@lexq/cli 1.1.7 → 2.1.0

package/dist/index.js

@@ -4,7 +4,7 @@
 import { Command } from "commander";
 import { readFileSync as readFileSync4 } from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { dirname as dirname2, join as join3 } from "path";
+import { dirname as dirname2, join as join4 } from "path";
 
 // src/commands/auth.ts
 import "commander";
@@ -85,6 +85,11 @@ var ApiError = class extends Error {
   statusCode;
   errorCode;
 };
+function describeForm(form) {
+  return [...form.entries()].map(
+    ([name, value]) => typeof value === "string" ? `  ${name}: ${value}` : `  ${name}: ${value.name} (${value.size} bytes, ${value.type})`
+  );
+}
 async function doFetch(method, path, options) {
   const config = loadConfig();
   const baseUrl = options.baseUrl ?? config.baseUrl;
@@ -99,26 +104,32 @@ async function doFetch(method, path, options) {
     }
   }
   const headers = { "X-API-KEY": apiKey, Accept: "application/json" };
-  if (options.body) headers["Content-Type"] = "application/json";
+  if (options.body && !options.form) headers["Content-Type"] = "application/json";
   if (options.dryRun) {
     const masked = apiKey.length > 8 ? apiKey.substring(0, 4) + "****" + apiKey.substring(apiKey.length - 4) : "****";
     console.log(`${method} ${url.toString()}`);
     console.log("Headers:");
     console.log(`  X-API-KEY: ${masked}`);
-    console.log(`  Content-Type: application/json`);
-    if (options.body) {
+    console.log(`  Content-Type: ${options.form ? "multipart/form-data" : "application/json"}`);
+    if (options.form) {
+      console.log("Body:");
+      for (const line of describeForm(options.form)) console.log(line);
+    } else if (options.body) {
       console.log("Body:");
       console.log(`  ${stringifyJson(options.body, 2) ?? ""}`);
     }
     console.log("\n(Use without --dry-run to execute)");
     process.exit(0);
   }
-  if (options.verbose) console.error(`\u2192 ${method} ${url.toString()}`);
+  if (options.verbose) {
+    console.error(`\u2192 ${method} ${url.toString()}`);
+    if (options.form) for (const line of describeForm(options.form)) console.error(line);
+  }
   const startTime = Date.now();
   const response = await fetch(url.toString(), {
     method,
     headers,
-    body: options.body ? stringifyJson(options.body) : void 0
+    body: options.form ?? (options.body ? stringifyJson(options.body) : void 0)
   });
   if (options.verbose) {
     console.error(`\u2190 ${response.status} ${response.statusText} (${Date.now() - startTime}ms)`);
@@ -132,7 +143,7 @@ function isFileResponse(response) {
   return contentType.includes("text/csv") || contentType.includes("application/octet-stream");
 }
 function assertOk(response, json) {
-  if (!response.ok || json.result !== "SUCCESS") {
+  if (json.result !== "SUCCESS") {
     throw new ApiError(
       response.status,
       json.errorCode,
@@ -140,12 +151,25 @@ function assertOk(response, json) {
     );
   }
 }
+async function refusal(response) {
+  let json;
+  try {
+    json = parseJson(await response.text());
+  } catch {
+  }
+  return new ApiError(
+    response.status,
+    json?.errorCode ?? null,
+    json?.message ?? `Request failed with status ${response.status}`
+  );
+}
 async function apiRequest(method, path, options = {}) {
   const { data } = await apiRequestWithMeta(method, path, options);
   return data;
 }
 async function apiRequestWithMeta(method, path, options = {}) {
   const response = await doFetch(method, path, options);
+  if (!response.ok) throw await refusal(response);
   if (isFileResponse(response)) {
     return { data: await response.text(), meta: null };
   }
@@ -349,6 +373,7 @@ var MAX_TRAFFIC_RATE = 99;
 var REPLAY_WINDOW_MAX_RECORDS = 5e4;
 var DEFAULT_SIMULATION_RECORDS = 1e3;
 var MAX_SIMULATION_RECORDS = 1e5;
+var MAX_DATASET_SIZE = 10485760;
 var PROFILE_SAMPLE_PERMILLE = 10;
 var LATENCY_WINDOW_MILLIS = 6e4;
 var TAIL_MIN_OBS = 3;
@@ -1773,7 +1798,13 @@ function registerDeployCommands(program) {
       process.exit(1);
     }
   });
-  deploy.command("rollback").description("Rollback to the previous deployed version").requiredOption("--group-id <groupId>", "Policy group ID").requiredOption("--memo <memo>", "Rollback reason").option("--force", "Skip confirmation prompt").addHelpText(
+  deploy.command("rollback").description("Rollback to the previous deployed version").requiredOption("--group-id <groupId>", "Policy group ID").requiredOption("--memo <memo>", "Rollback reason").option(
+    "--expected-current-version-id <versionId>",
+    "currentVersionId from your last read of the group"
+  ).option(
+    "--expected-current-deployment-id <deploymentId>",
+    "currentDeploymentId from your last read of the group"
+  ).option("--force", "Skip confirmation prompt").addHelpText(
     "after",
     dedent7`
 
@@ -1781,8 +1812,20 @@ function registerDeployCommands(program) {
         Only available if the previous version is still ACTIVE and its effective end
         has not passed (P-058).
 
+        Run lexq groups get first: currentVersionName is live now and
+        previousVersionName is what a rollback restores. Pass the group's
+        currentVersionId and currentDeploymentId with the two --expected-* options.
+        The server checks only the values you pass. If anyone deployed, rolled back
+        or undeployed in between, the rollback is rejected with 409 and nothing
+        changes: P-062 if another version or no version is live, P-063 if the same
+        version is live but from a newer deployment. Read the group again before
+        retrying.
+
         Example:
-          $ lexq deploy rollback --group-id <gid> --memo "High error rate" --force
+          $ lexq groups get --id <gid>
+          $ lexq deploy rollback --group-id <gid> --memo "High error rate" \
+              --expected-current-version-id <currentVersionId> \
+              --expected-current-deployment-id <currentDeploymentId> --force
       `
   ).action(async (opts) => {
     try {
@@ -1802,7 +1845,11 @@ function registerDeployCommands(program) {
         baseUrl: globalOpts.baseUrl,
         dryRun: globalOpts.dryRun,
         verbose: globalOpts.verbose,
-        body: { memo: opts.memo }
+        body: {
+          memo: opts.memo,
+          expectedCurrentVersionId: opts.expectedCurrentVersionId,
+          expectedCurrentDeploymentId: opts.expectedCurrentDeploymentId
+        }
       });
       console.log(`\u2713 Group ${opts.groupId} rolled back.`);
     } catch (error) {
@@ -2135,8 +2182,30 @@ async function warnUnregisteredFacts(globalOpts, groupId, versionId) {
 
 // src/commands/analytics.ts
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
+import { basename } from "path";
 import "commander";
 import dedent8 from "dedent";
+
+// src/lib/dataset-upload.ts
+import { extname } from "path";
+var DATASET_CONTENT_TYPES = {
+  ".csv": "text/csv",
+  ".json": "application/json"
+};
+function datasetContentType(filename) {
+  return DATASET_CONTENT_TYPES[extname(filename).toLowerCase()];
+}
+function uploadDataset(bytes, filename, options) {
+  const form = new FormData();
+  const type = datasetContentType(filename) ?? "application/octet-stream";
+  form.append("file", new Blob([bytes], { type }), filename);
+  return apiRequest("POST", "analytics/datasets/upload", {
+    ...options,
+    form
+  });
+}
+
+// src/commands/analytics.ts
 function registerAnalyticsCommands(program) {
   const analytics = program.command("analytics").description("Dry run, simulation, and requirements").addHelpText(
     "after",
@@ -2159,7 +2228,7 @@ function registerAnalyticsCommands(program) {
     dedent8`
 
         Examples:
-          $ lexq analytics dry-run --version-id <vid> --debug \\
+          $ lexq analytics dry-run --version-id <vid> --debug \
               --json '{"facts": {"paymentAmount": 150000, "customerTier": "VIP"}}'
 
           $ lexq analytics dry-run --version-id <vid> --file test-input.json
@@ -2555,41 +2624,13 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
   ).action(async (opts) => {
     try {
       const globalOpts = program.opts();
-      const config = loadConfig();
-      const baseUrl = globalOpts.baseUrl ?? config.baseUrl;
-      const apiKey = globalOpts.apiKey ?? config.apiKey;
-      if (!apiKey) {
-        throw new Error('Not authenticated. Run "lexq auth login" first.');
-      }
       const filePath = opts.file;
-      const fileBuffer = readFileSync2(filePath);
-      const fileName = filePath.split("/").pop() ?? "dataset";
-      const ext = fileName.split(".").pop()?.toLowerCase();
-      let contentType = "application/octet-stream";
-      if (ext === "csv") contentType = "text/csv";
-      else if (ext === "json") contentType = "application/json";
-      const blob = new Blob([fileBuffer], { type: contentType });
-      const formData = new FormData();
-      formData.append("file", blob, fileName);
-      const url = new URL(
-        "analytics/datasets/upload",
-        baseUrl.endsWith("/") ? baseUrl : baseUrl + "/"
-      );
-      if (globalOpts.verbose) {
-        console.error(`\u2192 POST ${url.toString()}`);
-        console.error(`  File: ${filePath} (${fileBuffer.length} bytes)`);
-      }
-      const response = await fetch(url.toString(), {
-        method: "POST",
-        headers: { "X-API-KEY": apiKey },
-        body: formData
+      const result = await uploadDataset(readFileSync2(filePath), basename(filePath), {
+        apiKey: globalOpts.apiKey,
+        baseUrl: globalOpts.baseUrl,
+        dryRun: globalOpts.dryRun,
+        verbose: globalOpts.verbose
       });
-      if (!response.ok) {
-        const errorText = await response.text();
-        throw new Error(`Upload failed (${response.status}): ${errorText}`);
-      }
-      const envelope = await response.json();
-      const result = envelope.data;
       console.log(`\u2713 Dataset uploaded: ${result.path}`);
       console.log(`  File: ${result.filename} (${result.size} bytes)`);
       printJson(result);
@@ -3526,56 +3567,36 @@ ${data.totalElements} total \xB7 page ${data.pageNo + 1}/${data.totalPages}`);
 
 // src/commands/serve.ts
 import "commander";
-import dedent17 from "dedent";
+import dedent19 from "dedent";
 
 // src/mcp/server.ts
 import { readFileSync as readFileSync3 } from "fs";
-import { dirname, join as join2 } from "path";
+import { dirname, join as join3 } from "path";
 import { fileURLToPath } from "url";
 import { serveStdio } from "@modelcontextprotocol/server/stdio";
 import { McpServer } from "@modelcontextprotocol/server";
 
 // src/mcp/tools/_shared.ts
+function localApiOptions() {
+  const stored = loadConfig();
+  return {
+    baseUrl: process.env.PARTNER_BASE_URL ?? stored.baseUrl,
+    apiKey: process.env.LEXQ_API_KEY ?? stored.apiKey
+  };
+}
 function createCallApiFromConfig() {
   return async (method, path, opts) => {
     try {
-      const stored = loadConfig();
-      const config = {
-        ...stored,
-        baseUrl: process.env.PARTNER_BASE_URL ?? stored.baseUrl,
-        apiKey: process.env.LEXQ_API_KEY ?? stored.apiKey
-      };
+      let form;
       if (opts?.upload) {
-        const url = new URL(
-          path,
-          config.baseUrl.endsWith("/") ? config.baseUrl : config.baseUrl + "/"
-        );
-        if (opts.params) {
-          for (const [key, value] of Object.entries(opts.params)) {
-            if (value !== void 0) url.searchParams.set(key, value);
-          }
-        }
-        if (!config.apiKey) {
-          throw new Error('Not authenticated. Run "lexq auth login" first.');
-        }
+        form = new FormData();
         const blob = new Blob([opts.upload.content], { type: "text/plain" });
-        const formData = new FormData();
-        formData.append(opts.upload.fieldName, blob, opts.upload.filename);
-        const response = await fetch(url.toString(), {
-          method,
-          headers: { "X-API-KEY": config.apiKey },
-          body: formData
-        });
-        const data2 = parseJson(await response.text());
-        return { content: [{ type: "text", text: stringifyJson(data2, 2) ?? "" }] };
+        form.append(opts.upload.fieldName, blob, opts.upload.filename);
       }
-      const clientOpts = {
-        apiKey: config.apiKey,
-        baseUrl: config.baseUrl
-      };
       const { data, meta } = await apiRequestWithMeta(method, path, {
-        ...clientOpts,
+        ...localApiOptions(),
         body: opts?.body,
+        form,
         params: opts?.params
       });
       const content = [
@@ -3618,181 +3639,514 @@ function formatUnregisteredFactWarning(meta) {
   ].join("\n");
 }
 
-// src/mcp/server-info.json
-var server_info_default = {
-  title: "LexQ",
-  description: "The Decision Operations Platform for engineering teams",
-  websiteUrl: "https://lexq.io",
-  icons: [
-    {
-      src: "https://lexq.io/logo.png",
-      mimeType: "image/png",
-      sizes: ["1024x1024"]
-    }
-  ]
-};
+// src/mcp/local-tools.ts
+import { readFile, realpath, stat } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { basename as basename2, isAbsolute, join as join2 } from "path";
+import { z as z2 } from "zod";
+import dedent16 from "dedent";
 
