@synapsor/runner 1.5.4 → 1.6.0

package/examples/auto-boundary-churn/seed/postgres.sql

@@ -0,0 +1,126 @@
+CREATE TABLE public.accounts (
+  id text PRIMARY KEY,
+  tenant_id text NOT NULL,
+  owner_id text NOT NULL,
+  region text NOT NULL CHECK (region IN ('east', 'north', 'south', 'west')),
+  segment text NOT NULL CHECK (segment IN ('enterprise', 'growth', 'startup')),
+  customer_email text NOT NULL,
+  internal_risk_score integer NOT NULL
+);
+
+CREATE TABLE public.churn_events (
+  id text PRIMARY KEY,
+  tenant_id text NOT NULL,
+  owner_id text NOT NULL,
+  account_id text NOT NULL REFERENCES public.accounts(id) ON DELETE RESTRICT,
+  reason_category text NOT NULL CHECK (reason_category IN ('onboarding', 'price', 'product', 'service')),
+  monthly_revenue_cents integer NOT NULL CHECK (monthly_revenue_cents >= 0),
+  churned_at timestamptz NOT NULL,
+  private_note text NOT NULL
+);
+
+CREATE INDEX churn_events_tenant_time_idx
+  ON public.churn_events(tenant_id, churned_at);
+
+WITH groups(prefix, tenant_id, owner_id, region, segment, reason_category, churned_at, group_size, revenue) AS (
+  VALUES
+    ('p1-west-price', 'acme', 'pm-1', 'west', 'growth', 'price', '2026-06-03T12:00:00Z'::timestamptz, 5, 12000),
+    ('p1-east-service', 'acme', 'pm-1', 'east', 'enterprise', 'service', '2026-06-10T12:00:00Z'::timestamptz, 5, 22000),
+    ('p1-north-product', 'acme', 'pm-1', 'north', 'startup', 'product', '2026-06-17T12:00:00Z'::timestamptz, 2, 5000),
+    ('p2-west-price', 'acme', 'pm-1', 'west', 'growth', 'price', '2026-07-08T12:00:00Z'::timestamptz, 10, 13000),
+    ('p2-east-service', 'acme', 'pm-1', 'east', 'enterprise', 'service', '2026-07-15T12:00:00Z'::timestamptz, 7, 23000),
+    ('p2-south-onboarding', 'acme', 'pm-1', 'south', 'startup', 'onboarding', '2026-07-22T12:00:00Z'::timestamptz, 5, 7000),
+    ('p2-north-product', 'acme', 'pm-1', 'north', 'startup', 'product', '2026-07-22T12:00:00Z'::timestamptz, 1, 6000),
+    ('other-west-price', 'globex', 'pm-2', 'west', 'enterprise', 'price', '2026-07-08T12:00:00Z'::timestamptz, 8, 99000)
+)
+INSERT INTO public.accounts (
+  id,
+  tenant_id,
+  owner_id,
+  region,
+  segment,
+  customer_email,
+  internal_risk_score
+)
+SELECT
+  prefix || '-' || item,
+  tenant_id,
+  owner_id,
+  region,
+  segment,
+  prefix || '-' || item || '@example.invalid',
+  900 + item
+FROM groups
+CROSS JOIN LATERAL generate_series(1, group_size) AS item;
+
+WITH groups(prefix, tenant_id, owner_id, reason_category, churned_at, group_size, revenue) AS (
+  VALUES
+    ('p1-west-price', 'acme', 'pm-1', 'price', '2026-06-03T12:00:00Z'::timestamptz, 5, 12000),
