@derwinjs/db 0.1.0

package/LICENSE

@@ -0,0 +1,25 @@
+Derwin — Proprietary License
+
+Copyright (c) 2026 Vize LLC. All rights reserved.
+
+This software and its associated documentation files (the "Software") are
+proprietary and confidential. No part of the Software may be copied, modified,
+distributed, sublicensed, sold, or otherwise transferred to any third party
+without the prior written consent of the copyright holder.
+
+Unauthorized use, reproduction, or distribution of the Software is prohibited
+and may result in civil and criminal penalties.
+
+This license may be superseded by an alternative license (e.g., MIT or
+Apache 2.0) at a future date if a decision is made to release the Software
+as open source. Such a decision will be recorded as a superseding ADR in
+docs/adrs/ and will apply only to the version of the Software in effect at
+the time of the decision.
+
+The Software is provided "as is", without warranty of any kind, express or
+implied, including but not limited to the warranties of merchantability,
+fitness for a particular purpose, and non-infringement. In no event shall the
+authors or copyright holders be liable for any claim, damages, or other
+liability, whether in an action of contract, tort, or otherwise, arising
+from, out of, or in connection with the Software or the use or other dealings
+in the Software.

package/README.md

@@ -0,0 +1,79 @@
+# @derwinjs/db
+
+Prisma schema + migrations for Derwin's own Postgres. **14 models, project-namespaced.** Per ADR-0005.
+
+This package owns the platform's persistence layer. Consumer DBs (Lifeline's Postgres, Side Piece's Postgres) are NOT shared with this — Derwin reads from them via Ticket / Document adapters; it stores its own state here.
+
+## Quick start
+
+```bash
+# 1. Set up Postgres locally (one option: Docker)
+docker run -d --name derwin-pg \
+  -e POSTGRES_USER=derwin \
+  -e POSTGRES_PASSWORD=derwin \
+  -e POSTGRES_DB=derwin \
+  -p 5432:5432 \
+  postgres:16
+
+# 2. Configure connection
+cp packages/db/.env.example packages/db/.env
+# Edit DATABASE_URL if needed
+
+# 3. Generate Prisma client + apply migrations
+pnpm --filter @derwinjs/db prisma:generate
+pnpm --filter @derwinjs/db prisma:migrate
+
+# 4. Seed dev fixture (Lifeline project + Profile + default Policy)
+pnpm --filter @derwinjs/db db:seed
+```
+
+After seeding, you can connect with `psql` and inspect:
+
+```bash
+docker exec -it derwin-pg psql -U derwin -d derwin -c "SELECT slug, type, mode FROM projects;"
+```
+
+Expected: one row, `lifeline | ERP | AUTHOR`.
+
+## Production: Supabase
+
+Per ADR-0005, the production deployment uses Supabase (parity with Lifeline). Connection string format:
+
+```
+postgresql://postgres:[PASSWORD]@db.[PROJECT-REF].supabase.co:5432/postgres
+```
+
+The pgvector extension gets enabled in QAP-036 (Sprint 3 — DB deployment). The RAGCorpus.embedding column is `Bytes?` for v1; QAP-076 (Sprint 7) switches it to `vector(1536)` once pgvector is available.
+
+## Schema conventions
+
+- **Project-namespaced.** Every project-scoped table has a `projectId` FK to `Project`. Cross-project leakage is the leading regression risk; queries MUST filter on `projectId`.
+- **Cascading deletes.** Deleting a Project cleanly removes all project-scoped data (cascades through 12 of 14 models).
+- **Append-only logs.** `ProfileEvolutionLog`, `ProjectModeLog`, `SpendLedger` are append-only — never updated, never deleted (compliance requirement per product brief §11.3).
+- **Audit retention.** `AuditArtifact.retentionUntil` is computed at write time from project compliance mode; a separate retention cron prunes expired artifacts (lands in Sprint 7).
+- **Indices on every read pattern.** Per technical spec §3 — `(projectId, status)`, `(projectId, finalBucket)`, `(projectId, createdAt DESC)`, etc.
+
+## Models (14)
+
+| #   | Model                 | Purpose                                                   | Layer         |
+| --- | --------------------- | --------------------------------------------------------- | ------------- |
+| 1   | `Project`             | Multi-tenant root                                         | A (Profile)   |
+| 2   | `ProjectProfile`      | Domain ontology, risk weights, critical flows, glossary   | A             |
+| 3   | `IngestedDoc`         | Source docs that fed the Profile                          | A             |
+| 4   | `ProfileEvolutionLog` | Append-only audit of every Profile change                 | A             |
+| 5   | `QARun`               | One discovery pass                                        | B/C           |
+| 6   | `RawSignal`           | What a Discovery route emits before triage                | B/C           |
+| 7   | `QATicket`            | The structured bug ticket                                 | D             |
+| 8   | `QAFixAttempt`        | One Claude dispatch + outcome                             | E             |
+| 9   | `ClassificationTrust` | Per-classification rolling 30-day trust score             | F             |
+| 10  | `RAGCorpus`           | Successful past fixes for in-context examples             | F             |
+| 11  | `AuditArtifact`       | Persistent evidence (screenshots, videos, prompts, diffs) | cross-cutting |
+| 12  | `Policy`              | Risk-tier rules, classification overrides, thresholds     | safety        |
+| 13  | `ProjectModeLog`      | Append-only mode-change audit                             | safety        |
+| 14  | `SpendLedger`         | Per-event $ spend (Anthropic, storage, etc.)              | cost          |
+
+Detail: see [`prisma/schema.prisma`](./prisma/schema.prisma) and technical spec §3.
+
+## Status
+
+Scaffolded in QAP-005 (Sprint 1). Schema is complete; the Prisma client gets imported by `@derwinjs/core` and `@derwinjs/api` starting in Sprint 2.