-// src/mcp/tools/status.ts
+// src/mcp/tools/analytics.ts
 import { z } from "zod";
-function registerStatusTools(server, callApi) {
+import dedent15 from "dedent";
+function datasetBlock(path) {
+  const dataset = { type: "UPLOADED", source: "S3_BUCKET", path };
+  return {
+    type: "text",
+    text: "Ready-to-use dataset block for lexq_simulation_start:\n" + stringifyJson({ dataset }, 2)
+  };
+}
+function registerAnalyticsTools(server, callApi) {
   server.registerTool(
-    "lexq_whoami",
+    "lexq_dry_run",
     {
-      title: "Who Am I",
+      title: "Dry Run",
       annotations: { readOnlyHint: true },
-      description: 'Show current authentication info (tenant ID, user ID, role) and tenantTimezone, the organization time zone that every yyyy-MM-dd date filter uses. Work out "today" or "yesterday" in that zone, not in UTC.',
-      inputSchema: z.object({})
+      description: dedent15`
+        Execute a single dry run against a version. Tests how rules evaluate given input facts without side effects.
+        
+        Returns:
+          inputFacts        — normalized input facts
+          mutatedFacts      — input facts changed by rule actions (e.g. MUTATE_FACT mutates paymentAmount)
+          generatedVariables — system-generated values; every fact in mutatedFacts gets a paired {factName}__delta key (signed difference)
+          executionTraces   — per-rule match status
+          decisionTraces    — per-rule decision (SELECTED / NO_MATCH / BLOCKED / etc.)
+        
+        Example input: { "facts": { "paymentAmount": 100000, "customerTier": "VIP" } }
+        Always dry-run before publishing to validate rule behavior.`,
+      inputSchema: z.object({
+        versionId: z.string().uuid().describe("Policy version ID to test against"),
+        facts: z.string().describe('JSON string of facts object, e.g. {"paymentAmount":100000}'),
+        includeDebugInfo: z.boolean().default(true).describe("Include execution and decision traces")
+      })
     },
-    async () => callApi("GET", "whoami")
+    async ({ versionId, facts, includeDebugInfo }) => {
+      const parsedFacts = parseJson(facts);
+      return callApi("POST", `analytics/dry-run/versions/${versionId}`, {
+        body: { facts: parsedFacts, includeDebugInfo }
+      });
+    }
   );
-}
-
-// src/mcp/tools/groups.ts
-import { z as z2 } from "zod";
-function registerGroupTools(server, callApi) {
   server.registerTool(
-    "lexq_groups_list",
+    "lexq_dry_run_compare",
     {
-      title: "List Policy Groups",
+      title: "Dry Run Compare",
       annotations: { readOnlyHint: true },
-      description: "List policy groups (tenant-wide, priority ASC). Deleted groups are not included.",
-      inputSchema: z2.object({})
+      description: dedent15`
+        Compare dry run results between two versions using the same input facts. Useful for validating changes.
+        
+        Returns:
+          resultA / resultB — full DryRunResponse for each version
+          diff.mutatedDiff   — changes in mutatedFacts between A and B (key → {before, after})
+          diff.generatedDiff — changes in generatedVariables between A and B`,
+      inputSchema: z.object({
+        versionIdA: z.string().uuid().describe("Baseline version ID"),
+        versionIdB: z.string().uuid().describe("Candidate version ID"),
+        facts: z.string().describe("JSON string of facts object")
+      })
     },
-    async () => callApi("GET", "policy-groups")
+    async ({ versionIdA, versionIdB, facts }) => {
+      const parsedFacts = parseJson(facts);
+      return callApi("POST", "analytics/dry-run/compare", {
+        body: { versionIdA, versionIdB, facts: parsedFacts }
+      });
+    }
   );
   server.registerTool(
-    "lexq_groups_get",
+    "lexq_requirements",
     {
-      title: "Get Policy Group",
+      title: "Analyze Requirements",
       annotations: { readOnlyHint: true },
-      description: "Get a single policy group by ID.",
-      inputSchema: z2.object({
-        groupId: z2.string().uuid().describe("Policy group ID")
+      description: "Analyze which input facts a version requires. Returns required keys, types, and an example request body.",
+      inputSchema: z.object({
+        groupId: z.string().uuid().describe("Policy group ID"),
+        versionId: z.string().uuid().describe("Version ID")
       })
     },
-    async ({ groupId }) => callApi("GET", `policy-groups/${groupId}`)
+    async ({ groupId, versionId }) => callApi("GET", `analytics/groups/${groupId}/versions/${versionId}/requirements`)
   );
   server.registerTool(
-    "lexq_groups_create",
+    "lexq_simulation_start",
     {
-      title: "Create Policy Group",
+      title: "Start Simulation",
       annotations: { readOnlyHint: false, destructiveHint: false },
-      description: `Create a new policy group. Requires name. Priority is auto-assigned (appended last, tenant-wide); use lexq_groups_reorder to change order. Optionally set conflict resolution, activation group, and description. Policy groups that share an activationGroup form a cluster and must share the same activationMode / activationStrategy / executionLimit; executionLimit is how many of those groups run, not how many rules. A tenant can have at most ${MAX_GROUPS_PER_TENANT} groups that are not ARCHIVED; archive groups you no longer use to free a slot.`,
-      inputSchema: z2.object({
-        name: z2.string().describe("Group name (unique among non-ARCHIVED)"),
-        description: z2.string().optional().describe("Group description"),
-        activationMode: z2.enum(ConflictResolutionMode).optional().describe("Conflict resolution mode"),
-        activationStrategy: z2.enum(ConflictResolutionStrategy).optional().describe("Ranking used to pick the winning groups when mode is EXCLUSIVE or MAX_N"),
-        executionLimit: z2.number().int().min(1).optional().describe(
-          "How many policy groups sharing this activationGroup may run (required when mode is MAX_N). Counts groups, not rules: every rule of a winning group runs."
-        ),
-        activationGroup: z2.string().optional().describe(
-          "Activation group (Execution Group) cluster key. Policy groups sharing this key compete, and group priority picks the winners."
-        )
+      description: dedent15`
+        Start an Impact Simulation against historical, uploaded, or inline data.
+
+        dataset.type and dataset.source are BOTH required, and must be paired:
+          HISTORICAL → source EXECUTION_LOGS, with dataset.from / dataset.to (yyyy-MM-dd, whole days
+                       in the organization time zone, both inclusive)
+          UPLOADED   → source S3_BUCKET,      with dataset.path (the path returned by lexq_dataset_upload)
+          MANUAL     → source REQUEST_BODY,   with dataset.manualData (array of fact records)
+
+        options.maxRecords: number (max ${MAX_SIMULATION_RECORDS}). When omitted, HISTORICAL and UPLOADED run at
+          most ${DEFAULT_SIMULATION_RECORDS} records and MANUAL runs every record sent.
+        options.baselinePolicyVersionId: uuid (optional, for baseline comparison)
+        options.includeRuleStats: boolean
+        options.metricConfig: optional — omit for plain execution count. To aggregate a fact, pass
+          { "targetVariable": "<fact>", "aggregationType": "COUNT" | "SUM" | "AVG" }
+
+        Example (uploaded dataset):
+        {
+          "policyVersionId": "<uuid>",
+          "dataset": { "type": "UPLOADED", "source": "S3_BUCKET", "path": "<path from lexq_dataset_upload>" },
+          "options": { "baselinePolicyVersionId": "<uuid>", "includeRuleStats": true, "maxRecords": 10000 }
+        }
+
+        Example (historical):
+        {
+          "policyVersionId": "<uuid>",
+          "dataset": { "type": "HISTORICAL", "source": "EXECUTION_LOGS", "from": "2026-01-01", "to": "2026-01-31" },
+          "options": { "baselinePolicyVersionId": "<uuid>", "includeRuleStats": true }
+        }
+      `,
+      inputSchema: z.object({
+        body: z.string().describe("JSON string of SimulationRequest")
       })
     },
-    async (args) => {
-      const body = {
-        name: args.name
-      };
-      if (args.description !== void 0) body.description = args.description;
-      if (args.activationMode !== void 0) body.activationMode = args.activationMode;
-      if (args.activationStrategy !== void 0) body.activationStrategy = args.activationStrategy;
-      if (args.executionLimit !== void 0) body.executionLimit = args.executionLimit;
-      if (args.activationGroup !== void 0) body.activationGroup = args.activationGroup;
-      return callApi("POST", "policy-groups", { body });
+    async ({ body }) => {
+      const parsed = parseJson(body);
+      return callApi("POST", "analytics/simulations", { body: parsed });
     }
   );
   server.registerTool(
-    "lexq_groups_update",
-    {
-      title: "Update Policy Group",
-      annotations: { readOnlyHint: false, destructiveHint: true },
-      description: "Update a policy group. Only provided fields are updated; omitted fields remain unchanged. A deleted group cannot be updated (409 P-059).",
-      inputSchema: z2.object({
-        groupId: z2.string().uuid().describe("Policy group ID"),
-        name: z2.string().optional().describe("New name"),
-        description: z2.string().optional().describe("New description"),
-        status: z2.enum(["ACTIVE", "DISABLED"]).optional().describe(
-          "DISABLED stops production execution of this group: execution calls return 403 (P-009), and a composite call that includes the group is rejected in full. The deployed version and any A/B test are kept, and dry run, Impact Simulation, and Decision Replay keep working, so a fix can be verified before setting ACTIVE again. To go back to the previous version, use lexq_deploy_rollback. To take the version out of production, use lexq_deploy_undeploy."
-        ),
-        activationGroup: z2.string().optional().describe(
-          "Activation group (Execution Group) cluster key. Policy groups sharing this key compete, and group priority picks the winners."
-        ),
-        activationMode: z2.enum(ConflictResolutionMode).optional().describe("Conflict resolution mode"),
-        activationStrategy: z2.enum(ConflictResolutionStrategy).optional().describe("Ranking used to pick the winning groups"),
-        executionLimit: z2.number().int().min(1).optional().describe(
-          "How many policy groups sharing this activationGroup may run. Counts groups, not rules."
-        )
-      })
-    },
-    async ({ groupId, ...body }) => callApi("PUT", `policy-groups/${groupId}`, { body })
-  );
-  server.registerTool(
-    "lexq_groups_delete",
+    "lexq_simulation_status",
     {
-      title: "Delete Policy Group",
-      annotations: { readOnlyHint: false, destructiveHint: true },
-      description: "Delete (archive) a policy group. A deployed group cannot be deleted (P-020); undeploy it first with lexq_deploy_undeploy, which also ends a running A/B test. This cannot be undone. The group no longer appears in lexq_groups_list and its name can be reused right away. Calls that change it (settings, versions, rules, starting an A/B test, publish, deploy, rollback, scheduling a deployment) return 409 P-059. If it was ever executed, deployed, or replayed, it is kept for audit; otherwise it is permanently deleted after 30 days.",
-      inputSchema: z2.object({
-        groupId: z2.string().uuid().describe("Policy group ID")
+      title: "Simulation Status",
+      annotations: { readOnlyHint: true },
+      description: "Get simulation status and results. Poll until status is COMPLETED or FAILED.",
+      inputSchema: z.object({
+        simulationId: z.string().uuid().describe("Simulation ID")
       })
     },
-    async ({ groupId }) => callApi("DELETE", `policy-groups/${groupId}`)
+    async ({ simulationId }) => callApi("GET", `analytics/simulations/${simulationId}`)
   );
   server.registerTool(
-    "lexq_groups_reorder",
+    "lexq_simulation_list",
     {
-      title: "Reorder Policy Groups",
-      annotations: { readOnlyHint: false, destructiveHint: true },
-      description: "Reorder policy groups by priority. Priority is tenant-wide and flat (1...N continuous); array index 0 = priority 1 (highest precedence). activationGroup is not affected \u2014 this only changes priority.",
-      inputSchema: z2.object({
-        groupIds: z2.array(z2.string().uuid()).describe("Group IDs in desired priority order (index 0 = priority 1)")
+      title: "List Simulations",
+      annotations: { readOnlyHint: true },
+      description: "List simulation history with optional filters.",
+      inputSchema: z.object({
+        page: z.number().int().min(0).default(0).describe("Page number"),
+        size: z.number().int().min(1).max(100).default(20).describe("Page size"),
+        status: z.enum(["PENDING", "RUNNING", "COMPLETED", "FAILED", "CANCELED"]).optional().describe("Filter by status"),
+        from: z.string().optional().describe(START_DAY),
+        to: z.string().optional().describe(END_DAY)
       })
     },
-    async ({ groupIds }) => {
-      const groups = groupIds.map((groupId, index) => ({
-        groupId,
-        priority: index + 1
-      }));
-      return callApi("PATCH", "policy-groups/reorder", { body: { groups } });
+    async ({ page, size, status, from, to }) => {
+      const params = paginationParams(page, size);
+      if (status) params.status = status;
+      if (from) params.from = from;
+      if (to) params.to = to;
+      return callApi("GET", "analytics/simulations", { params });
     }
   );
   server.registerTool(
-    "lexq_ab_test_start",
+    "lexq_simulation_cancel",
     {
-      title: "Start A/B Test",
-      annotations: { readOnlyHint: false, destructiveHint: false },
-      description: "Start an A/B test on a policy group. Requires a challenger version ID and traffic rate. The challenger must be a published version of the same group; a version from another group is rejected with P-016. The split is computed from context.trafficKey on each execution request; requests that omit it never reach the challenger and the test stays at 0%.",
-      inputSchema: z2.object({
-        groupId: z2.string().uuid().describe("Policy group ID"),
-        testVersionId: z2.string().uuid().describe("Challenger version ID. Must be a published version of this group"),
-        trafficRate: z2.number().int().min(1).max(99).describe("Traffic percentage routed to challenger (1-99)")
+      title: "Cancel Simulation",
+      annotations: { readOnlyHint: false, destructiveHint: true },
+      description: "Cancel a running or pending simulation.",
+      inputSchema: z.object({
+        simulationId: z.string().uuid().describe("Simulation ID")
       })
     },
-    async ({ groupId, ...body }) => callApi("POST", `policy-groups/${groupId}/ab-test`, { body })
+    async ({ simulationId }) => callApi("DELETE", `analytics/simulations/${simulationId}`)
   );
   server.registerTool(
-    "lexq_ab_test_stop",
+    "lexq_simulation_export",
     {
-      title: "Stop A/B Test",
-      annotations: { readOnlyHint: false, destructiveHint: true },
-      description: "Stop a running A/B test. All traffic is restored to the control (current) version.",
-      inputSchema: z2.object({
-        groupId: z2.string().uuid().describe("Policy group ID")
+      title: "Export Simulation",
+      annotations: { readOnlyHint: true },
+      description: "Export simulation results as JSON or CSV. Returns the raw data.",
+      inputSchema: z.object({
+        simulationId: z.string().uuid().describe("Simulation ID"),
+        format: z.enum(EXPORT_FORMATS).default("json").describe("Export format")
       })
     },
-    async ({ groupId }) => callApi("DELETE", `policy-groups/${groupId}/ab-test`)
+    async ({ simulationId, format }) => callApi("GET", `analytics/simulations/${simulationId}/export`, {
+      params: { format }
+    })
   );
   server.registerTool(
-    "lexq_ab_test_adjust",
+    "lexq_dataset_upload",
+    {
+      title: "Upload Dataset",
+      annotations: { readOnlyHint: false, destructiveHint: false },
+      description: dedent15`
+        Upload inline CSV or JSON content as a simulation dataset.
+        The content is uploaded to S3 and a path is returned in the "path" field.
+
+        To use the returned path in lexq_simulation_start, set:
+          dataset: { "type": "UPLOADED", "source": "S3_BUCKET", "path": "<returned path>" }
+
+        The content travels inside the tool call, so this suits small datasets, and the hosted server at
+        mcp.lexq.io limits the size of a request. For a larger file, use lexq_dataset_upload_file on the
+        local server (lexq serve --mcp), or upload it with the CLI or the console and pass the returned path.
+
+        CSV example:
+        userId,paymentAmount
+        user_001,150000
+        user_002,50000
+
+        JSON example: [{"userId":"user_001","paymentAmount":150000}, {"userId":"user_002","paymentAmount":50000}]
+      `,
+      inputSchema: z.object({
+        content: z.string().describe("CSV or JSON content as string"),
+        filename: z.string().default("dataset.csv").describe("Filename with extension (.csv or .json)")
+      })
+    },
+    async ({ content, filename }) => {
+      const result = await callApi("POST", "analytics/datasets/upload", {
+        upload: { content, filename, fieldName: "file" }
+      });
+      if (!result.isError) {
+        try {
+          const uploaded = parseJson(result.content[0]?.text ?? "{}");
+          const path = uploaded.data?.path ?? uploaded.path;
+          if (typeof path === "string" && path) result.content.push(datasetBlock(path));
+        } catch {
+        }
+      }
+      return result;
+    }
+  );
+  server.registerTool(
+    "lexq_dataset_template",
+    {
+      title: "Download Dataset Template",
+      annotations: { readOnlyHint: true },
+      description: "Generate a sample CSV or JSON template based on the required facts of a version. Use this to understand the expected data format before uploading a dataset.",
+      inputSchema: z.object({
+        groupId: z.string().uuid().describe("Policy group ID"),
+        versionId: z.string().uuid().describe("Version ID"),
+        format: z.enum(EXPORT_FORMATS).default("csv").describe("Template format")
+      })
+    },
+    async ({ groupId, versionId, format }) => callApi("GET", `analytics/groups/${groupId}/versions/${versionId}/dataset-template`, {
+      params: { format }
+    })
+  );
+}
+
+// src/mcp/local-tools.ts
+var MAX_DATASET_MB = MAX_DATASET_SIZE / 1024 / 1024;
+var NOT_ABSOLUTE = "file must be an absolute path on this computer. A leading ~/ stands for the home directory.";
+var NOT_A_DATASET = "file must be a .csv or .json file, and a symbolic link must point to one.";
+var TOO_LARGE = `file is larger than ${MAX_DATASET_MB} MB.`;
+var UNREADABLE = "file does not exist, or is not a regular file this server can read.";
+var NOT_AN_ARRAY = "a .json file must hold an array of records.";
+function refuse(message) {
+  return { content: [{ type: "text", text: JSON.stringify({ error: message }) }], isError: true };
+}
+function startsWithArray(bytes) {
+  let i = bytes[0] === 239 && bytes[1] === 187 && bytes[2] === 191 ? 3 : 0;
+  while (bytes[i] === 32 || bytes[i] === 9 || bytes[i] === 10 || bytes[i] === 13) i++;
+  return bytes[i] === 91;
+}
+async function readDatasetFile(file) {
+  const named = file.startsWith("~/") ? join2(homedir2(), file.slice(2)) : file;
+  if (!isAbsolute(named) || /^[\\/]{2}/.test(named)) return { error: NOT_ABSOLUTE };
+  if (!datasetContentType(named)) return { error: NOT_A_DATASET };
+  let real;
+  try {
+    real = await realpath(named);
+  } catch {
+    return { error: UNREADABLE };
+  }
+  const type = datasetContentType(real);
+  if (!type) return { error: NOT_A_DATASET };
+  try {
+    const info = await stat(real);
+    if (!info.isFile()) return { error: UNREADABLE };
+    if (info.size > MAX_DATASET_SIZE) return { error: TOO_LARGE };
+    const bytes = await readFile(real);
+    if (type === "application/json" && !startsWithArray(bytes)) return { error: NOT_AN_ARRAY };
+    return { bytes, filename: basename2(real) };
+  } catch {
+    return { error: UNREADABLE };
+  }
+}
+function registerLocalTools(server) {
+  server.registerTool(
+    "lexq_dataset_upload_file",
+    {
+      title: "Upload Dataset File",
+      annotations: { readOnlyHint: false, destructiveHint: false },
+      description: dedent16`
+        Upload a CSV or JSON file from this computer as a simulation dataset, up to ${MAX_DATASET_MB} MB.
+        The server reads the file from disk, so its content never passes through the conversation.
+        Only the local server (lexq serve --mcp) has this tool.
+
+        file: the absolute path of a .csv or .json file. A leading ~/ stands for the home directory.
+        A symbolic link is followed, and the file it points to must also end in .csv or .json.
+
+        CSV: a header row of fact keys, then one row per record. JSON: an array of objects.
+
+        Returns the stored path and a ready-to-use dataset block for lexq_simulation_start:
+          dataset: { "type": "UPLOADED", "source": "S3_BUCKET", "path": "<returned path>" }
+      `,
+      inputSchema: z2.object({
+        file: z2.string().min(1).describe(
+          "Absolute path of a .csv or .json file. A leading ~/ stands for the home directory."
+        )
+      })
+    },
+    async ({ file }) => {
+      const read = await readDatasetFile(file);
+      if ("error" in read) return refuse(read.error);
+      try {
+        const uploaded = await uploadDataset(read.bytes, read.filename, localApiOptions());
+        return {
+          content: [
+            { type: "text", text: stringifyJson(uploaded, 2) ?? "" },
+            datasetBlock(uploaded.path)
+          ]
+        };
+      } catch (error) {
+        return refuse(error instanceof Error ? error.message : String(error));
+      }
+    }
+  );
+}
+
+// src/mcp/server-info.json
+var server_info_default = {
+  title: "LexQ",
+  description: "The Decision Operations Platform for engineering teams",
+  websiteUrl: "https://lexq.io",
+  icons: [
+    {
+      src: "https://lexq.io/logo.png",
+      mimeType: "image/png",
+      sizes: ["1024x1024"]
+    }
+  ]
+};
+
+// src/mcp/tools/status.ts
+import { z as z3 } from "zod";
+function registerStatusTools(server, callApi) {
+  server.registerTool(
+    "lexq_whoami",
+    {
+      title: "Who Am I",
+      annotations: { readOnlyHint: true },
+      description: 'Show current authentication info (tenant ID, user ID, role) and tenantTimezone, the organization time zone that every yyyy-MM-dd date filter uses. Work out "today" or "yesterday" in that zone, not in UTC.',
+      inputSchema: z3.object({})
+    },
+    async () => callApi("GET", "whoami")
+  );
+}
+
+// src/mcp/tools/groups.ts
+import { z as z4 } from "zod";
+function registerGroupTools(server, callApi) {
+  server.registerTool(
+    "lexq_groups_list",
+    {
+      title: "List Policy Groups",
+      annotations: { readOnlyHint: true },
+      description: "List policy groups (tenant-wide, priority ASC). Deleted groups are not included.",
+      inputSchema: z4.object({})
+    },
+    async () => callApi("GET", "policy-groups")
+  );
+  server.registerTool(
+    "lexq_groups_get",
+    {
+      title: "Get Policy Group",
+      annotations: { readOnlyHint: true },
+      description: "Get a single policy group by ID. Its currentVersionId and currentDeploymentId are what lexq_deploy_rollback expects, and previousVersionName is the version a rollback restores.",
+      inputSchema: z4.object({
+        groupId: z4.string().uuid().describe("Policy group ID")
+      })
+    },
+    async ({ groupId }) => callApi("GET", `policy-groups/${groupId}`)
+  );
+  server.registerTool(
+    "lexq_groups_create",
+    {
+      title: "Create Policy Group",
+      annotations: { readOnlyHint: false, destructiveHint: false },
+      description: `Create a new policy group. Requires name. Priority is auto-assigned (appended last, tenant-wide); use lexq_groups_reorder to change order. Optionally set conflict resolution, activation group, and description. Policy groups that share an activationGroup form a cluster and must share the same activationMode / activationStrategy / executionLimit; executionLimit is how many of those groups run, not how many rules. A tenant can have at most ${MAX_GROUPS_PER_TENANT} groups that are not ARCHIVED; archive groups you no longer use to free a slot.`,
+      inputSchema: z4.object({
+        name: z4.string().describe("Group name (unique among non-ARCHIVED)"),
+        description: z4.string().optional().describe("Group description"),
+        activationMode: z4.enum(ConflictResolutionMode).optional().describe("Conflict resolution mode"),
+        activationStrategy: z4.enum(ConflictResolutionStrategy).optional().describe("Ranking used to pick the winning groups when mode is EXCLUSIVE or MAX_N"),
+        executionLimit: z4.number().int().min(1).optional().describe(
+          "How many policy groups sharing this activationGroup may run (required when mode is MAX_N). Counts groups, not rules: every rule of a winning group runs."
+        ),
+        activationGroup: z4.string().optional().describe(
+          "Activation group (Execution Group) cluster key. Policy groups sharing this key compete, and group priority picks the winners."
+        )
+      })
+    },
+    async (args) => {
+      const body = {
+        name: args.name
+      };
+      if (args.description !== void 0) body.description = args.description;
+      if (args.activationMode !== void 0) body.activationMode = args.activationMode;
+      if (args.activationStrategy !== void 0) body.activationStrategy = args.activationStrategy;
+      if (args.executionLimit !== void 0) body.executionLimit = args.executionLimit;
+      if (args.activationGroup !== void 0) body.activationGroup = args.activationGroup;
+      return callApi("POST", "policy-groups", { body });
+    }
+  );
+  server.registerTool(
+    "lexq_groups_update",
+    {
+      title: "Update Policy Group",
+      annotations: { readOnlyHint: false, destructiveHint: true },
+      description: "Update a policy group. Only provided fields are updated; omitted fields remain unchanged. A deleted group cannot be updated (409 P-059).",
+      inputSchema: z4.object({
+        groupId: z4.string().uuid().describe("Policy group ID"),
+        name: z4.string().optional().describe("New name"),
+        description: z4.string().optional().describe("New description"),
+        status: z4.enum(["ACTIVE", "DISABLED"]).optional().describe(
+          "DISABLED stops production execution of this group: execution calls return 403 (P-009), and a composite call that includes the group is rejected in full. The deployed version and any A/B test are kept, and dry run, Impact Simulation, and Decision Replay keep working, so a fix can be verified before setting ACTIVE again. To go back to the previous version, use lexq_deploy_rollback. To take the version out of production, use lexq_deploy_undeploy."
+        ),
+        activationGroup: z4.string().optional().describe(
+          "Activation group (Execution Group) cluster key. Policy groups sharing this key compete, and group priority picks the winners."
+        ),
+        activationMode: z4.enum(ConflictResolutionMode).optional().describe("Conflict resolution mode"),
+        activationStrategy: z4.enum(ConflictResolutionStrategy).optional().describe("Ranking used to pick the winning groups"),
+        executionLimit: z4.number().int().min(1).optional().describe(
+          "How many policy groups sharing this activationGroup may run. Counts groups, not rules."
+        )
+      })
+    },
+    async ({ groupId, ...body }) => callApi("PUT", `policy-groups/${groupId}`, { body })
+  );
+  server.registerTool(
+    "lexq_groups_delete",
+    {
+      title: "Delete Policy Group",
+      annotations: { readOnlyHint: false, destructiveHint: true },
+      description: "Delete (archive) a policy group. A deployed group cannot be deleted (P-020); undeploy it first with lexq_deploy_undeploy, which also ends a running A/B test. This cannot be undone. The group no longer appears in lexq_groups_list and its name can be reused right away. Calls that change it (settings, versions, rules, starting an A/B test, publish, deploy, rollback, scheduling a deployment) return 409 P-059. If it was ever executed, deployed, or replayed, it is kept for audit; otherwise it is permanently deleted after 30 days.",
+      inputSchema: z4.object({
+        groupId: z4.string().uuid().describe("Policy group ID")
+      })
+    },
+    async ({ groupId }) => callApi("DELETE", `policy-groups/${groupId}`)
+  );
+  server.registerTool(
+    "lexq_groups_reorder",
+    {
+      title: "Reorder Policy Groups",
+      annotations: { readOnlyHint: false, destructiveHint: true },
+      description: "Reorder policy groups by priority. Priority is tenant-wide and flat (1...N continuous); array index 0 = priority 1 (highest precedence). activationGroup is not affected \u2014 this only changes priority.",
+      inputSchema: z4.object({
+        groupIds: z4.array(z4.string().uuid()).describe("Group IDs in desired priority order (index 0 = priority 1)")
+      })
+    },
+    async ({ groupIds }) => {
+      const groups = groupIds.map((groupId, index) => ({
+        groupId,
+        priority: index + 1
+      }));
+      return callApi("PATCH", "policy-groups/reorder", { body: { groups } });
+    }
+  );
+  server.registerTool(
+    "lexq_ab_test_start",
+    {
+      title: "Start A/B Test",
+      annotations: { readOnlyHint: false, destructiveHint: false },
+      description: "Start an A/B test on a policy group. Requires a challenger version ID and traffic rate. The challenger must be a published version of the same group; a version from another group is rejected with P-016. The split is computed from context.trafficKey on each execution request; requests that omit it never reach the challenger and the test stays at 0%.",
+      inputSchema: z4.object({
+        groupId: z4.string().uuid().describe("Policy group ID"),
+        testVersionId: z4.string().uuid().describe("Challenger version ID. Must be a published version of this group"),
+        trafficRate: z4.number().int().min(1).max(99).describe("Traffic percentage routed to challenger (1-99)")
+      })
+    },
+    async ({ groupId, ...body }) => callApi("POST", `policy-groups/${groupId}/ab-test`, { body })
+  );
+  server.registerTool(
+    "lexq_ab_test_stop",
+    {
+      title: "Stop A/B Test",
+      annotations: { readOnlyHint: false, destructiveHint: true },
+      description: "Stop a running A/B test. All traffic is restored to the control (current) version.",
+      inputSchema: z4.object({
+        groupId: z4.string().uuid().describe("Policy group ID")
+      })
+    },
+    async ({ groupId }) => callApi("DELETE", `policy-groups/${groupId}/ab-test`)
+  );
+  server.registerTool(
+    "lexq_ab_test_adjust",
     {
       title: "Adjust A/B Test",
       annotations: { readOnlyHint: false, destructiveHint: true },
       description: "Adjust traffic rate of a running A/B test.",
-      inputSchema: z2.object({
-        groupId: z2.string().uuid().describe("Policy group ID"),
-        trafficRate: z2.number().int().min(1).max(99).describe("New traffic percentage for challenger (1-99)")
+      inputSchema: z4.object({
+        groupId: z4.string().uuid().describe("Policy group ID"),
+        trafficRate: z4.number().int().min(1).max(99).describe("New traffic percentage for challenger (1-99)")
       })
     },
     async ({ groupId, ...body }) => callApi("PATCH", `policy-groups/${groupId}/ab-test/traffic-rate`, { body })
@@ -3800,7 +4154,7 @@ function registerGroupTools(server, callApi) {
 }
 
