@synapsor/runner 1.5.4 → 1.6.0

package/docs/dsl-reference.md

@@ -168,6 +168,84 @@ Aggregate reads cannot declare model arguments, lookup, visible row fields,
 proposal clauses, joins, grouping, or arbitrary expressions. See [Bounded
 Aggregate Reads](aggregate-reads.md).
 
+## Protected named reads
+
+`PROTECTED READ` is the public DSL emitted by Protect This Query. It freezes a
+successful local authoring plan into a named capability. It is not the
+temporary `app.explore_data` plan grammar and it is not a generic query AST.
+
+This aggregate example is representative:
+
+```sql
+CREATE CAPABILITY analytics.churn_contributors_by_week
+  DESCRIPTION 'Describe reviewed weekly churn contributors.'
+  RETURNS HINT 'Returns privacy-suppressed reviewed groups.'
+  USING CONTEXT analytics_operator
+  SOURCE local_postgres
+  ON public.account_churn
+  PRIMARY KEY id
+  TENANT KEY tenant_id
+  ARG period_start STRING REQUIRED MAX LENGTH 32
+  ARG period_end STRING REQUIRED MAX LENGTH 32
+  PROTECTED READ AGGREGATE
+  BOUNDARY DIGEST sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+  GENERATION LOCK sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
+  PROTECTED FILTER status EQ FIXED 'churned'
+  PROTECTED FILTER churned_at GTE ARG period_start
+  PROTECTED FILTER churned_at LT ARG period_end
+  MEASURE churned_accounts COUNT ROWS
+  MEASURE affected_customers COUNT DISTINCT customer_id
+  GROUP DIMENSION region BY region
+  GROUP DIMENSION reason BY churn_reason
+  TIME DIMENSION churn_week BY WEEK OF churned_at
+  AGGREGATE ORDER BY MEASURE churned_accounts DESC
+  TOP 20 GROUPS
+  MIN GROUP SIZE 5
+  KEEP OUT email, private_notes
+  REQUIRE EVIDENCE
+  PROTECTED LIMITS ROWS 50 GROUPS 50 CELLS 500 BYTES 65536 TIMEOUT MS 3000 QUERIES 40 EXTRACTED CELLS 4000 DIFFERENCING 6 RATE PER MINUTE 20
+END
+```
+
+In that example, uppercase phrases such as `PROTECTED READ AGGREGATE`,
+`BOUNDARY DIGEST`, `MEASURE`, `GROUP DIMENSION`, and `TOP ... GROUPS` are DSL
+keywords. Names such as `analytics.churn_contributors_by_week`,
+`churned_accounts`, `affected_customers`, `region`, and `churn_week` are
+user-reviewed identifiers. Table/column references such as
+`public.account_churn`, `customer_id`, and `churned_at` come from inspected
+schema evidence and are frozen into the capability.
+
+The protected clauses mean:
+
+| Clause | Reviewed meaning |
+| --- | --- |
+| `PROTECTED READ ROWS` / `AGGREGATE` | Selects a frozen row or aggregate protected-read shape. |
+| `BOUNDARY DIGEST sha256:...` | Binds the capability to the exact human-activated exploration authority. |
+| `GENERATION LOCK sha256:...` | Binds it to the reviewed schema, role/grant/RLS posture, compiler, and Spec fingerprint. |
+| `PROTECTED RELATIONSHIP name ON local_key REFERENCES schema.table.target_key PRIMARY KEY pk TENANT KEY tenant [PRINCIPAL SCOPE KEY principal]` | Freezes at most one inspected, reviewed many-to-one path with fan-out one. |
+| `PROTECTED FILTER field OP FIXED value` | Freezes a reviewed literal. `OP` is `EQ`, `NEQ`, `LT`, `LTE`, `GT`, `GTE`, or bounded fixed-list `IN`. |
+| `PROTECTED FILTER field OP ARG name` | Allows only one declared typed/bounded argument at that reviewed literal position. |
+| `ALLOW READ ...` / `ROW ORDER BY ...` | Freezes row projection and up to three fixed sort fields for row mode. |
+| `MEASURE alias COUNT ROWS` | Counts the reviewed subject entity. |
+| `MEASURE alias COUNT DISTINCT field` | Counts distinct values of a field approved for aggregate use; the raw values need not be visible. |
+| `MEASURE alias SUM|AVG field` | Uses an explicitly approved aggregate-safe numeric measure. |
+| `GROUP DIMENSION alias BY field` | Freezes a reviewed categorical grouping. |
+| `TIME DIMENSION alias BY DAY|WEEK|MONTH OF field` | Freezes one reviewed timestamp and bucket. |
+| `COMPARE RANGE field FROM value TO value` | Freezes at most two bounded reviewed time ranges. |
+| `TOP n GROUPS` / `MIN GROUP SIZE n` | Fixes output breadth and cohort suppression. |
+| `PROTECTED LIMITS ...` | Fixes row/group/response/time/query/extraction/differencing/rate budgets; MCP arguments cannot widen them. |
+
+Protect normally generates this verbose authority block so that reviewers do
+not have to transcribe digests or limits. The generated DSL compiles through
+`@synapsor/dsl` into the optional default-deny `protected_read` field in the
+canonical Spec. Existing contracts with no `protected_read` field normalize
+and hash exactly as before.
+
+Protected row and aggregate capabilities can be served after exact-digest
+activation even when temporary Scoped Explore is disabled. Production never
+needs or advertises `app.explore_data`. See [Auto Boundary, Scoped Explore, And
+Protect](auto-boundary-and-scoped-explore.md).
+
 ## Read surface and evidence
 
 ```sql

package/docs/getting-started-own-database.md

@@ -1,62 +1,66 @@
 # Connect Your Own Database
 
-Use this path after the Docker demo passes and you want to try Synapsor Runner
-against a staging or disposable Postgres/MySQL database.
+Use this path after the synthetic proof passes and you want to try Synapsor
+Runner against a staging or disposable Postgres/MySQL database.
 
 Do not start with your most sensitive production database. Runner is a
-commit-safety runtime for reviewed single-row business actions, not a
-production certification.
+reviewed data boundary, not a production certification.
 
 If you only ran `synapsor-runner demo --quick`, you have tested the fixture-only
 teaching path and local ledger commands. This page is the real own-database
-path: it inspects your Postgres/MySQL metadata and generates reviewed semantic
-tools from your selections.
+path. Auto Boundary inspects the whole selected schema, combines deterministic
+database/Prisma/Drizzle/OpenAPI/Synapsor evidence, and generates disabled
+review artifacts without sampling source rows or using an LLM.
 
 ## Fast path
 
-Set one read-only database URL and run the public guided path:
+Set a dedicated SELECT-only, non-owner database URL plus trusted development
+scope and run the public guided path:
 