package/dist/agent-findings-ingestor.d.ts

@@ -0,0 +1,40 @@
+/**
+ * AgentFindingsIngestor — Prisma-backed ingestor that projects an inbound
+ * QA-agent envelope into a QARun + N RawSignals.
+ *
+ * QAP-019F (Sprint 2 Group D-3, Commit 2). Implements the
+ * AgentFindingsIngestor contract from @derwinjs/sdk by composing
+ * QARunStore.createRun under the hood (Group D-3 plan Decision 2).
+ *
+ * Translation under Option β:
+ *   - Envelope → QARun(triggerType='AGENT', triggeredBy=agentVersion ?? 'qa-agent',
+ *     scope = non-finding fields).
+ *   - Each finding → RawSignal(routeName='agent', signalType='agent_finding',
+ *     rawData = {sev, area, msg, file, tags, proposedFix}).
+ *   - Findings with sev='info' are dropped (Lifeline parity); counted
+ *     separately as droppedInfoCount in the response.
+ *   - **No inline ticket creation.** The orchestrator's Triage stage owns
+ *     ticket creation (ADR-0008); this ingestor only writes signals.
+ *
+ * FK violations from the underlying QARunStore (unknown projectId) bubble
+ * up as QAStoreError('fk_violation', ...) — we re-throw as
+ * AgentFindingsIngestorError('fk_violation', ...) so the route handler
+ * has a single typed error class to switch on.
+ */
+import type { QARunStore } from '@derwinjs/sdk';
+import { type AgentFindingsIngestor } from '@derwinjs/sdk';
+/**
+ * The ingestor composes QARunStore.createRun, so config takes a runStore
+ * rather than a Prisma client. Consumers that need a custom run store
+ * (e.g., a write-through cache, a dual-write to legacy Lifeline) can pass
+ * their own.
+ *
+ * configureQAPlatform() wires `runs: createPrismaQARunStore({ prisma })`
+ * and then `agentFindings: createPrismaAgentFindingsIngestor({ runStore: runs })`.
+ */
+export interface PrismaAgentFindingsIngestorConfig {
+    /** A QARunStore implementation. Most consumers pass createPrismaQARunStore output. */
+    runStore: QARunStore;
+}
+export declare function createPrismaAgentFindingsIngestor(config: PrismaAgentFindingsIngestorConfig): AgentFindingsIngestor;
+//# sourceMappingURL=agent-findings-ingestor.d.ts.map

