@lexq/cli 1.1.0 → 1.1.1

package/dist/index.js

@@ -1328,7 +1328,9 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
     dedent6`
 
         Facts used in a version's rules that have no definition yet (read-only).
-        Does not block publish/deploy — register them to enable validation.
+        Keys a rule only reads do not block publish/deploy; register them to enable
+        validation. A SET_FACT or MUTATE_FACT targetVar must already be registered:
+        saving or publishing fails with ACT-032 otherwise.
 
         Example:
           $ lexq facts unregistered --group-id <gid> --version-id <vid> --format table
@@ -3842,7 +3844,12 @@ function registerRuleTools(server, callApi) {
         If a required key is missing, ask the user to confirm the type, isRequired, and description
         before calling lexq_facts_create — registering facts enables type validation, Console UI
         autocomplete, and the dry-run requirements analyzer.
-        
+
+        An action's targetVar (SET_FACT, MUTATE_FACT) must be a registered fact. Saving or
+        publishing a rule whose targetVar is not registered fails with ACT-032, so register it
+        with lexq_facts_create first. Keys a rule only reads (condition fields, refVar) may stay
+        unregistered.
+
         After saving, lexq_facts_unregistered lists any keys this version references but has not
         defined (non-blocking, version-wide) — use it to decide what to register.
 
@@ -3871,8 +3878,9 @@ function registerRuleTools(server, callApi) {
 
         Action parameter schemas:
         - MUTATE_FACT: { targetVar: string, operator: "ASSIGN"|"ADD"|"SUB"|"MUL"|"DIV", method: "PERCENTAGE"|"AMOUNT", operand: number, refVar?: string, rounding?: RoundingOption }
-          targetVar is the fact this action reads and writes. It must exist in facts at execution
-          time as a number — supplied as an input fact or written by a prior action in this rule.
+          targetVar is the fact this action reads and writes. It must be a registered fact
+          (ACT-032 otherwise), and the request must send it (P-015 otherwise). Its value must be
+          a number when the action runs.
           A missing required fact throws (no 0 default).
           operand is the arithmetic operand; the unit is dictated by method (percent when
           PERCENTAGE, absolute amount when AMOUNT). Ranges are not constrained — negative values
@@ -3890,8 +3898,10 @@ function registerRuleTools(server, callApi) {
             DIV     targetVar /= operand             | invalid
           Constraints: DIV + PERCENTAGE is invalid (use MUL with the inverse). DIV + AMOUNT
           requires operand !== 0.
-        - SET_FACT: { targetVar: string, value: string|number|boolean } Creates the fact if absent
-          — this is the only action that does. MUTATE_FACT requires the target to already exist.
+        - SET_FACT: { targetVar: string, value: string|number|boolean } targetVar must be a
+          registered fact (ACT-032 otherwise). The request does not have to send it: SET_FACT is
+          the only action that can write a key absent from the input facts. MUTATE_FACT requires
+          its target to be present in the input facts.
         - BLOCK: { reason: string } Records a rejection decision. It does NOT halt rule execution —
           subsequent actions and subsequent winning rules still run. Enforcement is the caller's
           responsibility; the decision surfaces as the isBlocked fact.
@@ -3916,7 +3926,7 @@ function registerRuleTools(server, callApi) {
     {
       title: "Update Rule",
       annotations: { readOnlyHint: false, destructiveHint: true },
-      description: `Update an existing rule in a DRAFT version. Only provided fields are changed. A new condition tree must stay within ${MAX_CONDITIONS_PER_RULE} conditions (SINGLE nodes) and ${MAX_CONDITION_DEPTH} levels of nesting below the root.`,
+      description: `Update an existing rule in a DRAFT version. Only provided fields are changed. A new condition tree must stay within ${MAX_CONDITIONS_PER_RULE} conditions (SINGLE nodes) and ${MAX_CONDITION_DEPTH} levels of nesting below the root. Saving re-checks every action in the rule, including ones you did not change, and fails with ACT-032 if any action's targetVar is not a registered fact.`,
       inputSchema: z4.object({