 ```bash
 export DATABASE_URL="<postgres-or-mysql-read-url>"
+export SYNAPSOR_TENANT_ID="<staging-tenant>"
+export SYNAPSOR_PRINCIPAL="<developer-id>"
 npx -y -p @synapsor/runner synapsor-runner start --from-env DATABASE_URL
 ```
 
-That command does the useful local mini-Synapsor path:
+A fresh interactive project with no existing config, selector, or automation
+input follows:
 
 ```text
-inspect your schema
--> choose one table/view
--> choose trusted scope and visible fields
--> optionally choose proposal/writeback rules
--> generate synapsor.runner.json + canonical synapsor.contract.json
--> preview MCP tools exposed to the model
--> run a local smoke check of the tool boundary
--> optionally write .synapsor/smoke-input.json for one real row
--> open the secured localhost first-action workbench in an interactive terminal
+inspect the whole selected schema and structured application artifacts
+-> draft disabled public DSL, canonical JSON, tests, and generation lock
+-> review scope, fields, analytics permissions, relationships, and budgets
+-> activate the exact exploration-boundary digest in local Workbench
+-> install exactly app.describe_data and app.explore_data in Cursor
+-> ask a bounded row or PM-style aggregate question against staging
+-> Protect This Query into a disabled named capability
+-> activate that exact digest and remove broad Explore
+-> serve only the named protected capability in production
 ```
 
 It does not print your database URL, put the URL in MCP client config, expose
 `execute_sql`, expose approval/commit tools, or give the model write
-credentials.
+credentials. Before boundary activation it does not read source rows.
 
 `start --from-env` is the shortest public command for first-run onboarding.
-`onboard db --from-env DATABASE_URL` is the same explicit path if you prefer the
-older command name in scripts.
-
-Interactive `start` opens the focused local workbench after config validation
-and an MCP boundary handshake. Use `--no-open` for CI or scripts. That handshake
-proves the reviewed tool surface; the workbench's **Test** step remains pending
-until a real scoped read is recorded in the local ledger.
-
-During the wizard, provide the optional sample object id if you know one safe
-row in the selected table. Runner writes `./.synapsor/smoke-input.json` with
-that id and prints the exact `smoke call` command. If you skip it, use
-`--json '{"<lookup_arg>":"<real_id>"}'` when you are ready to test one real
-row.
-
-The rest of this page shows the same flow step by step using the public
-`synapsor-runner ...` CLI. From a source checkout, use `./bin/synapsor-runner ...` if the
-global binary is not linked yet.
+Read [Auto Boundary, Scoped Explore, And
+Protect](auto-boundary-and-scoped-explore.md) for the complete command and
+security reference.
+
+Established routes remain unchanged. `--table`, `--answers`, `onboard db`,
+explicit `init` flags, existing configs, headless startup, JSON output, and CI
+do not enter Auto Boundary, prompt unexpectedly, open a browser, rescan an
+existing project, or require a generation lock. For example:
+
+```bash
+synapsor-runner start --from-env DATABASE_URL --table invoices --no-open
+synapsor-runner onboard db --from-env DATABASE_URL --answers ./answers.json
+```
+
+The rest of this page documents those established one-object/manual routes.
+They remain supported for existing projects and automation. From a source
+checkout, use `./bin/synapsor-runner ...` if the global binary is not linked.
 
 From a source checkout, `./scripts/use-your-db.sh` runs the same kind of
 guided flow plus local repository checks.

package/docs/limitations.md

@@ -1,9 +1,9 @@
 # Limitations
 
-Synapsor Runner is intentionally narrow. Version 1.4 adds opt-in reviewed
-compensation on top of guarded bounded-set writeback, single-row CRUD, and
-explicit receipt authority; it does not claim Synapsor Cloud scale or an
-enterprise SLA.
+Synapsor Runner is intentionally narrow. Version 1.6 adds deterministic