package/dist/agent-findings-ingestor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-findings-ingestor.d.ts","sourceRoot":"","sources":["../src/agent-findings-ingestor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAML,KAAK,qBAAqB,EAG3B,MAAM,eAAe,CAAC;AAIvB;;;;;;;;GAQG;AACH,MAAM,WAAW,iCAAiC;IAChD,sFAAsF;IACtF,QAAQ,EAAE,UAAU,CAAC;CACtB;AAID,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,iCAAiC,GACxC,qBAAqB,CAwDvB"}

package/dist/agent-findings-ingestor.js

@@ -0,0 +1,154 @@
+/**
+ * AgentFindingsIngestor — Prisma-backed ingestor that projects an inbound
+ * QA-agent envelope into a QARun + N RawSignals.
+ *
+ * QAP-019F (Sprint 2 Group D-3, Commit 2). Implements the
+ * AgentFindingsIngestor contract from @derwinjs/sdk by composing
+ * QARunStore.createRun under the hood (Group D-3 plan Decision 2).
+ *
+ * Translation under Option β:
+ *   - Envelope → QARun(triggerType='AGENT', triggeredBy=agentVersion ?? 'qa-agent',
+ *     scope = non-finding fields).
+ *   - Each finding → RawSignal(routeName='agent', signalType='agent_finding',
+ *     rawData = {sev, area, msg, file, tags, proposedFix}).
+ *   - Findings with sev='info' are dropped (Lifeline parity); counted
+ *     separately as droppedInfoCount in the response.
+ *   - **No inline ticket creation.** The orchestrator's Triage stage owns
+ *     ticket creation (ADR-0008); this ingestor only writes signals.
+ *
+ * FK violations from the underlying QARunStore (unknown projectId) bubble
+ * up as QAStoreError('fk_violation', ...) — we re-throw as
+ * AgentFindingsIngestorError('fk_violation', ...) so the route handler
+ * has a single typed error class to switch on.
+ */
+import { AgentFindingsIngestorError, QARunStoreError, } from '@derwinjs/sdk';
+// ─── Factory ─────────────────────────────────────────────────────────────
+export function createPrismaAgentFindingsIngestor(config) {
+    const { runStore } = config;
+    return {
+        async ingestAgentFindings(input) {
+            validateInput(input);
+            const { projectId, envelope } = input;
+            // Filter findings: drop info-severity. Lifeline rule — info-level
+            // findings are diagnostic noise, not signal.
+            const droppedInfoCount = envelope.findings.filter((f) => f.sev === 'info').length;
+            const keptFindings = envelope.findings.filter((f) => f.sev !== 'info');
+            // Build the signals payload. routeName is a synthetic constant
+            // 'agent' — Lifeline's RawSignal.routeName is required + non-empty
+            // and the agent has no per-finding route concept.
+            const signals = keptFindings.map((f) => ({
+                routeName: 'agent',
+                signalType: 'agent_finding',
+                rawData: agentFindingToRawData(f),
+                rawArtifactRefs: [],
+            }));
+            // Compose QARunStore.createRun. Triage stage may later promote some
+            // signals to QATickets; that's not this ingestor's job.
+            let detail;
+            try {
+                detail = await runStore.createRun({
+                    projectId,
+                    triggeredBy: envelope.agentVersion ?? 'qa-agent',
+                    triggerType: 'AGENT',
+                    scope: buildScopeFromEnvelope(envelope),
+                    status: 'COMPLETED',
+                    completedAt: new Date(),
+                    signals,
+                });
+            }
+            catch (err) {
+                if (err instanceof QARunStoreError && err.code === 'fk_violation') {
+                    throw new AgentFindingsIngestorError('fk_violation', `AgentFindingsIngestor: QARunStore reports FK violation: ${err.message}`, { projectId });
+                }
+                throw err;
+            }
+            return {
+                qaRunId: detail.run.id,
+                status: detail.run.status,
