dimension for the rule table: HIT | MISS (default: HIT)").addHelpText(
+    "after",
+    dedent9`
+
+        Slow-rule judgment is relative only: flagged = p50 ≥ 10× the median of
+        per-rule p50s within the group. Absolute ms thresholds are intentionally
+        not supported. Percentiles are withheld (–) when n < 100; TOTAL is
+        recorded for every call, rule detail from a deterministic 1% sample.
+
+        Examples:
+          $ lexq profile <groupId>
+          $ lexq profile <groupId> --cache MISS --from 2026-07-01T00:00:00Z
+          $ lexq profile <groupId> --rule <ruleId> --version <versionId>
+      `
+  ).action(async (groupId, opts) => {
+    try {
+      const globalOpts = program.opts();
+      const format = globalOpts.format ?? "json";
+      if (opts.cache && !ProfileCacheState.includes(opts.cache)) {
+        throw new Error(`--cache must be one of: ${ProfileCacheState.join(" | ")}`);
+      }
+      const params = {};
+      if (opts.version) params.versionId = opts.version;
+      if (opts.from) params.from = opts.from;
+      if (opts.to) params.to = opts.to;
+      if (opts.cache) params.cacheState = opts.cache;
+      const clientOpts = {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose
+      };
+      if (opts.rule) {
+        const data2 = await apiRequest(
+          "GET",
+          `policy-groups/${groupId}/profile/rules/${opts.rule}`,
+          { ...clientOpts, params }
+        );
+        if (format === "table") {
+          console.error("note: --rule detail is nested; printing JSON (table not supported)");
+        }
+        printJson(data2);
+        return;
+      }
+      const data = await apiRequest("GET", `policy-groups/${groupId}/profile`, {
+        ...clientOpts,
+        params
+      });
+      if (format !== "table") {
+        printJson(data);
+        return;
+      }
+      console.log(`window   : ${data.from} ~ ${data.to}  (cache: ${data.ruleCacheState})`);
+      console.log(`version  : ${data.policyVersionId ?? "\u2013 (no live version)"}`);
+      for (const s of data.summary) {
+        const t = s.total;
+        console.log(
+          `TOTAL ${s.cacheState.padEnd(4)}: n=${t.n}  p50=${msWithUnit(t.p50Nanos)}  p95=${msWithUnit(t.p95Nanos)}  p99=${msWithUnit(t.p99Nanos)}`
+        );
+      }
+      for (const b of data.baselines) {
+        const base = b.status === "OK" ? `${msWithUnit(b.baselineP50Nanos)} (cohort ${b.cohortSize})` : `\u2013 (${b.status}, cohort ${b.cohortSize})`;
+        console.log(`baseline ${b.phase.padEnd(9)}: ${base}`);
+      }
+      if (data.droppedRows > 0) {
+        console.log(`\u26A0 droppedRows=${data.droppedRows} (corrupt histogram rows skipped)`);
+      }
+      printTable(
+        ["Rule", "Phase", "n", "p50(ms)", "p95(ms)", "p99(ms)", "\xD7base", "Flagged"],
+        data.rules.flatMap(
+          (rule) => rule.phases.map((p) => [
+            rule.ruleId.substring(0, 12),
+            p.phase,
+            String(p.stats.n),
+            ms(p.stats.p50Nanos),
+            ms(p.stats.p95Nanos),
+            ms(p.stats.p99Nanos),
+            p.baselineMultiple == null ? "\u2013" : `${p.baselineMultiple.toFixed(1)}\xD7`,
+            p.flagged ? "YES" : ""
+          ])
+        ),
+        { truncate: 24 }
+      );
+    } catch (error) {
+      printError(error);
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/history.ts
+import "commander";
+import dedent10 from "dedent";
 function registerHistoryCommands(program) {
   const history = program.command("history").description("Execution history").addHelpText(
     "after",
-    dedent9`
+    dedent10`
 
         View and analyze policy execution logs from production traffic.
 
@@ -2203,7 +2330,7 @@ function registerHistoryCommands(program) {
   );
   history.command("list").description("List execution history").option("--trace-id <traceId>", "Filter by trace ID").option("--group-id <groupId>", "Filter by policy group").option("--version-id <versionId>", "Filter by version").option("--status <status>", "Filter by status (SUCCESS, NO_MATCH, ERROR, TIMEOUT)").option("--start-date <date>", "Start date (yyyy-MM-dd)").option("--end-date <date>", "End date (yyyy-MM-dd)").option("--page <number>", "Page number", "0").option("--size <number>", "Page size", "20").addHelpText(
     "after",
-    dedent9`
+    dedent10`
 
         Examples:
           $ lexq history list --status ERROR --format table
@@ -2257,7 +2384,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   history.command("get").description("Get execution detail").requiredOption("--id <traceId>", "Trace ID").addHelpText(
     "after",
-    dedent9`
+    dedent10`
 
         Returns the full execution detail including request facts, result traces,
         and decision traces (SELECTED, NO_MATCH, BLOCKED, etc.).
@@ -2283,7 +2410,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   history.command("stats").description("Get execution statistics").option("--group-id <groupId>", "Filter by policy group").option("--start-date <date>", "Start date (yyyy-MM-dd)").option("--end-date <date>", "End date (yyyy-MM-dd)").addHelpText(
     "after",
-    dedent9`
+    dedent10`
 
         Shows total executions, success/no-match/failure counts, success rate, and avg latency.
 
