@lexq/cli 0.1.59 → 0.2.0

package/dist/index.js

@@ -3317,8 +3317,8 @@ import dedent17 from "dedent";
 import { readFileSync as readFileSync3 } from "fs";
 import { dirname, join as join2 } from "path";
 import { fileURLToPath } from "url";
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
+import { McpServer } from "@modelcontextprotocol/server";
 
 // src/mcp/tools/_shared.ts
 function createCallApiFromConfig() {
@@ -3402,27 +3402,28 @@ function formatUnregisteredFactWarning(meta) {
 }
 
 // src/mcp/tools/status.ts
+import { z } from "zod";
 function registerStatusTools(server, callApi) {
   server.registerTool(
     "lexq_whoami",
     {
       title: "Who Am I",
       description: "Show current authentication info (tenant ID, user ID, role).",
-      inputSchema: {}
+      inputSchema: z.object({})
     },
     async () => callApi("GET", "whoami")
   );
 }
 
 // src/mcp/tools/groups.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 function registerGroupTools(server, callApi) {
   server.registerTool(
     "lexq_groups_list",
     {
       title: "List Policy Groups",
       description: "List all policy groups (tenant-wide, priority ASC).",
-      inputSchema: {}
+      inputSchema: z2.object({})
     },
     async () => callApi("GET", "policy-groups")
   );
@@ -3431,9 +3432,9 @@ function registerGroupTools(server, callApi) {
     {
       title: "Get Policy Group",
       description: "Get a single policy group by ID.",
-      inputSchema: {
-        groupId: z.string().uuid().describe("Policy group ID")
-      }
+      inputSchema: z2.object({
+        groupId: z2.string().uuid().describe("Policy group ID")
+      })
     },
     async ({ groupId }) => callApi("GET", `policy-groups/${groupId}`)
   );
@@ -3442,18 +3443,18 @@ function registerGroupTools(server, callApi) {
     {
       title: "Create Policy Group",
       description: "Create a new policy group. Requires name. Priority is auto-assigned (appended last, tenant-wide); use lexq_groups_reorder to change order. Optionally set conflict resolution, activation group, and description. Policy groups that share an activationGroup form a cluster and must share the same activationMode / activationStrategy / executionLimit; executionLimit is how many of those groups run, not how many rules.",
-      inputSchema: {
-        name: z.string().describe("Group name (unique among non-ARCHIVED)"),
-        description: z.string().optional().describe("Group description"),
-        activationMode: z.enum(ConflictResolutionMode).optional().describe("Conflict resolution mode"),
-        activationStrategy: z.enum(ConflictResolutionStrategy).optional().describe("Ranking used to pick the winning groups when mode is EXCLUSIVE or MAX_N"),
-        executionLimit: z.number().int().min(1).optional().describe(
+      inputSchema: z2.object({
+        name: z2.string().describe("Group name (unique among non-ARCHIVED)"),
+        description: z2.string().optional().describe("Group description"),
+        activationMode: z2.enum(ConflictResolutionMode).optional().describe("Conflict resolution mode"),
+        activationStrategy: z2.enum(ConflictResolutionStrategy).optional().describe("Ranking used to pick the winning groups when mode is EXCLUSIVE or MAX_N"),
+        executionLimit: z2.number().int().min(1).optional().describe(
           "How many policy groups sharing this activationGroup may run (required when mode is MAX_N). Counts groups, not rules: every rule of a winning group runs."
         ),
-        activationGroup: z.string().optional().describe(
+        activationGroup: z2.string().optional().describe(
           "Activation group (Execution Group) cluster key. Policy groups sharing this key compete, and group priority picks the winners."
         )
-      }
+      })
     },
     async (args) => {
       const body = {
@@ -3472,20 +3473,20 @@ function registerGroupTools(server, callApi) {
     {
       title: "Update Policy Group",
       description: "Update a policy group. Only provided fields are updated; omitted fields remain unchanged.",
-      inputSchema: {
-        groupId: z.string().uuid().describe("Policy group ID"),
-        name: z.string().optional().describe("New name"),
-        description: z.string().optional().describe("New description"),
-        status: z.enum(["ACTIVE", "DISABLED"]).optional().describe("Status (DISABLED = emergency stop)"),
-        activationGroup: z.string().optional().describe(
+      inputSchema: z2.object({
+        groupId: z2.string().uuid().describe("Policy group ID"),
+        name: z2.string().optional().describe("New name"),
+        description: z2.string().optional().describe("New description"),
+        status: z2.enum(["ACTIVE", "DISABLED"]).optional().describe("Status (DISABLED = emergency stop)"),
+        activationGroup: z2.string().optional().describe(
           "Activation group (Execution Group) cluster key. Policy groups sharing this key compete, and group priority picks the winners."
         ),
-        activationMode: z.enum(ConflictResolutionMode).optional().describe("Conflict resolution mode"),
-        activationStrategy: z.enum(ConflictResolutionStrategy).optional().describe("Ranking used to pick the winning groups"),
-        executionLimit: z.number().int().min(1).optional().describe(
+        activationMode: z2.enum(ConflictResolutionMode).optional().describe("Conflict resolution mode"),
+        activationStrategy: z2.enum(ConflictResolutionStrategy).optional().describe("Ranking used to pick the winning groups"),
+        executionLimit: z2.number().int().min(1).optional().describe(
           "How many policy groups sharing this activationGroup may run. Counts groups, not rules."
         )
-      }
+      })
     },
     async ({ groupId, ...body }) => callApi("PUT", `policy-groups/${groupId}`, { body })
   );
@@ -3494,9 +3495,9 @@ function registerGroupTools(server, callApi) {
     {
       title: "Delete Policy Group",
       description: "Archive a policy group. Only non-live groups can be deleted. This is irreversible.",
-      inputSchema: {
-        groupId: z.string().uuid().describe("Policy group ID")
-      }
+      inputSchema: z2.object({
+        groupId: z2.string().uuid().describe("Policy group ID")
+      })
     },
     async ({ groupId }) => callApi("DELETE", `policy-groups/${groupId}`)
   );
@@ -3505,9 +3506,9 @@ function registerGroupTools(server, callApi) {
     {
       title: "Reorder Policy Groups",
       description: "Reorder policy groups by priority. Priority is tenant-wide and flat (1...N continuous); array index 0 = priority 1 (highest precedence). activationGroup is not affected \u2014 this only changes priority.",
-      inputSchema: {
-        groupIds: z.array(z.string().uuid()).describe("Group IDs in desired priority order (index 0 = priority 1)")
-      }
+      inputSchema: z2.object({
+        groupIds: z2.array(z2.string().uuid()).describe("Group IDs in desired priority order (index 0 = priority 1)")
+      })
     },
     async ({ groupIds }) => {
       const groups = groupIds.map((groupId, index) => ({
@@ -3522,11 +3523,11 @@ function registerGroupTools(server, callApi) {
     {
       title: "Start A/B Test",
       description: "Start an A/B test on a policy group. Requires a challenger version ID and traffic rate. The split is computed from context.trafficKey on each execution request; requests that omit it never reach the challenger and the test stays at 0%.",
-      inputSchema: {
-        groupId: z.string().uuid().describe("Policy group ID"),
-        testVersionId: z.string().uuid().describe("Challenger version ID to test"),
-        trafficRate: z.number().int().min(1).max(99).describe("Traffic percentage routed to challenger (1-99)")
-      }
+      inputSchema: z2.object({
+        groupId: z2.string().uuid().describe("Policy group ID"),
+        testVersionId: z2.string().uuid().describe("Challenger version ID to test"),
+        trafficRate: z2.number().int().min(1).max(99).describe("Traffic percentage routed to challenger (1-99)")
+      })
     },
     async ({ groupId, ...body }) => callApi("POST", `policy-groups/${groupId}/ab-test`, { body })
   );
@@ -3535,9 +3536,9 @@ function registerGroupTools(server, callApi) {
     {
       title: "Stop A/B Test",
       description: "Stop a running A/B test. All traffic is restored to the control (current) version.",
-      inputSchema: {
-        groupId: z.string().uuid().describe("Policy group ID")
-      }
+      inputSchema: z2.object({
+        groupId: z2.string().uuid().describe("Policy group ID")
+      })
     },
     async ({ groupId }) => callApi("DELETE", `policy-groups/${groupId}/ab-test`)
   );
@@ -3546,28 +3547,28 @@ function registerGroupTools(server, callApi) {
     {
       title: "Adjust A/B Test",
       description: "Adjust traffic rate of a running A/B test.",
-      inputSchema: {
-        groupId: z.string().uuid().describe("Policy group ID"),
-        trafficRate: z.number().int().min(1).max(99).describe("New traffic percentage for challenger (1-99)")
-      }
+      inputSchema: z2.object({
+        groupId: z2.string().uuid().describe("Policy group ID"),
+        trafficRate: z2.number().int().min(1).max(99).describe("New traffic percentage for challenger (1-99)")
+      })
     },
     async ({ groupId, ...body }) => callApi("PATCH", `policy-groups/${groupId}/ab-test/traffic-rate`, { body })
   );
 }
 
