@synapsor/runner 1.4.122 → 1.5.0

package/examples/support-billing-agent/synapsor.runner.json

@@ -9,7 +9,15 @@
       "engine": "postgres",
       "read_url_env": "REFERENCE_POSTGRES_READ_URL",
       "write_url_env": "REFERENCE_POSTGRES_WRITE_URL",
-      "statement_timeout_ms": 3000
+      "statement_timeout_ms": 3000,
+      "database_scope": {
+        "mode": "postgres_rls",
+        "tenant_setting": "synapsor.tenant_id",
+        "principal_setting": "synapsor.principal"
+      },
+      "credential_scope": {
+        "mode": "shared"
+      }
     }
   },
   "trusted_context": {
@@ -38,7 +46,8 @@
         "schema": "public",
         "table": "support_tickets",
         "primary_key": "id",
-        "tenant_key": "tenant_id"
+        "tenant_key": "tenant_id",
+        "principal_scope_key": "assigned_to"
       },
       "args": {
         "ticket_id": {
@@ -71,7 +80,8 @@
         "schema": "public",
         "table": "customers",
         "primary_key": "id",
-        "tenant_key": "tenant_id"
+        "tenant_key": "tenant_id",
+        "principal_scope_key": "assigned_to"
       },
       "args": {
         "customer_id": {
@@ -140,7 +150,8 @@
         "schema": "public",
         "table": "invoices",
         "primary_key": "id",
-        "tenant_key": "tenant_id"
+        "tenant_key": "tenant_id",
+        "principal_scope_key": "assigned_to"
       },
       "args": {
         "invoice_id": {
@@ -174,7 +185,8 @@
         "schema": "public",
         "table": "invoices",
         "primary_key": "id",
-        "tenant_key": "tenant_id"
+        "tenant_key": "tenant_id",
+        "principal_scope_key": "assigned_to"
       },
       "args": {
         "invoice_id": {