+                signalsRaised: detail.run.signalsRaised,
+                droppedInfoCount,
+            };
+        },
+    };
+}
+// ─── Helpers ─────────────────────────────────────────────────────────────
+/**
+ * Project a single agent finding to RawSignal.rawData. Optional fields
+ * are omitted (rather than written as null) so JSON column reads stay
+ * tight — Lifeline parity.
+ */
+function agentFindingToRawData(f) {
+    const data = {
+        sev: f.sev,
+        area: f.area,
+        msg: f.msg,
+    };
+    if (f.file !== undefined && f.file !== null)
+        data.file = f.file;
+    if (f.tags !== undefined && f.tags.length > 0)
+        data.tags = [...f.tags];
+    if (f.proposedFix !== undefined && f.proposedFix !== null)
+        data.proposedFix = f.proposedFix;
+    return data;
+}
+/**
+ * Pack the non-finding envelope fields into QARun.scope so the dashboard
+ * can render the agent's summary metadata without an extra query. Findings
+ * intentionally omitted — they live as RawSignal rows.
+ */
+function buildScopeFromEnvelope(envelope) {
+    const scope = {
+        source: envelope.source,
+        generatedAt: envelope.generatedAt,
+        platform: { ...envelope.platform },
+    };
+    if (envelope.agentVersion !== undefined)
+        scope.agentVersion = envelope.agentVersion;
+    if (envelope.healthScore !== undefined)
+        scope.healthScore = envelope.healthScore;
+    if (envelope.summary !== undefined)
+        scope.summary = envelope.summary;
+    if (envelope.sprintPlan !== undefined)
+        scope.sprintPlan = envelope.sprintPlan;
+    if (envelope.moduleHealth !== undefined)
+        scope.moduleHealth = envelope.moduleHealth;
+    if (envelope.issuesByArea !== undefined)
+        scope.issuesByArea = envelope.issuesByArea;
+    return scope;
+}
+// ─── Validation ──────────────────────────────────────────────────────────
+function validateInput(input) {
+    if (typeof input.projectId !== 'string' || input.projectId.length === 0) {
+        throw new AgentFindingsIngestorError('invalid_input', 'AgentFindingsIngestor: projectId is required');
+    }
+    const envelopeValue = input.envelope;
+    if (typeof envelopeValue !== 'object' || envelopeValue === null) {
+        throw new AgentFindingsIngestorError('invalid_input', 'AgentFindingsIngestor: envelope is required');
+    }
+    // Cast through unknown to bypass the literal-type narrowing — this guard
+    // catches untyped JSON from the route layer where source could be anything.
+    const sourceValue = input.envelope.source;
+    if (sourceValue !== 'qa-agent') {
+        throw new AgentFindingsIngestorError('invalid_input', `AgentFindingsIngestor: envelope.source must be 'qa-agent' (got '${String(sourceValue)}')`);
+    }
+    const findingsValue = input.envelope.findings;
+    if (!Array.isArray(findingsValue)) {
+        throw new AgentFindingsIngestorError('invalid_input', 'AgentFindingsIngestor: envelope.findings must be an array');
+    }
+    input.envelope.findings.forEach((f, i) => {
+        validateFinding(f, i);
+    });
+}
+function validateFinding(f, idx) {
+    const validSevs = ['critical', 'high', 'medium', 'low', 'info'];
+    if (typeof f.sev !== 'string' || !validSevs.includes(f.sev)) {
+        throw new AgentFindingsIngestorError('invalid_input', `AgentFindingsIngestor: findings[${String(idx)}].sev must be one of ${validSevs.join('|')}`);
+    }
+    if (typeof f.area !== 'string' || f.area.length === 0) {
+        throw new AgentFindingsIngestorError('invalid_input', `AgentFindingsIngestor: findings[${String(idx)}].area is required`);
+    }
+    if (typeof f.msg !== 'string' || f.msg.length === 0) {
+        throw new AgentFindingsIngestorError('invalid_input', `AgentFindingsIngestor: findings[${String(idx)}].msg is required`);
+    }
+}
+//# sourceMappingURL=agent-findings-ingestor.js.map