 // src/mcp/tools/versions.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 function registerVersionTools(server, callApi) {
   server.registerTool(
     "lexq_versions_list",
     {
       title: "List Policy Versions",
       description: "List all versions of a policy group.",
-      inputSchema: {
-        groupId: z2.string().uuid().describe("Policy group ID"),
-        page: z2.number().int().min(0).default(0).describe("Page number"),
-        size: z2.number().int().min(1).max(100).default(20).describe("Page size")
-      }
+      inputSchema: z3.object({
+        groupId: z3.string().uuid().describe("Policy group ID"),
+        page: z3.number().int().min(0).default(0).describe("Page number"),
+        size: z3.number().int().min(1).max(100).default(20).describe("Page size")
+      })
     },
     async ({ groupId, page, size }) => callApi("GET", `policy-groups/${groupId}/versions`, {
       params: paginationParams(page, size)
@@ -3578,10 +3579,10 @@ function registerVersionTools(server, callApi) {
     {
       title: "Get Policy Version",
       description: "Get a single version by ID, including its rules and fact requirements.",
-      inputSchema: {
-        groupId: z2.string().uuid().describe("Policy group ID"),
-        versionId: z2.string().uuid().describe("Version ID")
-      }
+      inputSchema: z3.object({
+        groupId: z3.string().uuid().describe("Policy group ID"),
+        versionId: z3.string().uuid().describe("Version ID")
+      })
     },
     async ({ groupId, versionId }) => callApi("GET", `policy-groups/${groupId}/versions/${versionId}`)
   );
@@ -3590,12 +3591,12 @@ function registerVersionTools(server, callApi) {
     {
       title: "Create Policy Version",
       description: "Create a new DRAFT version in a policy group. Optionally provide a commit message and effective date range.",
-      inputSchema: {
-        groupId: z2.string().uuid().describe("Policy group ID"),
-        commitMessage: z2.string().optional().describe("Commit message describing this version"),
-        effectiveFrom: z2.string().optional().describe("Effective start date (ISO 8601)"),
-        effectiveTo: z2.string().optional().describe("Effective end date (ISO 8601)")
-      }
+      inputSchema: z3.object({
+        groupId: z3.string().uuid().describe("Policy group ID"),
+        commitMessage: z3.string().optional().describe("Commit message describing this version"),
+        effectiveFrom: z3.string().optional().describe("Effective start date (ISO 8601)"),
+        effectiveTo: z3.string().optional().describe("Effective end date (ISO 8601)")
+      })
     },
     async ({ groupId, ...body }) => callApi("POST", `policy-groups/${groupId}/versions`, { body })
   );
@@ -3604,13 +3605,13 @@ function registerVersionTools(server, callApi) {
     {
       title: "Update Policy Version",
       description: "Update a DRAFT version. Only DRAFT versions can be modified. Only provided fields are changed.",
-      inputSchema: {
-        groupId: z2.string().uuid().describe("Policy group ID"),
-        versionId: z2.string().uuid().describe("Version ID"),
-        commitMessage: z2.string().optional().describe("New commit message"),
-        effectiveFrom: z2.string().optional().describe("New effective start date"),
-        effectiveTo: z2.string().optional().describe("New effective end date")
-      }
+      inputSchema: z3.object({
+        groupId: z3.string().uuid().describe("Policy group ID"),
+        versionId: z3.string().uuid().describe("Version ID"),
+        commitMessage: z3.string().optional().describe("New commit message"),
+        effectiveFrom: z3.string().optional().describe("New effective start date"),
+        effectiveTo: z3.string().optional().describe("New effective end date")
+      })
     },
     async ({ groupId, versionId, ...body }) => callApi("PUT", `policy-groups/${groupId}/versions/${versionId}`, { body })
   );
@@ -3619,10 +3620,10 @@ function registerVersionTools(server, callApi) {
     {
       title: "Delete Policy Version",
       description: "Delete a DRAFT version. Only DRAFT versions can be deleted.",
-      inputSchema: {
-        groupId: z2.string().uuid().describe("Policy group ID"),
-        versionId: z2.string().uuid().describe("Version ID")
-      }
+      inputSchema: z3.object({
+        groupId: z3.string().uuid().describe("Policy group ID"),
+        versionId: z3.string().uuid().describe("Version ID")
+      })
     },
     async ({ groupId, versionId }) => callApi("DELETE", `policy-groups/${groupId}/versions/${versionId}`)
   );
@@ -3631,10 +3632,10 @@ function registerVersionTools(server, callApi) {
     {
       title: "Clone Policy Version",
       description: "Clone an existing version to create a new DRAFT. Useful when the source version is already published.",
-      inputSchema: {
-        groupId: z2.string().uuid().describe("Policy group ID"),
-        versionId: z2.string().uuid().describe("Source version ID to clone")
-      }
+      inputSchema: z3.object({
+        groupId: z3.string().uuid().describe("Policy group ID"),
+        versionId: z3.string().uuid().describe("Source version ID to clone")
+      })
     },
     async ({ groupId, versionId }) => {
       return callApi("POST", `policy-groups/${groupId}/versions/${versionId}/clone`, {
@@ -3645,7 +3646,7 @@ function registerVersionTools(server, callApi) {
 }
 
 // src/mcp/tools/rules.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 import dedent15 from "dedent";
 function registerRuleTools(server, callApi) {
   server.registerTool(
@@ -3653,10 +3654,10 @@ function registerRuleTools(server, callApi) {
     {
       title: "List Rules",
       description: "List all rules in a version (priority ASC). Returns summary with conditionSummary and actionSummary.",
-      inputSchema: {
-        groupId: z3.string().uuid().describe("Policy group ID"),
-        versionId: z3.string().uuid().describe("Version ID")
-      }
+      inputSchema: z4.object({
+        groupId: z4.string().uuid().describe("Policy group ID"),
+        versionId: z4.string().uuid().describe("Version ID")
+      })
     },
     async ({ groupId, versionId }) => callApi("GET", `policy-groups/${groupId}/versions/${versionId}/rules`)
   );
@@ -3665,11 +3666,11 @@ function registerRuleTools(server, callApi) {
     {
       title: "Get Rule Detail",
       description: "Get full rule detail including condition tree and action definitions.",
-      inputSchema: {
-        groupId: z3.string().uuid().describe("Policy group ID"),
-        versionId: z3.string().uuid().describe("Version ID"),
-        ruleId: z3.string().uuid().describe("Rule ID")
-      }
+      inputSchema: z4.object({
+        groupId: z4.string().uuid().describe("Policy group ID"),
+        versionId: z4.string().uuid().describe("Version ID"),
+        ruleId: z4.string().uuid().describe("Rule ID")
+      })
     },
     async ({ groupId, versionId, ruleId }) => callApi("GET", `policy-groups/${groupId}/versions/${versionId}/rules/${ruleId}`)
   );
@@ -3738,13 +3739,13 @@ function registerRuleTools(server, callApi) {
 