 // src/mcp/tools/versions.ts
-import { z as z3 } from "zod";
+import { z as z5 } from "zod";
 function registerVersionTools(server, callApi) {
   server.registerTool(
     "lexq_versions_list",
@@ -3808,10 +4162,10 @@ function registerVersionTools(server, callApi) {
       title: "List Policy Versions",
       annotations: { readOnlyHint: true },
       description: "List all versions of a policy group.",
-      inputSchema: z3.object({
-        groupId: z3.string().uuid().describe("Policy group ID"),
-        page: z3.number().int().min(0).default(0).describe("Page number"),
-        size: z3.number().int().min(1).max(100).default(20).describe("Page size")
+      inputSchema: z5.object({
+        groupId: z5.string().uuid().describe("Policy group ID"),
+        page: z5.number().int().min(0).default(0).describe("Page number"),
+        size: z5.number().int().min(1).max(100).default(20).describe("Page size")
       })
     },
     async ({ groupId, page, size }) => callApi("GET", `policy-groups/${groupId}/versions`, {
@@ -3824,9 +4178,9 @@ function registerVersionTools(server, callApi) {
       title: "Get Policy Version",
       annotations: { readOnlyHint: true },
       description: "Get a single version by ID, including its rules and fact requirements.",
-      inputSchema: z3.object({
-        groupId: z3.string().uuid().describe("Policy group ID"),
-        versionId: z3.string().uuid().describe("Version ID")
+      inputSchema: z5.object({
+        groupId: z5.string().uuid().describe("Policy group ID"),
+        versionId: z5.string().uuid().describe("Version ID")
       })
     },
     async ({ groupId, versionId }) => callApi("GET", `policy-groups/${groupId}/versions/${versionId}`)
@@ -3837,11 +4191,11 @@ function registerVersionTools(server, callApi) {
       title: "Create Policy Version",
       annotations: { readOnlyHint: false, destructiveHint: false },
       description: `Create a new DRAFT version in a policy group. Optionally provide a commit message and effective date range. A group can hold at most ${MAX_DRAFT_VERSIONS_PER_GROUP} DRAFT versions at a time; published versions do not count. Publish or delete drafts to make room.`,
-      inputSchema: z3.object({
-        groupId: z3.string().uuid().describe("Policy group ID"),
-        commitMessage: z3.string().optional().describe("Commit message describing this version"),
-        effectiveFrom: z3.string().optional().describe(`Effective start, ${INSTANT}`),
-        effectiveTo: z3.string().optional().describe(`Effective end, ${INSTANT}`)
+      inputSchema: z5.object({
+        groupId: z5.string().uuid().describe("Policy group ID"),
+        commitMessage: z5.string().optional().describe("Commit message describing this version"),
+        effectiveFrom: z5.string().optional().describe(`Effective start, ${INSTANT}`),
+        effectiveTo: z5.string().optional().describe(`Effective end, ${INSTANT}`)
       })
     },
     async ({ groupId, ...body }) => callApi("POST", `policy-groups/${groupId}/versions`, { body })
@@ -3852,14 +4206,14 @@ function registerVersionTools(server, callApi) {
       title: "Update Policy Version",
       annotations: { readOnlyHint: false, destructiveHint: true },
       description: "Update a DRAFT version. Only DRAFT versions can be modified. Omitted fields keep their current values. To remove an end of the effective window, set clearEffectiveFrom or clearEffectiveTo to true instead of sending a value.",
-      inputSchema: z3.object({
-        groupId: z3.string().uuid().describe("Policy group ID"),
-        versionId: z3.string().uuid().describe("Version ID"),
-        commitMessage: z3.string().optional().describe("New commit message"),
-        effectiveFrom: z3.string().optional().describe(`Effective start, ${INSTANT} Omit it to keep the current start.`),
-        effectiveTo: z3.string().optional().describe(`Effective end, ${INSTANT} Omit it to keep the current end.`),
-        clearEffectiveFrom: z3.boolean().optional().describe("Set to true to remove the effective start. Do not send effectiveFrom with it."),
-        clearEffectiveTo: z3.boolean().optional().describe("Set to true to remove the effective end. Do not send effectiveTo with it.")
+      inputSchema: z5.object({
+        groupId: z5.string().uuid().describe("Policy group ID"),
+        versionId: z5.string().uuid().describe("Version ID"),
+        commitMessage: z5.string().optional().describe("New commit message"),
+        effectiveFrom: z5.string().optional().describe(`Effective start, ${INSTANT} Omit it to keep the current start.`),
+        effectiveTo: z5.string().optional().describe(`Effective end, ${INSTANT} Omit it to keep the current end.`),
+        clearEffectiveFrom: z5.boolean().optional().describe("Set to true to remove the effective start. Do not send effectiveFrom with it."),
+        clearEffectiveTo: z5.boolean().optional().describe("Set to true to remove the effective end. Do not send effectiveTo with it.")
       })
     },
     async ({ groupId, versionId, ...body }) => callApi("PUT", `policy-groups/${groupId}/versions/${versionId}`, { body })
@@ -3870,9 +4224,9 @@ function registerVersionTools(server, callApi) {
       title: "Delete Policy Version",
       annotations: { readOnlyHint: false, destructiveHint: true },
       description: "Delete a DRAFT version. Only DRAFT versions can be deleted.",
-      inputSchema: z3.object({
-        groupId: z3.string().uuid().describe("Policy group ID"),
-        versionId: z3.string().uuid().describe("Version ID")
+      inputSchema: z5.object({
+        groupId: z5.string().uuid().describe("Policy group ID"),
+        versionId: z5.string().uuid().describe("Version ID")
       })
     },
     async ({ groupId, versionId }) => callApi("DELETE", `policy-groups/${groupId}/versions/${versionId}`)
@@ -3883,9 +4237,9 @@ function registerVersionTools(server, callApi) {
       title: "Clone Policy Version",
       annotations: { readOnlyHint: false, destructiveHint: false },
       description: `Clone an existing version to create a new DRAFT. Useful when the source version is already published. The new DRAFT counts toward the limit of ${MAX_DRAFT_VERSIONS_PER_GROUP} DRAFT versions per group, and a source with more than ${MAX_RULES_PER_VERSION} rules cannot be cloned.`,
-      inputSchema: z3.object({
-        groupId: z3.string().uuid().describe("Policy group ID"),
-        versionId: z3.string().uuid().describe("Source version ID to clone")
+      inputSchema: z5.object({
+        groupId: z5.string().uuid().describe("Policy group ID"),
+        versionId: z5.string().uuid().describe("Source version ID to clone")
       })
     },
     async ({ groupId, versionId }) => {
@@ -3897,8 +4251,8 @@ function registerVersionTools(server, callApi) {
 }
 