@@ -2332,11 +2459,11 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 
 // src/commands/replay.ts
 import "commander";
-import dedent10 from "dedent";
+import dedent11 from "dedent";
 function registerReplayCommands(program) {
   const replay = program.command("replay").description("Decision Replay").addHelpText(
     "after",
-    dedent10`
+    dedent11`
 
         Re-evaluate past production executions against a candidate version.
 
@@ -2352,7 +2479,7 @@ function registerReplayCommands(program) {
   );
   replay.command("decision").description("Replay a single execution against a candidate version").requiredOption("--trace-id <traceId>", "Trace ID of the past execution").requiredOption("--version-id <versionId>", "Candidate version to re-evaluate against").addHelpText(
     "after",
-    dedent10`
+    dedent11`
 
         Free of charge (TPS throttle only). Returns decisionChanged, effect
         changes, fired rules on both sides, and a determinism verdict.
@@ -2378,7 +2505,7 @@ function registerReplayCommands(program) {
   });
   replay.command("start").description("Submit a window replay job (blast radius)").requiredOption("--version-id <versionId>", "Candidate version to re-evaluate against").requiredOption("--from <date>", "Window start date (yyyy-MM-dd)").requiredOption("--to <date>", "Window end date (yyyy-MM-dd)").option("--max-records <number>", "Sample cap (hard cap 50k)").addHelpText(
     "after",
-    dedent10`
+    dedent11`
 
         Billed per replayed record (REPLAY metric). Poll with "lexq replay get".
 
@@ -2476,11 +2603,11 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 
 // src/commands/provenance.ts
 import "commander";
-import dedent11 from "dedent";
+import dedent12 from "dedent";
 function registerProvenanceCommands(program) {
   const provenance = program.command("provenance").description("Decision Provenance").addHelpText(
     "after",
-    dedent11`
+    dedent12`
 
         Trace who authored, published, and deployed the rules behind a decision.
 
@@ -2506,7 +2633,7 @@ function registerProvenanceCommands(program) {
   });
   provenance.command("reveal-audits").description("List PII reveal audits (who revealed what, when)").option("--trace-id <traceId>", "Filter by trace ID (exact)").option("--fact-key <factKey>", "Filter by fact key (partial, case-insensitive)").option("--revealed-by <operatorId>", "Filter by operator ID (exact)").option("--start-date <date>", "Start date (yyyy-MM-dd)").option("--end-date <date>", "End date (yyyy-MM-dd)").option("--page <number>", "Page number", "0").option("--size <number>", "Page size", "20").addHelpText(
     "after",
-    dedent11`
+    dedent12`
 
         Metadata only — revealed values are never stored or returned.
 
@@ -2559,11 +2686,11 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 
 // src/commands/integrations.ts
 import "commander";
-import dedent12 from "dedent";
+import dedent13 from "dedent";
 function registerIntegrationCommands(program) {
   const integrations = program.command("integrations").description("Manage external integrations").addHelpText(
     "after",
-    dedent12`
+    dedent13`
 
         Integrations connect rule actions to external services (webhooks, coupons,
         points, notifications, CRM, messengers).
@@ -2633,7 +2760,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   integrations.command("save").description("Create or update an integration").requiredOption("--json <body>", "Request body as JSON string").addHelpText(
     "after",
-    dedent12`
+    dedent13`
 
         Examples:
           # Create
@@ -2683,7 +2810,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   integrations.command("delete").description("Delete an integration").requiredOption("--id <integrationId>", "Integration ID").option("--force", "Skip confirmation prompt").addHelpText(
     "after",
-    dedent12`
+    dedent13`
 
         Rules referencing this integration will fail at execution time.
         Use --force to skip confirmation.
@@ -2715,7 +2842,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   integrations.command("config-spec").description("Get integration configuration field specs").addHelpText(
     "after",
-    dedent12`
+    dedent13`
 
         Shows required and optional configuration fields for each integration type.
 
@@ -2741,41 +2868,11 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 
 // src/commands/logs.ts
 import "commander";
-import dedent13 from "dedent";
-
-// src/types/enums.ts
-var FailureStatus = ["PENDING", "RESOLVED", "IGNORED"];
-var FailureAction = ["RETRY", "IGNORE", "RESOLVE"];
-var TaskCategory = ["INTEGRATION", "INTERNAL"];
-var TaskType = [
-  // Integration
-  "COUPON_ISSUE",
-  "COUPON_CANCEL",
-  "POINT_EARN",
-  "POINT_USE",
-  "POINT_REFUND",
-  "NOTIFICATION_SEND",
-  "CRM_SYNC_USER",
-  "CRM_ADD_TAG",
-  "WEBHOOK_EXECUTE",
-  // Internal
-  "IMAGE_PROCESSING",
-  "DAILY_SETTLEMENT",
-  "PLATFORM_WEBHOOK"
-];
-var PlatformEventType = [
-  "VERSION_PUBLISHED",
-  "DEPLOYED",
-  "ROLLED_BACK",
-  "UNDEPLOYED"
-];
-var WebhookPayloadFormat = ["GENERIC", "SLACK"];
-
-// src/commands/logs.ts
+import dedent14 from "dedent";
 function registerLogCommands(program) {
   const logs = program.command("logs").description("Failure logs").addHelpText(
     "after",
-    dedent13`
+    dedent14`
 