+whole-application boundary drafting and a local authoring-only Explore ->
+Protect path on top of guarded writes. It does not turn Runner into a generic
+database query tool, claim Synapsor Cloud scale, or claim an enterprise SLA.
 
 ## Supported
 
@@ -49,6 +49,19 @@ enterprise SLA.
 - Capability recipes that generate reviewed starter configs.
 - Shadow-mode proposal-vs-human-action comparison.
 - Static MCP database risk review.
+- Deterministic whole-schema Auto Boundary drafting from database metadata,
+  statically parsed Prisma/Drizzle schema artifacts, OpenAPI documents, and
+  existing Synapsor definitions. Generated authority starts disabled.
+- Local development/staging Scoped Explore through exactly
+  `app.describe_data` and `app.explore_data`, with no SQL-string argument.
+- Reviewed PM-style aggregate Explore with `count`, `count_distinct`, `sum`,
+  `avg`, categorical dimensions, fixed time buckets, typed filters, bounded
+  top-N, optional one-hop proven many-to-one relationships, cohort suppression,
+  and durable extraction/differencing budgets.
+- Protect This Query to public DSL, canonical JSON, tests, and a disabled named
+  capability that survives Explore shutdown after exact-digest activation.
+- Generation-lock drift detection for generated authority. Manually authored
+  projects without a lock retain their previous behavior.
 - Local indexed search for proposals, evidence bundles, query audit, writeback
   receipts, and proposal replay.
 - DSL enum arguments and fixed, tenant-scoped aggregate count/sum/avg tools
@@ -89,8 +102,12 @@ truth for the model-facing tools.
 - Prompt-injection prevention.
 - Unbounded/high-throughput or multi-region ledger scale.
 - Managed fleet, SLA, compliance certification, or production support guarantee.
-- Arbitrary aggregate expressions, joins, grouping, dynamic columns,
-  model-controlled aggregate predicates, or a statistical privacy guarantee.
+- Production, shared HTTP, remote, or non-loopback Scoped Explore.
+- Arbitrary aggregate expressions, dynamic identifiers, unrestricted joins,
+  many-to-many joins, formulas, window functions, subqueries, `HAVING`,
+  user-defined functions, or a statistical privacy guarantee. Version 1.6
+  supports only the explicitly reviewed authoring cube described above and
+  fixed protected named capabilities produced from it.
 - Automatic policy widening or activation from graduated-trust metrics.
 - Immutable/WORM compliance storage from the local report exporter.
 
@@ -120,7 +137,7 @@ not a hosted central evidence service, organization RBAC/SSO, compliance
 retention system, or unbounded search engine. Each bridge operation serializes
 through an advisory lock and fails above configured `max_entries`.
 
-Only homogeneous 1.4 fleet operation is claimed for protocol-v4 compensation
+Only homogeneous 1.x fleet operation is claimed for protocol-v4 compensation
 jobs. Mixed-minor v3/v4 rolling compensation is not claimed.
 See [Running A Small Runner
 Fleet](running-a-runner-fleet.md).

package/docs/release-notes.md

@@ -10,7 +10,40 @@ npx -y -p @synapsor/runner synapsor-runner demo --quick
 The OSS runner command is `synapsor-runner`. The `synapsor` command is reserved
 for the Synapsor Cloud CLI.
 
-## 1.5.4 (prepared, not published)
+## 1.6.0 (prepared, not published)
+
+### Connect, Explore, Protect
+
+- A fresh interactive `start --from-env DATABASE_URL` can inspect the whole
+  staging schema and structured Prisma/Drizzle/OpenAPI/Synapsor artifacts,
+  then emit a disabled candidate boundary without executing adopter code,
+  reading source rows, or using an LLM.
+- The local Workbench requires explicit review of scope, fields, aggregate
+  measures/dimensions/time buckets, one-hop relationships, privacy budgets,
+  role/grant/RLS posture, profile, generation lock, and exact digest.
+- The temporary Cursor authoring entry exposes only `app.describe_data` and
+  `app.explore_data`. Typed row and PM-style aggregate plans are bounded by the
+  activated authority, run read-only, and cannot introduce SQL, identifiers,