 // src/mcp/tools/rules.ts
-import { z as z4 } from "zod";
-import dedent15 from "dedent";
+import { z as z6 } from "zod";
+import dedent17 from "dedent";
 function registerRuleTools(server, callApi) {
   server.registerTool(
     "lexq_rules_list",
@@ -3906,9 +4260,9 @@ function registerRuleTools(server, callApi) {
       title: "List Rules",
       annotations: { readOnlyHint: true },
       description: "List all rules in a version (priority ASC). Returns summary with conditionSummary and actionSummary.",
-      inputSchema: z4.object({
-        groupId: z4.string().uuid().describe("Policy group ID"),
-        versionId: z4.string().uuid().describe("Version ID")
+      inputSchema: z6.object({
+        groupId: z6.string().uuid().describe("Policy group ID"),
+        versionId: z6.string().uuid().describe("Version ID")
       })
     },
     async ({ groupId, versionId }) => callApi("GET", `policy-groups/${groupId}/versions/${versionId}/rules`)
@@ -3919,10 +4273,10 @@ function registerRuleTools(server, callApi) {
       title: "Get Rule Detail",
       annotations: { readOnlyHint: true },
       description: "Get full rule detail including condition tree and action definitions.",
-      inputSchema: z4.object({
-        groupId: z4.string().uuid().describe("Policy group ID"),
-        versionId: z4.string().uuid().describe("Version ID"),
-        ruleId: z4.string().uuid().describe("Rule ID")
+      inputSchema: z6.object({
+        groupId: z6.string().uuid().describe("Policy group ID"),
+        versionId: z6.string().uuid().describe("Version ID"),
+        ruleId: z6.string().uuid().describe("Rule ID")
       })
     },
     async ({ groupId, versionId, ruleId }) => callApi("GET", `policy-groups/${groupId}/versions/${versionId}/rules/${ruleId}`)
@@ -3932,7 +4286,7 @@ function registerRuleTools(server, callApi) {
     {
       title: "Create Rule",
       annotations: { readOnlyHint: false, destructiveHint: false },
-      description: dedent15`
+      description: dedent17`
         Create a rule in a DRAFT version. Requires name, condition tree, and actions array. priority is auto-assigned (appended last); use lexq_rules_reorder to change order.
 
         Before creating rules with new fact keys, call lexq_facts_list to check existing facts.
@@ -4013,10 +4367,10 @@ function registerRuleTools(server, callApi) {
 
         RoundingOption (optional, MUTATE_FACT only): { scale: integer (0..${MAX_ROUNDING_SCALE}), mode?: "HALF_UP"|"HALF_DOWN"|"HALF_EVEN"|"FLOOR"|"CEILING"|"DOWN"|"UP" } mode defaults to HALF_UP. When omitted, calculator output is preserved at full precision (lossless).
       `,
-      inputSchema: z4.object({
-        groupId: z4.string().uuid().describe("Policy group ID"),
-        versionId: z4.string().uuid().describe("Version ID"),
-        rule: z4.string().describe(
+      inputSchema: z6.object({
+        groupId: z6.string().uuid().describe("Policy group ID"),
+        versionId: z6.string().uuid().describe("Version ID"),
+        rule: z6.string().describe(
           "JSON string of CreateRuleRequest: { name, condition, actions, mutexGroup?, mutexMode?, mutexStrategy?, mutexLimit?, isEnabled? }"
         )
       })
@@ -4032,11 +4386,11 @@ function registerRuleTools(server, callApi) {
       title: "Update Rule",
       annotations: { readOnlyHint: false, destructiveHint: true },
       description: `Update an existing rule in a DRAFT version. Only provided fields are changed. A new condition tree must stay within ${MAX_CONDITIONS_PER_RULE} conditions (SINGLE nodes) and ${MAX_CONDITION_DEPTH} levels of nesting below the root. Saving re-checks every action in the rule, including ones you did not change, and fails with ACT-032 if any action's targetVar is not a registered fact.`,
-      inputSchema: z4.object({
-        groupId: z4.string().uuid().describe("Policy group ID"),
-        versionId: z4.string().uuid().describe("Version ID"),
-        ruleId: z4.string().uuid().describe("Rule ID"),
-        rule: z4.string().describe(
+      inputSchema: z6.object({
+        groupId: z6.string().uuid().describe("Policy group ID"),
+        versionId: z6.string().uuid().describe("Version ID"),
+        ruleId: z6.string().uuid().describe("Rule ID"),
+        rule: z6.string().describe(
           "JSON string of UpdateRuleRequest: { name?, condition?, actions?, mutexGroup?, mutexMode?, mutexStrategy?, mutexLimit?, isEnabled? }"
         )
       })
@@ -4054,11 +4408,11 @@ function registerRuleTools(server, callApi) {
       title: "Delete Rule",
       annotations: { readOnlyHint: false, destructiveHint: true },
       description: "Delete a rule from a DRAFT version.",
-      inputSchema: z4.object({
-        groupId: z4.string().uuid().describe("Policy group ID"),
-        versionId: z4.string().uuid().describe("Version ID"),
-        ruleId: z4.string().uuid().describe("Rule ID"),
-        force: z4.boolean().default(false).describe("Skip confirmation (for the last rule in a version)")
+      inputSchema: z6.object({
+        groupId: z6.string().uuid().describe("Policy group ID"),
+        versionId: z6.string().uuid().describe("Version ID"),
+        ruleId: z6.string().uuid().describe("Rule ID"),
+        force: z6.boolean().default(false).describe("Skip confirmation (for the last rule in a version)")
       })
     },
     async ({ groupId, versionId, ruleId, force }) => {
@@ -4075,10 +4429,10 @@ function registerRuleTools(server, callApi) {
       title: "Reorder Rules",
       annotations: { readOnlyHint: false, destructiveHint: true },
       description: "Reorder rules by specifying rule IDs in desired order. Priorities are assigned 1...N (1-based, continuous); array index 0 = priority 1 (highest precedence).",
-      inputSchema: z4.object({
-        groupId: z4.string().uuid().describe("Policy group ID"),
-        versionId: z4.string().uuid().describe("Version ID"),
-        ruleIds: z4.array(z4.string().uuid()).describe("Rule IDs in desired priority order")
+      inputSchema: z6.object({
+        groupId: z6.string().uuid().describe("Policy group ID"),
+        versionId: z6.string().uuid().describe("Version ID"),
+        ruleIds: z6.array(z6.string().uuid()).describe("Rule IDs in desired priority order")
       })
     },
     async ({ groupId, versionId, ruleIds }) => {
@@ -4097,11 +4451,11 @@ function registerRuleTools(server, callApi) {
       title: "Toggle Rule",
       annotations: { readOnlyHint: false, destructiveHint: true },
       description: "Enable or disable a rule without deleting it.",
-      inputSchema: z4.object({
-        groupId: z4.string().uuid().describe("Policy group ID"),
-        versionId: z4.string().uuid().describe("Version ID"),
-        ruleId: z4.string().uuid().describe("Rule ID"),
-        isEnabled: z4.boolean().describe("true to enable, false to disable")
+      inputSchema: z6.object({
+        groupId: z6.string().uuid().describe("Policy group ID"),
+        versionId: z6.string().uuid().describe("Version ID"),
+        ruleId: z6.string().uuid().describe("Rule ID"),
+        isEnabled: z6.boolean().describe("true to enable, false to disable")
       })
     },
     async ({ groupId, versionId, ruleId, isEnabled }) => callApi("PATCH", `policy-groups/${groupId}/versions/${versionId}/rules/${ruleId}/enabled`, {
@@ -4111,7 +4465,7 @@ function registerRuleTools(server, callApi) {
 }
 
 // src/mcp/tools/facts.ts
-import { z as z5 } from "zod";
+import { z as z7 } from "zod";
 