         System failure logs (DLQ) for background tasks — webhook calls, coupon issuance,
         point operations, notifications, and platform event webhooks.
@@ -2792,7 +2889,7 @@ function registerLogCommands(program) {
   );
   logs.command("list").description("List failure logs").option("--category <category>", "Filter by category (INTEGRATION, INTERNAL)").option("--task-type <taskType>", `Filter by task type (${TaskType.join(", ")})`).option("--status <status>", "Filter by status (PENDING, RESOLVED, IGNORED)").option("--keyword <keyword>", "Search keyword").option("--start-date <date>", "Start date (yyyy-MM-dd)").option("--end-date <date>", "End date (yyyy-MM-dd)").option("--page <number>", "Page number", "0").option("--size <number>", "Page size", "20").addHelpText(
     "after",
-    dedent13`
+    dedent14`
 
         Examples:
           $ lexq logs list --status PENDING --format table
@@ -2843,7 +2940,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   logs.command("get").description("Get failure log detail").requiredOption("--id <logId>", "Log ID").addHelpText(
     "after",
-    dedent13`
+    dedent14`
 
         Includes the full payload that was used for the failed operation.
         Use this to inspect what went wrong before deciding to RETRY or RESOLVE.
@@ -2865,7 +2962,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   logs.command("action").description("Process a failure log action (RETRY, IGNORE, RESOLVE)").requiredOption("--id <logId>", "Log ID").requiredOption("--action <action>", "Action: RETRY, IGNORE, or RESOLVE").addHelpText(
     "after",
-    dedent13`
+    dedent14`
 
         Actions:
           RETRY    Re-execute the failed operation with the original payload
@@ -2897,7 +2994,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   logs.command("bulk-action").description("Bulk process failure logs").requiredOption("--ids <logIds>", "Comma-separated log IDs").requiredOption("--action <action>", "Action: RETRY, IGNORE, or RESOLVE").addHelpText(
     "after",
-    dedent13`
+    dedent14`
 
         Processes each log individually. Failures are skipped with a warning.
 
@@ -2925,11 +3022,11 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 
 // src/commands/webhook-subscriptions.ts
 import "commander";
-import dedent14 from "dedent";
+import dedent15 from "dedent";
 function registerWebhookSubscriptionCommands(program) {
   const webhooks = program.command("webhook-subscriptions").description("Manage platform event webhook subscriptions").addHelpText(
     "after",
-    dedent14`
+    dedent15`
 
         Receive notifications when deployment lifecycle events occur
         (publish, deploy, rollback, undeploy).
@@ -3003,7 +3100,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   webhooks.command("save").description("Create or update a webhook subscription").requiredOption("--json <body>", "Request body as JSON string").addHelpText(
     "after",
-    dedent14`
+    dedent15`
 
         Examples:
           # Create (Slack format)
@@ -3058,7 +3155,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   webhooks.command("delete").description("Delete a webhook subscription").requiredOption("--id <subscriptionId>", "Subscription ID").option("--force", "Skip confirmation prompt").addHelpText(
     "after",
-    dedent14`
+    dedent15`
 
         Use --force to skip the confirmation prompt.
 
@@ -3092,7 +3189,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   });
   webhooks.command("test").description("Send a test event to verify webhook connectivity").requiredOption("--id <subscriptionId>", "Subscription ID").addHelpText(
     "after",
-    dedent14`
+    dedent15`
 
         Sends a test event to the webhook URL and reports the HTTP status code.
         Does not record failures in the failure log.
@@ -3128,7 +3225,7 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 
 // src/commands/serve.ts
 import "commander";
-import dedent17 from "dedent";
+import dedent18 from "dedent";
 
 // src/mcp/server.ts
 import { readFileSync as readFileSync3 } from "fs";
@@ -3455,7 +3552,7 @@ function registerVersionTools(server, callApi) {
 
 // src/mcp/tools/rules.ts
 import { z as z3 } from "zod";
-import dedent15 from "dedent";
+import dedent16 from "dedent";
 function registerRuleTools(server, callApi) {
   server.registerTool(
     "lexq_rules_list",
@@ -3486,7 +3583,7 @@ function registerRuleTools(server, callApi) {
     "lexq_rules_create",
     {
       title: "Create Rule",
-      description: dedent15`
+      description: dedent16`
         Create a rule in a DRAFT version. Requires name, condition tree, and actions array. priority is auto-assigned (appended last); use lexq_rules_reorder to change order.
 
         Before creating rules with new fact keys, call lexq_facts_list to check existing facts.
@@ -3832,13 +3929,13 @@ function registerDeployTools(server, callApi) {
 
 // src/mcp/tools/analytics.ts
 import { z as z6 } from "zod";
-import dedent16 from "dedent";
+import dedent17 from "dedent";
 function registerAnalyticsTools(server, callApi) {
   server.registerTool(
     "lexq_dry_run",
     {
       title: "Dry Run",
-      description: dedent16`
+      description: dedent17`
         Execute a single dry run against a version. Tests how rules evaluate given input facts without side effects.
         
         Returns:
@@ -3868,7 +3965,7 @@ function registerAnalyticsTools(server, callApi) {
     "lexq_dry_run_compare",
     {
       title: "Dry Run Compare",
-      description: dedent16`
+      description: dedent17`
         Compare dry run results between two versions using the same input facts. Useful for validating changes.
         