         RoundingOption (optional, MUTATE_FACT only): { scale: integer (0..${MAX_ROUNDING_SCALE}), mode?: "HALF_UP"|"HALF_DOWN"|"HALF_EVEN"|"FLOOR"|"CEILING"|"DOWN"|"UP" } mode defaults to HALF_UP. When omitted, calculator output is preserved at full precision (lossless).
       `,
-      inputSchema: {
-        groupId: z3.string().uuid().describe("Policy group ID"),
-        versionId: z3.string().uuid().describe("Version ID"),
-        rule: z3.string().describe(
+      inputSchema: z4.object({
+        groupId: z4.string().uuid().describe("Policy group ID"),
+        versionId: z4.string().uuid().describe("Version ID"),
+        rule: z4.string().describe(
           "JSON string of CreateRuleRequest: { name, condition, actions, mutexGroup?, mutexMode?, mutexStrategy?, mutexLimit?, isEnabled? }"
         )
-      }
+      })
     },
     async ({ groupId, versionId, rule }) => {
       const body = parseJson(rule);
@@ -3756,14 +3757,14 @@ function registerRuleTools(server, callApi) {
     {
       title: "Update Rule",
       description: "Update an existing rule in a DRAFT version. Only provided fields are changed.",
-      inputSchema: {
-        groupId: z3.string().uuid().describe("Policy group ID"),
-        versionId: z3.string().uuid().describe("Version ID"),
-        ruleId: z3.string().uuid().describe("Rule ID"),
-        rule: z3.string().describe(
+      inputSchema: z4.object({
+        groupId: z4.string().uuid().describe("Policy group ID"),
+        versionId: z4.string().uuid().describe("Version ID"),
+        ruleId: z4.string().uuid().describe("Rule ID"),
+        rule: z4.string().describe(
           "JSON string of UpdateRuleRequest: { name?, condition?, actions?, mutexGroup?, mutexMode?, mutexStrategy?, mutexLimit?, isEnabled? }"
         )
-      }
+      })
     },
     async ({ groupId, versionId, ruleId, rule }) => {
       const body = parseJson(rule);
@@ -3777,12 +3778,12 @@ function registerRuleTools(server, callApi) {
     {
       title: "Delete Rule",
       description: "Delete a rule from a DRAFT version.",
-      inputSchema: {
-        groupId: z3.string().uuid().describe("Policy group ID"),
-        versionId: z3.string().uuid().describe("Version ID"),
-        ruleId: z3.string().uuid().describe("Rule ID"),
-        force: z3.boolean().default(false).describe("Skip confirmation (for the last rule in a version)")
-      }
+      inputSchema: z4.object({
+        groupId: z4.string().uuid().describe("Policy group ID"),
+        versionId: z4.string().uuid().describe("Version ID"),
+        ruleId: z4.string().uuid().describe("Rule ID"),
+        force: z4.boolean().default(false).describe("Skip confirmation (for the last rule in a version)")
+      })
     },
     async ({ groupId, versionId, ruleId, force }) => {
       const params = {};
@@ -3797,11 +3798,11 @@ function registerRuleTools(server, callApi) {
     {
       title: "Reorder Rules",
       description: "Reorder rules by specifying rule IDs in desired order. Priorities are assigned 1...N (1-based, continuous); array index 0 = priority 1 (highest precedence).",
-      inputSchema: {
-        groupId: z3.string().uuid().describe("Policy group ID"),
-        versionId: z3.string().uuid().describe("Version ID"),
-        ruleIds: z3.array(z3.string().uuid()).describe("Rule IDs in desired priority order")
-      }
+      inputSchema: z4.object({
+        groupId: z4.string().uuid().describe("Policy group ID"),
+        versionId: z4.string().uuid().describe("Version ID"),
+        ruleIds: z4.array(z4.string().uuid()).describe("Rule IDs in desired priority order")
+      })
     },
     async ({ groupId, versionId, ruleIds }) => {
       const rules = ruleIds.map((ruleId, index) => ({
@@ -3818,12 +3819,12 @@ function registerRuleTools(server, callApi) {
     {
       title: "Toggle Rule",
       description: "Enable or disable a rule without deleting it.",
-      inputSchema: {
-        groupId: z3.string().uuid().describe("Policy group ID"),
-        versionId: z3.string().uuid().describe("Version ID"),
-        ruleId: z3.string().uuid().describe("Rule ID"),
-        isEnabled: z3.boolean().describe("true to enable, false to disable")
-      }
+      inputSchema: z4.object({
+        groupId: z4.string().uuid().describe("Policy group ID"),
+        versionId: z4.string().uuid().describe("Version ID"),
+        ruleId: z4.string().uuid().describe("Rule ID"),
+        isEnabled: z4.boolean().describe("true to enable, false to disable")
+      })
     },
     async ({ groupId, versionId, ruleId, isEnabled }) => callApi("PATCH", `policy-groups/${groupId}/versions/${versionId}/rules/${ruleId}/enabled`, {
       body: { isEnabled }
@@ -3832,7 +3833,7 @@ function registerRuleTools(server, callApi) {
 }
 
 // src/mcp/tools/facts.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 
 // src/types/facts.ts
 var FACT_KEY_PATTERN = /^[a-zA-Z][a-zA-Z0-9_]*$/;
@@ -3845,11 +3846,11 @@ function registerFactTools(server, callApi) {
     {
       title: "List Fact Definitions",
       description: "List all fact definitions (input variable schema). Shows key, type, required, and PII status. Always check this before creating rules.",
-      inputSchema: {
-        page: z4.number().int().min(0).default(0).describe("Page number"),
-        size: z4.number().int().min(1).max(100).default(20).describe("Page size"),
-        keyword: z4.string().optional().describe("Search keyword")
-      }
+      inputSchema: z5.object({
+        page: z5.number().int().min(0).default(0).describe("Page number"),
+        size: z5.number().int().min(1).max(100).default(20).describe("Page size"),
+        keyword: z5.string().optional().describe("Search keyword")
+      })
     },
     async ({ page, size, keyword }) => {
       const params = paginationParams(page, size);
@@ -3862,16 +3863,16 @@ function registerFactTools(server, callApi) {
     {
       title: "Create Fact Definition",
       description: "Register a new input variable. Key starts with a letter, then letters, numbers, and underscores (e.g. paymentAmount). Casing is not enforced. Types: STRING, NUMBER, BOOLEAN, LIST_STRING, LIST_NUMBER.",
-      inputSchema: {
-        key: z4.string().regex(FACT_KEY_PATTERN).describe("Variable key. Any casing; must start with a letter."),
-        name: z4.string().describe("Display name"),
-        type: z4.enum(VALUE_TYPES).describe("Value type"),
-        description: z4.string().optional().describe("Description"),
-        isRequired: z4.boolean().default(false).describe("Whether this fact is required for rule evaluation"),
-        isPii: z4.boolean().default(false).describe(
+      inputSchema: z5.object({
+        key: z5.string().regex(FACT_KEY_PATTERN).describe("Variable key. Any casing; must start with a letter."),
+        name: z5.string().describe("Display name"),
+        type: z5.enum(VALUE_TYPES).describe("Value type"),
+        description: z5.string().optional().describe("Description"),
+        isRequired: z5.boolean().default(false).describe("Whether this fact is required for rule evaluation"),
+        isPii: z5.boolean().default(false).describe(
           "Mark as PII \u2014 masked on every read surface, revealable only in the console (audited)"
         )
-      }
+      })
     },
     async (args) => callApi("POST", "schema/facts", { body: args })
   );
@@ -3880,16 +3881,16 @@ function registerFactTools(server, callApi) {
     {
       title: "Update Fact Definition",
       description: "Update a fact definition. The key is immutable. The type can change only while no rule references the fact; if any does, the call fails with FD-007 and reports the count. Only the fields you send are changed. System facts accept name, description, and PII only.",
-      inputSchema: {
-        factId: z4.string().uuid().describe("Fact definition ID"),
-        name: z4.string().optional().describe("Display name"),
-        description: z4.string().optional().describe("Description"),
-        type: z4.enum(VALUE_TYPES).optional().describe(
+      inputSchema: z5.object({
+        factId: z5.string().uuid().describe("Fact definition ID"),
+        name: z5.string().optional().describe("Display name"),
+        description: z5.string().optional().describe("Description"),
+        type: z5.enum(VALUE_TYPES).optional().describe(
           "Value type. Omit to leave it unchanged. Changing it fails with FD-007 while any rule references the fact."
         ),
-        isRequired: z4.boolean().optional().describe("Required flag"),
-        isPii: z4.boolean().optional().describe("PII flag \u2014 enables/disables masking (changeable even on system facts)")
-      }
+        isRequired: z5.boolean().optional().describe("Required flag"),
+        isPii: z5.boolean().optional().describe("PII flag \u2014 enables/disables masking (changeable even on system facts)")
+      })
     },
     async ({ factId, ...body }) => callApi("PUT", `schema/facts/${factId}`, { body })
   );
@@ -3898,9 +3899,9 @@ function registerFactTools(server, callApi) {
     {
       title: "Delete Fact Definition",
       description: "Delete a fact definition. System facts cannot be deleted. Neither can a fact that any rule references: that call fails with FD-006 and reports the count. Remove the references first.",
-      inputSchema: {
-        factId: z4.string().uuid().describe("Fact definition ID")
-      }
+      inputSchema: z5.object({
+        factId: z5.string().uuid().describe("Fact definition ID")
+      })
     },
     async ({ factId }) => callApi("DELETE", `schema/facts/${factId}`)
   );
@@ -3909,7 +3910,7 @@ function registerFactTools(server, callApi) {
     {
       title: "Get Action Runtime Fact Metadata",
       description: "Retrieve runtime fact requirements per Action type. For each Action, shows which input facts must be present in the execution payload \u2014 e.g. MUTATE_FACT always requires its targetVar fact, plus refVar when one is specified. The factRequired flag describes the FACT, not the parameter: refVar is an optional parameter, but if you specify it the named fact must exist. A required fact absent at runtime throws \u2014 the engine never defaults to 0. Facts are supplied as input or written by a prior action in the same rule; only SET_FACT creates a fact from nothing. Static data, safe to cache in-session.",
-      inputSchema: {}
+      inputSchema: z5.object({})
     },
     async () => callApi("GET", "schema/action-metadata")
   );
@@ -3918,10 +3919,10 @@ function registerFactTools(server, callApi) {
     {
       title: "List Unregistered Facts",
       description: "List facts referenced by a version's rules but not yet defined (read-only \u2014 does not block publish/deploy, INV-4). Version-wide: covers every rule in the version. Each entry carries the inferred type, suggested name, and where it is referenced (condition/action). Register them with lexq_facts_create to enable type validation and the dry-run requirements analyzer.",
-      inputSchema: {
-        groupId: z4.string().uuid().describe("Policy group ID"),
-        versionId: z4.string().uuid().describe("Version ID")
-      }
+      inputSchema: z5.object({
+        groupId: z5.string().uuid().describe("Policy group ID"),
+        versionId: z5.string().uuid().describe("Version ID")
+      })
     },
     async ({ groupId, versionId }) => callApi("GET", `policy-groups/${groupId}/versions/${versionId}/unregistered-facts`)
   );
@@ -3930,10 +3931,10 @@ function registerFactTools(server, callApi) {
     {
       title: "Export Fact Catalog",
       description: "Export the fact catalog. The two formats carry different things: CSV is the catalog as it stands, system facts included, for reading in a spreadsheet; JSON matches the shape that batch create accepts, so it can be fed straight back in, which is why it leaves out the fields that endpoint does not take. Returns the file contents as text.",
-      inputSchema: {
-        format: z4.enum(EXPORT_FORMATS).default("csv").describe("Export format"),
-        keyword: z4.string().optional().describe("Filter by key or name")
-      }
+      inputSchema: z5.object({
+        format: z5.enum(EXPORT_FORMATS).default("csv").describe("Export format"),
+        keyword: z5.string().optional().describe("Filter by key or name")
+      })
     },
     async ({ format, keyword }) => callApi("GET", "schema/facts/export", {
       params: keyword ? { format, keyword } : { format }
@@ -3942,18 +3943,18 @@ function registerFactTools(server, callApi) {
 }
 