 // src/types/facts.ts
 var FACT_KEY_PATTERN = /^[a-zA-Z][a-zA-Z0-9_]*$/;
@@ -4125,10 +4479,10 @@ function registerFactTools(server, callApi) {
       title: "List Fact Definitions",
       annotations: { readOnlyHint: true },
       description: "List all fact definitions (input variable schema). Shows key, type, required, and PII status. Always check this before creating rules.",
-      inputSchema: z5.object({
-        page: z5.number().int().min(0).default(0).describe("Page number"),
-        size: z5.number().int().min(1).max(100).default(20).describe("Page size"),
-        keyword: z5.string().optional().describe("Search keyword")
+      inputSchema: z7.object({
+        page: z7.number().int().min(0).default(0).describe("Page number"),
+        size: z7.number().int().min(1).max(100).default(20).describe("Page size"),
+        keyword: z7.string().optional().describe("Search keyword")
       })
     },
     async ({ page, size, keyword }) => {
@@ -4143,21 +4497,21 @@ function registerFactTools(server, callApi) {
       title: "Create Fact Definition",
       annotations: { readOnlyHint: false, destructiveHint: false },
       description: "Register a new input variable. Key starts with a letter, then letters, numbers, and underscores (e.g. paymentAmount). Casing is not enforced. Types: STRING, NUMBER, BOOLEAN, LIST_STRING, LIST_NUMBER.",
-      inputSchema: z5.object({
-        key: z5.string().regex(FACT_KEY_PATTERN).describe("Variable key. Any casing; must start with a letter."),
-        name: z5.string().describe("Display name"),
-        type: z5.enum(VALUE_TYPES).describe("Value type"),
-        description: z5.string().optional().describe("Description"),
-        isRequired: z5.boolean().default(false).describe("Whether this fact is required for rule evaluation"),
-        isPii: z5.boolean().default(false).describe(
+      inputSchema: z7.object({
+        key: z7.string().regex(FACT_KEY_PATTERN).describe("Variable key. Any casing; must start with a letter."),
+        name: z7.string().describe("Display name"),
+        type: z7.enum(VALUE_TYPES).describe("Value type"),
+        description: z7.string().optional().describe("Description"),
+        isRequired: z7.boolean().default(false).describe("Whether this fact is required for rule evaluation"),
+        isPii: z7.boolean().default(false).describe(
           "Mark as PII \u2014 masked on every read surface, revealable only in the console (audited)"
         ),
-        valueDomain: z5.object({
-          allowedValues: z5.array(z5.union([z5.string(), z5.number()])).optional().describe(
+        valueDomain: z7.object({
+          allowedValues: z7.array(z7.union([z7.string(), z7.number()])).optional().describe(
             "Accepted values. For list types the value domain applies to each element, not to the list as a whole."
           ),
-          min: z5.number().optional().describe("Lower bound, inclusive. Numeric types only."),
-          max: z5.number().optional().describe("Upper bound, inclusive. Numeric types only.")
+          min: z7.number().optional().describe("Lower bound, inclusive. Numeric types only."),
+          max: z7.number().optional().describe("Upper bound, inclusive. Numeric types only.")
         }).optional().describe(
           "Which values this fact accepts. Omit for no value domain. STRING and LIST_STRING take allowedValues only; NUMBER and LIST_NUMBER take all three; BOOLEAN takes none. Declaring it lets the rule editor offer a dropdown and rejects a rule literal that could never match."
         )
@@ -4171,21 +4525,21 @@ function registerFactTools(server, callApi) {
       title: "Update Fact Definition",
       annotations: { readOnlyHint: false, destructiveHint: true },
       description: "Update a fact definition. The key is immutable. The type can change only while no rule references the fact; if any does, the call fails with FD-007 and reports the count. Rules in deleted groups do not count. Only the fields you send are changed. System facts (isBlocked, blockReason) accept changes to name, description, PII, and the value domain; isRequired is ignored, and their type cannot change (FD-003).",
-      inputSchema: z5.object({
-        factId: z5.string().uuid().describe("Fact definition ID"),
-        name: z5.string().optional().describe("Display name"),
-        description: z5.string().optional().describe('Description. Send "" to remove it.'),
-        type: z5.enum(VALUE_TYPES).optional().describe(
+      inputSchema: z7.object({
+        factId: z7.string().uuid().describe("Fact definition ID"),
+        name: z7.string().optional().describe("Display name"),
+        description: z7.string().optional().describe('Description. Send "" to remove it.'),
+        type: z7.enum(VALUE_TYPES).optional().describe(
           "Value type. Omit to leave it unchanged. Changing it fails with FD-007 while any rule outside a deleted group references the fact."
         ),
-        isRequired: z5.boolean().optional().describe("Required flag"),
-        isPii: z5.boolean().optional().describe("PII flag \u2014 enables/disables masking (changeable even on system facts)"),
-        valueDomain: z5.object({
-          allowedValues: z5.array(z5.union([z5.string(), z5.number()])).optional().describe(
+        isRequired: z7.boolean().optional().describe("Required flag"),
+        isPii: z7.boolean().optional().describe("PII flag \u2014 enables/disables masking (changeable even on system facts)"),
+        valueDomain: z7.object({
+          allowedValues: z7.array(z7.union([z7.string(), z7.number()])).optional().describe(
             "Accepted values. For list types the value domain applies to each element, not to the list as a whole."
           ),
-          min: z5.number().optional().describe("Lower bound, inclusive. Numeric types only."),
-          max: z5.number().optional().describe("Upper bound, inclusive. Numeric types only.")
+          min: z7.number().optional().describe("Lower bound, inclusive. Numeric types only."),
+          max: z7.number().optional().describe("Upper bound, inclusive. Numeric types only.")
         }).optional().describe(
           "Which values this fact accepts. Three states: omit the field to leave the value domain alone, send {} to remove it, or send a populated object to replace it. Narrowing it never blocks the update and does not rewrite rules. When rules compare this fact with a value the new value domain excludes, the result ends with a warning that lists them by version: drafts and the versions currently deployed."
         )
@@ -4199,8 +4553,8 @@ function registerFactTools(server, callApi) {
       title: "Delete Fact Definition",
       annotations: { readOnlyHint: false, destructiveHint: true },
       description: "Delete a fact definition. System facts cannot be deleted. Neither can a fact that any rule references: that call fails with FD-006 and reports the count. Rules in deleted groups do not count. Remove the references first.",
-      inputSchema: z5.object({
-        factId: z5.string().uuid().describe("Fact definition ID")
+      inputSchema: z7.object({
+        factId: z7.string().uuid().describe("Fact definition ID")
       })
     },
     async ({ factId }) => callApi("DELETE", `schema/facts/${factId}`)
@@ -4211,7 +4565,7 @@ function registerFactTools(server, callApi) {
       title: "Get Action Runtime Fact Metadata",
       annotations: { readOnlyHint: true },
       description: "Retrieve runtime fact requirements per Action type. For each Action, shows which input facts must be present in the execution payload \u2014 e.g. MUTATE_FACT always requires its targetVar fact, plus refVar when one is specified. The factRequired flag describes the FACT, not the parameter: refVar is an optional parameter, but if you specify it the named fact must exist. A required fact absent at runtime throws \u2014 the engine never defaults to 0. These facts must be sent in the request (P-015 otherwise), even when an earlier action in the same rule writes them. SET_FACT requires no input fact: it is the only action whose targetVar the request does not have to send, and that targetVar must be a registered fact (ACT-032). Static data, safe to cache in-session.",
-      inputSchema: z5.object({})
+      inputSchema: z7.object({})
     },
     async () => callApi("GET", "schema/action-metadata")
   );
@@ -4221,9 +4575,9 @@ function registerFactTools(server, callApi) {
       title: "List Unregistered Facts",
       annotations: { readOnlyHint: true },
       description: "List facts referenced by a version's rules but not yet defined (read-only). Keys that rules only read do not block publish/deploy; a rule whose action targetVar is not a registered fact is rejected at save and publish with ACT-032. Version-wide: covers every rule in the version. Each entry carries the inferred type, suggested name, and where it is referenced (condition/action). Register them with lexq_facts_create to enable type validation and the dry-run requirements analyzer.",
-      inputSchema: z5.object({
-        groupId: z5.string().uuid().describe("Policy group ID"),
-        versionId: z5.string().uuid().describe("Version ID")
+      inputSchema: z7.object({
+        groupId: z7.string().uuid().describe("Policy group ID"),
+        versionId: z7.string().uuid().describe("Version ID")
       })
     },
     async ({ groupId, versionId }) => callApi("GET", `policy-groups/${groupId}/versions/${versionId}/unregistered-facts`)
@@ -4234,9 +4588,9 @@ function registerFactTools(server, callApi) {
       title: "Export Fact Catalog",
       annotations: { readOnlyHint: true },
       description: "Export the fact catalog. The two formats carry different things: CSV is the catalog as it stands, system facts included, for reading in a spreadsheet; JSON matches the shape that batch create accepts, so it can be fed straight back in, which is why it leaves out the fields that endpoint does not take. Returns the file contents as text.",
-      inputSchema: z5.object({
-        format: z5.enum(EXPORT_FORMATS).default("csv").describe("Export format"),
-        keyword: z5.string().optional().describe("Filter by key or name")
+      inputSchema: z7.object({
+        format: z7.enum(EXPORT_FORMATS).default("csv").describe("Export format"),
+        keyword: z7.string().optional().describe("Filter by key or name")
       })
     },
     async ({ format, keyword }) => callApi("GET", "schema/facts/export", {
@@ -4246,7 +4600,8 @@ function registerFactTools(server, callApi) {
 }
 