         Returns:
@@ -3904,7 +4001,7 @@ function registerAnalyticsTools(server, callApi) {
     "lexq_simulation_start",
     {
       title: "Start Simulation",
-      description: dedent16`
+      description: dedent17`
         Start an Impact Simulation against historical, uploaded, or inline data.
 
         dataset.type and dataset.source are BOTH required, and must be paired:
@@ -4002,7 +4099,7 @@ function registerAnalyticsTools(server, callApi) {
     "lexq_dataset_upload",
     {
       title: "Upload Dataset",
-      description: dedent16`
+      description: dedent17`
         Upload inline CSV or JSON content as a simulation dataset.
         The content is uploaded to S3 and a path is returned in the "path" field.
 
@@ -4058,8 +4155,56 @@ function registerAnalyticsTools(server, callApi) {
   );
 }
 
-// src/mcp/tools/replay.ts
+// src/mcp/tools/profile.ts
 import { z as z7 } from "zod";
+var RELATIVE_THRESHOLD = "flagged = p50 \u2265 10\xD7 median of per-rule p50s within the group; absolute thresholds are intentionally not supported.";
+function profileParams(opts) {
+  const params = {};
+  if (opts.versionId) params.versionId = opts.versionId;
+  if (opts.from) params.from = opts.from;
+  if (opts.to) params.to = opts.to;
+  if (opts.cacheState) params.cacheState = opts.cacheState;
+  return params;
+}
+function registerProfileTools(server, callApi) {
+  server.registerTool(
+    "lexq_profile_overview",
+    {
+      title: "Group Latency Profile",
+      description: "Per-rule latency profile of a policy group over a time window: group TOTAL distribution split by cache state (HIT = compiled ruleset cache hit, MISS = deep-load + compile), a per-rule CONDITION/ACTION percentile table, and slow-rule flags. " + RELATIVE_THRESHOLD + " Every percentile is accompanied by its sample count n; percentiles are withheld (null) when n < 100, and baselines report INSUFFICIENT_COHORT when fewer than 3 rules qualify. Rule detail comes from a deterministic 1% sample of calls; TOTAL is recorded for every call. Defaults: last 24h, live version, cacheState HIT.",
+      inputSchema: {
+        groupId: z7.string().uuid().describe("Policy group ID"),
+        versionId: z7.string().uuid().optional().describe("Version to inspect (default: live version)"),
+        from: z7.string().optional().describe("Window start, ISO-8601 instant (e.g. 2026-07-01T00:00:00Z). Default: 24h ago"),
+        to: z7.string().optional().describe("Window end, ISO-8601 instant. Default: now"),
+        cacheState: z7.enum(["HIT", "MISS"]).optional().describe("Cache dimension for the rule table and judgment (default: HIT)")
+      }
+    },
+    async ({ groupId, versionId, from, to, cacheState }) => callApi("GET", `policy-groups/${groupId}/profile`, {
+      params: profileParams({ versionId, from, to, cacheState })
+    })
+  );
+  server.registerTool(
+    "lexq_profile_rule",
+    {
+      title: "Rule Latency Detail",
+      description: "Single-rule latency detail: merged phase \xD7 cacheState distributions plus a per-window time series (60s windows). Missing windows are genuine gaps \u2014 never interpolated. Series points carry each window's own values; percentiles in merged distributions are withheld (null) when n < 100. " + RELATIVE_THRESHOLD,
+      inputSchema: {
+        groupId: z7.string().uuid().describe("Policy group ID"),
+        ruleId: z7.string().uuid().describe("Rule ID (from lexq_profile_overview)"),
+        versionId: z7.string().uuid().optional().describe("Version to inspect (default: live version)"),
+        from: z7.string().optional().describe("Window start, ISO-8601 instant. Default: 24h ago"),
+        to: z7.string().optional().describe("Window end, ISO-8601 instant. Default: now")
+      }
+    },
+    async ({ groupId, ruleId, versionId, from, to }) => callApi("GET", `policy-groups/${groupId}/profile/rules/${ruleId}`, {
+      params: profileParams({ versionId, from, to })
+    })
+  );
+}
+
+// src/mcp/tools/replay.ts
+import { z as z8 } from "zod";
 function registerReplayTools(server, callApi) {
   server.registerTool(
     "lexq_replay_decision",
@@ -4067,8 +4212,8 @@ function registerReplayTools(server, callApi) {
       title: "Replay a Decision",
       description: "Re-evaluate a past execution (traceId) against a candidate version and return the decision diff (decisionChanged, effect changes, fired rules) plus a determinism verdict. Synchronous and free of charge (TPS throttle only). External effects (webhooks, notifications) are always mocked \u2014 nothing fires.",
       inputSchema: {
-        traceId: z7.string().describe("Trace ID of the past execution to replay"),
-        candidateVersionId: z7.string().uuid().describe("Version to re-evaluate against")
+        traceId: z8.string().describe("Trace ID of the past execution to replay"),
+        candidateVersionId: z8.string().uuid().describe("Version to re-evaluate against")
       }
     },
     async ({ traceId, candidateVersionId }) => callApi("POST", "replay/decisions", { body: { traceId, candidateVersionId } })
@@ -4079,10 +4224,10 @@ function registerReplayTools(server, callApi) {
       title: "Start Window Replay (Blast Radius)",
       description: "Submit an async job that replays a date window of past executions against a candidate version and measures the blast radius (how many decisions change). Billed per replayed record (REPLAY metric); VIEWER role cannot submit. Poll with lexq_replay_status.",
       inputSchema: {
-        candidateVersionId: z7.string().uuid().describe("Version to re-evaluate against"),
-        from: z7.string().describe("Window start date (yyyy-MM-dd)"),
-        to: z7.string().describe("Window end date (yyyy-MM-dd)"),
-        maxRecords: z7.number().int().min(1).optional().describe("Sample cap (server default applies; hard cap 50k)")
+        candidateVersionId: z8.string().uuid().describe("Version to re-evaluate against"),
+        from: z8.string().describe("Window start date (yyyy-MM-dd)"),
+        to: z8.string().describe("Window end date (yyyy-MM-dd)"),
+        maxRecords: z8.number().int().min(1).optional().describe("Sample cap (server default applies; hard cap 50k)")
       }
     },
     async ({ candidateVersionId, from, to, maxRecords }) => callApi("POST", "replay/jobs", { body: { candidateVersionId, from, to, maxRecords } })
@@ -4093,7 +4238,7 @@ function registerReplayTools(server, callApi) {
       title: "Get Replay Job Status",
       description: "Poll a window replay job. RUNNING shows progress 0\u2013100; COMPLETED fills summary and changedSamples; FAILED carries errorMessage. capped=true means the window exceeded the sample cap and only part was replayed.",
       inputSchema: {
-        jobId: z7.string().describe("Replay job ID from lexq_replay_start")
+        jobId: z8.string().describe("Replay job ID from lexq_replay_start")
       }
     },
     async ({ jobId }) => callApi("GET", `replay/jobs/${jobId}`)
@@ -4104,8 +4249,8 @@ function registerReplayTools(server, callApi) {
       title: "List Replay Jobs",
       description: "List window replay job history (reverse-chronological). Lightweight items \u2014 use lexq_replay_status for summary and changed samples.",
       inputSchema: {
-        page: z7.number().int().min(0).default(0).describe("Page number"),
-        size: z7.number().int().min(1).max(100).default(20).describe("Page size")
+        page: z8.number().int().min(0).default(0).describe("Page number"),
+        size: z8.number().int().min(1).max(100).default(20).describe("Page size")
       }
     },
     async ({ page, size }) => callApi("GET", "replay/jobs", { params: paginationParams(page, size) })
@@ -4116,7 +4261,7 @@ function registerReplayTools(server, callApi) {
       title: "Cancel Replay Job",
       description: "Cooperatively cancel a PENDING or RUNNING window replay job. Other states are rejected. VIEWER role cannot cancel.",
       inputSchema: {
-        jobId: z7.string().describe("Replay job ID")
+        jobId: z8.string().describe("Replay job ID")
       }
     },
     async ({ jobId }) => callApi("POST", `replay/jobs/${jobId}/cancel`)
@@ -4124,7 +4269,7 @@ function registerReplayTools(server, callApi) {
 }
 