 // src/mcp/tools/deploy.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 function registerDeployTools(server, callApi) {
   server.registerTool(
     "lexq_deploy_publish",
     {
       title: "Publish Version",
       description: "Publish a DRAFT version (DRAFT \u2192 ACTIVE). Locks the version from further edits. Must have at least one rule. Undefined facts referenced by rules do not block publishing (INV-4); call lexq_facts_unregistered first to review them.",
-      inputSchema: {
-        groupId: z5.string().uuid().describe("Policy group ID"),
-        versionId: z5.string().uuid().describe("Version ID to publish"),
-        memo: z5.string().min(1).describe("Publish memo (required)")
-      }
+      inputSchema: z6.object({
+        groupId: z6.string().uuid().describe("Policy group ID"),
+        versionId: z6.string().uuid().describe("Version ID to publish"),
+        memo: z6.string().min(1).describe("Publish memo (required)")
+      })
     },
     async ({ groupId, versionId, memo }) => callApi("POST", `policy-groups/${groupId}/versions/${versionId}/publish`, { body: { memo } })
   );
@@ -3962,11 +3963,11 @@ function registerDeployTools(server, callApi) {
     {
       title: "Deploy to Live",
       description: "Deploy an ACTIVE (published) version to live traffic. Takes effect immediately. Versions whose effective start date has not arrived are rejected (P-037) \u2014 use lexq_deploy_schedule for those. Undefined facts do not block deployment (INV-4); use lexq_facts_unregistered to review what the version references but has not defined.",
-      inputSchema: {
-        groupId: z5.string().uuid().describe("Policy group ID"),
-        versionId: z5.string().uuid().describe("Version ID to deploy"),
-        memo: z5.string().min(1).describe("Deployment memo (required)")
-      }
+      inputSchema: z6.object({
+        groupId: z6.string().uuid().describe("Policy group ID"),
+        versionId: z6.string().uuid().describe("Version ID to deploy"),
+        memo: z6.string().min(1).describe("Deployment memo (required)")
+      })
     },
     async ({ groupId, versionId, memo }) => callApi("POST", `policy-groups/${groupId}/deploy`, {
       body: { versionId, memo }
@@ -3977,10 +3978,10 @@ function registerDeployTools(server, callApi) {
     {
       title: "Rollback Deployment",
       description: "Rollback to the previous deployed version. Only available if there is a previous version.",
-      inputSchema: {
-        groupId: z5.string().uuid().describe("Policy group ID"),
-        memo: z5.string().min(1).describe("Rollback reason (required)")
-      }
+      inputSchema: z6.object({
+        groupId: z6.string().uuid().describe("Policy group ID"),
+        memo: z6.string().min(1).describe("Rollback reason (required)")
+      })
     },
     async ({ groupId, memo }) => callApi("POST", `policy-groups/${groupId}/rollback`, {
       body: { memo }
@@ -3991,10 +3992,10 @@ function registerDeployTools(server, callApi) {
     {
       title: "Undeploy",
       description: "Remove the live version from traffic. The version stays ACTIVE but no longer serves requests.",
-      inputSchema: {
-        groupId: z5.string().uuid().describe("Policy group ID"),
-        memo: z5.string().min(1).describe("Undeploy reason (required)")
-      }
+      inputSchema: z6.object({
+        groupId: z6.string().uuid().describe("Policy group ID"),
+        memo: z6.string().min(1).describe("Undeploy reason (required)")
+      })
     },
     async ({ groupId, memo }) => callApi("POST", `policy-groups/${groupId}/undeploy`, {
       body: { memo }
@@ -4005,11 +4006,11 @@ function registerDeployTools(server, callApi) {
     {
       title: "Schedule Deployment",
       description: "Schedule an ACTIVE version with a future effective start date to auto-deploy at that time (Scheduled Deployment). One pending schedule per group; manual deploy/rollback/undeploy, starting an A/B test, or archiving the group cancels it. The snapshot hash is sealed at scheduling and re-verified at execution (fail-closed).",
-      inputSchema: {
-        groupId: z5.string().uuid().describe("Policy group ID"),
-        versionId: z5.string().uuid().describe("ACTIVE version ID with a future effective start date"),
-        memo: z5.string().min(1).describe("Schedule memo (required)")
-      }
+      inputSchema: z6.object({
+        groupId: z6.string().uuid().describe("Policy group ID"),
+        versionId: z6.string().uuid().describe("ACTIVE version ID with a future effective start date"),
+        memo: z6.string().min(1).describe("Schedule memo (required)")
+      })
     },
     async ({ groupId, versionId, memo }) => callApi("POST", `policy-groups/${groupId}/schedule`, {
       body: { versionId, memo }
@@ -4020,9 +4021,9 @@ function registerDeployTools(server, callApi) {
     {
       title: "Cancel Scheduled Deployment",
       description: "Cancel the pending scheduled deployment for a group. The version itself is not affected. Fails with P-039 if no pending schedule exists.",
-      inputSchema: {
-        groupId: z5.string().uuid().describe("Policy group ID")
-      }
+      inputSchema: z6.object({
+        groupId: z6.string().uuid().describe("Policy group ID")
+      })
     },
     async ({ groupId }) => callApi("DELETE", `policy-groups/${groupId}/schedule`)
   );
@@ -4031,10 +4032,10 @@ function registerDeployTools(server, callApi) {
     {
       title: "List Scheduled Deployments",
       description: "List scheduled deployments across all groups (all statuses: PENDING, EXECUTED, CANCELED, FAILED), newest first.",
-      inputSchema: {
-        page: z5.number().int().min(0).default(0).describe("Page number"),
-        size: z5.number().int().min(1).max(100).default(20).describe("Page size")
-      }
+      inputSchema: z6.object({
+        page: z6.number().int().min(0).default(0).describe("Page number"),
+        size: z6.number().int().min(1).max(100).default(20).describe("Page size")
+      })
     },
     async ({ page, size }) => callApi("GET", "policy-groups/schedules", { params: paginationParams(page, size) })
   );
@@ -4043,14 +4044,14 @@ function registerDeployTools(server, callApi) {
     {
       title: "Deployment History",
       description: "List deployment history across all groups.",
-      inputSchema: {
-        page: z5.number().int().min(0).default(0).describe("Page number"),
-        size: z5.number().int().min(1).max(100).default(20).describe("Page size"),
-        groupId: z5.string().uuid().optional().describe("Filter by group ID"),
-        types: z5.string().optional().describe("Filter by deployment types (comma-separated: DEPLOY,ROLLBACK,UNDEPLOY)"),
-        startDate: z5.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z5.string().optional().describe("End date (yyyy-MM-dd)")
-      }
+      inputSchema: z6.object({
+        page: z6.number().int().min(0).default(0).describe("Page number"),
+        size: z6.number().int().min(1).max(100).default(20).describe("Page size"),
+        groupId: z6.string().uuid().optional().describe("Filter by group ID"),
+        types: z6.string().optional().describe("Filter by deployment types (comma-separated: DEPLOY,ROLLBACK,UNDEPLOY)"),
+        startDate: z6.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z6.string().optional().describe("End date (yyyy-MM-dd)")
+      })
     },
     async ({ page, size, groupId, types, startDate, endDate }) => {
       const params = paginationParams(page, size);
@@ -4066,9 +4067,9 @@ function registerDeployTools(server, callApi) {
     {
       title: "Deployment Detail",
       description: "Get detailed info about a specific deployment including snapshot hash and integrity check.",
-      inputSchema: {
-        deploymentId: z5.string().uuid().describe("Deployment ID")
-      }
+      inputSchema: z6.object({
+        deploymentId: z6.string().uuid().describe("Deployment ID")
+      })
     },
     async ({ deploymentId }) => callApi("GET", `deployments/${deploymentId}`)
   );
@@ -4077,7 +4078,7 @@ function registerDeployTools(server, callApi) {
     {
       title: "Deployment Overview",
       description: "Show current deployment status of all groups \u2014 which version is live, last deployment type, and deployer.",
-      inputSchema: {}
+      inputSchema: z6.object({})
     },
     async () => callApi("GET", "deployments/overview")
   );
@@ -4086,9 +4087,9 @@ function registerDeployTools(server, callApi) {
     {
       title: "List Deployable Versions",
       description: "List ACTIVE (published) versions that can be deployed for a group. Use this to find which versions are available before calling deploy live.",
-      inputSchema: {
-        groupId: z5.string().uuid().describe("Policy group ID")
-      }
+      inputSchema: z6.object({
+        groupId: z6.string().uuid().describe("Policy group ID")
+      })
     },
     async ({ groupId }) => callApi("GET", `deployments/groups/${groupId}/deployable-versions`)
   );
@@ -4097,10 +4098,10 @@ function registerDeployTools(server, callApi) {
     {
       title: "Deployment Diff",
       description: "Compare rule snapshots between two versions. Shows added, removed, and modified rules. Useful for reviewing changes before deploying a new version.",
-      inputSchema: {
-        baseVersionId: z5.string().uuid().describe("Base version ID (typically the current live)"),
-        targetVersionId: z5.string().uuid().describe("Target version ID (the one you want to deploy)")
-      }
+      inputSchema: z6.object({
+        baseVersionId: z6.string().uuid().describe("Base version ID (typically the current live)"),
+        targetVersionId: z6.string().uuid().describe("Target version ID (the one you want to deploy)")
+      })
     },
     async ({ baseVersionId, targetVersionId }) => callApi("GET", "deployments/diff", {
       params: { baseVersionId, targetVersionId }
@@ -4109,7 +4110,7 @@ function registerDeployTools(server, callApi) {
 }
 