 // src/mcp/tools/deploy.ts
-import { z as z6 } from "zod";
+import dedent18 from "dedent";
+import { z as z8 } from "zod";
 function registerDeployTools(server, callApi) {
   server.registerTool(
     "lexq_deploy_publish",
@@ -4254,10 +4609,10 @@ function registerDeployTools(server, callApi) {
       title: "Publish Version",
       annotations: { readOnlyHint: false, destructiveHint: false },
       description: `Publish a DRAFT version (DRAFT \u2192 ACTIVE). Locks the version from further edits. Must have at least one rule. Undefined facts that rules only read do not block publishing; call lexq_facts_unregistered first to review them. Publishing fails if an action's targetVar is not a registered fact (ACT-032), if the version's compiled rules exceed ${MAX_SNAPSHOT_BYTES / 1024} KB, or if its effective end has already passed (P-058); move the end into the future with lexq_versions_update first.`,
-      inputSchema: z6.object({
-        groupId: z6.string().uuid().describe("Policy group ID"),
-        versionId: z6.string().uuid().describe("Version ID to publish"),
-        memo: z6.string().min(1).describe("Publish memo (required)")
+      inputSchema: z8.object({
+        groupId: z8.string().uuid().describe("Policy group ID"),
+        versionId: z8.string().uuid().describe("Version ID to publish"),
+        memo: z8.string().min(1).describe("Publish memo (required)")
       })
     },
     async ({ groupId, versionId, memo }) => callApi("POST", `policy-groups/${groupId}/versions/${versionId}/publish`, { body: { memo } })
@@ -4268,10 +4623,10 @@ function registerDeployTools(server, callApi) {
       title: "Deploy to Live",
       annotations: { readOnlyHint: false, destructiveHint: true },
       description: "Deploy an ACTIVE (published) version to live traffic. Takes effect immediately. Versions whose effective start date has not arrived are rejected (P-037) \u2014 use lexq_deploy_schedule for those. Versions whose effective end has passed are rejected (P-058). Undefined facts do not block deployment; use lexq_facts_unregistered to review what the version references but has not defined.",
-      inputSchema: z6.object({
-        groupId: z6.string().uuid().describe("Policy group ID"),
-        versionId: z6.string().uuid().describe("Version ID to deploy"),
-        memo: z6.string().min(1).describe("Deployment memo (required)")
+      inputSchema: z8.object({
+        groupId: z8.string().uuid().describe("Policy group ID"),
+        versionId: z8.string().uuid().describe("Version ID to deploy"),
+        memo: z8.string().min(1).describe("Deployment memo (required)")
       })
     },
     async ({ groupId, versionId, memo }) => callApi("POST", `policy-groups/${groupId}/deploy`, {
@@ -4283,14 +4638,20 @@ function registerDeployTools(server, callApi) {
     {
       title: "Rollback Deployment",
       annotations: { readOnlyHint: false, destructiveHint: true },
-      description: "Rollback to the previous deployed version. Only available if there is a previous version that is still ACTIVE and whose effective end has not passed (P-058).",
-      inputSchema: z6.object({
-        groupId: z6.string().uuid().describe("Policy group ID"),
-        memo: z6.string().min(1).describe("Rollback reason (required)")
+      description: dedent18`
+        Roll the group back to the version that was live before the current one. Call lexq_groups_get first: currentVersionName is live now, previousVersionName is what a rollback restores, and a rollback is rejected while canRollback is false. A rollback needs a previous version that is still ACTIVE and whose effective end has not passed (P-058).
+
+        Pass the currentVersionId and currentDeploymentId from that call as expectedCurrentVersionId and expectedCurrentDeploymentId. If anyone deployed, rolled back or undeployed in between, the rollback is rejected with 409 and nothing changes: P-062 if another version or no version is live, P-063 if the same version is live but from a newer deployment. Read the group again and check with the user before retrying.
+      `,
+      inputSchema: z8.object({
+        groupId: z8.string().uuid().describe("Policy group ID"),
+        expectedCurrentVersionId: z8.string().uuid().describe("currentVersionId from your last read of the group"),
+        expectedCurrentDeploymentId: z8.string().uuid().describe("currentDeploymentId from your last read of the group"),
+        memo: z8.string().min(1).describe("Rollback reason (required)")
       })
     },
-    async ({ groupId, memo }) => callApi("POST", `policy-groups/${groupId}/rollback`, {
-      body: { memo }
+    async ({ groupId, expectedCurrentVersionId, expectedCurrentDeploymentId, memo }) => callApi("POST", `policy-groups/${groupId}/rollback`, {
+      body: { memo, expectedCurrentVersionId, expectedCurrentDeploymentId }
     })
   );
   server.registerTool(
@@ -4299,372 +4660,133 @@ function registerDeployTools(server, callApi) {
       title: "Undeploy",
       annotations: { readOnlyHint: false, destructiveHint: true },
       description: "Remove the live version from traffic. The version stays ACTIVE but no longer serves requests.",
-      inputSchema: z6.object({
-        groupId: z6.string().uuid().describe("Policy group ID"),
-        memo: z6.string().min(1).describe("Undeploy reason (required)")
-      })
-    },
-    async ({ groupId, memo }) => callApi("POST", `policy-groups/${groupId}/undeploy`, {
-      body: { memo }
-    })
-  );
-  server.registerTool(
-    "lexq_deploy_schedule",
-    {
-      title: "Schedule Deployment",
-      annotations: { readOnlyHint: false, destructiveHint: false },
-      description: "Schedule an ACTIVE version with a future effective start date to auto-deploy at that time (Scheduled Deployment). The time is the version's effectiveFrom, set on the DRAFT before publishing; this call takes no time of its own. One pending schedule per group; manual deploy/rollback/undeploy, starting an A/B test, or archiving the group cancels it. The snapshot hash is sealed at scheduling and re-verified at execution (fail-closed).",
-      inputSchema: z6.object({
-        groupId: z6.string().uuid().describe("Policy group ID"),
-        versionId: z6.string().uuid().describe("ACTIVE version ID with a future effective start date"),
-        memo: z6.string().min(1).describe("Schedule memo (required)")
-      })
-    },
-    async ({ groupId, versionId, memo }) => callApi("POST", `policy-groups/${groupId}/schedule`, {
-      body: { versionId, memo }
-    })
-  );
-  server.registerTool(
-    "lexq_deploy_unschedule",
-    {
-      title: "Cancel Scheduled Deployment",
-      annotations: { readOnlyHint: false, destructiveHint: true },
-      description: "Cancel the pending scheduled deployment for a group. The version itself is not affected. Fails with P-039 if no pending schedule exists.",
-      inputSchema: z6.object({
-        groupId: z6.string().uuid().describe("Policy group ID")
-      })
-    },
-    async ({ groupId }) => callApi("DELETE", `policy-groups/${groupId}/schedule`)
-  );
-  server.registerTool(
-    "lexq_deploy_schedules",
-    {
-      title: "List Scheduled Deployments",
-      annotations: { readOnlyHint: true },
-      description: "List scheduled deployments across all groups (all statuses: PENDING, EXECUTED, CANCELED, FAILED), newest first.",
-      inputSchema: z6.object({
-        page: z6.number().int().min(0).default(0).describe("Page number"),
-        size: z6.number().int().min(1).max(100).default(20).describe("Page size")
-      })
-    },
-    async ({ page, size }) => callApi("GET", "policy-groups/schedules", { params: paginationParams(page, size) })
-  );
-  server.registerTool(
-    "lexq_deploy_history",
-    {
-      title: "Deployment History",
-      annotations: { readOnlyHint: true },
-      description: "List deployment history across all groups.",
-      inputSchema: z6.object({
-        page: z6.number().int().min(0).default(0).describe("Page number"),
-        size: z6.number().int().min(1).max(100).default(20).describe("Page size"),
-        groupId: z6.string().uuid().optional().describe("Filter by group ID"),
-        types: z6.string().optional().describe("Filter by deployment types (comma-separated: DEPLOY,ROLLBACK,UNDEPLOY)"),
-        startDate: z6.string().optional().describe(START_DAY),
-        endDate: z6.string().optional().describe(END_DAY)
-      })
-    },
-    async ({ page, size, groupId, types, startDate, endDate }) => {
-      const params = paginationParams(page, size);
-      if (groupId) params.groupId = groupId;
-      if (types) params.types = types;
-      if (startDate) params.startDate = startDate;
-      if (endDate) params.endDate = endDate;
-      return callApi("GET", "deployments", { params });
-    }
-  );
-  server.registerTool(
-    "lexq_deploy_detail",
-    {
-      title: "Deployment Detail",
-      annotations: { readOnlyHint: true },
-      description: "Get detailed info about a specific deployment including snapshot hash and integrity check.",
-      inputSchema: z6.object({
-        deploymentId: z6.string().uuid().describe("Deployment ID")
-      })
-    },
-    async ({ deploymentId }) => callApi("GET", `deployments/${deploymentId}`)
-  );
-  server.registerTool(
-    "lexq_deploy_overview",
-    {
-      title: "Deployment Overview",
-      annotations: { readOnlyHint: true },
-      description: "Show current deployment status of all groups \u2014 which version is live, last deployment type, and deployer.",
-      inputSchema: z6.object({})
-    },
-    async () => callApi("GET", "deployments/overview")
-  );
-  server.registerTool(
-    "lexq_deploy_deployable",
-    {
-      title: "List Deployable Versions",
-      annotations: { readOnlyHint: true },
-      description: "List ACTIVE (published) versions that can be deployed for a group. Use this to find which versions are available before calling deploy live.",
-      inputSchema: z6.object({
-        groupId: z6.string().uuid().describe("Policy group ID")
-      })
-    },
-    async ({ groupId }) => callApi("GET", `deployments/groups/${groupId}/deployable-versions`)
-  );
-  server.registerTool(
-    "lexq_deploy_diff",
-    {
-      title: "Deployment Diff",
-      annotations: { readOnlyHint: true },
-      description: "Compare rule snapshots between two versions. Shows added, removed, and modified rules. Useful for reviewing changes before deploying a new version.",
-      inputSchema: z6.object({
-        baseVersionId: z6.string().uuid().describe("Base version ID (typically the current live)"),
-        targetVersionId: z6.string().uuid().describe("Target version ID (the one you want to deploy)")
-      })
-    },
-    async ({ baseVersionId, targetVersionId }) => callApi("GET", "deployments/diff", {
-      params: { baseVersionId, targetVersionId }
-    })
-  );
-}
-
-// src/mcp/tools/analytics.ts
-import { z as z7 } from "zod";
-import dedent16 from "dedent";
-function registerAnalyticsTools(server, callApi) {
-  server.registerTool(
-    "lexq_dry_run",
-    {
-      title: "Dry Run",
-      annotations: { readOnlyHint: true },
-      description: dedent16`
-        Execute a single dry run against a version. Tests how rules evaluate given input facts without side effects.
-        
-        Returns:
-          inputFacts        — normalized input facts
-          mutatedFacts      — input facts changed by rule actions (e.g. MUTATE_FACT mutates paymentAmount)
-          generatedVariables — system-generated values; every fact in mutatedFacts gets a paired {factName}__delta key (signed difference)
-          executionTraces   — per-rule match status
-          decisionTraces    — per-rule decision (SELECTED / NO_MATCH / BLOCKED / etc.)
-        
-        Example input: { "facts": { "paymentAmount": 100000, "customerTier": "VIP" } }
-        Always dry-run before publishing to validate rule behavior.`,
-      inputSchema: z7.object({
-        versionId: z7.string().uuid().describe("Policy version ID to test against"),
-        facts: z7.string().describe('JSON string of facts object, e.g. {"paymentAmount":100000}'),
-        includeDebugInfo: z7.boolean().default(true).describe("Include execution and decision traces")
-      })
-    },
-    async ({ versionId, facts, includeDebugInfo }) => {
-      const parsedFacts = parseJson(facts);
-      return callApi("POST", `analytics/dry-run/versions/${versionId}`, {
-        body: { facts: parsedFacts, includeDebugInfo }
-      });
-    }
-  );
-  server.registerTool(
-    "lexq_dry_run_compare",
-    {
-      title: "Dry Run Compare",
-      annotations: { readOnlyHint: true },
-      description: dedent16`
-        Compare dry run results between two versions using the same input facts. Useful for validating changes.
-        
-        Returns:
-          resultA / resultB — full DryRunResponse for each version
-          diff.mutatedDiff   — changes in mutatedFacts between A and B (key → {before, after})
-          diff.generatedDiff — changes in generatedVariables between A and B`,
-      inputSchema: z7.object({
-        versionIdA: z7.string().uuid().describe("Baseline version ID"),
-        versionIdB: z7.string().uuid().describe("Candidate version ID"),
-        facts: z7.string().describe("JSON string of facts object")
-      })
-    },
-    async ({ versionIdA, versionIdB, facts }) => {
-      const parsedFacts = parseJson(facts);
-      return callApi("POST", "analytics/dry-run/compare", {
-        body: { versionIdA, versionIdB, facts: parsedFacts }
-      });
-    }
+      inputSchema: z8.object({
+        groupId: z8.string().uuid().describe("Policy group ID"),
+        memo: z8.string().min(1).describe("Undeploy reason (required)")
+      })
+    },
+    async ({ groupId, memo }) => callApi("POST", `policy-groups/${groupId}/undeploy`, {
+      body: { memo }
+    })
   );
   server.registerTool(
-    "lexq_requirements",
+    "lexq_deploy_schedule",
     {
-      title: "Analyze Requirements",
-      annotations: { readOnlyHint: true },
-      description: "Analyze which input facts a version requires. Returns required keys, types, and an example request body.",
-      inputSchema: z7.object({
-        groupId: z7.string().uuid().describe("Policy group ID"),
-        versionId: z7.string().uuid().describe("Version ID")
+      title: "Schedule Deployment",
+      annotations: { readOnlyHint: false, destructiveHint: false },
+      description: "Schedule an ACTIVE version with a future effective start date to auto-deploy at that time (Scheduled Deployment). The time is the version's effectiveFrom, set on the DRAFT before publishing; this call takes no time of its own. One pending schedule per group; manual deploy/rollback/undeploy, starting an A/B test, or archiving the group cancels it. The snapshot hash is sealed at scheduling and re-verified at execution (fail-closed).",
+      inputSchema: z8.object({
+        groupId: z8.string().uuid().describe("Policy group ID"),
+        versionId: z8.string().uuid().describe("ACTIVE version ID with a future effective start date"),
+        memo: z8.string().min(1).describe("Schedule memo (required)")
       })
     },
-    async ({ groupId, versionId }) => callApi("GET", `analytics/groups/${groupId}/versions/${versionId}/requirements`)
+    async ({ groupId, versionId, memo }) => callApi("POST", `policy-groups/${groupId}/schedule`, {
+      body: { versionId, memo }
+    })
   );
   server.registerTool(
-    "lexq_simulation_start",
+    "lexq_deploy_unschedule",
     {
-      title: "Start Simulation",
-      annotations: { readOnlyHint: false, destructiveHint: false },
-      description: dedent16`
-        Start an Impact Simulation against historical, uploaded, or inline data.
-
-        dataset.type and dataset.source are BOTH required, and must be paired:
-          HISTORICAL → source EXECUTION_LOGS, with dataset.from / dataset.to (yyyy-MM-dd, whole days
-                       in the organization time zone, both inclusive)
-          UPLOADED   → source S3_BUCKET,      with dataset.path (the path returned by lexq_dataset_upload)
-          MANUAL     → source REQUEST_BODY,   with dataset.manualData (array of fact records)
-
-        options.maxRecords: number (max ${MAX_SIMULATION_RECORDS}). When omitted, HISTORICAL and UPLOADED run at
-          most ${DEFAULT_SIMULATION_RECORDS} records and MANUAL runs every record sent.
-        options.baselinePolicyVersionId: uuid (optional, for baseline comparison)
-        options.includeRuleStats: boolean
-        options.metricConfig: optional — omit for plain execution count. To aggregate a fact, pass
-          { "targetVariable": "<fact>", "aggregationType": "COUNT" | "SUM" | "AVG" }
-
-        Example (uploaded dataset):
-        {
-          "policyVersionId": "<uuid>",
-          "dataset": { "type": "UPLOADED", "source": "S3_BUCKET", "path": "<path from lexq_dataset_upload>" },
-          "options": { "baselinePolicyVersionId": "<uuid>", "includeRuleStats": true, "maxRecords": 10000 }
-        }
-
-        Example (historical):
-        {
-          "policyVersionId": "<uuid>",
-          "dataset": { "type": "HISTORICAL", "source": "EXECUTION_LOGS", "from": "2026-01-01", "to": "2026-01-31" },
-          "options": { "baselinePolicyVersionId": "<uuid>", "includeRuleStats": true }
-        }
-      `,
-      inputSchema: z7.object({
-        body: z7.string().describe("JSON string of SimulationRequest")
+      title: "Cancel Scheduled Deployment",
+      annotations: { readOnlyHint: false, destructiveHint: true },
+      description: "Cancel the pending scheduled deployment for a group. The version itself is not affected. Fails with P-039 if no pending schedule exists.",
+      inputSchema: z8.object({
+        groupId: z8.string().uuid().describe("Policy group ID")
       })
     },
-    async ({ body }) => {
-      const parsed = parseJson(body);
-      return callApi("POST", "analytics/simulations", { body: parsed });
-    }
+    async ({ groupId }) => callApi("DELETE", `policy-groups/${groupId}/schedule`)
   );
   server.registerTool(
-    "lexq_simulation_status",
+    "lexq_deploy_schedules",
     {
-      title: "Simulation Status",
+      title: "List Scheduled Deployments",
       annotations: { readOnlyHint: true },
-      description: "Get simulation status and results. Poll until status is COMPLETED or FAILED.",
-      inputSchema: z7.object({
-        simulationId: z7.string().uuid().describe("Simulation ID")
+      description: "List scheduled deployments across all groups (all statuses: PENDING, EXECUTED, CANCELED, FAILED), newest first.",
+      inputSchema: z8.object({
+        page: z8.number().int().min(0).default(0).describe("Page number"),
+        size: z8.number().int().min(1).max(100).default(20).describe("Page size")
       })
     },
-    async ({ simulationId }) => callApi("GET", `analytics/simulations/${simulationId}`)
+    async ({ page, size }) => callApi("GET", "policy-groups/schedules", { params: paginationParams(page, size) })
   );
   server.registerTool(
-    "lexq_simulation_list",
+    "lexq_deploy_history",
     {
-      title: "List Simulations",
+      title: "Deployment History",
       annotations: { readOnlyHint: true },
-      description: "List simulation history with optional filters.",
-      inputSchema: z7.object({
-        page: z7.number().int().min(0).default(0).describe("Page number"),
-        size: z7.number().int().min(1).max(100).default(20).describe("Page size"),
-        status: z7.enum(["PENDING", "RUNNING", "COMPLETED", "FAILED", "CANCELED"]).optional().describe("Filter by status"),
-        from: z7.string().optional().describe(START_DAY),
-        to: z7.string().optional().describe(END_DAY)
+      description: "List deployment history across all groups.",
+      inputSchema: z8.object({
+        page: z8.number().int().min(0).default(0).describe("Page number"),
+        size: z8.number().int().min(1).max(100).default(20).describe("Page size"),
+        groupId: z8.string().uuid().optional().describe("Filter by group ID"),
+        types: z8.string().optional().describe("Filter by deployment types (comma-separated: DEPLOY,ROLLBACK,UNDEPLOY)"),
+        startDate: z8.string().optional().describe(START_DAY),
+        endDate: z8.string().optional().describe(END_DAY)
       })
     },
-    async ({ page, size, status, from, to }) => {
+    async ({ page, size, groupId, types, startDate, endDate }) => {
       const params = paginationParams(page, size);
-      if (status) params.status = status;
-      if (from) params.from = from;
-      if (to) params.to = to;
-      return callApi("GET", "analytics/simulations", { params });
+      if (groupId) params.groupId = groupId;
+      if (types) params.types = types;
+      if (startDate) params.startDate = startDate;
+      if (endDate) params.endDate = endDate;
+      return callApi("GET", "deployments", { params });
     }
   );
   server.registerTool(
-    "lexq_simulation_cancel",
+    "lexq_deploy_detail",
     {
-      title: "Cancel Simulation",
-      annotations: { readOnlyHint: false, destructiveHint: true },
-      description: "Cancel a running or pending simulation.",
-      inputSchema: z7.object({
-        simulationId: z7.string().uuid().describe("Simulation ID")
+      title: "Deployment Detail",
+      annotations: { readOnlyHint: true },
+      description: "Get detailed info about a specific deployment including snapshot hash and integrity check.",
+      inputSchema: z8.object({
+        deploymentId: z8.string().uuid().describe("Deployment ID")
       })
     },
-    async ({ simulationId }) => callApi("DELETE", `analytics/simulations/${simulationId}`)
+    async ({ deploymentId }) => callApi("GET", `deployments/${deploymentId}`)
   );
   server.registerTool(
-    "lexq_simulation_export",
+    "lexq_deploy_overview",
     {
-      title: "Export Simulation",
+      title: "Deployment Overview",
       annotations: { readOnlyHint: true },
-      description: "Export simulation results as JSON or CSV. Returns the raw data.",
-      inputSchema: z7.object({
-        simulationId: z7.string().uuid().describe("Simulation ID"),
-        format: z7.enum(EXPORT_FORMATS).default("json").describe("Export format")
-      })
+      description: "Show current deployment status of all groups \u2014 which version is live, last deployment type, and deployer. Each group also carries currentDeploymentId, previousVersionName (the version a rollback restores) and canRollback, as in lexq_groups_get.",
+      inputSchema: z8.object({})
     },
-    async ({ simulationId, format }) => callApi("GET", `analytics/simulations/${simulationId}/export`, {
-      params: { format }
-    })
+    async () => callApi("GET", "deployments/overview")
   );
   server.registerTool(
-    "lexq_dataset_upload",
+    "lexq_deploy_deployable",
     {
-      title: "Upload Dataset",
-      annotations: { readOnlyHint: false, destructiveHint: false },
-      description: dedent16`
-        Upload inline CSV or JSON content as a simulation dataset.
-        The content is uploaded to S3 and a path is returned in the "path" field.
-
-        To use the returned path in lexq_simulation_start, set:
-          dataset: { "type": "UPLOADED", "source": "S3_BUCKET", "path": "<returned path>" }
-
-        CSV example:
-        userId,paymentAmount
-        user_001,150000
-        user_002,50000
-
-        JSON example: [{"userId":"user_001","paymentAmount":150000}, {"userId":"user_002","paymentAmount":50000}]
-      `,
-      inputSchema: z7.object({
-        content: z7.string().describe("CSV or JSON content as string"),
-        filename: z7.string().default("dataset.csv").describe("Filename with extension (.csv or .json)")
+      title: "List Deployable Versions",
+      annotations: { readOnlyHint: true },
+      description: "List ACTIVE (published) versions that can be deployed for a group. Use this to find which versions are available before calling deploy live.",
+      inputSchema: z8.object({
+        groupId: z8.string().uuid().describe("Policy group ID")
       })
     },
-    async ({ content, filename }) => {
-      const result = await callApi("POST", "analytics/datasets/upload", {
-        upload: { content, filename, fieldName: "file" }
-      });
-      if (!result.isError) {
-        try {
-          const uploaded = parseJson(result.content[0]?.text ?? "{}");
-          if (uploaded.path) {
-            const dataset = { type: "UPLOADED", source: "S3_BUCKET", path: uploaded.path };
-            result.content.push({
-              type: "text",
-              text: "Ready-to-use dataset block for lexq_simulation_start:\n" + stringifyJson({ dataset }, 2)
-            });
-          }
-        } catch {
-        }
-      }
-      return result;
-    }
+    async ({ groupId }) => callApi("GET", `deployments/groups/${groupId}/deployable-versions`)
   );
   server.registerTool(
-    "lexq_dataset_template",
+    "lexq_deploy_diff",
     {
-      title: "Download Dataset Template",
+      title: "Deployment Diff",
       annotations: { readOnlyHint: true },
-      description: "Generate a sample CSV or JSON template based on the required facts of a version. Use this to understand the expected data format before uploading a dataset.",
-      inputSchema: z7.object({
-        groupId: z7.string().uuid().describe("Policy group ID"),
-        versionId: z7.string().uuid().describe("Version ID"),
-        format: z7.enum(EXPORT_FORMATS).default("csv").describe("Template format")
+      description: "Compare rule snapshots between two versions. Shows added, removed, and modified rules. Useful for reviewing changes before deploying a new version.",
+      inputSchema: z8.object({
+        baseVersionId: z8.string().uuid().describe("Base version ID (typically the current live)"),
+        targetVersionId: z8.string().uuid().describe("Target version ID (the one you want to deploy)")
       })
     },
-    async ({ groupId, versionId, format }) => callApi("GET", `analytics/groups/${groupId}/versions/${versionId}/dataset-template`, {
-      params: { format }
+    async ({ baseVersionId, targetVersionId }) => callApi("GET", "deployments/diff", {
+      params: { baseVersionId, targetVersionId }
     })
   );
 }
 