 // src/mcp/tools/history.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 function registerHistoryTools(server, callApi) {
   server.registerTool(
     "lexq_history_list",
@@ -4132,14 +4277,14 @@ function registerHistoryTools(server, callApi) {
       title: "List Execution History",
       description: "List policy execution history. Shows trace ID, group, version, status, match result, and latency.",
       inputSchema: {
-        page: z8.number().int().min(0).default(0).describe("Page number"),
-        size: z8.number().int().min(1).max(100).default(20).describe("Page size"),
-        traceId: z8.string().optional().describe("Filter by trace ID"),
-        groupId: z8.string().uuid().optional().describe("Filter by policy group"),
-        versionId: z8.string().uuid().optional().describe("Filter by version"),
-        status: z8.enum(["SUCCESS", "NO_MATCH", "ERROR", "TIMEOUT"]).optional().describe("Filter by execution status"),
-        startDate: z8.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z8.string().optional().describe("End date (yyyy-MM-dd)")
+        page: z9.number().int().min(0).default(0).describe("Page number"),
+        size: z9.number().int().min(1).max(100).default(20).describe("Page size"),
+        traceId: z9.string().optional().describe("Filter by trace ID"),
+        groupId: z9.string().uuid().optional().describe("Filter by policy group"),
+        versionId: z9.string().uuid().optional().describe("Filter by version"),
+        status: z9.enum(["SUCCESS", "NO_MATCH", "ERROR", "TIMEOUT"]).optional().describe("Filter by execution status"),
+        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ page, size, traceId, groupId, versionId, status, startDate, endDate }) => {
@@ -4159,7 +4304,7 @@ function registerHistoryTools(server, callApi) {
       title: "Get Execution Detail",
       description: "Get full execution detail including inputFacts, mutatedFacts, generatedVariables, executionTraces, and decisionTraces.",
       inputSchema: {
-        traceId: z8.string().describe("Trace ID from execution history")
+        traceId: z9.string().describe("Trace ID from execution history")
       }
     },
     async ({ traceId }) => callApi("GET", `execution/history/${traceId}`)
@@ -4170,9 +4315,9 @@ function registerHistoryTools(server, callApi) {
       title: "Execution Statistics",
       description: "Get execution KPIs: total executions, success/failure counts, success rate, and average latency.",
       inputSchema: {
-        groupId: z8.string().uuid().optional().describe("Filter by policy group"),
-        startDate: z8.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z8.string().optional().describe("End date (yyyy-MM-dd)")
+        groupId: z9.string().uuid().optional().describe("Filter by policy group"),
+        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ groupId, startDate, endDate }) => {
@@ -4186,7 +4331,7 @@ function registerHistoryTools(server, callApi) {
 }
 