+  tenant/principal identity, or wider limits.
+- Aggregate Explore supports reviewed count/distinct/sum/avg, categorical and
+  time grouping, bounded comparisons/top-N, cohort suppression, and durable
+  anti-differencing/extraction/rate limits. It is descriptive analysis, not a
+  causation claim.
+- Protect This Query writes public DSL, canonical JSON, tests, and a disabled
+  named capability. Exact-digest activation disables broad Explore; production
+  serves only the named protected tool.
+- Scoped Explore is absent from production, unknown-profile, shared HTTP,
+  remote, and non-loopback `tools/list`. Write-capable, owner, superuser,
+  `BYPASSRLS`, or unverifiable credentials cannot enable source-row Explore.
+- Existing 1.x projects do not need Workbench, generation locks, rescans, or
+  new fields. Published legacy contracts preserve exact normalization/digests,
+  and established CLI/headless/CI routes keep their behavior.
+
+Prepared package versions: `@synapsor/runner@1.6.0`,
+`@synapsor/dsl@1.5.0`, and `@synapsor/spec@1.5.0`. Nothing has been published
+by this repository change.
+
+## 1.5.4 (published 2026-07-22)
 
 ### Networked MCP authentication hardening
 
@@ -47,9 +80,9 @@ for the Synapsor Cloud CLI.
   environment variable. Explicit ENVIRONMENT, verified HTTP_CLAIM, verified
   CLOUD_SESSION, and STATIC_DEV behavior remains distinct.
 
-Prepared package versions: `@synapsor/runner@1.5.4` and
-`@synapsor/dsl@1.4.4`. `@synapsor/spec@1.4.2` and the Cloud CLI are
-unchanged. Nothing has been published by this repository change.
+Published package versions: `@synapsor/runner@1.5.4` and
+`@synapsor/dsl@1.4.4`. `@synapsor/spec@1.4.2` and the Cloud CLI were
+unchanged.
 
 ## 1.5.3 (published 2026-07-21)
 

package/docs/schema-api-candidates.md

@@ -1,5 +1,26 @@
 # Reviewed Candidates From Prisma, Drizzle, And OpenAPI
 
+Runner 1.6.0 uses these same bounded static parsers as evidence in the
+whole-application [Auto Boundary](auto-boundary-and-scoped-explore.md) flow.
+The database catalog remains authoritative for database structure; Prisma,
+Drizzle, OpenAPI, and existing Synapsor definitions contribute deterministic
+names, relationships, and structured review evidence. None of them
+independently grant authority.
+
+For a fresh interactive staging project, prefer:
+
+```bash
+synapsor-runner start --from-env DATABASE_URL
+```
+
+That combines all detected structured sources into one disabled candidate
+graph, generation lock, and Workbench review. It never executes adopter code,
+samples source rows before activation, uses an LLM, or overwrites an active
+contract.
+
+The individual commands below remain useful for CI, focused review, and
+backward-compatible workflows.
+
 Use these generators after schema or API inspection when you want a review
 starting point without granting authority:
 
@@ -42,11 +63,17 @@ They do not decide which tenant or principal is authoritative, which fields are
 safe to expose, which writes are valid, business bounds, approval policy, or
 auto-approval. A field-name heuristic is not data classification.
 
-Review `generation-review.json` and `REVIEW.md`, replace every
+In the individual-generator path, review `generation-review.json` and
+`REVIEW.md`, replace every
 `review_required_*` placeholder, run the generated tests and a
 [Shadow study](shadow-studies.md), then deliberately copy reviewed definitions
 into an active contract through code review.
 
+In Auto Boundary, Workbench presents the unresolved scope, field, aggregate,
+relationship, privacy, and role-posture decisions together. Exact-digest
+activation enables only the reviewed local authoring boundary. Generated named
+capabilities still begin disabled and require their own activation.
+
 ## Input Safety
 
 Input is bounded to 2 MiB, 50 objects, 128 fields per object, and 200 generated

package/docs/troubleshooting-first-run.md

@@ -12,6 +12,104 @@ Use JSON for automation:
 npx -y -p @synapsor/runner synapsor-runner doctor --first-run --json
 ```
 