+    ('p1-east-service', 'acme', 'pm-1', 'service', '2026-06-10T12:00:00Z'::timestamptz, 5, 22000),
+    ('p1-north-product', 'acme', 'pm-1', 'product', '2026-06-17T12:00:00Z'::timestamptz, 2, 5000),
+    ('p2-west-price', 'acme', 'pm-1', 'price', '2026-07-08T12:00:00Z'::timestamptz, 10, 13000),
+    ('p2-east-service', 'acme', 'pm-1', 'service', '2026-07-15T12:00:00Z'::timestamptz, 7, 23000),
+    ('p2-south-onboarding', 'acme', 'pm-1', 'onboarding', '2026-07-22T12:00:00Z'::timestamptz, 5, 7000),
+    ('p2-north-product', 'acme', 'pm-1', 'product', '2026-07-22T12:00:00Z'::timestamptz, 1, 6000),
+    ('other-west-price', 'globex', 'pm-2', 'price', '2026-07-08T12:00:00Z'::timestamptz, 8, 99000)
+)
+INSERT INTO public.churn_events (
+  id,
+  tenant_id,
+  owner_id,
+  account_id,
+  reason_category,
+  monthly_revenue_cents,
+  churned_at,
+  private_note
+)
+SELECT
+  'event-' || prefix || '-' || item,
+  tenant_id,
+  owner_id,
+  prefix || '-' || item,
+  reason_category,
+  revenue,
+  churned_at,
+  'synthetic kept-out note ' || prefix || '-' || item
+FROM groups
+CROSS JOIN LATERAL generate_series(1, group_size) AS item;
+
+ALTER TABLE public.accounts ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.accounts FORCE ROW LEVEL SECURITY;
+ALTER TABLE public.churn_events ENABLE ROW LEVEL SECURITY;
+ALTER TABLE public.churn_events FORCE ROW LEVEL SECURITY;
+
+CREATE POLICY accounts_trusted_scope ON public.accounts
+  FOR SELECT
+  USING (
+    tenant_id = current_setting('app.tenant_id', true)
+    AND owner_id = current_setting('app.principal', true)
+  );
+
+CREATE POLICY churn_events_trusted_scope ON public.churn_events
+  FOR SELECT
+  USING (
+    tenant_id = current_setting('app.tenant_id', true)
+    AND owner_id = current_setting('app.principal', true)
+  );
+
+DO $$
+BEGIN
+  CREATE ROLE synapsor_churn_reader LOGIN PASSWORD 'synapsor_churn_reader_password';
+EXCEPTION WHEN duplicate_object THEN NULL;
+END
+$$;
+
+ALTER ROLE synapsor_churn_reader SET default_transaction_read_only = on;
+GRANT CONNECT ON DATABASE synapsor_auto_boundary TO synapsor_churn_reader;
+GRANT USAGE ON SCHEMA public TO synapsor_churn_reader;
+GRANT SELECT ON public.accounts, public.churn_events TO synapsor_churn_reader;
+
+-- The image entrypoint runs these statements under a temporary postmaster and
+-- then restarts PostgreSQL. Compose reports healthy only after that final
+-- postmaster starts, preventing first-client disconnects in CI.
+CREATE TABLE public.synapsor_fixture_ready (
+  initialized_at timestamptz NOT NULL
+);
+INSERT INTO public.synapsor_fixture_ready (initialized_at) VALUES (clock_timestamp());