 // src/mcp/tools/provenance.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 function registerProvenanceTools(server, callApi) {
   server.registerTool(
     "lexq_provenance_get",
@@ -4194,7 +4339,7 @@ function registerProvenanceTools(server, callApi) {
       title: "Get Decision Provenance",
       description: "Get the lineage of a single decision: what was decided, deterministic why per rule, input facts (PII facts are masked as \u2022\u2022\u2022\u2022\u2022\u2022 with maskedKeys listing them \u2014 values are revealable only in the console, audited), the authored/published/deployed responsibility chain, and the rule snapshot fingerprint.",
       inputSchema: {
-        traceId: z9.string().describe("Trace ID of the execution")
+        traceId: z10.string().describe("Trace ID of the execution")
       }
     },
     async ({ traceId }) => callApi("GET", `provenance/${traceId}`)
@@ -4205,13 +4350,13 @@ function registerProvenanceTools(server, callApi) {
       title: "List PII Reveal Audits",
       description: "List the PII reveal audit ledger \u2014 who revealed which fact of which trace, and when. Metadata only; revealed values are never stored or returned. Use for monthly access-log inspection and SIEM collection.",
       inputSchema: {
-        page: z9.number().int().min(0).default(0).describe("Page number"),
-        size: z9.number().int().min(1).max(100).default(20).describe("Page size"),
-        traceId: z9.string().optional().describe("Filter by trace ID (exact match)"),
-        revealedBy: z9.string().optional().describe("Filter by operator ID (exact match)"),
-        factKey: z9.string().optional().describe("Filter by fact key (partial match, case-insensitive)"),
-        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
+        page: z10.number().int().min(0).default(0).describe("Page number"),
+        size: z10.number().int().min(1).max(100).default(20).describe("Page size"),
+        traceId: z10.string().optional().describe("Filter by trace ID (exact match)"),
+        revealedBy: z10.string().optional().describe("Filter by operator ID (exact match)"),
+        factKey: z10.string().optional().describe("Filter by fact key (partial match, case-insensitive)"),
+        startDate: z10.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z10.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ page, size, traceId, revealedBy, factKey, startDate, endDate }) => {
@@ -4227,7 +4372,7 @@ function registerProvenanceTools(server, callApi) {
 }
 
 // src/mcp/tools/integrations.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 function registerIntegrationTools(server, callApi) {
   server.registerTool(
     "lexq_integrations_list",
@@ -4235,9 +4380,9 @@ function registerIntegrationTools(server, callApi) {
       title: "List Integrations",
       description: "List all external integrations (webhooks, CRM, notification, etc.).",
       inputSchema: {
-        page: z10.number().int().min(0).default(0).describe("Page number"),
-        size: z10.number().int().min(1).max(100).default(20).describe("Page size"),
-        type: z10.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).optional().describe("Filter by integration type")
+        page: z11.number().int().min(0).default(0).describe("Page number"),
+        size: z11.number().int().min(1).max(100).default(20).describe("Page size"),
+        type: z11.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).optional().describe("Filter by integration type")
       }
     },
     async ({ page, size, type }) => {
@@ -4252,7 +4397,7 @@ function registerIntegrationTools(server, callApi) {
       title: "Get Integration",
       description: "Get integration detail by ID.",
       inputSchema: {
-        integrationId: z10.string().uuid().describe("Integration ID")
+        integrationId: z11.string().uuid().describe("Integration ID")
       }
     },
     async ({ integrationId }) => callApi("GET", `integrations/${integrationId}`)
@@ -4263,13 +4408,13 @@ function registerIntegrationTools(server, callApi) {
       title: "Save Integration",
       description: "Create or update an integration. Provide id to update an existing one; omit id to create new. Types: COUPON, POINT, NOTIFICATION, CRM, MESSENGER, WEBHOOK.",
       inputSchema: {
-        id: z10.string().uuid().optional().describe("Integration ID (omit to create, provide to update)"),
-        type: z10.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).describe("Integration type"),
-        name: z10.string().describe("Integration name"),
-        baseUrl: z10.string().describe("Base URL of the external service"),
-        credential: z10.string().optional().describe("API key or token for the service"),
-        additionalConfig: z10.string().optional().describe("JSON string of additional config key-value pairs"),
-        isActive: z10.boolean().default(true).describe("Whether the integration is active")
+        id: z11.string().uuid().optional().describe("Integration ID (omit to create, provide to update)"),
+        type: z11.enum(["COUPON", "POINT", "NOTIFICATION", "CRM", "MESSENGER", "WEBHOOK"]).describe("Integration type"),
+        name: z11.string().describe("Integration name"),
+        baseUrl: z11.string().describe("Base URL of the external service"),
+        credential: z11.string().optional().describe("API key or token for the service"),
+        additionalConfig: z11.string().optional().describe("JSON string of additional config key-value pairs"),
+        isActive: z11.boolean().default(true).describe("Whether the integration is active")
       }
     },
     async ({ additionalConfig, ...rest }) => {
@@ -4284,7 +4429,7 @@ function registerIntegrationTools(server, callApi) {
       title: "Delete Integration",
       description: "Delete an integration by ID.",
       inputSchema: {
-        integrationId: z10.string().uuid().describe("Integration ID")
+        integrationId: z11.string().uuid().describe("Integration ID")
       }
     },
     async ({ integrationId }) => callApi("DELETE", `integrations/${integrationId}`)
@@ -4301,7 +4446,7 @@ function registerIntegrationTools(server, callApi) {
 }
 