+## Fresh Start Did Not Enter Auto Boundary
+
+Auto Boundary is the default only for a fresh interactive `start --from-env`
+with no existing config, selector, answers file, machine-output flag, or other
+automation input. This preserves every established 1.x route.
+
+Check the generated state:
+
+```bash
+synapsor-runner boundary status --json
+```
+
+To draft explicitly without prompts or a browser:
+
+```bash
+synapsor-runner boundary draft \
+  --from-env DATABASE_URL \
+  --schema public \
+  --project-root . \
+  --json
+```
+
+## Scoped Explore Is Not Advertised
+
+This is correct unless all authoring prerequisites pass. Explore is disabled by
+default and never appears in production, unknown-profile, shared HTTP, remote,
+or non-loopback `tools/list`.
+
+Check:
+
+```bash
+synapsor-runner boundary status --json
+synapsor-runner boundary diff --json
+synapsor-runner mcp status cursor --project
+```
+
+The exact boundary digest must be active, the profile must explicitly be
+`development` or `staging`, the generation lock and compiler/Spec versions
+must be current, and the inspected database role must still be SELECT-only,
+non-owner, non-superuser, and not `BYPASSRLS`. Runner also enforces a read-only
+transaction for every Explore call.
+
+A write-capable, owner, superuser, `BYPASSRLS`, or unverifiable credential may
+still inspect metadata with a warning. It cannot enable source-row Explore.
+Use a dedicated staging reader instead of weakening this check.
+
+## Cursor Has Production Tools Instead Of Authoring Tools
+
+Install the managed local authoring entry only after boundary activation:
+
+```bash
+synapsor-runner mcp install cursor \
+  --project \
+  --authoring \
+  --project-root . \
+  --yes
+```
+
+Authoring status reports exactly `app.describe_data` and `app.explore_data`.
+After Protect and exact-digest activation, replace that entry with the
+production config. The protected named capability remains available while
+Explore disappears:
+
+```bash
+synapsor-runner mcp install cursor \
+  --project \
+  --config ./synapsor.runner.json \
+  --store ./.synapsor/local.db \
+  --yes
+```
+
+## Boundary Became Stale After A Schema Or Grant Change
+
+Generated authority is bound to the schema, role, grants, ownership, RLS
+posture, compiler, and canonical Spec fingerprint:
+
+```bash
+synapsor-runner boundary diff --json
+```
+
+Additive fields receive no implicit authority. Breaking or posture drift fails
+closed only for lock-bound generated authority. Regenerate, review the semantic
+diff, and activate the new exact digest. Existing manually authored projects
+without a generation lock retain their previous behavior.
+
+## Aggregate Explore Suppressed Or Refused A Result
+
+Suppression and budget failures are security behavior, not query failures.
+Workbench shows the reviewed minimum cohort, maximum groups, response limits,
+and durable extraction/differencing budgets. You cannot widen them in a model
+argument.
+
+Use a larger legitimate cohort or protect a narrower reviewed question. Do not
+work around suppression with repeated slightly different filters: Runner
+records normalized redacted plan metadata and exhausts the differencing budget.
+Returned rows/groups, trusted tenant/principal values, credentials, and raw
+sensitive literals are not stored in the query audit.
+
 ## Safe Action Draft Does Not Appear As A Tool
 