package/fixtures/compatibility/published-1.5.4/manifest.json

@@ -0,0 +1,76 @@
+{
+  "schema_version": "synapsor.published-compatibility.v1",
+  "published_packages": {
+    "@synapsor/runner": {
+      "version": "1.5.4",
+      "npm_shasum": "63ef030b0360118082bc670239ad4927673b6bc7"
+    },
+    "@synapsor/dsl": {
+      "version": "1.4.4",
+      "npm_shasum": "dee671d3c3d25f5434b488f80b3041d0c5606c2f"
+    },
+    "@synapsor/spec": {
+      "version": "1.4.2",
+      "npm_shasum": "cb9aa813f481ef14d542a1896c228159aab86353"
+    }
+  },
+  "contracts": [
+    {
+      "path": "packages/spec/fixtures/valid/basic-read.contract.json",
+      "source_sha256": "5ec499965f639d784603b7942390d18a3e742d79e4d510dbea470e166a743972",
+      "canonical_sha256": "9d3addfde77eb6528aae7b9e81ae0f582b5c002aa77ebb2d7381fe663f5f5b1e"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/aggregate-read/contract.json",
+      "source_sha256": "830bc208b749bb9ed6a4b4468571d58d68bc8a2b6e1072fc45fb87d1c68697e7",
+      "canonical_sha256": "ccc6ea17f449bfc207d1cea70ef3320d575c450a3904c850dcb631132c6e5602"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/proposal-capability/contract.json",
+      "source_sha256": "d4c25fb8f79f04c13bdb3daf8c18a44d4f1c61596660a67bf35d46d0f94f4100",
+      "canonical_sha256": "d895081246d41a072892b5dde6929099302492a77a229033fbfa5052cce34b18"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/bounded-set-threats/contract.json",
+      "source_sha256": "c902d45457789a6d87504ca434c8b299f3e09be779f3bfdf7bbd8684d575a10e",
+      "canonical_sha256": "64c7078ff1687762d95c17873238759b3572dce499f903a8d6f1aaa8faae5f24"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/reversible-change-sets/contract.json",
+      "source_sha256": "7e4f8da90a4b235097f76e70a7f550153bbf62d219e7ef6f4f2194f6c36fa205",
+      "canonical_sha256": "181f2e93ad3c53b9a1345a4ed6c8b5e24ab0201c00159f38659f0c2a00c037de"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/principal-row-scope/contract.json",
+      "source_sha256": "00a05c1f4e82cc9c4e5d2d68c9c9201cd9512ac42d63292314bb7b4845026996",
+      "canonical_sha256": "fc96a5327ab0f4b311c90da9b5585348e81349ed66bd3a22e41e5f29804c32a8"
+    },
+    {
+      "path": "packages/spec/fixtures/conformance/approval-quorum/contract.json",
+      "source_sha256": "dde6b328f648ba60d837fa363494d764d7eb0d2d9a8a81ff70a9c077edde410c",
+      "canonical_sha256": "9407a7d0cc4439c773c3caf721aaed6c6e163c403fa67518632829d8c5de33e7"
+    }
+  ],
+  "dsl_sources": [
+    {
+      "path": "packages/dsl/examples/aggregate-read.synapsor.sql",
+      "source_sha256": "bccac4c2eb0ab7b2fc099c7fb3f6fdc25ee2e6e534282aa19b46f0aec8191b8d",
+      "canonical_sha256": "0cc2d892f00a31a3582d773812a26c6c45c0ce343e1d8d09da226a5bbb7c93eb"
+    },
+    {
+      "path": "packages/dsl/examples/billing-late-fee.synapsor.sql",
+      "source_sha256": "f5c462cff7aa0cd01a08543c6096ee1d225ebba449d65b7470815b1aa7ec42cd",
+      "canonical_sha256": "d495df575d64e798a730dad385e097dfc2c2f371a1505865bc45179ad3c479f2"
+    },
+    {
+      "path": "packages/dsl/examples/bounded-set-multi-term.synapsor.sql",
+      "source_sha256": "0ae199034ebba8b25146435c911576118f948b55b54636a5e68f46002cd1c6dd",
+      "canonical_sha256": "5b3e84cf8f5062a8afcd50763bde907e6a141977456e74a81d01f8b3a484e422"
+    },
+    {
+      "path": "packages/dsl/examples/principal-row-scope.synapsor.sql",
+      "source_sha256": "08ccd769d633417ea45d478383d9628991f43262223f12c78bbd776202b10253",
+      "canonical_sha256": "e29f2819c267210e54f783c40d0f550d11d0d1de844dbe1590ed8c3405af3cf7"
+    }
+  ]
+}

package/fixtures/compatibility/published-1.5.4/sources/packages/dsl/examples/aggregate-read.synapsor.sql

@@ -0,0 +1,21 @@
+CREATE AGENT CONTEXT finance_operator
+  BIND tenant_id FROM ENVIRONMENT SYNAPSOR_TENANT_ID REQUIRED
+  BIND principal FROM ENVIRONMENT SYNAPSOR_PRINCIPAL REQUIRED
+  TENANT BINDING tenant_id
+  PRINCIPAL BINDING principal
+END
+
+CREATE CAPABILITY billing.overdue_balance_total
+  DESCRIPTION 'Return one suppressed overdue-balance aggregate for the trusted tenant.'
+  RETURNS HINT 'Returns one scalar or a suppression result; never member rows.'
+  USING CONTEXT finance_operator
+  SOURCE local_postgres
+  ON public.invoices
+  PRIMARY KEY id
+  TENANT KEY tenant_id
+  AGGREGATE READ SUM balance_cents
+  SELECT WHERE status = 'overdue'
+  MIN GROUP SIZE 5
+  KEEP OUT customer_email, private_notes
+  REQUIRE EVIDENCE
+END

package/fixtures/compatibility/published-1.5.4/sources/packages/dsl/examples/billing-late-fee.synapsor.sql