         groupId: z4.string().uuid().describe("Policy group ID"),
         versionId: z4.string().uuid().describe("Version ID"),
@@ -4095,7 +4105,7 @@ function registerFactTools(server, callApi) {
     {
       title: "Get Action Runtime Fact Metadata",
       annotations: { readOnlyHint: true },
-      description: "Retrieve runtime fact requirements per Action type. For each Action, shows which input facts must be present in the execution payload \u2014 e.g. MUTATE_FACT always requires its targetVar fact, plus refVar when one is specified. The factRequired flag describes the FACT, not the parameter: refVar is an optional parameter, but if you specify it the named fact must exist. A required fact absent at runtime throws \u2014 the engine never defaults to 0. Facts are supplied as input or written by a prior action in the same rule; only SET_FACT creates a fact from nothing. Static data, safe to cache in-session.",
+      description: "Retrieve runtime fact requirements per Action type. For each Action, shows which input facts must be present in the execution payload \u2014 e.g. MUTATE_FACT always requires its targetVar fact, plus refVar when one is specified. The factRequired flag describes the FACT, not the parameter: refVar is an optional parameter, but if you specify it the named fact must exist. A required fact absent at runtime throws \u2014 the engine never defaults to 0. These facts must be sent in the request (P-015 otherwise), even when an earlier action in the same rule writes them. SET_FACT requires no input fact: it is the only action that can write a key the request did not send, and its targetVar must be a registered fact (ACT-032). Static data, safe to cache in-session.",
       inputSchema: z5.object({})
     },
     async () => callApi("GET", "schema/action-metadata")
@@ -4105,7 +4115,7 @@ function registerFactTools(server, callApi) {
     {
       title: "List Unregistered Facts",
       annotations: { readOnlyHint: true },
-      description: "List facts referenced by a version's rules but not yet defined (read-only \u2014 does not block publish/deploy). Version-wide: covers every rule in the version. Each entry carries the inferred type, suggested name, and where it is referenced (condition/action). Register them with lexq_facts_create to enable type validation and the dry-run requirements analyzer.",
+      description: "List facts referenced by a version's rules but not yet defined (read-only). Keys that rules only read do not block publish/deploy; a rule whose action targetVar is not a registered fact is rejected at save and publish with ACT-032. Version-wide: covers every rule in the version. Each entry carries the inferred type, suggested name, and where it is referenced (condition/action). Register them with lexq_facts_create to enable type validation and the dry-run requirements analyzer.",
       inputSchema: z5.object({
         groupId: z5.string().uuid().describe("Policy group ID"),
         versionId: z5.string().uuid().describe("Version ID")
@@ -4138,7 +4148,7 @@ function registerDeployTools(server, callApi) {
     {
       title: "Publish Version",
       annotations: { readOnlyHint: false, destructiveHint: false },
-      description: `Publish a DRAFT version (DRAFT \u2192 ACTIVE). Locks the version from further edits. Must have at least one rule. Undefined facts referenced by rules do not block publishing; call lexq_facts_unregistered first to review them. Publishing fails if the version's compiled rules exceed ${MAX_SNAPSHOT_BYTES / 1024} KB, or if its effective end has already passed (P-058); move the end into the future with lexq_versions_update first.`,
+      description: `Publish a DRAFT version (DRAFT \u2192 ACTIVE). Locks the version from further edits. Must have at least one rule. Undefined facts that rules only read do not block publishing; call lexq_facts_unregistered first to review them. Publishing fails if an action's targetVar is not a registered fact (ACT-032), if the version's compiled rules exceed ${MAX_SNAPSHOT_BYTES / 1024} KB, or if its effective end has already passed (P-058); move the end into the future with lexq_versions_update first.`,
       inputSchema: z6.object({
         groupId: z6.string().uuid().describe("Policy group ID"),
         versionId: z6.string().uuid().describe("Version ID to publish"),