 // src/mcp/tools/analytics.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 import dedent16 from "dedent";
 function registerAnalyticsTools(server, callApi) {
   server.registerTool(
@@ -4128,11 +4129,11 @@ function registerAnalyticsTools(server, callApi) {
         
         Example input: { "facts": { "paymentAmount": 100000, "customerTier": "VIP" } }
         Always dry-run before publishing to validate rule behavior.`,
-      inputSchema: {
-        versionId: z6.string().uuid().describe("Policy version ID to test against"),
-        facts: z6.string().describe('JSON string of facts object, e.g. {"paymentAmount":100000}'),
-        includeDebugInfo: z6.boolean().default(true).describe("Include execution and decision traces")
-      }
+      inputSchema: z7.object({
+        versionId: z7.string().uuid().describe("Policy version ID to test against"),
+        facts: z7.string().describe('JSON string of facts object, e.g. {"paymentAmount":100000}'),
+        includeDebugInfo: z7.boolean().default(true).describe("Include execution and decision traces")
+      })
     },
     async ({ versionId, facts, includeDebugInfo }) => {
       const parsedFacts = parseJson(facts);
@@ -4152,11 +4153,11 @@ function registerAnalyticsTools(server, callApi) {
           resultA / resultB — full DryRunResponse for each version
           diff.mutatedDiff   — changes in mutatedFacts between A and B (key → {before, after})
           diff.generatedDiff — changes in generatedVariables between A and B`,
-      inputSchema: {
-        versionIdA: z6.string().uuid().describe("Baseline version ID"),
-        versionIdB: z6.string().uuid().describe("Candidate version ID"),
-        facts: z6.string().describe("JSON string of facts object")
-      }
+      inputSchema: z7.object({
+        versionIdA: z7.string().uuid().describe("Baseline version ID"),
+        versionIdB: z7.string().uuid().describe("Candidate version ID"),
+        facts: z7.string().describe("JSON string of facts object")
+      })
     },
     async ({ versionIdA, versionIdB, facts }) => {
       const parsedFacts = parseJson(facts);
@@ -4170,10 +4171,10 @@ function registerAnalyticsTools(server, callApi) {
     {
       title: "Analyze Requirements",
       description: "Analyze which input facts a version requires. Returns required keys, types, and an example request body.",
-      inputSchema: {
-        groupId: z6.string().uuid().describe("Policy group ID"),
-        versionId: z6.string().uuid().describe("Version ID")
-      }
+      inputSchema: z7.object({
+        groupId: z7.string().uuid().describe("Policy group ID"),
+        versionId: z7.string().uuid().describe("Version ID")
+      })
     },
     async ({ groupId, versionId }) => callApi("GET", `analytics/groups/${groupId}/versions/${versionId}/requirements`)
   );
@@ -4209,9 +4210,9 @@ function registerAnalyticsTools(server, callApi) {
           "options": { "baselinePolicyVersionId": "<uuid>", "includeRuleStats": true }
         }
       `,
-      inputSchema: {
-        body: z6.string().describe("JSON string of SimulationRequest")
-      }
+      inputSchema: z7.object({
+        body: z7.string().describe("JSON string of SimulationRequest")
+      })
     },
     async ({ body }) => {
       const parsed = parseJson(body);
@@ -4223,9 +4224,9 @@ function registerAnalyticsTools(server, callApi) {
     {
       title: "Simulation Status",
       description: "Get simulation status and results. Poll until status is COMPLETED or FAILED.",
-      inputSchema: {
-        simulationId: z6.string().uuid().describe("Simulation ID")
-      }
+      inputSchema: z7.object({
+        simulationId: z7.string().uuid().describe("Simulation ID")
+      })
     },
     async ({ simulationId }) => callApi("GET", `analytics/simulations/${simulationId}`)
   );
@@ -4234,13 +4235,13 @@ function registerAnalyticsTools(server, callApi) {
     {
       title: "List Simulations",
       description: "List simulation history with optional filters.",
-      inputSchema: {
-        page: z6.number().int().min(0).default(0).describe("Page number"),
-        size: z6.number().int().min(1).max(100).default(20).describe("Page size"),
-        status: z6.enum(["PENDING", "RUNNING", "COMPLETED", "FAILED", "CANCELED"]).optional().describe("Filter by status"),
-        from: z6.string().optional().describe("Start date (yyyy-MM-dd)"),
-        to: z6.string().optional().describe("End date (yyyy-MM-dd)")
-      }
+      inputSchema: z7.object({
+        page: z7.number().int().min(0).default(0).describe("Page number"),
+        size: z7.number().int().min(1).max(100).default(20).describe("Page size"),
+        status: z7.enum(["PENDING", "RUNNING", "COMPLETED", "FAILED", "CANCELED"]).optional().describe("Filter by status"),
+        from: z7.string().optional().describe("Start date (yyyy-MM-dd)"),
+        to: z7.string().optional().describe("End date (yyyy-MM-dd)")
+      })
     },
     async ({ page, size, status, from, to }) => {
       const params = paginationParams(page, size);
@@ -4255,9 +4256,9 @@ function registerAnalyticsTools(server, callApi) {
     {
       title: "Cancel Simulation",
       description: "Cancel a running or pending simulation.",
-      inputSchema: {
-        simulationId: z6.string().uuid().describe("Simulation ID")
-      }
+      inputSchema: z7.object({
+        simulationId: z7.string().uuid().describe("Simulation ID")
+      })
     },
     async ({ simulationId }) => callApi("DELETE", `analytics/simulations/${simulationId}`)
   );
@@ -4266,10 +4267,10 @@ function registerAnalyticsTools(server, callApi) {
     {
       title: "Export Simulation",
       description: "Export simulation results as JSON or CSV. Returns the raw data.",
-      inputSchema: {
-        simulationId: z6.string().uuid().describe("Simulation ID"),
-        format: z6.enum(EXPORT_FORMATS).default("json").describe("Export format")
-      }
+      inputSchema: z7.object({
+        simulationId: z7.string().uuid().describe("Simulation ID"),
+        format: z7.enum(EXPORT_FORMATS).default("json").describe("Export format")
+      })
     },
     async ({ simulationId, format }) => callApi("GET", `analytics/simulations/${simulationId}/export`, {
       params: { format }
@@ -4293,10 +4294,10 @@ function registerAnalyticsTools(server, callApi) {
 