 // src/mcp/tools/profile.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var RELATIVE_THRESHOLD = `flagged = p50 \u2265 ${SLOW_MULTIPLIER}\xD7 median of per-rule p50s within the group; absolute thresholds are intentionally not supported.`;
 function profileParams(opts) {
   const params = {};
@@ -4681,14 +4803,14 @@ function registerProfileTools(server, callApi) {
       title: "Group Latency Profile",
       annotations: { readOnlyHint: true },
       description: "Per-rule latency profile of a policy group over a time window: group TOTAL distribution split by cache state (HIT = compiled ruleset cache hit, MISS = deep-load + compile), a per-rule CONDITION/ACTION percentile table, and slow-rule flags. " + RELATIVE_THRESHOLD + ` Every percentile is accompanied by its sample count n; a percentile is withheld (null) unless n\xD7(1\u2212q) \u2265 ${TAIL_MIN_OBS} (p50 needs n \u2265 6, p95 n \u2265 60, p99 n \u2265 300 \u2014 display gate, separate from the n \u2265 ${MIN_SAMPLES} judgment gate). Baselines report INSUFFICIENT_COHORT when fewer than ${MIN_COHORT_SIZE} rules qualify. Rule detail comes from a deterministic ${PROFILE_SAMPLE_PERMILLE / 10}% sample of calls; TOTAL is recorded for every call. Defaults: last ${PROFILE_DEFAULT_WINDOW_HOURS}h, live version, cacheState HIT.`,
-      inputSchema: z8.object({
-        groupId: z8.string().uuid().describe("Policy group ID"),
-        versionId: z8.string().uuid().optional().describe("Version to inspect (default: live version)"),
-        from: z8.string().optional().describe(
+      inputSchema: z9.object({
+        groupId: z9.string().uuid().describe("Policy group ID"),
+        versionId: z9.string().uuid().optional().describe("Version to inspect (default: live version)"),
+        from: z9.string().optional().describe(
           `Window start, ISO-8601 instant (e.g. 2026-07-01T00:00:00Z). Default: ${PROFILE_DEFAULT_WINDOW_HOURS}h ago`
         ),
-        to: z8.string().optional().describe("Window end, ISO-8601 instant. Default: now"),
-        cacheState: z8.enum(["HIT", "MISS"]).optional().describe("Cache dimension for the rule table and judgment (default: HIT)")
+        to: z9.string().optional().describe("Window end, ISO-8601 instant. Default: now"),
+        cacheState: z9.enum(["HIT", "MISS"]).optional().describe("Cache dimension for the rule table and judgment (default: HIT)")
       })
     },
     async ({ groupId, versionId, from, to, cacheState }) => callApi("GET", `policy-groups/${groupId}/profile`, {
@@ -4701,14 +4823,14 @@ function registerProfileTools(server, callApi) {
       title: "Rule Latency Detail",
       annotations: { readOnlyHint: true },
       description: `Single-rule latency detail: merged phase \xD7 cacheState distributions plus a per-window time series (${LATENCY_WINDOW_MILLIS / 1e3}s windows). Missing windows are genuine gaps \u2014 never interpolated. Series points carry each window's own values; percentiles in merged distributions are withheld (null) unless n\xD7(1\u2212q) \u2265 ${TAIL_MIN_OBS} (p50 n \u2265 6, p95 n \u2265 60, p99 n \u2265 300). ` + RELATIVE_THRESHOLD,
-      inputSchema: z8.object({
-        groupId: z8.string().uuid().describe("Policy group ID"),
-        ruleId: z8.string().uuid().describe("Rule ID (from lexq_profile_overview)"),
-        versionId: z8.string().uuid().optional().describe("Version to inspect (default: live version)"),
-        from: z8.string().optional().describe(
+      inputSchema: z9.object({
+        groupId: z9.string().uuid().describe("Policy group ID"),
+        ruleId: z9.string().uuid().describe("Rule ID (from lexq_profile_overview)"),
+        versionId: z9.string().uuid().optional().describe("Version to inspect (default: live version)"),
+        from: z9.string().optional().describe(
           `Window start, ISO-8601 instant. Default: ${PROFILE_DEFAULT_WINDOW_HOURS}h ago`
         ),
-        to: z8.string().optional().describe("Window end, ISO-8601 instant. Default: now")
+        to: z9.string().optional().describe("Window end, ISO-8601 instant. Default: now")
       })
     },
     async ({ groupId, ruleId, versionId, from, to }) => callApi("GET", `policy-groups/${groupId}/profile/rules/${ruleId}`, {
@@ -4718,7 +4840,7 @@ function registerProfileTools(server, callApi) {
 }
 
 // src/mcp/tools/replay.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 function registerReplayTools(server, callApi) {
   server.registerTool(
     "lexq_replay_decision",
@@ -4726,9 +4848,9 @@ function registerReplayTools(server, callApi) {
       title: "Replay a Decision",
       annotations: { readOnlyHint: true },
       description: "Re-evaluate a past execution (traceId) against a candidate version and return the decision diff (decisionChanged, effect changes, fired rules) plus a determinism verdict. Synchronous and free of charge (TPS throttle only). A replay sends no webhook, notification, or event: rule actions produce no outward effects.",
-      inputSchema: z9.object({
-        traceId: z9.string().describe("Trace ID of the past execution to replay"),
-        candidateVersionId: z9.string().uuid().describe("Version to re-evaluate against")
+      inputSchema: z10.object({
+        traceId: z10.string().describe("Trace ID of the past execution to replay"),
+        candidateVersionId: z10.string().uuid().describe("Version to re-evaluate against")
       })
     },
     async ({ traceId, candidateVersionId }) => callApi("POST", "replay/decisions", { body: { traceId, candidateVersionId } })
@@ -4739,11 +4861,11 @@ function registerReplayTools(server, callApi) {
       title: "Start Window Replay (Blast Radius)",
       annotations: { readOnlyHint: false, destructiveHint: false },
       description: "Submit an async job that replays a date window of past executions against a candidate version and measures the blast radius (how many decisions change). Billed per replayed record (REPLAY metric); VIEWER role cannot submit. Poll with lexq_replay_status.",
-      inputSchema: z9.object({
-        candidateVersionId: z9.string().uuid().describe("Version to re-evaluate against"),
-        from: z9.string().describe(WINDOW_START_DAY),
-        to: z9.string().describe(WINDOW_END_DAY),
-        maxRecords: z9.number().int().min(1).optional().describe(
+      inputSchema: z10.object({
+        candidateVersionId: z10.string().uuid().describe("Version to re-evaluate against"),
+        from: z10.string().describe(WINDOW_START_DAY),
+        to: z10.string().describe(WINDOW_END_DAY),
+        maxRecords: z10.number().int().min(1).optional().describe(
           `Sample cap (server default applies; hard cap ${REPLAY_WINDOW_MAX_RECORDS / 1e3}k)`
         )
       })
@@ -4756,8 +4878,8 @@ function registerReplayTools(server, callApi) {
       title: "Get Replay Job Status",
       annotations: { readOnlyHint: true },
       description: "Poll a window replay job. RUNNING shows progress 0\u2013100; COMPLETED fills summary and changedSamples; FAILED carries errorMessage. capped=true means the window exceeded the sample cap and only part was replayed.",
-      inputSchema: z9.object({
-        jobId: z9.string().describe("Replay job ID from lexq_replay_start")
+      inputSchema: z10.object({
+        jobId: z10.string().describe("Replay job ID from lexq_replay_start")
       })
     },
     async ({ jobId }) => callApi("GET", `replay/jobs/${jobId}`)
@@ -4768,9 +4890,9 @@ function registerReplayTools(server, callApi) {
       title: "List Replay Jobs",
       annotations: { readOnlyHint: true },
       description: "List window replay job history (reverse-chronological). Lightweight items \u2014 use lexq_replay_status for summary and changed samples.",
-      inputSchema: z9.object({
-        page: z9.number().int().min(0).default(0).describe("Page number"),
-        size: z9.number().int().min(1).max(100).default(20).describe("Page size")
+      inputSchema: z10.object({
+        page: z10.number().int().min(0).default(0).describe("Page number"),
+        size: z10.number().int().min(1).max(100).default(20).describe("Page size")
       })
     },
     async ({ page, size }) => callApi("GET", "replay/jobs", { params: paginationParams(page, size) })
@@ -4781,8 +4903,8 @@ function registerReplayTools(server, callApi) {
       title: "Cancel Replay Job",
       annotations: { readOnlyHint: false, destructiveHint: true },
       description: "Cooperatively cancel a PENDING or RUNNING window replay job. Other states are rejected. VIEWER role cannot cancel.",
-      inputSchema: z9.object({
-        jobId: z9.string().describe("Replay job ID")
+      inputSchema: z10.object({
+        jobId: z10.string().describe("Replay job ID")
       })
     },
     async ({ jobId }) => callApi("POST", `replay/jobs/${jobId}/cancel`)
@@ -4793,9 +4915,9 @@ function registerReplayTools(server, callApi) {
       title: "Export Replay Result",
       annotations: { readOnlyHint: true },
       description: "Export a COMPLETED window replay job. A running job is rejected \u2014 a partial result reads as the whole thing on the receiving end. The two formats carry different things: CSV holds the effect blast radius, whose columns are fixed; JSON holds the changed samples and action parameters, which nest and whose keys differ per tenant. JSON is not a superset of CSV. Returns the file contents as text.",
-      inputSchema: z9.object({
-        jobId: z9.string().describe("Replay job ID"),
-        format: z9.enum(EXPORT_FORMATS).default("json").describe("Export format")
+      inputSchema: z10.object({
+        jobId: z10.string().describe("Replay job ID"),
+        format: z10.enum(EXPORT_FORMATS).default("json").describe("Export format")
       })
     },
     async ({ jobId, format }) => callApi("GET", `replay/jobs/${jobId}/export`, { params: { format } })
@@ -4803,7 +4925,7 @@ function registerReplayTools(server, callApi) {
 }
 
 // src/mcp/tools/history.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 function registerHistoryTools(server, callApi) {
   server.registerTool(
     "lexq_history_list",
@@ -4811,15 +4933,15 @@ function registerHistoryTools(server, callApi) {
       title: "List Execution History",
       annotations: { readOnlyHint: true },
       description: "List policy execution history. Shows trace ID, group, version, status, match result, and latency.",
-      inputSchema: z10.object({
-        page: z10.number().int().min(0).default(0).describe("Page number"),
-        size: z10.number().int().min(1).max(100).default(20).describe("Page size"),
-        traceId: z10.string().optional().describe("Filter by trace ID"),
-        groupId: z10.string().uuid().optional().describe("Filter by policy group"),
-        versionId: z10.string().uuid().optional().describe("Filter by version"),
-        status: z10.enum(["SUCCESS", "NO_MATCH", "ERROR", "TIMEOUT"]).optional().describe("Filter by execution status"),
-        startDate: z10.string().optional().describe(START_DAY),
-        endDate: z10.string().optional().describe(END_DAY)
+      inputSchema: z11.object({
+        page: z11.number().int().min(0).default(0).describe("Page number"),
+        size: z11.number().int().min(1).max(100).default(20).describe("Page size"),
+        traceId: z11.string().optional().describe("Filter by trace ID"),
+        groupId: z11.string().uuid().optional().describe("Filter by policy group"),
+        versionId: z11.string().uuid().optional().describe("Filter by version"),
+        status: z11.enum(["SUCCESS", "NO_MATCH", "ERROR", "TIMEOUT"]).optional().describe("Filter by execution status"),
+        startDate: z11.string().optional().describe(START_DAY),
+        endDate: z11.string().optional().describe(END_DAY)
       })
     },
     async ({ page, size, traceId, groupId, versionId, status, startDate, endDate }) => {
@@ -4839,8 +4961,8 @@ function registerHistoryTools(server, callApi) {
       title: "Get Execution Detail",
       annotations: { readOnlyHint: true },
       description: "Get full execution detail including inputFacts, mutatedFacts, generatedVariables, executionTraces, and decisionTraces.",
-      inputSchema: z10.object({
-        traceId: z10.string().describe("Trace ID from execution history")
+      inputSchema: z11.object({
+        traceId: z11.string().describe("Trace ID from execution history")
       })
     },
     async ({ traceId }) => callApi("GET", `execution/history/${traceId}`)
@@ -4851,10 +4973,10 @@ function registerHistoryTools(server, callApi) {
       title: "Execution Statistics",
       annotations: { readOnlyHint: true },
       description: `Get execution KPIs: total executions, success/failure counts, success rate, and average latency. Without dates the window is the last ${STATS_DEFAULT_WINDOW_DAYS} days through today, in the organization time zone. At most ${STATS_MAX_WINDOW_DAYS} days per call; a longer range is rejected with AN-039. startDate alone runs through today.`,
-      inputSchema: z10.object({
-        groupId: z10.string().uuid().optional().describe("Filter by policy group"),
-        startDate: z10.string().optional().describe(START_DAY),
-        endDate: z10.string().optional().describe(END_DAY)
+      inputSchema: z11.object({
+        groupId: z11.string().uuid().optional().describe("Filter by policy group"),
+        startDate: z11.string().optional().describe(START_DAY),
+        endDate: z11.string().optional().describe(END_DAY)
       })
     },
     async ({ groupId, startDate, endDate }) => {
@@ -4868,7 +4990,7 @@ function registerHistoryTools(server, callApi) {
 }
 