package/fixtures/contracts/capability-surface-fitness.contract.json

@@ -0,0 +1,190 @@
+{
+  "spec_version": "0.1",
+  "kind": "SynapsorContract",
+  "metadata": {
+    "name": "capability surface fitness fixture",
+    "description": "Exercises advisory capability-breadth review without changing contract validity.",
+    "version": "1.0.0"
+  },
+  "resources": [
+    {
+      "name": "billing_invoices",
+      "engine": "postgres",
+      "schema": "public",
+      "table": "invoices",
+      "type": "table",
+      "primary_key": "id",
+      "tenant_key": "tenant_id",
+      "conflict_key": "updated_at"
+    }
+  ],
+  "contexts": [
+    {
+      "name": "billing_operator",
+      "bindings": [
+        {
+          "name": "tenant_id",
+          "source": "environment",
+          "key": "SYNAPSOR_TENANT_ID",
+          "required": true
+        }
+      ],
+      "tenant_binding": "tenant_id"
+    }
+  ],
+  "capabilities": [
+    {
+      "name": "billing.execute",
+      "description": "Look up one reviewed invoice reference.",
+      "returns_hint": "One allowlisted invoice row.",
+      "kind": "read",
+      "context": "billing_operator",
+      "source": "local_postgres",
+      "subject": { "resource": "billing_invoices" },
+      "args": {
+        "filter": { "type": "string", "required": true, "max_length": 128 }
+      },
+      "lookup": { "id_from_arg": "filter" },
+      "visible_fields": ["id", "tenant_id", "status"],
+      "kept_out_fields": ["card_token", "internal_note"],
+      "evidence": { "required": true, "query_audit": true },
+      "max_rows": 1
+    },
+    {
+      "name": "billing.inspect_invoice_primary",
+      "description": "Inspect one primary invoice.",
+      "returns_hint": "One allowlisted invoice row.",
+      "kind": "read",
+      "context": "billing_operator",
+      "source": "local_postgres",
+      "subject": { "resource": "billing_invoices" },
+      "args": {
+        "invoice_id": { "type": "string", "required": true, "max_length": 128 }
+      },
+      "lookup": { "id_from_arg": "invoice_id" },
+      "visible_fields": ["id", "tenant_id", "status"],
+      "kept_out_fields": ["card_token", "internal_note"],
+      "evidence": { "required": true, "query_audit": true },
+      "max_rows": 1
+    },
+    {
+      "name": "billing.inspect_invoice_copy",
+      "description": "Inspect the same reviewed invoice shape for duplicate detection.",
+      "returns_hint": "One allowlisted invoice row.",
+      "kind": "read",
+      "context": "billing_operator",
+      "source": "local_postgres",
+      "subject": { "resource": "billing_invoices" },
+      "args": {
+        "invoice_id": { "type": "string", "required": true, "max_length": 128 }
+      },
+      "lookup": { "id_from_arg": "invoice_id" },
+      "visible_fields": ["id", "tenant_id", "status"],
+      "kept_out_fields": ["card_token", "internal_note"],
+      "evidence": { "required": true, "query_audit": true },
+      "max_rows": 1
+    },
+    {
+      "name": "billing.inspect_invoice_secondary",
+      "description": "Inspect one secondary invoice.",
+      "returns_hint": "One allowlisted invoice row.",
+      "kind": "read",
+      "context": "billing_operator",
+      "source": "local_postgres",
+      "subject": { "resource": "billing_invoices" },
+      "args": {
+        "secondary_invoice_id": { "type": "string", "required": true, "max_length": 128 }
+      },
+      "lookup": { "id_from_arg": "secondary_invoice_id" },
+      "visible_fields": ["id", "tenant_id", "status"],
+      "kept_out_fields": ["card_token", "internal_note"],
+      "evidence": { "required": true, "query_audit": true },
+      "max_rows": 1
+    },
+    {
+      "name": "billing.inspect_invoice_archived",
+      "description": "Inspect one archived invoice.",
+      "returns_hint": "One allowlisted invoice row.",
+      "kind": "read",
+      "context": "billing_operator",
+      "source": "local_postgres",
+      "subject": { "resource": "billing_invoices" },
+      "args": {
+        "archived_invoice_id": { "type": "string", "required": true, "max_length": 128 }
+      },
+      "lookup": { "id_from_arg": "archived_invoice_id" },
+      "visible_fields": ["id", "tenant_id", "status"],
+      "kept_out_fields": ["card_token", "internal_note"],
+      "evidence": { "required": true, "query_audit": true },
+      "max_rows": 1
+    },
+    {
+      "name": "billing.inspect_invoice_disputed",
+      "description": "Inspect one disputed invoice.",
+      "returns_hint": "One allowlisted invoice row.",
+      "kind": "read",
+      "context": "billing_operator",
+      "source": "local_postgres",
+      "subject": { "resource": "billing_invoices" },
+      "args": {
+        "disputed_invoice_id": { "type": "string", "required": true, "max_length": 128 }
+      },
+      "lookup": { "id_from_arg": "disputed_invoice_id" },
+      "visible_fields": ["id", "tenant_id", "status"],
+      "kept_out_fields": ["card_token", "internal_note"],
+      "evidence": { "required": true, "query_audit": true },
+      "max_rows": 1
+    },
+    {
+      "name": "billing.inspect_invoice_overdue",
+      "description": "Inspect one overdue invoice.",
+      "returns_hint": "One allowlisted invoice row.",
+      "kind": "read",
+      "context": "billing_operator",
+      "source": "local_postgres",
+      "subject": { "resource": "billing_invoices" },
+      "args": {
+        "overdue_invoice_id": { "type": "string", "required": true, "max_length": 128 }
+      },
+      "lookup": { "id_from_arg": "overdue_invoice_id" },
+      "visible_fields": ["id", "tenant_id", "status"],
+      "kept_out_fields": ["card_token", "internal_note"],
+      "evidence": { "required": true, "query_audit": true },
+      "max_rows": 1
+    },
+    {
+      "name": "billing.inspect_invoice_paid",
+      "description": "Inspect one paid invoice.",
+      "returns_hint": "One allowlisted invoice row.",
+      "kind": "read",
+      "context": "billing_operator",
+      "source": "local_postgres",
+      "subject": { "resource": "billing_invoices" },
+      "args": {
+        "paid_invoice_id": { "type": "string", "required": true, "max_length": 128 }
+      },
+      "lookup": { "id_from_arg": "paid_invoice_id" },
+      "visible_fields": ["id", "tenant_id", "status"],
+      "kept_out_fields": ["card_token", "internal_note"],
+      "evidence": { "required": true, "query_audit": true },
+      "max_rows": 1
+    },
+    {
+      "name": "billing.inspect_invoice_voided",
+      "description": "Inspect one voided invoice.",
+      "returns_hint": "One allowlisted invoice row.",
+      "kind": "read",
+      "context": "billing_operator",
+      "source": "local_postgres",
+      "subject": { "resource": "billing_invoices" },
+      "args": {
+        "voided_invoice_id": { "type": "string", "required": true, "max_length": 128 }
+      },
+      "lookup": { "id_from_arg": "voided_invoice_id" },
+      "visible_fields": ["id", "tenant_id", "status"],
+      "kept_out_fields": ["card_token", "internal_note"],
+      "evidence": { "required": true, "query_audit": true },
+      "max_rows": 1
+    }
+  ]
+}