 // src/mcp/tools/logs.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 function registerLogTools(server, callApi) {
   server.registerTool(
     "lexq_logs_list",
@@ -4309,14 +4454,14 @@ function registerLogTools(server, callApi) {
       title: "List Failure Logs",
       description: "List system failure logs from background tasks (webhook calls, coupon issuance, etc.).",
       inputSchema: {
-        page: z11.number().int().min(0).default(0).describe("Page number"),
-        size: z11.number().int().min(1).max(100).default(20).describe("Page size"),
-        category: z11.enum(TaskCategory).optional().describe("Task category"),
-        taskType: z11.enum(TaskType).optional().describe("Task type"),
-        status: z11.enum(FailureStatus).optional().describe("Log status"),
-        keyword: z11.string().optional().describe("Search in refId, refSubId, errorMessage"),
-        startDate: z11.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z11.string().optional().describe("End date (yyyy-MM-dd)")
+        page: z12.number().int().min(0).default(0).describe("Page number"),
+        size: z12.number().int().min(1).max(100).default(20).describe("Page size"),
+        category: z12.enum(TaskCategory).optional().describe("Task category"),
+        taskType: z12.enum(TaskType).optional().describe("Task type"),
+        status: z12.enum(FailureStatus).optional().describe("Log status"),
+        keyword: z12.string().optional().describe("Search in refId, refSubId, errorMessage"),
+        startDate: z12.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z12.string().optional().describe("End date (yyyy-MM-dd)")
       }
     },
     async ({ page, size, category, taskType, status, keyword, startDate, endDate }) => {
@@ -4336,7 +4481,7 @@ function registerLogTools(server, callApi) {
       title: "Get Failure Log",
       description: "Get failure log detail by ID.",
       inputSchema: {
-        logId: z11.string().uuid().describe("Failure log ID")
+        logId: z12.string().uuid().describe("Failure log ID")
       }
     },
     async ({ logId }) => callApi("GET", `failure-logs/${logId}`)
@@ -4347,8 +4492,8 @@ function registerLogTools(server, callApi) {
       title: "Process Failure Log",
       description: "Process a single failure log: RETRY (re-execute with original payload), RESOLVE (mark as manually fixed), or IGNORE (skip intentionally).",
       inputSchema: {
-        logId: z11.string().uuid().describe("Failure log ID"),
-        action: z11.enum(FailureAction).describe("Action to take")
+        logId: z12.string().uuid().describe("Failure log ID"),
+        action: z12.enum(FailureAction).describe("Action to take")
       }
     },
     async ({ logId, action }) => callApi("POST", `failure-logs/${logId}/actions`, {
@@ -4361,8 +4506,8 @@ function registerLogTools(server, callApi) {
       title: "Bulk Process Failure Logs",
       description: "Process multiple failure logs at once. Provide an array of log IDs and the action.",
       inputSchema: {
-        logIds: z11.array(z11.string().uuid()).describe("Array of failure log IDs"),
-        action: z11.enum(FailureAction).describe("Action to apply to all logs")
+        logIds: z12.array(z12.string().uuid()).describe("Array of failure log IDs"),
+        action: z12.enum(FailureAction).describe("Action to apply to all logs")
       }
     },
     async ({ logIds, action }) => callApi("POST", "failure-logs/bulk-actions", {
@@ -4372,7 +4517,7 @@ function registerLogTools(server, callApi) {
 }
 
 // src/mcp/tools/webhook-subscriptions.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function registerWebhookSubscriptionTools(server, callApi) {
   server.registerTool(
     "lexq_webhook_subscriptions_list",
@@ -4380,8 +4525,8 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "List Webhook Subscriptions",
       description: "List platform event webhook subscriptions. These receive deployment lifecycle notifications (publish, deploy, rollback, undeploy).",
       inputSchema: {
-        page: z12.number().int().min(0).default(0).describe("Page number"),
-        size: z12.number().int().min(1).max(100).default(20).describe("Page size")
+        page: z13.number().int().min(0).default(0).describe("Page number"),
+        size: z13.number().int().min(1).max(100).default(20).describe("Page size")
       }
     },
     async ({ page, size }) => {
@@ -4395,7 +4540,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Get Webhook Subscription",
       description: "Get webhook subscription detail by ID.",
       inputSchema: {
-        id: z12.string().uuid().describe("Webhook subscription ID")
+        id: z13.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("GET", `webhook-subscriptions/${id}`)
@@ -4406,13 +4551,13 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Save Webhook Subscription",
       description: 'Create or update a webhook subscription. Omit id to create, provide id to update. Events: VERSION_PUBLISHED, DEPLOYED, ROLLED_BACK, UNDEPLOYED. Formats: GENERIC (full JSON), SLACK ({"text": "..."}).',
       inputSchema: {
-        id: z12.string().uuid().optional().describe("Subscription ID (omit to create, provide to update)"),
-        name: z12.string().min(1).describe("Subscription name (unique per tenant)"),
-        webhookUrl: z12.string().url().describe("Webhook endpoint URL"),
-        subscribedEvents: z12.array(z12.enum(PlatformEventType)).min(1).describe("Events to subscribe to"),
-        payloadFormat: z12.enum(WebhookPayloadFormat).optional().default("GENERIC").describe("Payload format"),
-        secret: z12.string().optional().describe("HMAC-SHA256 signing secret"),
-        isActive: z12.boolean().optional().default(true).describe("Whether the subscription is active")
+        id: z13.string().uuid().optional().describe("Subscription ID (omit to create, provide to update)"),
+        name: z13.string().min(1).describe("Subscription name (unique per tenant)"),
+        webhookUrl: z13.string().url().describe("Webhook endpoint URL"),
+        subscribedEvents: z13.array(z13.enum(PlatformEventType)).min(1).describe("Events to subscribe to"),
+        payloadFormat: z13.enum(WebhookPayloadFormat).optional().default("GENERIC").describe("Payload format"),
+        secret: z13.string().optional().describe("HMAC-SHA256 signing secret"),
+        isActive: z13.boolean().optional().default(true).describe("Whether the subscription is active")
       }
     },
     async ({ ...body }) => callApi("POST", "webhook-subscriptions", { body })
@@ -4423,7 +4568,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Delete Webhook Subscription",
       description: "Delete a webhook subscription by ID.",
       inputSchema: {
-        id: z12.string().uuid().describe("Webhook subscription ID")
+        id: z13.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("DELETE", `webhook-subscriptions/${id}`)
@@ -4434,7 +4579,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Test Webhook Subscription",
       description: "Send a test event to verify webhook connectivity. Returns the HTTP status code and success/failure message.",
       inputSchema: {
-        id: z12.string().uuid().describe("Webhook subscription ID")
+        id: z13.string().uuid().describe("Webhook subscription ID")
       }
     },
     async ({ id }) => callApi("POST", `webhook-subscriptions/${id}/test`)
@@ -4442,7 +4587,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
 }
 