         JSON example: [{"userId":"user_001","paymentAmount":150000}, {"userId":"user_002","paymentAmount":50000}]
       `,
-      inputSchema: {
-        content: z6.string().describe("CSV or JSON content as string"),
-        filename: z6.string().default("dataset.csv").describe("Filename with extension (.csv or .json)")
-      }
+      inputSchema: z7.object({
+        content: z7.string().describe("CSV or JSON content as string"),
+        filename: z7.string().default("dataset.csv").describe("Filename with extension (.csv or .json)")
+      })
     },
     async ({ content, filename }) => {
       const result = await callApi("POST", "analytics/datasets/upload", {
@@ -4323,11 +4324,11 @@ function registerAnalyticsTools(server, callApi) {
     {
       title: "Download Dataset Template",
       description: "Generate a sample CSV or JSON template based on the required facts of a version. Use this to understand the expected data format before uploading a dataset.",
-      inputSchema: {
-        groupId: z6.string().uuid().describe("Policy group ID"),
-        versionId: z6.string().uuid().describe("Version ID"),
-        format: z6.enum(EXPORT_FORMATS).default("csv").describe("Template format")
-      }
+      inputSchema: z7.object({
+        groupId: z7.string().uuid().describe("Policy group ID"),
+        versionId: z7.string().uuid().describe("Version ID"),
+        format: z7.enum(EXPORT_FORMATS).default("csv").describe("Template format")
+      })
     },
     async ({ groupId, versionId, format }) => callApi("GET", `analytics/groups/${groupId}/versions/${versionId}/dataset-template`, {
       params: { format }
@@ -4336,7 +4337,7 @@ function registerAnalyticsTools(server, callApi) {
 }
 
 // src/mcp/tools/profile.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var RELATIVE_THRESHOLD = `flagged = p50 \u2265 ${SLOW_MULTIPLIER}\xD7 median of per-rule p50s within the group; absolute thresholds are intentionally not supported.`;
 function profileParams(opts) {
   const params = {};
@@ -4352,15 +4353,15 @@ function registerProfileTools(server, callApi) {
     {
       title: "Group Latency Profile",
       description: "Per-rule latency profile of a policy group over a time window: group TOTAL distribution split by cache state (HIT = compiled ruleset cache hit, MISS = deep-load + compile), a per-rule CONDITION/ACTION percentile table, and slow-rule flags. " + RELATIVE_THRESHOLD + ` Every percentile is accompanied by its sample count n; a percentile is withheld (null) unless n\xD7(1\u2212q) \u2265 ${TAIL_MIN_OBS} (p50 needs n \u2265 6, p95 n \u2265 60, p99 n \u2265 300 \u2014 display gate, separate from the n \u2265 ${MIN_SAMPLES} judgment gate). Baselines report INSUFFICIENT_COHORT when fewer than ${MIN_COHORT_SIZE} rules qualify. Rule detail comes from a deterministic ${PROFILE_SAMPLE_PERMILLE / 10}% sample of calls; TOTAL is recorded for every call. Defaults: last ${PROFILE_DEFAULT_WINDOW_HOURS}h, live version, cacheState HIT.`,
-      inputSchema: {
-        groupId: z7.string().uuid().describe("Policy group ID"),
-        versionId: z7.string().uuid().optional().describe("Version to inspect (default: live version)"),
-        from: z7.string().optional().describe(
+      inputSchema: z8.object({
+        groupId: z8.string().uuid().describe("Policy group ID"),
+        versionId: z8.string().uuid().optional().describe("Version to inspect (default: live version)"),
+        from: z8.string().optional().describe(
           `Window start, ISO-8601 instant (e.g. 2026-07-01T00:00:00Z). Default: ${PROFILE_DEFAULT_WINDOW_HOURS}h ago`
         ),
-        to: z7.string().optional().describe("Window end, ISO-8601 instant. Default: now"),
-        cacheState: z7.enum(["HIT", "MISS"]).optional().describe("Cache dimension for the rule table and judgment (default: HIT)")
-      }
+        to: z8.string().optional().describe("Window end, ISO-8601 instant. Default: now"),
+        cacheState: z8.enum(["HIT", "MISS"]).optional().describe("Cache dimension for the rule table and judgment (default: HIT)")
+      })
     },
     async ({ groupId, versionId, from, to, cacheState }) => callApi("GET", `policy-groups/${groupId}/profile`, {
       params: profileParams({ versionId, from, to, cacheState })
@@ -4371,15 +4372,15 @@ function registerProfileTools(server, callApi) {
     {
       title: "Rule Latency Detail",
       description: `Single-rule latency detail: merged phase \xD7 cacheState distributions plus a per-window time series (${LATENCY_WINDOW_MILLIS / 1e3}s windows). Missing windows are genuine gaps \u2014 never interpolated. Series points carry each window's own values; percentiles in merged distributions are withheld (null) unless n\xD7(1\u2212q) \u2265 ${TAIL_MIN_OBS} (p50 n \u2265 6, p95 n \u2265 60, p99 n \u2265 300). ` + RELATIVE_THRESHOLD,
-      inputSchema: {
-        groupId: z7.string().uuid().describe("Policy group ID"),
-        ruleId: z7.string().uuid().describe("Rule ID (from lexq_profile_overview)"),
-        versionId: z7.string().uuid().optional().describe("Version to inspect (default: live version)"),
-        from: z7.string().optional().describe(
+      inputSchema: z8.object({
+        groupId: z8.string().uuid().describe("Policy group ID"),
+        ruleId: z8.string().uuid().describe("Rule ID (from lexq_profile_overview)"),
+        versionId: z8.string().uuid().optional().describe("Version to inspect (default: live version)"),
+        from: z8.string().optional().describe(
           `Window start, ISO-8601 instant. Default: ${PROFILE_DEFAULT_WINDOW_HOURS}h ago`
         ),
-        to: z7.string().optional().describe("Window end, ISO-8601 instant. Default: now")
-      }
+        to: z8.string().optional().describe("Window end, ISO-8601 instant. Default: now")
+      })
     },
     async ({ groupId, ruleId, versionId, from, to }) => callApi("GET", `policy-groups/${groupId}/profile/rules/${ruleId}`, {
       params: profileParams({ versionId, from, to })
@@ -4388,17 +4389,17 @@ function registerProfileTools(server, callApi) {
 }
 
 // src/mcp/tools/replay.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 function registerReplayTools(server, callApi) {
   server.registerTool(
     "lexq_replay_decision",
     {
       title: "Replay a Decision",
       description: "Re-evaluate a past execution (traceId) against a candidate version and return the decision diff (decisionChanged, effect changes, fired rules) plus a determinism verdict. Synchronous and free of charge (TPS throttle only). A replay sends no webhook, notification, or event: rule actions produce no outward effects.",
-      inputSchema: {
-        traceId: z8.string().describe("Trace ID of the past execution to replay"),
-        candidateVersionId: z8.string().uuid().describe("Version to re-evaluate against")
-      }
+      inputSchema: z9.object({
+        traceId: z9.string().describe("Trace ID of the past execution to replay"),
+        candidateVersionId: z9.string().uuid().describe("Version to re-evaluate against")
+      })
     },
     async ({ traceId, candidateVersionId }) => callApi("POST", "replay/decisions", { body: { traceId, candidateVersionId } })
   );
@@ -4407,14 +4408,14 @@ function registerReplayTools(server, callApi) {
     {
       title: "Start Window Replay (Blast Radius)",
       description: "Submit an async job that replays a date window of past executions against a candidate version and measures the blast radius (how many decisions change). Billed per replayed record (REPLAY metric); VIEWER role cannot submit. Poll with lexq_replay_status.",
-      inputSchema: {
-        candidateVersionId: z8.string().uuid().describe("Version to re-evaluate against"),
-        from: z8.string().describe("Window start date (yyyy-MM-dd)"),
-        to: z8.string().describe("Window end date (yyyy-MM-dd)"),
-        maxRecords: z8.number().int().min(1).optional().describe(
+      inputSchema: z9.object({
+        candidateVersionId: z9.string().uuid().describe("Version to re-evaluate against"),
+        from: z9.string().describe("Window start date (yyyy-MM-dd)"),
+        to: z9.string().describe("Window end date (yyyy-MM-dd)"),
+        maxRecords: z9.number().int().min(1).optional().describe(
           `Sample cap (server default applies; hard cap ${REPLAY_WINDOW_MAX_RECORDS / 1e3}k)`
         )
-      }
+      })
     },
     async ({ candidateVersionId, from, to, maxRecords }) => callApi("POST", "replay/jobs", { body: { candidateVersionId, from, to, maxRecords } })
   );
@@ -4423,9 +4424,9 @@ function registerReplayTools(server, callApi) {
     {
       title: "Get Replay Job Status",
       description: "Poll a window replay job. RUNNING shows progress 0\u2013100; COMPLETED fills summary and changedSamples; FAILED carries errorMessage. capped=true means the window exceeded the sample cap and only part was replayed.",
-      inputSchema: {
-        jobId: z8.string().describe("Replay job ID from lexq_replay_start")
-      }
+      inputSchema: z9.object({
+        jobId: z9.string().describe("Replay job ID from lexq_replay_start")
+      })
     },
     async ({ jobId }) => callApi("GET", `replay/jobs/${jobId}`)
   );
@@ -4434,10 +4435,10 @@ function registerReplayTools(server, callApi) {
     {
       title: "List Replay Jobs",
       description: "List window replay job history (reverse-chronological). Lightweight items \u2014 use lexq_replay_status for summary and changed samples.",
-      inputSchema: {
-        page: z8.number().int().min(0).default(0).describe("Page number"),
-        size: z8.number().int().min(1).max(100).default(20).describe("Page size")
-      }
+      inputSchema: z9.object({
+        page: z9.number().int().min(0).default(0).describe("Page number"),
+        size: z9.number().int().min(1).max(100).default(20).describe("Page size")
+      })
     },
     async ({ page, size }) => callApi("GET", "replay/jobs", { params: paginationParams(page, size) })
   );
@@ -4446,9 +4447,9 @@ function registerReplayTools(server, callApi) {
     {
       title: "Cancel Replay Job",
       description: "Cooperatively cancel a PENDING or RUNNING window replay job. Other states are rejected. VIEWER role cannot cancel.",
-      inputSchema: {
-        jobId: z8.string().describe("Replay job ID")
-      }
+      inputSchema: z9.object({
+        jobId: z9.string().describe("Replay job ID")
+      })
     },
     async ({ jobId }) => callApi("POST", `replay/jobs/${jobId}/cancel`)
   );
@@ -4457,33 +4458,33 @@ function registerReplayTools(server, callApi) {
     {
       title: "Export Replay Result",
       description: "Export a COMPLETED window replay job. A running job is rejected \u2014 a partial result reads as the whole thing on the receiving end. The two formats carry different things: CSV holds the effect blast radius, whose columns are fixed; JSON holds the changed samples and action parameters, which nest and whose keys differ per tenant. JSON is not a superset of CSV. Returns the file contents as text.",
-      inputSchema: {
-        jobId: z8.string().describe("Replay job ID"),
-        format: z8.enum(EXPORT_FORMATS).default("json").describe("Export format")
-      }
+      inputSchema: z9.object({
+        jobId: z9.string().describe("Replay job ID"),
+        format: z9.enum(EXPORT_FORMATS).default("json").describe("Export format")
+      })
     },
     async ({ jobId, format }) => callApi("GET", `replay/jobs/${jobId}/export`, { params: { format } })
   );
 }
 