package/fixtures/effects/changed/eff_support_late_fee_v1.result.json

@@ -0,0 +1,58 @@
+{
+  "$schema": "../../../schemas/effect-result.schema.json",
+  "schema_version": "synapsor.effect-result.v1",
+  "fixture_id": "eff_support_late_fee_v1",
+  "capability_calls": [
+    {
+      "name": "billing.inspect_invoice",
+      "args": {
+        "invoice_id": "INV-3001"
+      }
+    },
+    {
+      "name": "billing.propose_late_fee_waiver",
+      "args": {
+        "invoice_id": "INV-3001",
+        "waiver_reason": "Courtesy waiver supported by SUP-184"
+      }
+    }
+  ],
+  "trusted_context": {
+    "tenant_id": "acme",
+    "principal": "support-agent-reference",
+    "provenance": "static_dev"
+  },
+  "proposal": {
+    "result_category": "proposal_created",
+    "capability": "billing.propose_late_fee_waiver",
+    "contract_version": "0.1.0",
+    "target": {
+      "business_object": "invoice",
+      "object_id": "INV-3001"
+    },
+    "diff": {
+      "late_fee_cents": {
+        "before": 5500,
+        "proposed": 2500
+      },
+      "waiver_reason": {
+        "before": null,
+        "proposed": "Partial waiver"
+      }
+    },
+    "policy": {
+      "decision": "auto_approved"
+    }
+  },
+  "observed_fields": [
+    "invoice_status",
+    "late_fee_cents",
+    "support_ticket",
+    "waiver_reason"
+  ],
+  "evidence": {
+    "mode": "fixture",
+    "new_source_reads": false
+  },
+  "source_database_changed": false
+}

package/fixtures/effects/dataset.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "../../schemas/effect-dataset.schema.json",
+  "schema_version": "synapsor.effect-dataset.v1",
+  "name": "reference support billing effects",
+  "fixtures": [
+    "./support-late-fee.effect.json"
+  ]
+}

package/fixtures/effects/results/eff_support_late_fee_v1.result.json

@@ -0,0 +1,59 @@
+{
+  "$schema": "../../../schemas/effect-result.schema.json",
+  "schema_version": "synapsor.effect-result.v1",
+  "fixture_id": "eff_support_late_fee_v1",
+  "capability_calls": [
+    {
+      "name": "billing.inspect_invoice",
+      "args": {
+        "invoice_id": "INV-3001"
+      }
+    },
+    {
+      "name": "billing.propose_late_fee_waiver",
+      "args": {
+        "invoice_id": "INV-3001",
+        "waiver_reason": "Courtesy waiver supported by SUP-184"
+      }
+    }
+  ],
+  "trusted_context": {
+    "tenant_id": "acme",
+    "principal": "support-agent-reference",
+    "provenance": "static_dev"
+  },
+  "proposal": {
+    "result_category": "proposal_created",
+    "capability": "billing.propose_late_fee_waiver",
+    "contract_version": "0.1.0",
+    "target": {
+      "business_object": "invoice",
+      "object_id": "INV-3001"
+    },
+    "diff": {
+      "late_fee_cents": {
+        "before": 5500,
+        "proposed": 0
+      },
+      "waiver_reason": {
+        "before": null,
+        "proposed": "Courtesy waiver supported by SUP-184"
+      }
+    },
+    "policy": {
+      "decision": "pending_review",
+      "required_role": "billing_lead"
+    }
+  },
+  "observed_fields": [
+    "invoice_status",
+    "late_fee_cents",
+    "support_ticket",
+    "waiver_reason"
+  ],
+  "evidence": {
+    "mode": "fixture",
+    "new_source_reads": false
+  },
+  "source_database_changed": false
+}