package/dist/mcp/register.js

@@ -409,7 +409,12 @@ function registerRuleTools(server, callApi) {
         If a required key is missing, ask the user to confirm the type, isRequired, and description
         before calling lexq_facts_create — registering facts enables type validation, Console UI
         autocomplete, and the dry-run requirements analyzer.
-        
+
+        An action's targetVar (SET_FACT, MUTATE_FACT) must be a registered fact. Saving or
+        publishing a rule whose targetVar is not registered fails with ACT-032, so register it
+        with lexq_facts_create first. Keys a rule only reads (condition fields, refVar) may stay
+        unregistered.
+
         After saving, lexq_facts_unregistered lists any keys this version references but has not
         defined (non-blocking, version-wide) — use it to decide what to register.
 
@@ -438,8 +443,9 @@ function registerRuleTools(server, callApi) {
 
         Action parameter schemas:
         - MUTATE_FACT: { targetVar: string, operator: "ASSIGN"|"ADD"|"SUB"|"MUL"|"DIV", method: "PERCENTAGE"|"AMOUNT", operand: number, refVar?: string, rounding?: RoundingOption }
-          targetVar is the fact this action reads and writes. It must exist in facts at execution
-          time as a number — supplied as an input fact or written by a prior action in this rule.
+          targetVar is the fact this action reads and writes. It must be a registered fact
+          (ACT-032 otherwise), and the request must send it (P-015 otherwise). Its value must be
+          a number when the action runs.
           A missing required fact throws (no 0 default).
           operand is the arithmetic operand; the unit is dictated by method (percent when
           PERCENTAGE, absolute amount when AMOUNT). Ranges are not constrained — negative values
@@ -457,8 +463,10 @@ function registerRuleTools(server, callApi) {
             DIV     targetVar /= operand             | invalid
           Constraints: DIV + PERCENTAGE is invalid (use MUL with the inverse). DIV + AMOUNT
           requires operand !== 0.
-        - SET_FACT: { targetVar: string, value: string|number|boolean } Creates the fact if absent
-          — this is the only action that does. MUTATE_FACT requires the target to already exist.
+        - SET_FACT: { targetVar: string, value: string|number|boolean } targetVar must be a
+          registered fact (ACT-032 otherwise). The request does not have to send it: SET_FACT is
+          the only action that can write a key absent from the input facts. MUTATE_FACT requires
+          its target to be present in the input facts.
         - BLOCK: { reason: string } Records a rejection decision. It does NOT halt rule execution —
           subsequent actions and subsequent winning rules still run. Enforcement is the caller's
           responsibility; the decision surfaces as the isBlocked fact.
@@ -483,7 +491,7 @@ function registerRuleTools(server, callApi) {
     {
       title: "Update Rule",
       annotations: { readOnlyHint: false, destructiveHint: true },
-      description: `Update an existing rule in a DRAFT version. Only provided fields are changed. A new condition tree must stay within ${MAX_CONDITIONS_PER_RULE} conditions (SINGLE nodes) and ${MAX_CONDITION_DEPTH} levels of nesting below the root.`,
+      description: `Update an existing rule in a DRAFT version. Only provided fields are changed. A new condition tree must stay within ${MAX_CONDITIONS_PER_RULE} conditions (SINGLE nodes) and ${MAX_CONDITION_DEPTH} levels of nesting below the root. Saving re-checks every action in the rule, including ones you did not change, and fails with ACT-032 if any action's targetVar is not a registered fact.`,
       inputSchema: z4.object({
         groupId: z4.string().uuid().describe("Policy group ID"),
         versionId: z4.string().uuid().describe("Version ID"),
@@ -666,7 +674,7 @@ function registerFactTools(server, callApi) {
     {
       title: "Get Action Runtime Fact Metadata",
       annotations: { readOnlyHint: true },
-      description: "Retrieve runtime fact requirements per Action type. For each Action, shows which input facts must be present in the execution payload \u2014 e.g. MUTATE_FACT always requires its targetVar fact, plus refVar when one is specified. The factRequired flag describes the FACT, not the parameter: refVar is an optional parameter, but if you specify it the named fact must exist. A required fact absent at runtime throws \u2014 the engine never defaults to 0. Facts are supplied as input or written by a prior action in the same rule; only SET_FACT creates a fact from nothing. Static data, safe to cache in-session.",
+      description: "Retrieve runtime fact requirements per Action type. For each Action, shows which input facts must be present in the execution payload \u2014 e.g. MUTATE_FACT always requires its targetVar fact, plus refVar when one is specified. The factRequired flag describes the FACT, not the parameter: refVar is an optional parameter, but if you specify it the named fact must exist. A required fact absent at runtime throws \u2014 the engine never defaults to 0. These facts must be sent in the request (P-015 otherwise), even when an earlier action in the same rule writes them. SET_FACT requires no input fact: it is the only action that can write a key the request did not send, and its targetVar must be a registered fact (ACT-032). Static data, safe to cache in-session.",
       inputSchema: z5.object({})
     },
     async () => callApi("GET", "schema/action-metadata")
@@ -676,7 +684,7 @@ function registerFactTools(server, callApi) {
     {
       title: "List Unregistered Facts",
       annotations: { readOnlyHint: true },
-      description: "List facts referenced by a version's rules but not yet defined (read-only \u2014 does not block publish/deploy). Version-wide: covers every rule in the version. Each entry carries the inferred type, suggested name, and where it is referenced (condition/action). Register them with lexq_facts_create to enable type validation and the dry-run requirements analyzer.",
+      description: "List facts referenced by a version's rules but not yet defined (read-only). Keys that rules only read do not block publish/deploy; a rule whose action targetVar is not a registered fact is rejected at save and publish with ACT-032. Version-wide: covers every rule in the version. Each entry carries the inferred type, suggested name, and where it is referenced (condition/action). Register them with lexq_facts_create to enable type validation and the dry-run requirements analyzer.",
       inputSchema: z5.object({
         groupId: z5.string().uuid().describe("Policy group ID"),
         versionId: z5.string().uuid().describe("Version ID")
@@ -709,7 +717,7 @@ function registerDeployTools(server, callApi) {
     {
       title: "Publish Version",
       annotations: { readOnlyHint: false, destructiveHint: false },
-      description: `Publish a DRAFT version (DRAFT \u2192 ACTIVE). Locks the version from further edits. Must have at least one rule. Undefined facts referenced by rules do not block publishing; call lexq_facts_unregistered first to review them. Publishing fails if the version's compiled rules exceed ${MAX_SNAPSHOT_BYTES / 1024} KB, or if its effective end has already passed (P-058); move the end into the future with lexq_versions_update first.`,
+      description: `Publish a DRAFT version (DRAFT \u2192 ACTIVE). Locks the version from further edits. Must have at least one rule. Undefined facts that rules only read do not block publishing; call lexq_facts_unregistered first to review them. Publishing fails if an action's targetVar is not a registered fact (ACT-032), if the version's compiled rules exceed ${MAX_SNAPSHOT_BYTES / 1024} KB, or if its effective end has already passed (P-058); move the end into the future with lexq_versions_update first.`,
       inputSchema: z6.object({
         groupId: z6.string().uuid().describe("Policy group ID"),
         versionId: z6.string().uuid().describe("Version ID to publish"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lexq/cli",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "mcpName": "io.lexq/lexq",
   "description": "LexQ CLI — manage policies, simulate rules, and deploy from the terminal. Built for humans and AI agents.",
   "type": "module",