@@ -0,0 +1,56 @@
+CREATE AGENT CONTEXT local_operator
+  BIND tenant_id FROM ENVIRONMENT SYNAPSOR_TENANT_ID REQUIRED
+  BIND principal FROM ENVIRONMENT SYNAPSOR_PRINCIPAL REQUIRED
+  TENANT BINDING tenant_id
+  PRINCIPAL BINDING principal
+END
+
+CREATE CAPABILITY billing.inspect_invoice
+  DESCRIPTION 'Inspect one invoice in the trusted tenant before proposing a waiver.'
+  RETURNS HINT 'Returns reviewed invoice fields plus evidence/query-audit handles.'
+  USING CONTEXT local_operator
+  SOURCE local_postgres
+  ON public.invoices
+  PRIMARY KEY id
+  TENANT KEY tenant_id
+  CONFLICT GUARD updated_at
+  LOOKUP invoice_id BY id
+  ARG invoice_id STRING REQUIRED MAX LENGTH 128 DESCRIPTION 'Invoice id such as INV-3001.'
+  ALLOW READ id, tenant_id, customer_id, status, late_fee_cents, waiver_reason, updated_at
+  KEEP OUT card_token, internal_risk_score
+  REQUIRE EVIDENCE
+  MAX ROWS 1
+END
+
+CREATE CAPABILITY billing.propose_late_fee_waiver
+  DESCRIPTION 'Propose waiving one invoice late fee after inspecting invoice and policy evidence.'
+  RETURNS HINT 'Returns a review-required proposal id, exact diff, evidence handle, and source_database_changed:false.'
+  USING CONTEXT local_operator
+  SOURCE local_postgres
+  ON public.invoices
+  PRIMARY KEY id
+  TENANT KEY tenant_id
+  CONFLICT GUARD updated_at
+  LOOKUP invoice_id BY id
+  ARG invoice_id STRING REQUIRED MAX LENGTH 128 DESCRIPTION 'Invoice id such as INV-3001.'
+  ARG waiver_reason TEXT REQUIRED MAX LENGTH 500 DESCRIPTION 'Business reason for the proposed waiver.'
+  ALLOW READ id, tenant_id, customer_id, status, late_fee_cents, waiver_reason, updated_at
+  KEEP OUT card_token, internal_risk_score
+  REQUIRE EVIDENCE
+  MAX ROWS 1
+  PROPOSE ACTION billing.waive_late_fee
+  ALLOW WRITE late_fee_cents, waiver_reason
+  PATCH late_fee_cents = 0
+  PATCH waiver_reason = ARG waiver_reason
+  APPROVAL ROLE billing_lead
+  WRITEBACK DIRECT SQL
+END
+
+CREATE AGENT WORKFLOW billing.late_fee_review
+  USING CONTEXT local_operator
+  ALLOW CAPABILITY billing.inspect_invoice
+  ALLOW CAPABILITY billing.propose_late_fee_waiver
+  REQUIRE EVIDENCE
+  APPROVAL REQUIRED ROLE billing_lead
+  CHECKPOINT PROPOSAL ONLY
+END

package/fixtures/compatibility/published-1.5.4/sources/packages/dsl/examples/bounded-set-multi-term.synapsor.sql