package/fixtures/effects/support-late-fee.effect.json

@@ -0,0 +1,71 @@
+{
+  "$schema": "../../schemas/effect-fixture.schema.json",
+  "schema_version": "synapsor.effect-fixture.v1",
+  "fixture_id": "eff_support_late_fee_v1",
+  "fixture_digest": "sha256:d9f1b57bcac0afcc7e29215d52aa998fee4ed1eb3be3d203ecd7366d9925284f",
+  "name": "support late-fee waiver",
+  "business_request": "Waive the $55 late fee on invoice INV-3001 after reviewing support evidence.",
+  "source": {
+    "kind": "shadow_case",
+    "reference_id": "shc_reference_late_fee_v1",
+    "captured_digest": "sha256:998d3f9939fae03b6b3607d954014f11380b5fc4421376a807aaa9c48521ab36"
+  },
+  "evidence": {
+    "mode": "replay_snapshot",
+    "bundle_ids": [
+      "ev_reference_late_fee_v1"
+    ],
+    "query_fingerprints": [
+      "sha256:f9e33e7580abaedf9c6d7b6a8fa829ad821a39b48a2687b14af2954ef68cd79e"
+    ],
+    "snapshot": [
+      {
+        "facts": {
+          "support_ticket": "SUP-184",
+          "courtesy_waiver_eligible": true,
+          "invoice_status": "past_due"
+        }
+      }
+    ],
+    "source_reads_during_evaluation": false
+  },
+  "expected": {
+    "capability_calls": [
+      "billing.inspect_invoice",
+      "billing.propose_late_fee_waiver"
+    ],
+    "trusted_context": {
+      "tenant_id": "acme",
+      "principal": "support-agent-reference",
+      "provenance": "static_dev"
+    },
+    "proposal": {
+      "result_category": "proposal_created",
+      "capability": "billing.propose_late_fee_waiver",
+      "contract_version": "0.1.0",
+      "target": {
+        "business_object": "invoice",
+        "object_id": "INV-3001"
+      },
+      "diff": {
+        "late_fee_cents": {
+          "before": 5500,
+          "proposed": 0
+        },
+        "waiver_reason": {
+          "before": null,
+          "proposed": "Courtesy waiver supported by SUP-184"
+        }
+      },
+      "policy": {
+        "decision": "pending_review",
+        "required_role": "billing_lead"
+      }
+    },
+    "hidden_fields": [
+      "card_token",
+      "internal_risk_note"
+    ],
+    "source_database_changed": false
+  }
+}

package/fixtures/generators/drizzle/malicious.ts

@@ -0,0 +1,11 @@
+import { writeFileSync } from "node:fs";
+import { pgTable, text } from "drizzle-orm/pg-core";
+
+writeFileSync(process.env.SYNAPSOR_GENERATOR_MARKER!, "executed");
+const unrelatedSecret = process.env.SYNAPSOR_GENERATOR_UNRELATED_SECRET;
+
+export const invoices = pgTable("invoices", {
+  id: text("id").primaryKey(),
+  tenantId: text("tenant_id").notNull(),
+  status: text("status").notNull().default(unrelatedSecret),
+});

package/fixtures/generators/drizzle/schema.ts

@@ -0,0 +1,12 @@
+import { integer, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+
+export const supportTickets = pgTable("support_tickets", {
+  id: text("id").primaryKey(),
+  tenantId: text("tenant_id").notNull(),
+  customerId: text("customer_id").notNull(),
+  subject: text("subject").notNull(),
+  status: text("status").notNull(),
+  internalNote: text("internal_note"),
+  priority: integer("priority").notNull(),
+  updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});

package/fixtures/generators/openapi/external-ref.yaml

@@ -0,0 +1,15 @@
+openapi: 3.1.0
+info:
+  title: Forbidden external reference
+  version: 1.0.0
+paths:
+  /customers/{customer_id}:
+    get:
+      operationId: getCustomer
+      responses:
+        "200":
+          description: Customer
+          content:
+            application/json:
+              schema:
+                $ref: "https://attacker.invalid/customer.yaml"