 This is expected before activation. `start --action`, agent edits, `action

package/examples/auto-boundary-churn/README.md

@@ -0,0 +1,23 @@
+# Auto Boundary Churn Fixture
+
+This synthetic staging fixture is the measured Runner 1.6.0 golden path:
+PostgreSQL, Next.js, Prisma, Cursor-compatible local MCP, and the local
+Workbench.
+
+The database role is SELECT-only, non-owner, non-superuser, and subject to
+forced tenant/principal RLS. The data includes reviewed churn cohorts, a
+cross-tenant denial case, kept-out fields, and cohorts below the privacy
+threshold.
+
+Run the automated acceptance path from the repository root:
+
+```bash
+corepack pnpm test:auto-boundary-explore
+corepack pnpm test:auto-boundary-explore:packed
+```
+
+The packed gate uses only packed public artifacts for the complete journey:
+disabled whole-schema draft, digest activation, two Cursor authoring tools,
+privacy-suppressed weekly churn analysis, denial and differencing tests,
+Protect This Query, production Explore removal, and the surviving named
+capability. No source row is mutated.

package/examples/auto-boundary-churn/app/page.tsx

@@ -0,0 +1,8 @@
+export default function ChurnOverview() {
+  return (
+    <main>
+      <h1>Subscription churn review</h1>
+      <p>This synthetic staging application is used by the Synapsor Auto Boundary acceptance test.</p>
+    </main>
+  );
+}

package/examples/auto-boundary-churn/docker-compose.yml

@@ -0,0 +1,16 @@
+services:
+  postgres:
+    image: postgres:16
+    environment:
+      POSTGRES_DB: synapsor_auto_boundary
+      POSTGRES_USER: synapsor_admin
+      POSTGRES_PASSWORD: synapsor_admin_password
+    ports:
+      - "127.0.0.1:55460:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "test \"$(psql -U synapsor_admin -d synapsor_auto_boundary -tAc \"SELECT pg_postmaster_start_time() > initialized_at FROM public.synapsor_fixture_ready LIMIT 1\" 2>/dev/null | xargs)\" = t"]
+      interval: 1s
+      timeout: 3s
+      retries: 40
+    volumes:
+      - ./seed/postgres.sql:/docker-entrypoint-initdb.d/001-schema.sql:ro

package/examples/auto-boundary-churn/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "synapsor-auto-boundary-churn",
+  "version": "0.0.0",
+  "private": true,
+  "scripts": {
+    "dev": "next dev"
+  },
+  "dependencies": {
+    "@prisma/client": "^6.0.0",
+    "next": "^15.0.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "devDependencies": {
+    "prisma": "^6.0.0",
+    "typescript": "^5.8.0"
+  }
+}

package/examples/auto-boundary-churn/prisma/schema.prisma

@@ -0,0 +1,36 @@
+generator client {
+  provider = "prisma-client-js"
+}
+
+datasource db {
+  provider = "postgresql"
+  url      = env("DATABASE_URL")
+}
+
+model Account {
+  id                String       @id
+  tenantId          String       @map("tenant_id")
+  ownerId           String       @map("owner_id")
+  region            String
+  segment           String
+  customerEmail     String       @map("customer_email")
+  internalRiskScore Int          @map("internal_risk_score")
+  churnEvents       ChurnEvent[]
+
+  @@map("accounts")
+}
+
+model ChurnEvent {
+  id                  String   @id
+  tenantId            String   @map("tenant_id")
+  ownerId             String   @map("owner_id")
+  accountId           String   @map("account_id")
+  reasonCategory      String   @map("reason_category")
+  monthlyRevenueCents Int      @map("monthly_revenue_cents")
+  churnedAt           DateTime @map("churned_at") @db.Timestamptz(6)
+  privateNote         String   @map("private_note")
+  account             Account  @relation(fields: [accountId], references: [id])
+
+  @@index([tenantId, churnedAt])
+  @@map("churn_events")
+}