 // src/mcp/tools/domain-templates.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 function registerDomainTemplateTools(server, callApi) {
   server.registerTool(
     "lexq_domain_templates_list",
@@ -4459,7 +4604,7 @@ function registerDomainTemplateTools(server, callApi) {
       title: "Preview Domain Template",
       description: "Preview exactly what a domain template will provision before applying it: the fact definitions it registers, the sample rules it creates, and an apply plan. This is a read-only dry run \u2014 nothing is created. Only ACTIVE templates can be previewed.",
       inputSchema: {
-        template: z13.string().describe(
+        template: z14.string().describe(
           "Domain template key (e.g. ECOMMERCE). Use lexq_domain_templates_list to see available keys \u2014 currently only ECOMMERCE is ACTIVE."
         )
       }
@@ -4472,8 +4617,8 @@ function registerDomainTemplateTools(server, callApi) {
       title: "Apply Domain Template",
       description: "Apply a domain template to the current tenant. Creates the template's fact definitions and a new policy group pre-populated with its sample rules as a DRAFT version. Existing facts are skipped \u2014 apply is additive and never overwrites existing schema. Run lexq_domain_templates_preview first to review what will be created. Only ACTIVE templates can be applied.",
       inputSchema: {
-        template: z13.string().describe("Domain template key to apply (e.g. ECOMMERCE)."),
-        customName: z13.string().optional().describe(
+        template: z14.string().describe("Domain template key to apply (e.g. ECOMMERCE)."),
+        customName: z14.string().optional().describe(
           "Optional custom name for the policy group that gets created. If omitted, the template's default name is used."
         )
       }
@@ -4495,6 +4640,7 @@ function registerAllTools(server, callApi) {
   registerFactTools(server, callApi);
   registerDeployTools(server, callApi);
   registerAnalyticsTools(server, callApi);
+  registerProfileTools(server, callApi);
   registerReplayTools(server, callApi);
   registerHistoryTools(server, callApi);
   registerProvenanceTools(server, callApi);
@@ -4529,7 +4675,7 @@ async function startMcpServer() {
 function registerServeCommand(program) {
   program.command("serve").description("Start LexQ as a server for AI agent integrations").option("--mcp", "Start as MCP (Model Context Protocol) server over stdio").addHelpText(
     "after",
-    dedent17`
+    dedent18`
 
         Example:
           $ lexq serve --mcp
@@ -4560,11 +4706,11 @@ function registerServeCommand(program) {
 
 // src/commands/domain-templates.ts
 import "commander";
-import dedent18 from "dedent";
+import dedent19 from "dedent";
 function registerDomainTemplateCommands(program) {
   const templates = program.command("domain-templates").description("Browse and apply domain templates").addHelpText(
     "after",
-    dedent18`
+    dedent19`
 
         A domain template is an industry-specific starter pack of fact
         definitions and sample rules. Applying one provisions a ready-to-use
@@ -4612,7 +4758,7 @@ function registerDomainTemplateCommands(program) {
   });
   templates.command("preview").description("Preview what a domain template provisions").requiredOption("--template <key>", "Domain template key (e.g. ECOMMERCE)").addHelpText(
     "after",
-    dedent18`
+    dedent19`
 
         Read-only dry run — shows the fact definitions and sample rules the
         template will create. Nothing is provisioned.
@@ -4641,7 +4787,7 @@ function registerDomainTemplateCommands(program) {
   });
   templates.command("apply").description("Apply a domain template to the current tenant").requiredOption("--template <key>", "Domain template key (e.g. ECOMMERCE)").option("--name <n>", "Custom name for the policy group that gets created").option("--force", "Skip confirmation prompt").addHelpText(
     "after",
-    dedent18`
+    dedent19`
 
         Creates the template's fact definitions and a new DRAFT policy group
         populated with its sample rules. Existing facts are skipped — apply is
@@ -4716,6 +4862,7 @@ function createCli() {
   registerDomainTemplateCommands(program);
   registerDeployCommands(program);
   registerAnalyticsCommands(program);
+  registerProfileCommands(program);
   registerHistoryCommands(program);
   registerReplayCommands(program);
   registerProvenanceCommands(program);