package/skills/lexq-recipes/SKILL.md

@@ -480,8 +480,10 @@ lexq analytics dry-run --version-id <vid> --debug --json '{
 
 **Notes**
 
-- `SET_FACT` creates the fact if it does not exist. `MUTATE_FACT` requires the target to already
-  be present — that is the division of labor between them.
+- Register a `SET_FACT` target before saving the rule, as the step above does. A rule whose
+  `targetVar` is not a registered fact is rejected with `ACT-032`.
+- At execution, `SET_FACT` writes the key even when the request did not send it. `MUTATE_FACT`
+  requires the request to send its target. That is the division of labor between them.
 - Flags appear in `generatedVariables` in the response. `SET_FACT` produces no `__delta` because
   it is an assignment, not an arithmetic change.
 - Segment on a `LIST_STRING` fact with `HAS_ANY` / `HAS_ALL` / `HAS_NONE`, not `CONTAINS`.

package/skills/lexq-rules/SKILL.md

@@ -181,14 +181,14 @@ Each rule can have multiple actions. Actions fire sequentially.
 | Type          | Description                                | Key Parameters                                                       |
 |---------------|--------------------------------------------|----------------------------------------------------------------------|
 | `MUTATE_FACT` | Arithmetic change to a numeric fact        | `targetVar`, `operator`, `method`, `operand`, `refVar?`, `rounding?` |
-| `SET_FACT`    | Assign a literal value — creates if absent | `targetVar`, `value`                                                 |
+| `SET_FACT`    | Assign a literal value to a registered fact | `targetVar`, `value`                                                |
 | `BLOCK`       | Record a rejection decision                | `reason`                                                             |
 
 ### `MUTATE_FACT` parameters
 
 | Parameter   | Required | Meaning                                                                       |
 |-------------|----------|-------------------------------------------------------------------------------|
-| `targetVar` | always   | The fact this action **reads and writes**. Must already exist as a number.    |
+| `targetVar` | always   | The fact this action **reads and writes**. Must be registered and present as a number at execution. |
 | `operator`  | always   | `ASSIGN` \| `ADD` \| `SUB` \| `MUL` \| `DIV`                                  |
 | `method`    | always   | `PERCENTAGE` \| `AMOUNT` — dictates the unit of `operand`                     |
 | `operand`   | always   | The arithmetic operand. Percent when PERCENTAGE, absolute amount when AMOUNT. |
@@ -235,8 +235,15 @@ Use `refVar` when the base differs from the target:
 
 ### `SET_FACT` vs `MUTATE_FACT`
 
-`SET_FACT` creates the fact if it does not exist. `MUTATE_FACT` requires the target to already be
-present as a number and throws otherwise. "Make something that wasn't there" is `SET_FACT`'s job.
+Both actions write to `targetVar`, and it must be a **registered fact**. Saving or publishing a
+rule whose `targetVar` is not registered fails with `ACT-032`; register it with
+`lexq facts create` first. Keys a rule only reads (condition fields, `refVar`) may stay
+unregistered.
+
+At execution, they differ in what the request must send. `SET_FACT` writes the value even when
+the request did not send the key. `MUTATE_FACT` requires the request to send the target (`P-015`
+otherwise), and the target's value must be a number when the action runs. "Write something the
+request didn't send" is `SET_FACT`'s job.
 
 ### `BLOCK` does not halt execution