package/fixtures/generators/openapi/openapi.yaml

@@ -0,0 +1,81 @@
+openapi: 3.1.0
+info:
+  title: Support billing API
+  version: 1.0.0
+servers:
+  - url: https://user:server-secret@example.invalid/api
+paths:
+  /invoices/{invoice_id}:
+    get:
+      operationId: getInvoice
+      tags: [billing]
+      parameters:
+        - name: invoice_id
+          in: path
+          required: true
+          schema:
+            type: string
+          example: INV-SECRET-EXAMPLE
+      responses:
+        "200":
+          description: Invoice response with server-secret-description
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Invoice"
+    patch:
+      operationId: waiveLateFee
+      tags: [billing]
+      parameters:
+        - name: invoice_id
+          in: path
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/WaiverRequest"
+      responses:
+        "200":
+          description: Updated invoice
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Invoice"
+components:
+  schemas:
+    Invoice:
+      type: object
+      required: [id, tenant_id, status, balance_cents, updated_at]
+      properties:
+        id:
+          type: string
+          readOnly: true
+        tenant_id:
+          type: string
+        status:
+          type: string
+        balance_cents:
+          type: integer
+        card_token:
+          type: string
+          writeOnly: true
+          default: card-secret-must-not-escape
+        updated_at:
+          type: string
+          format: date-time
+          readOnly: true
+    WaiverRequest:
+      type: object
+      required: [reason]
+      properties:
+        reason:
+          type: string
+          example: secret-business-example
+        amount_cents:
+          type: integer
+          minimum: 0
+          maximum: 5000

package/fixtures/generators/prisma/schema.prisma

@@ -0,0 +1,34 @@
+datasource db {
+  provider = "postgresql"
+  url      = env("GENERATOR_FIXTURE_DATABASE_URL")
+}
+
+generator client {
+  provider = "prisma-client-js"
+}
+
+model Customer {
+  id           String    @id @default(uuid())
+  tenantId     String    @map("tenant_id")
+  email        String
+  displayName  String    @map("display_name")
+  apiToken     String    @default("fixture-secret-must-not-escape") @map("api_token")
+  updatedAt    DateTime  @updatedAt @map("updated_at")
+  invoices     Invoice[]
+
+  @@map("customers")
+}
+
+model Invoice {
+  id             String   @id
+  tenantId       String   @map("tenant_id")
+  customerId     String   @map("customer_id")
+  status         String
+  balanceCents   Int      @map("balance_cents")
+  lateFeeCents   Int      @map("late_fee_cents")
+  internalNote   String?  @map("internal_note")
+  updatedAt      DateTime @updatedAt @map("updated_at")
+  customer       Customer @relation(fields: [customerId], references: [id])
+
+  @@map("invoices")
+}

package/package.json

@@ -1,12 +1,18 @@
 {
   "name": "@synapsor/runner",
-  "version": "1.4.122",
+  "version": "1.5.0",
   "description": "Stop giving AI agents execute_sql; expose reviewed Postgres/MySQL MCP actions with proposals, approval, writeback, and replay.",
   "license": "Apache-2.0",
   "type": "module",
   "bin": {
     "synapsor-runner": "dist/cli.js"
   },
+  "exports": {
+    "./runtime": {
+      "types": "./dist/runtime.d.ts",
+      "import": "./dist/runtime.mjs"
+    }
+  },
   "files": [
     "dist/cli.js",
     "dist/cli.d.ts",
@@ -14,6 +20,9 @@
     "dist/local-ui.d.ts",
     "dist/local-ui.d.ts.map",
     "dist/runner.mjs",
+    "dist/runtime.mjs",
+    "dist/runtime.d.ts",
+    "dist/runtime.d.ts.map",
     "docs/**/*.md",
     "examples/dangerous-mcp-tools.json",
     "examples/app-owned-writeback/**",
@@ -64,12 +73,14 @@
     "mysql2": "^3.11.0",
     "pdf-lib": "1.17.1",
     "pg": "^8.13.0",
+    "typescript": "5.9.3",
     "vscode-languageserver": "9.0.1",
     "vscode-languageserver-textdocument": "1.0.12",
+    "yaml": "2.8.1",
     "zod": "^3.25.0"
   },
   "devDependencies": {
-    "typescript": "^5.7.0",
+    "ajv": "^8.17.1",
     "vitest": "^3.2.0"
   },
   "homepage": "https://synapsor.ai",

package/schemas/effect-dataset.schema.json

@@ -0,0 +1,19 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://synapsor.ai/schemas/effect-dataset.schema.json",
+  "title": "Synapsor effect regression dataset",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema_version", "name", "fixtures"],
+  "properties": {
+    "$schema": { "type": "string" },
+    "schema_version": { "const": "synapsor.effect-dataset.v1" },
+    "name": { "type": "string", "minLength": 1, "maxLength": 256 },
+    "fixtures": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 1000,
+      "items": { "type": "string", "minLength": 1, "maxLength": 2048 }
+    }
+  }
+}