@@ -0,0 +1,30 @@
+CREATE AGENT CONTEXT local_operator
+  BIND tenant_id FROM ENVIRONMENT SYNAPSOR_TENANT_ID REQUIRED
+  BIND principal FROM ENVIRONMENT SYNAPSOR_PRINCIPAL REQUIRED
+  TENANT BINDING tenant_id
+  PRINCIPAL BINDING principal
+END
+
+CREATE CAPABILITY cases.close_high_risk
+  DESCRIPTION 'Close active high-risk support cases within reviewed row and value caps.'
+  RETURNS HINT 'Returns a proposal for the exact reviewed set; source rows remain unchanged.'
+  USING CONTEXT local_operator
+  SOURCE support_db
+  ON public.support_cases
+  PRIMARY KEY id
+  TENANT KEY tenant_id
+  CONFLICT GUARD version
+  LOOKUP reason BY id
+  ARG reason STRING REQUIRED MAX LENGTH 100
+  ALLOW READ id, tenant_id, risk_level, case_status, exposure_cents, version
+  REQUIRE EVIDENCE
+  PROPOSE ACTION close_high_risk UPDATE SET
+  SELECT WHERE risk_level = 'high' AND case_status = 'active'
+  MAX ROWS 10
+  MAX TOTAL exposure_cents BEFORE 50000
+  ALLOW WRITE case_status
+  PATCH case_status = 'closed'
+  ADVANCE VERSION version USING INTEGER INCREMENT
+  APPROVAL ROLE support_manager
+  WRITEBACK DIRECT SQL
+END

package/fixtures/compatibility/published-1.5.4/sources/packages/dsl/examples/principal-row-scope.synapsor.sql

@@ -0,0 +1,23 @@
+CREATE AGENT CONTEXT care_session
+  BIND hospital_id FROM HTTP_CLAIM hospital_id REQUIRED
+  BIND principal FROM HTTP_CLAIM sub REQUIRED
+  TENANT BINDING hospital_id
+  PRINCIPAL BINDING principal
+END
+
+CREATE CAPABILITY care.inspect_assigned_patient
+  DESCRIPTION 'Inspect one patient assigned to the authenticated case manager within the trusted hospital.'
+  RETURNS HINT 'Returns reviewed patient fields and evidence only when both tenant and assignee locks match.'
+  USING CONTEXT care_session
+  SOURCE local_postgres
+  ON public.patients
+  PRIMARY KEY id
+  TENANT KEY hospital_id
+  PRINCIPAL SCOPE KEY assigned_to
+  LOOKUP patient_id BY id
+  ARG patient_id STRING REQUIRED MAX LENGTH 128 DESCRIPTION 'Reviewed patient identifier.'
+  ALLOW READ id, hospital_id, display_name, care_status, updated_at
+  KEEP OUT assigned_to, diagnosis_notes, insurance_member_id
+  REQUIRE EVIDENCE
+  MAX ROWS 1
+END

package/fixtures/compatibility/published-1.5.4/sources/packages/spec/fixtures/conformance/aggregate-read/contract.json

@@ -0,0 +1,119 @@
+{
+  "spec_version": "0.1",
+  "kind": "SynapsorContract",
+  "metadata": {
+    "name": "aggregate read and enum conformance",
+    "version": "1.0.0"
+  },
+  "resources": [
+    {
+      "name": "billing_invoices",
+      "engine": "postgres",
+      "schema": "public",
+      "table": "invoices",
+      "primary_key": "id",
+      "tenant_key": "tenant_id"
+    }
+  ],
+  "contexts": [
+    {
+      "name": "billing_context",
+      "bindings": [
+        {
+          "name": "tenant_id",
+          "source": "environment",
+          "key": "SYNAPSOR_TENANT_ID"
+        },
+        {
+          "name": "principal",
+          "source": "environment",
+          "key": "SYNAPSOR_PRINCIPAL"
+        }
+      ],
+      "tenant_binding": "tenant_id",
+      "principal_binding": "principal"
+    }
+  ],
+  "capabilities": [
+    {
+      "name": "billing.sum_overdue_balance",
+      "description": "Return one privacy-suppressed aggregate for the trusted tenant.",
+      "returns_hint": "Returns one scalar or a suppression result; never member rows.",
+      "kind": "aggregate_read",
+      "context": "billing_context",
+      "source": "local_postgres",
+      "subject": {
+        "resource": "billing_invoices"
+      },
+      "args": {},
+      "visible_fields": [],
+      "kept_out_fields": [
+        "customer_email",
+        "private_notes"
+      ],
+      "evidence": {
+        "required": true,
+        "query_audit": true
+      },
+      "aggregate": {
+        "function": "sum",
+        "column": "balance_cents",
+        "selection": {
+          "all": [
+            {
+              "column": "status",
+              "operator": "eq",
+              "value": "overdue"
+            }
+          ]
+        },
+        "minimum_group_size": 5
+      }
+    },
+    {
+      "name": "billing.inspect_invoice",
+      "description": "Inspect one tenant-scoped invoice using a reviewed risk enum.",
+      "kind": "read",
+      "context": "billing_context",
+      "source": "local_postgres",
+      "subject": {
+        "resource": "billing_invoices"
+      },
+      "args": {
+        "invoice_id": {
+          "type": "string",
+          "required": true,
+          "max_length": 128
+        },
+        "risk_level": {
+          "type": "string",
+          "required": true,
+          "enum": [
+            "low",
+            "medium",
+            "high"
+          ]
+        }
+      },
+      "lookup": {
+        "id_from_arg": "invoice_id"
+      },
+      "visible_fields": [
+        "id",
+        "tenant_id",
+        "status",
+        "balance_cents"
+      ],
+      "kept_out_fields": [
+        "customer_email",
+        "private_notes"
+      ],
+      "evidence": {
+        "required": true,
+        "query_audit": true
+      },
+      "max_rows": 1
+    }
+  ]
+}
+