package/dist/agent-findings-ingestor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-findings-ingestor.js","sourceRoot":"","sources":["../src/agent-findings-ingestor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EACL,0BAA0B,EAC1B,eAAe,GAOhB,MAAM,eAAe,CAAC;AAkBvB,4EAA4E;AAE5E,MAAM,UAAU,iCAAiC,CAC/C,MAAyC;IAEzC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAE5B,OAAO;QACL,KAAK,CAAC,mBAAmB,CAAC,KAA+B;YACvD,aAAa,CAAC,KAAK,CAAC,CAAC;YAErB,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;YAEtC,kEAAkE;YAClE,6CAA6C;YAC7C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;YAClF,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;YAEvE,+DAA+D;YAC/D,mEAAmE;YACnE,kDAAkD;YAClD,MAAM,OAAO,GAAwB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5D,SAAS,EAAE,OAAO;gBAClB,UAAU,EAAE,eAAe;gBAC3B,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;gBACjC,eAAe,EAAE,EAAE;aACpB,CAAC,CAAC,CAAC;YAEJ,oEAAoE;YACpE,wDAAwD;YACxD,IAAI,MAAM,CAAC;YACX,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC;oBAChC,SAAS;oBACT,WAAW,EAAE,QAAQ,CAAC,YAAY,IAAI,UAAU;oBAChD,WAAW,EAAE,OAAO;oBACpB,KAAK,EAAE,sBAAsB,CAAC,QAAQ,CAAC;oBACvC,MAAM,EAAE,WAAW;oBACnB,WAAW,EAAE,IAAI,IAAI,EAAE;oBACvB,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBAClE,MAAM,IAAI,0BAA0B,CAClC,cAAc,EACd,2DAA2D,GAAG,CAAC,OAAO,EAAE,EACxE,EAAE,SAAS,EAAE,CACd,CAAC;gBACJ,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;gBACtB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM;gBACzB,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa;gBACvC,gBAAgB;aACjB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,CAAe;IAC5C,MAAM,IAAI,GAA4B;QACpC,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,EAAE,CAAC,CAAC,GAAG;KACX,CAAC;IACF,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;QAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAChE,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,IAAI;QAAE,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;IAC5F,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,QAA+B;IAC7D,MAAM,KAAK,GAA4B;QACrC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE;KACnC,CAAC;IACF,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IACpF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,KAAK,CAAC,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;IACjF,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACrE,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;IAC9E,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IACpF,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,YAAY,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAE5E,SAAS,aAAa,CAAC,KAA+B;IACpD,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAY,KAAK,CAAC,QAAQ,CAAC;IAC9C,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAChE,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAiB,CAAC;IACrD,IAAI,WAAW,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,mEAAmE,MAAM,CAAC,WAAW,CAAC,IAAI,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAY,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,CAAe,EAAE,GAAW;IACnD,MAAM,SAAS,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,mCAAmC,MAAM,CAAC,GAAG,CAAC,wBAAwB,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,mCAAmC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,0BAA0B,CAClC,eAAe,EACf,mCAAmC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAClE,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/classification-trust-store.d.ts