 // src/mcp/tools/history.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 function registerHistoryTools(server, callApi) {
   server.registerTool(
     "lexq_history_list",
     {
       title: "List Execution History",
       description: "List policy execution history. Shows trace ID, group, version, status, match result, and latency.",
-      inputSchema: {
-        page: z9.number().int().min(0).default(0).describe("Page number"),
-        size: z9.number().int().min(1).max(100).default(20).describe("Page size"),
-        traceId: z9.string().optional().describe("Filter by trace ID"),
-        groupId: z9.string().uuid().optional().describe("Filter by policy group"),
-        versionId: z9.string().uuid().optional().describe("Filter by version"),
-        status: z9.enum(["SUCCESS", "NO_MATCH", "ERROR", "TIMEOUT"]).optional().describe("Filter by execution status"),
-        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
-      }
+      inputSchema: z10.object({
+        page: z10.number().int().min(0).default(0).describe("Page number"),
+        size: z10.number().int().min(1).max(100).default(20).describe("Page size"),
+        traceId: z10.string().optional().describe("Filter by trace ID"),
+        groupId: z10.string().uuid().optional().describe("Filter by policy group"),
+        versionId: z10.string().uuid().optional().describe("Filter by version"),
+        status: z10.enum(["SUCCESS", "NO_MATCH", "ERROR", "TIMEOUT"]).optional().describe("Filter by execution status"),
+        startDate: z10.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z10.string().optional().describe("End date (yyyy-MM-dd)")
+      })
     },
     async ({ page, size, traceId, groupId, versionId, status, startDate, endDate }) => {
       const params = paginationParams(page, size);
@@ -4501,9 +4502,9 @@ function registerHistoryTools(server, callApi) {
     {
       title: "Get Execution Detail",
       description: "Get full execution detail including inputFacts, mutatedFacts, generatedVariables, executionTraces, and decisionTraces.",
-      inputSchema: {
-        traceId: z9.string().describe("Trace ID from execution history")
-      }
+      inputSchema: z10.object({
+        traceId: z10.string().describe("Trace ID from execution history")
+      })
     },
     async ({ traceId }) => callApi("GET", `execution/history/${traceId}`)
   );
@@ -4512,11 +4513,11 @@ function registerHistoryTools(server, callApi) {
     {
       title: "Execution Statistics",
       description: "Get execution KPIs: total executions, success/failure counts, success rate, and average latency.",
-      inputSchema: {
-        groupId: z9.string().uuid().optional().describe("Filter by policy group"),
-        startDate: z9.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z9.string().optional().describe("End date (yyyy-MM-dd)")
-      }
+      inputSchema: z10.object({
+        groupId: z10.string().uuid().optional().describe("Filter by policy group"),
+        startDate: z10.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z10.string().optional().describe("End date (yyyy-MM-dd)")
+      })
     },
     async ({ groupId, startDate, endDate }) => {
       const params = {};
@@ -4529,16 +4530,16 @@ function registerHistoryTools(server, callApi) {
 }
 
 // src/mcp/tools/provenance.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 function registerProvenanceTools(server, callApi) {
   server.registerTool(
     "lexq_provenance_get",
     {
       title: "Get Decision Provenance",
       description: "Get the lineage of a single decision: what was decided, deterministic why per rule, input facts (PII facts are masked as \u2022\u2022\u2022\u2022\u2022\u2022 with maskedKeys listing them \u2014 values are revealable only in the console, audited), the authored/published/deployed responsibility chain, and the rule snapshot fingerprint.",
-      inputSchema: {
-        traceId: z10.string().describe("Trace ID of the execution")
-      }
+      inputSchema: z11.object({
+        traceId: z11.string().describe("Trace ID of the execution")
+      })
     },
     async ({ traceId }) => callApi("GET", `provenance/${traceId}`)
   );
@@ -4547,15 +4548,15 @@ function registerProvenanceTools(server, callApi) {
     {
       title: "List PII Reveal Audits",
       description: "List the PII reveal audit ledger \u2014 who revealed which fact of which trace, and when. Metadata only; revealed values are never stored or returned. Use for monthly access-log inspection and SIEM collection.",
-      inputSchema: {
-        page: z10.number().int().min(0).default(0).describe("Page number"),
-        size: z10.number().int().min(1).max(100).default(20).describe("Page size"),
-        traceId: z10.string().optional().describe("Filter by trace ID (exact match)"),
-        revealedBy: z10.string().optional().describe("Filter by operator ID (exact match)"),
-        factKey: z10.string().optional().describe("Filter by fact key (partial match, case-insensitive)"),
-        startDate: z10.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z10.string().optional().describe("End date (yyyy-MM-dd)")
-      }
+      inputSchema: z11.object({
+        page: z11.number().int().min(0).default(0).describe("Page number"),
+        size: z11.number().int().min(1).max(100).default(20).describe("Page size"),
+        traceId: z11.string().optional().describe("Filter by trace ID (exact match)"),
+        revealedBy: z11.string().optional().describe("Filter by operator ID (exact match)"),
+        factKey: z11.string().optional().describe("Filter by fact key (partial match, case-insensitive)"),
+        startDate: z11.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z11.string().optional().describe("End date (yyyy-MM-dd)")
+      })
     },
     async ({ page, size, traceId, revealedBy, factKey, startDate, endDate }) => {
       const params = paginationParams(page, size);
@@ -4570,22 +4571,22 @@ function registerProvenanceTools(server, callApi) {
 }
 