 // src/mcp/tools/provenance.ts
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 function registerProvenanceTools(server, callApi) {
   server.registerTool(
     "lexq_provenance_get",
@@ -4876,8 +4998,8 @@ function registerProvenanceTools(server, callApi) {
       title: "Get Decision Provenance",
       annotations: { readOnlyHint: true },
       description: "Get the lineage of a single decision: what was decided, deterministic why per rule, input facts (PII facts are masked as \u2022\u2022\u2022\u2022\u2022\u2022 with maskedKeys listing them \u2014 values are revealable only in the console, audited), the authored/published/deployed responsibility chain, and the rule snapshot fingerprint.",
-      inputSchema: z11.object({
-        traceId: z11.string().describe("Trace ID of the execution")
+      inputSchema: z12.object({
+        traceId: z12.string().describe("Trace ID of the execution")
       })
     },
     async ({ traceId }) => callApi("GET", `provenance/${traceId}`)
@@ -4888,14 +5010,14 @@ function registerProvenanceTools(server, callApi) {
       title: "List PII Reveal Audits",
       annotations: { readOnlyHint: true },
       description: "List the PII reveal audit ledger \u2014 who revealed which fact of which trace, and when. Metadata only; revealed values are never stored or returned. Use for monthly access-log inspection and SIEM collection.",
-      inputSchema: z11.object({
-        page: z11.number().int().min(0).default(0).describe("Page number"),
-        size: z11.number().int().min(1).max(100).default(20).describe("Page size"),
-        traceId: z11.string().optional().describe("Filter by trace ID (exact match)"),
-        revealedBy: z11.string().optional().describe("Filter by operator ID (exact match)"),
-        factKey: z11.string().optional().describe("Filter by fact key (partial match, case-insensitive)"),
-        startDate: z11.string().optional().describe(START_DAY),
-        endDate: z11.string().optional().describe(END_DAY)
+      inputSchema: z12.object({
+        page: z12.number().int().min(0).default(0).describe("Page number"),
+        size: z12.number().int().min(1).max(100).default(20).describe("Page size"),
+        traceId: z12.string().optional().describe("Filter by trace ID (exact match)"),
+        revealedBy: z12.string().optional().describe("Filter by operator ID (exact match)"),
+        factKey: z12.string().optional().describe("Filter by fact key (partial match, case-insensitive)"),
+        startDate: z12.string().optional().describe(START_DAY),
+        endDate: z12.string().optional().describe(END_DAY)
       })
     },
     async ({ page, size, traceId, revealedBy, factKey, startDate, endDate }) => {
@@ -4911,7 +5033,7 @@ function registerProvenanceTools(server, callApi) {
 }
 
 // src/mcp/tools/logs.ts
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 function registerLogTools(server, callApi) {
   server.registerTool(
     "lexq_logs_list",
@@ -4919,14 +5041,14 @@ function registerLogTools(server, callApi) {
       title: "List Failure Logs",
       annotations: { readOnlyHint: true },
       description: `List system failure logs from background tasks (platform event webhooks, scheduled deployments). Without dates the window is ${FAILURE_LOG_LOOKBACK_DAYS} days back through today, in the organization time zone; pass startDate to look further back.`,
-      inputSchema: z12.object({
-        page: z12.number().int().min(0).default(0).describe("Page number"),
-        size: z12.number().int().min(1).max(100).default(20).describe("Page size"),
-        taskType: z12.enum(TaskType).optional().describe("Task type"),
-        status: z12.enum(FailureStatus).optional().describe("Log status"),
-        keyword: z12.string().optional().describe("Search in refId, refSubId, errorMessage"),
-        startDate: z12.string().optional().describe(START_DAY),
-        endDate: z12.string().optional().describe(END_DAY)
+      inputSchema: z13.object({
+        page: z13.number().int().min(0).default(0).describe("Page number"),
+        size: z13.number().int().min(1).max(100).default(20).describe("Page size"),
+        taskType: z13.enum(TaskType).optional().describe("Task type"),
+        status: z13.enum(FailureStatus).optional().describe("Log status"),
+        keyword: z13.string().optional().describe("Search in refId, refSubId, errorMessage"),
+        startDate: z13.string().optional().describe(START_DAY),
+        endDate: z13.string().optional().describe(END_DAY)
       })
     },
     async ({ page, size, taskType, status, keyword, startDate, endDate }) => {
@@ -4945,8 +5067,8 @@ function registerLogTools(server, callApi) {
       title: "Get Failure Log",
       annotations: { readOnlyHint: true },
       description: "Get failure log detail by ID.",
-      inputSchema: z12.object({
-        logId: z12.string().uuid().describe("Failure log ID")
+      inputSchema: z13.object({
+        logId: z13.string().uuid().describe("Failure log ID")
       })
     },
     async ({ logId }) => callApi("GET", `failure-logs/${logId}`)
@@ -4957,9 +5079,9 @@ function registerLogTools(server, callApi) {
       title: "Process Failure Log",
       annotations: { readOnlyHint: false, destructiveHint: false },
       description: "Process a single failure log: RESOLVE (mark as manually fixed) or IGNORE (skip intentionally).",
-      inputSchema: z12.object({
-        logId: z12.string().uuid().describe("Failure log ID"),
-        action: z12.enum(FailureAction).describe("Action to take")
+      inputSchema: z13.object({
+        logId: z13.string().uuid().describe("Failure log ID"),
+        action: z13.enum(FailureAction).describe("Action to take")
       })
     },
     async ({ logId, action }) => callApi("POST", `failure-logs/${logId}/actions`, {
@@ -4972,9 +5094,9 @@ function registerLogTools(server, callApi) {
       title: "Bulk Process Failure Logs",
       annotations: { readOnlyHint: false, destructiveHint: false },
       description: "Process multiple failure logs at once. Provide an array of log IDs and the action.",
-      inputSchema: z12.object({
-        logIds: z12.array(z12.string().uuid()).describe("Array of failure log IDs"),
-        action: z12.enum(FailureAction).describe("Action to apply to all logs")
+      inputSchema: z13.object({
+        logIds: z13.array(z13.string().uuid()).describe("Array of failure log IDs"),
+        action: z13.enum(FailureAction).describe("Action to apply to all logs")
       })
     },
     async ({ logIds, action }) => callApi("POST", "failure-logs/bulk-actions", {
@@ -4984,7 +5106,7 @@ function registerLogTools(server, callApi) {
 }
 
 // src/mcp/tools/webhook-subscriptions.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 function registerWebhookSubscriptionTools(server, callApi) {
   server.registerTool(
     "lexq_webhook_subscriptions_list",
@@ -4992,9 +5114,9 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "List Webhook Subscriptions",
       annotations: { readOnlyHint: true },
       description: "List platform event webhook subscriptions. These receive deployment lifecycle notifications: publish, deploy, rollback, and undeploy, plus a deployment being scheduled or a schedule being canceled.",
-      inputSchema: z13.object({
-        page: z13.number().int().min(0).default(0).describe("Page number"),
-        size: z13.number().int().min(1).max(100).default(20).describe("Page size")
+      inputSchema: z14.object({
+        page: z14.number().int().min(0).default(0).describe("Page number"),
+        size: z14.number().int().min(1).max(100).default(20).describe("Page size")
       })
     },
     async ({ page, size }) => {
@@ -5008,8 +5130,8 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Get Webhook Subscription",
       annotations: { readOnlyHint: true },
       description: "Get webhook subscription detail by ID.",
-      inputSchema: z13.object({
-        id: z13.string().uuid().describe("Webhook subscription ID")
+      inputSchema: z14.object({
+        id: z14.string().uuid().describe("Webhook subscription ID")
       })
     },
     async ({ id }) => callApi("GET", `webhook-subscriptions/${id}`)
@@ -5020,14 +5142,14 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Save Webhook Subscription",
       annotations: { readOnlyHint: false, destructiveHint: true },
       description: `Create or update a webhook subscription. Omit id to create, provide id to update. Events: ${PlatformEventType.join(", ")}. Formats: GENERIC (full JSON), SLACK ({"text": "..."}).`,
-      inputSchema: z13.object({
-        id: z13.string().uuid().optional().describe("Subscription ID (omit to create, provide to update)"),
-        name: z13.string().min(1).describe("Subscription name (unique per tenant)"),
-        webhookUrl: z13.string().url().describe("Webhook endpoint URL"),
-        subscribedEvents: z13.array(z13.enum(PlatformEventType)).min(1).describe("Events to subscribe to"),
-        payloadFormat: z13.enum(WebhookPayloadFormat).optional().default("GENERIC").describe("Payload format"),
-        secret: z13.string().optional().describe("HMAC-SHA256 signing secret"),
-        isActive: z13.boolean().optional().default(true).describe("Whether the subscription is active")
+      inputSchema: z14.object({
+        id: z14.string().uuid().optional().describe("Subscription ID (omit to create, provide to update)"),
+        name: z14.string().min(1).describe("Subscription name (unique per tenant)"),
+        webhookUrl: z14.string().url().describe("Webhook endpoint URL"),
+        subscribedEvents: z14.array(z14.enum(PlatformEventType)).min(1).describe("Events to subscribe to"),
+        payloadFormat: z14.enum(WebhookPayloadFormat).optional().default("GENERIC").describe("Payload format"),
+        secret: z14.string().optional().describe("HMAC-SHA256 signing secret"),
+        isActive: z14.boolean().optional().default(true).describe("Whether the subscription is active")
       })
     },
     async ({ ...body }) => callApi("POST", "webhook-subscriptions", { body })
@@ -5038,8 +5160,8 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Delete Webhook Subscription",
       annotations: { readOnlyHint: false, destructiveHint: true },
       description: "Delete a webhook subscription by ID.",
-      inputSchema: z13.object({
-        id: z13.string().uuid().describe("Webhook subscription ID")
+      inputSchema: z14.object({
+        id: z14.string().uuid().describe("Webhook subscription ID")
       })
     },
     async ({ id }) => callApi("DELETE", `webhook-subscriptions/${id}`)
@@ -5050,8 +5172,8 @@ function registerWebhookSubscriptionTools(server, callApi) {
       title: "Test Webhook Subscription",
       annotations: { readOnlyHint: false, destructiveHint: false },
       description: "Send a test event to verify webhook connectivity. Returns the HTTP status code and success/failure message.",
-      inputSchema: z13.object({
-        id: z13.string().uuid().describe("Webhook subscription ID")
+      inputSchema: z14.object({
+        id: z14.string().uuid().describe("Webhook subscription ID")
       })
     },
     async ({ id }) => callApi("POST", `webhook-subscriptions/${id}/test`)
@@ -5059,7 +5181,7 @@ function registerWebhookSubscriptionTools(server, callApi) {
 }
 
 // src/mcp/tools/domain-templates.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 function registerDomainTemplateTools(server, callApi) {
   server.registerTool(
     "lexq_domain_templates_list",
@@ -5067,7 +5189,7 @@ function registerDomainTemplateTools(server, callApi) {
       title: "List Domain Templates",
       annotations: { readOnlyHint: true },
       description: "List all domain templates. A domain template is a starter pack of fact definitions and sample rules for a common decision, such as checkout pricing (ECOMMERCE) or transfer approval (FINTECH). Each entry reports its key, whether it can be applied (isAvailable), and how many facts and sample rules it provisions. Call this before preview or apply to see which templates exist.",
-      inputSchema: z14.object({})
+      inputSchema: z15.object({})
     },
     async () => callApi("GET", "domain-templates")
   );
@@ -5077,8 +5199,8 @@ function registerDomainTemplateTools(server, callApi) {
       title: "Preview Domain Template",
       annotations: { readOnlyHint: true },
       description: "Preview exactly what a domain template will provision before applying it: the fact definitions it registers (an input with a value domain carries its allowed values or range), the sample rules it creates with a description of each, and an apply plan. This is a read-only dry run; nothing is created. factConflicts lists keys this tenant already has with a different type, or with different allowed values or a different range on an input fact. While it is not empty, apply fails with P-061 and creates nothing: delete those facts or change them to match the template, then apply. plan is null for a template that cannot be applied yet.",
-      inputSchema: z14.object({
-        template: z14.string().describe(
+      inputSchema: z15.object({
+        template: z15.string().describe(
           "Domain template key (e.g. ECOMMERCE). Use lexq_domain_templates_list to see the keys."
         )
       })
@@ -5091,9 +5213,9 @@ function registerDomainTemplateTools(server, callApi) {
       title: "Apply Domain Template",
       annotations: { readOnlyHint: false, destructiveHint: false },
       description: "Apply a domain template to the current tenant. Creates the template's fact definitions and a new policy group pre-populated with its sample rules as a DRAFT version. Apply never overwrites existing schema: a key that already exists with the same definition is kept as it is. Run lexq_domain_templates_preview first. If its factConflicts is not empty, apply fails with P-061 and creates nothing until those facts are deleted or changed to match the template. A template whose isAvailable is false cannot be applied.",
-      inputSchema: z14.object({
-        template: z14.string().describe("Domain template key to apply (e.g. ECOMMERCE)."),
-        customName: z14.string().optional().describe(
+      inputSchema: z15.object({
+        template: z15.string().describe("Domain template key to apply (e.g. ECOMMERCE)."),
+        customName: z15.string().optional().describe(
           "Optional custom name for the policy group that gets created. If omitted, the template's default name is used."
         )
       })
@@ -5129,7 +5251,7 @@ var SERVER_INFO = { name: "lexq", ...server_info_default };
 var __dirname = dirname(fileURLToPath(import.meta.url));
 function getVersion() {
   try {
-    const pkg = JSON.parse(readFileSync3(join2(__dirname, "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync3(join3(__dirname, "..", "package.json"), "utf-8"));
     return pkg.version;
   } catch {
     return "0.1.0";
@@ -5142,6 +5264,7 @@ function startMcpServer() {
     () => {
       const server = new McpServer({ ...SERVER_INFO, version });
       registerAllTools(server, callApi);
+      registerLocalTools(server);
       return server;
     },
     {
@@ -5159,7 +5282,7 @@ function startMcpServer() {
 function registerServeCommand(program) {
   program.command("serve").description("Start LexQ as a server for AI agent integrations").option("--mcp", "Start as MCP (Model Context Protocol) server over stdio").addHelpText(
     "after",
-    dedent17`
+    dedent19`
 
         Example:
           $ lexq serve --mcp
@@ -5190,11 +5313,11 @@ function registerServeCommand(program) {
 
 // src/commands/domain-templates.ts
 import "commander";
-import dedent18 from "dedent";
+import dedent20 from "dedent";
 function registerDomainTemplateCommands(program) {
   const templates = program.command("domain-templates").description("Browse and apply domain templates").addHelpText(
     "after",
-    dedent18`
+    dedent20`
 
         A domain template is an industry-specific starter pack of fact
         definitions and sample rules. Applying one provisions a ready-to-use
@@ -5242,7 +5365,7 @@ function registerDomainTemplateCommands(program) {
   });
   templates.command("preview").description("Preview what a domain template provisions").requiredOption("--template <key>", "Domain template key (e.g. ECOMMERCE)").addHelpText(
     "after",
-    dedent18`
+    dedent20`
 
         Read-only dry run — shows the fact definitions and sample rules the
         template will create. Nothing is provisioned.
@@ -5271,7 +5394,7 @@ function registerDomainTemplateCommands(program) {
   });
   templates.command("apply").description("Apply a domain template to the current tenant").requiredOption("--template <key>", "Domain template key (e.g. ECOMMERCE)").option("--name <n>", "Custom name for the policy group that gets created").option("--force", "Skip confirmation prompt").addHelpText(
     "after",
-    dedent18`
+    dedent20`
 
         Creates the template's fact definitions and a new DRAFT policy group
         populated with its sample rules. A fact that already exists with the
@@ -5325,7 +5448,7 @@ function registerDomainTemplateCommands(program) {
 var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
 function getVersion2() {
   try {
-    const pkg = JSON.parse(readFileSync4(join3(__dirname2, "..", "package.json"), "utf-8"));
+    const pkg = JSON.parse(readFileSync4(join4(__dirname2, "..", "package.json"), "utf-8"));
     return pkg.version;
   } catch {
     return "0.0.0";