package/fixtures/compatibility/published-1.5.4/sources/packages/spec/fixtures/conformance/approval-quorum/contract.json

@@ -0,0 +1,44 @@
+{
+  "spec_version": "0.1",
+  "kind": "SynapsorContract",
+  "contexts": [
+    {
+      "name": "local_operator",
+      "bindings": [
+        { "name": "tenant_id", "source": "environment", "key": "SYNAPSOR_TENANT_ID" },
+        { "name": "principal", "source": "environment", "key": "SYNAPSOR_PRINCIPAL" }
+      ],
+      "tenant_binding": "tenant_id",
+      "principal_binding": "principal"
+    }
+  ],
+  "capabilities": [
+    {
+      "name": "billing.propose_late_fee_waiver",
+      "kind": "proposal",
+      "context": "local_operator",
+      "subject": {
+        "schema": "public",
+        "table": "invoices",
+        "primary_key": "id",
+        "tenant_key": "tenant_id",
+        "conflict_key": "updated_at"
+      },
+      "args": { "invoice_id": { "type": "string" } },
+      "lookup": { "id_from_arg": "invoice_id" },
+      "visible_fields": ["id", "tenant_id", "late_fee_cents", "updated_at"],
+      "proposal": {
+        "action": "billing.waive_late_fee",
+        "allowed_fields": ["late_fee_cents"],
+        "patch": { "late_fee_cents": { "fixed": 0 } },
+        "conflict_guard": { "column": "updated_at" },
+        "approval": {
+          "mode": "human",
+          "required_role": "billing_lead",
+          "required_approvals": 2
+        },
+        "writeback": { "mode": "direct_sql" }
+      }
+    }
+  ]
+}

package/fixtures/compatibility/published-1.5.4/sources/packages/spec/fixtures/conformance/bounded-set-threats/contract.json