 // src/mcp/tools/logs.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 function registerLogTools(server, callApi) {
   server.registerTool(
     "lexq_logs_list",
     {
       title: "List Failure Logs",
       description: "List system failure logs from background tasks (platform event webhooks, scheduled deployments).",
-      inputSchema: {
-        page: z11.number().int().min(0).default(0).describe("Page number"),
-        size: z11.number().int().min(1).max(100).default(20).describe("Page size"),
-        taskType: z11.enum(TaskType).optional().describe("Task type"),
-        status: z11.enum(FailureStatus).optional().describe("Log status"),
-        keyword: z11.string().optional().describe("Search in refId, refSubId, errorMessage"),
-        startDate: z11.string().optional().describe("Start date (yyyy-MM-dd)"),
-        endDate: z11.string().optional().describe("End date (yyyy-MM-dd)")
-      }
+      inputSchema: z12.object({
+        page: z12.number().int().min(0).default(0).describe("Page number"),
+        size: z12.number().int().min(1).max(100).default(20).describe("Page size"),
+        taskType: z12.enum(TaskType).optional().describe("Task type"),
+        status: z12.enum(FailureStatus).optional().describe("Log status"),
+        keyword: z12.string().optional().describe("Search in refId, refSubId, errorMessage"),
+        startDate: z12.string().optional().describe("Start date (yyyy-MM-dd)"),
+        endDate: z12.string().optional().describe("End date (yyyy-MM-dd)")
+      })
     },
     async ({ page, size, taskType, status, keyword, startDate, endDate }) => {
       const params = paginationParams(page, size);
@@ -4602,9 +4603,9 @@ function registerLogTools(server, callApi) {
     {
       title: "Get Failure Log",
       description: "Get failure log detail by ID.",
-      inputSchema: {
-        logId: z11.string().uuid().describe("Failure log ID")
-      }
+      inputSchema: z12.object({
+        logId: z12.string().uuid().describe("Failure log ID")
+      })
     },
     async ({ logId }) => callApi("GET", `failure-logs/${logId}`)
   );
@@ -4613,10 +4614,10 @@ function registerLogTools(server, callApi) {
     {
       title: "Process Failure Log",
       description: "Process a single failure log: RESOLVE (mark as manually fixed) or IGNORE (skip intentionally).",
-      inputSchema: {
-        logId: z11.string().uuid().describe("Failure log ID"),
-        action: z11.enum(FailureAction).describe("Action to take")
-      }
+      inputSchema: z12.object({
+        logId: z12.string().uuid().describe("Failure log ID"),
+        action: z12.enum(FailureAction).describe("Action to take")
+      })
     },
     async ({ logId, action }) => callApi("POST", `failure-logs/${logId}/actions`, {
       params: { action }
@@ -4627,10 +4628,10 @@ function registerLogTools(server, callApi) {
     {
       title: "Bulk Process Failure Logs",
       description: "Process multiple failure logs at once. Provide an array of log IDs and the action.",
-      inputSchema: {
-        logIds: z11.array(z11.string().uuid()).describe("Array of failure log IDs"),
-        action: z11.enum(FailureAction).describe("Action to apply to all logs")
-      }
+      inputSchema: z12.object({
+        logIds: z12.array(z12.string().uuid()).describe("Array of failure log IDs"),
+        action: z12.enum(FailureAction).describe("Action to apply to all logs")
+      })
     },
     async ({ logIds, action }) => callApi("POST", "failure-logs/bulk-actions", {
       body: { logIds, action }
@@ -4639,17 +4640,17 @@ function registerLogTools(server, callApi) {
 }
 
 // src/mcp/tools/webhook-subscriptions.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function registerWebhookSubscriptionTools(server, callApi) {
   server.registerTool(
     "lexq_webhook_subscriptions_list",
     {
       title: "List Webhook Subscriptions",
       description: "List platform event webhook subscriptions. These receive deployment lifecycle notifications (publish, deploy, rollback, undeploy).",
-      inputSchema: {
-        page: z12.number().int().min(0).default(0).describe("Page number"),
-        size: z12.number().int().min(1).max(100).default(20).describe("Page size")
-      }
+      inputSchema: z13.object({
+        page: z13.number().int().min(0).default(0).describe("Page number"),
+        size: z13.number().int().min(1).max(100).default(20).describe("Page size")
+      })
     },
     async ({ page, size }) => {
       const params = paginationParams(page, size);
@@ -4661,9 +4662,9 @@ function registerWebhookSubscriptionTools(server, callApi) {
     {
       title: "Get Webhook Subscription",
       description: "Get webhook subscription detail by ID.",
-      inputSchema: {
-        id: z12.string().uuid().describe("Webhook subscription ID")
-      }
+      inputSchema: z13.object({
+        id: z13.string().uuid().describe("Webhook subscription ID")
+      })
     },
     async ({ id }) => callApi("GET", `webhook-subscriptions/${id}`)
   );
@@ -4672,15 +4673,15 @@ function registerWebhookSubscriptionTools(server, callApi) {
     {
       title: "Save Webhook Subscription",
       description: 'Create or update a webhook subscription. Omit id to create, provide id to update. Events: VERSION_PUBLISHED, DEPLOYED, ROLLED_BACK, UNDEPLOYED. Formats: GENERIC (full JSON), SLACK ({"text": "..."}).',
-      inputSchema: {
-        id: z12.string().uuid().optional().describe("Subscription ID (omit to create, provide to update)"),
-        name: z12.string().min(1).describe("Subscription name (unique per tenant)"),
-        webhookUrl: z12.string().url().describe("Webhook endpoint URL"),
-        subscribedEvents: z12.array(z12.enum(PlatformEventType)).min(1).describe("Events to subscribe to"),
-        payloadFormat: z12.enum(WebhookPayloadFormat).optional().default("GENERIC").describe("Payload format"),
-        secret: z12.string().optional().describe("HMAC-SHA256 signing secret"),
-        isActive: z12.boolean().optional().default(true).describe("Whether the subscription is active")
-      }
+      inputSchema: z13.object({
+        id: z13.string().uuid().optional().describe("Subscription ID (omit to create, provide to update)"),
+        name: z13.string().min(1).describe("Subscription name (unique per tenant)"),
+        webhookUrl: z13.string().url().describe("Webhook endpoint URL"),
+        subscribedEvents: z13.array(z13.enum(PlatformEventType)).min(1).describe("Events to subscribe to"),
+        payloadFormat: z13.enum(WebhookPayloadFormat).optional().default("GENERIC").describe("Payload format"),
+        secret: z13.string().optional().describe("HMAC-SHA256 signing secret"),
+        isActive: z13.boolean().optional().default(true).describe("Whether the subscription is active")
+      })
     },
     async ({ ...body }) => callApi("POST", "webhook-subscriptions", { body })
   );
@@ -4689,9 +4690,9 @@ function registerWebhookSubscriptionTools(server, callApi) {
     {
       title: "Delete Webhook Subscription",
       description: "Delete a webhook subscription by ID.",
-      inputSchema: {
-        id: z12.string().uuid().describe("Webhook subscription ID")
-      }
+      inputSchema: z13.object({
+        id: z13.string().uuid().describe("Webhook subscription ID")
+      })
     },
     async ({ id }) => callApi("DELETE", `webhook-subscriptions/${id}`)
   );
@@ -4700,23 +4701,23 @@ function registerWebhookSubscriptionTools(server, callApi) {
     {
       title: "Test Webhook Subscription",
       description: "Send a test event to verify webhook connectivity. Returns the HTTP status code and success/failure message.",
-      inputSchema: {
-        id: z12.string().uuid().describe("Webhook subscription ID")
-      }
+      inputSchema: z13.object({
+        id: z13.string().uuid().describe("Webhook subscription ID")
+      })
     },
     async ({ id }) => callApi("POST", `webhook-subscriptions/${id}/test`)
   );
 }
 
 // src/mcp/tools/domain-templates.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 function registerDomainTemplateTools(server, callApi) {
   server.registerTool(
     "lexq_domain_templates_list",
     {
       title: "List Domain Templates",
       description: "List all domain templates. A domain template is a curated, industry-specific starter pack of fact definitions and sample rules (e.g. ECOMMERCE). Each entry reports its key, status (ACTIVE or COMING_SOON), and a summary of what it provisions. Call this before preview or apply to discover which templates can currently be applied.",
-      inputSchema: {}
+      inputSchema: z14.object({})
     },
     async () => callApi("GET", "domain-templates")
   );
@@ -4725,11 +4726,11 @@ function registerDomainTemplateTools(server, callApi) {
     {
       title: "Preview Domain Template",
       description: "Preview exactly what a domain template will provision before applying it: the fact definitions it registers, the sample rules it creates, and an apply plan. This is a read-only dry run \u2014 nothing is created. Only ACTIVE templates can be previewed.",
-      inputSchema: {
-        template: z13.string().describe(
+      inputSchema: z14.object({
+        template: z14.string().describe(
           "Domain template key (e.g. ECOMMERCE). Use lexq_domain_templates_list to see available keys \u2014 currently only ECOMMERCE is ACTIVE."
         )
-      }
+      })
     },
     async ({ template }) => callApi("GET", `domain-templates/${template}/preview`)
   );
@@ -4738,12 +4739,12 @@ function registerDomainTemplateTools(server, callApi) {
     {
       title: "Apply Domain Template",
       description: "Apply a domain template to the current tenant. Creates the template's fact definitions and a new policy group pre-populated with its sample rules as a DRAFT version. Existing facts are skipped \u2014 apply is additive and never overwrites existing schema. Run lexq_domain_templates_preview first to review what will be created. Only ACTIVE templates can be applied.",
-      inputSchema: {
-        template: z13.string().describe("Domain template key to apply (e.g. ECOMMERCE)."),
-        customName: z13.string().optional().describe(
+      inputSchema: z14.object({
+        template: z14.string().describe("Domain template key to apply (e.g. ECOMMERCE)."),
+        customName: z14.string().optional().describe(
           "Optional custom name for the policy group that gets created. If omitted, the template's default name is used."
         )
-      }
+      })
     },
     async ({ template, customName }) => {
       const body = {};