@@ -0,0 +1,115 @@
+{
+  "spec_version": "0.1",
+  "kind": "SynapsorContract",
+  "metadata": { "name": "bounded-set-threats", "version": "1.0.0" },
+  "contexts": [
+    {
+      "name": "trusted_operator",
+      "bindings": [
+        { "name": "tenant_id", "source": "environment", "key": "SYNAPSOR_TENANT_ID", "required": true },
+        { "name": "principal", "source": "environment", "key": "SYNAPSOR_PRINCIPAL", "required": true }
+      ],
+      "tenant_binding": "tenant_id",
+      "principal_binding": "principal"
+    }
+  ],
+  "capabilities": [
+    {
+      "name": "billing.close_overdue_invoices",
+      "kind": "proposal",
+      "context": "trusted_operator",
+      "source": "local_postgres",
+      "subject": { "schema": "public", "table": "invoices", "primary_key": "id", "tenant_key": "tenant_id", "conflict_key": "version" },
+      "args": { "reason": { "type": "string", "required": true, "max_length": 500 } },
+      "visible_fields": ["id", "tenant_id", "status", "balance_cents", "version"],
+      "kept_out_fields": ["internal_risk_score"],
+      "evidence": { "required": true, "query_audit": true },
+      "proposal": {
+        "action": "close_overdue",
+        "operation": {
+          "kind": "update",
+          "cardinality": "set",
+          "selection": { "all": [{ "column": "status", "operator": "eq", "value": "overdue" }] },
+          "max_rows": 10,
+          "aggregate_bounds": [{ "column": "balance_cents", "measure": "before", "maximum": 50000 }],
+          "version_advance": { "column": "version", "strategy": "integer_increment" }
+        },
+        "allowed_fields": ["status", "close_reason"],
+        "patch": { "status": { "fixed": "closed" }, "close_reason": { "from_arg": "reason" } },
+        "conflict_guard": { "column": "version" },
+        "approval": { "mode": "human", "required_role": "billing_reviewer" },
+        "writeback": { "mode": "direct_sql" }
+      }
+    },
+    {
+      "name": "billing.delete_expired_drafts",
+      "kind": "proposal",
+      "context": "trusted_operator",
+      "source": "local_postgres",
+      "subject": { "schema": "public", "table": "invoice_drafts", "primary_key": "id", "tenant_key": "tenant_id", "conflict_key": "version" },
+      "args": { "reason": { "type": "string", "required": true, "max_length": 500 } },
+      "visible_fields": ["id", "tenant_id", "status", "estimated_cents", "version"],
+      "evidence": { "required": true, "query_audit": true },
+      "proposal": {
+        "action": "delete_expired_drafts",
+        "operation": {
+          "kind": "delete",
+          "cardinality": "set",
+          "selection": { "all": [{ "column": "status", "operator": "eq", "value": "expired" }] },
+          "max_rows": 5,
+          "aggregate_bounds": [{ "column": "estimated_cents", "measure": "before", "maximum": 10000 }]
+        },
+        "allowed_fields": [],
+        "patch": {},
+        "conflict_guard": { "column": "version" },
+        "approval": { "mode": "human", "required_role": "billing_reviewer", "required_approvals": 2 },
+        "writeback": { "mode": "direct_sql" }
+      }
+    },
+    {
+      "name": "billing.create_credits",
+      "kind": "proposal",
+      "context": "trusted_operator",
+      "source": "local_postgres",
+      "subject": { "schema": "public", "table": "account_credits", "primary_key": "id", "tenant_key": "tenant_id" },
+      "args": {
+        "items": {
+          "type": "object_array",
+          "required": true,
+          "max_items": 10,
+          "fields": {
+            "id": { "type": "string", "required": true, "max_length": 128 },
+            "external_id": { "type": "string", "required": true, "max_length": 128 },
+            "amount_cents": { "type": "number", "required": true, "minimum": 1, "maximum": 2500 },
+            "reason": { "type": "string", "required": true, "max_length": 500 }
+          }
+        }
+      },
+      "visible_fields": ["id", "tenant_id", "external_id", "amount_cents", "reason", "version"],
+      "kept_out_fields": ["internal_note"],
+      "evidence": { "required": true, "query_audit": true },
+      "proposal": {
+        "action": "create_credits",
+        "operation": {
+          "kind": "insert",
+          "cardinality": "set",
+          "batch": { "items_from_arg": "items" },
+          "max_rows": 10,
+          "aggregate_bounds": [{ "column": "amount_cents", "measure": "after", "maximum": 25000 }],
+          "deduplication": {
+            "components": [
+              { "column": "tenant_id", "source": "trusted_tenant" },
+              { "column": "id", "source": "item_field", "item_field": "id" },
+              { "column": "external_id", "source": "item_field", "item_field": "external_id" }
+            ]
+          }
+        },
+        "allowed_fields": ["amount_cents", "reason"],
+        "patch": { "amount_cents": { "from_item": "amount_cents" }, "reason": { "from_item": "reason" } },
+        "numeric_bounds": { "amount_cents": { "minimum": 1, "maximum": 2500 } },
+        "approval": { "mode": "human", "required_role": "billing_reviewer" },
+        "writeback": { "mode": "direct_sql" }
+      }
+    }
+  ]
+}