@@ -0,0 +1,31 @@
+/**
+ * ClassificationTrustStore — Prisma implementation against Derwin's
+ * ClassificationTrust table.
+ *
+ * QAP-015 (Sprint 2). Implements the ClassificationTrustStore contract from
+ * @derwinjs/sdk (see packages/sdk/src/types/classification-trust-store.ts)
+ * against the @derwinjs/db Prisma client. Mirrors createPrismaQAFixAttemptStore
+ * in structure: a factory taking `{ prisma }` so callers inject the client
+ * (per the architecture pivot's DI seam — @derwinjs/db owns persistence; the
+ * orchestrator wires it in via configureQAPlatform()).
+ *
+ * Tenant isolation: every method scopes by projectId in the WHERE clause and
+ * uses findFirst (not findUnique) for reads so wrong-tenant lookups return
+ * null instead of leaking the (classification, surface) tuple's existence
+ * cross-project. App-layer guards in Sprint 2 ahead of the full Supabase RLS
+ * migration (Sprint 3 / QAP-024).
+ *
+ * Composes with TrustScoreUpdater (@derwinjs/core, Layer F): the updater
+ * recomputes whole rows from scratch on each cron tick (rolling 30-day
+ * window aggregation). It does NOT supply lastComputedAt — this store
+ * always overwrites it with `new Date()` on both upsert branches per the
+ * SDK contract.
+ */
+import { type PrismaClient } from './prisma.js';
+import { type ClassificationTrustStore } from '@derwinjs/sdk';
+export interface PrismaClassificationTrustStoreConfig {
+    /** Generated Prisma client. Pass an instance per process. */
+    prisma: PrismaClient;
+}
+export declare function createPrismaClassificationTrustStore(config: PrismaClassificationTrustStoreConfig): ClassificationTrustStore;
+//# sourceMappingURL=classification-trust-store.d.ts.map

package/dist/classification-trust-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification-trust-store.d.ts","sourceRoot":"","sources":["../src/classification-trust-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAU,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAEL,KAAK,wBAAwB,EAG9B,MAAM,eAAe,CAAC;AAIvB,MAAM,WAAW,oCAAoC;IACnD,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAID,wBAAgB,oCAAoC,CAClD,MAAM,EAAE,oCAAoC,GAC3C,wBAAwB,CA6F1B"}

package/dist/classification-trust-store.js

@@ -0,0 +1,154 @@
+/**
+ * ClassificationTrustStore — Prisma implementation against Derwin's
+ * ClassificationTrust table.
+ *
+ * QAP-015 (Sprint 2). Implements the ClassificationTrustStore contract from
+ * @derwinjs/sdk (see packages/sdk/src/types/classification-trust-store.ts)
+ * against the @derwinjs/db Prisma client. Mirrors createPrismaQAFixAttemptStore
+ * in structure: a factory taking `{ prisma }` so callers inject the client
+ * (per the architecture pivot's DI seam — @derwinjs/db owns persistence; the
+ * orchestrator wires it in via configureQAPlatform()).
+ *
+ * Tenant isolation: every method scopes by projectId in the WHERE clause and
+ * uses findFirst (not findUnique) for reads so wrong-tenant lookups return
+ * null instead of leaking the (classification, surface) tuple's existence
+ * cross-project. App-layer guards in Sprint 2 ahead of the full Supabase RLS
+ * migration (Sprint 3 / QAP-024).
+ *
+ * Composes with TrustScoreUpdater (@derwinjs/core, Layer F): the updater
+ * recomputes whole rows from scratch on each cron tick (rolling 30-day
+ * window aggregation). It does NOT supply lastComputedAt — this store
+ * always overwrites it with `new Date()` on both upsert branches per the
+ * SDK contract.
+ */
+import { ClassificationTrustStoreError, } from '@derwinjs/sdk';
+// ─── Factory ─────────────────────────────────────────────────────────────
+export function createPrismaClassificationTrustStore(config) {
+    const { prisma } = config;
+    return {
+        async upsertTrust(input) {
+            validateUpsertInput(input);
+            // The lastComputedAt timestamp is owned by this store, not the caller —
+            // the SDK contract documents it as "Sets lastComputedAt to now on both
+            // paths." Generate once so create + update branches agree.
+            const lastComputedAt = new Date();
+            const dataShared = {
+                attemptsLast30d: input.attemptsLast30d,
+                mergedClean: input.mergedClean,
+                mergedWithEdits: input.mergedWithEdits,
+                regressed: input.regressed,
+                reverted: input.reverted,
+                successScore: input.successScore,
+                trustPercent: input.trustPercent,
+                autoMergeEligible: input.autoMergeEligible,
+                lastComputedAt,
+            };
+            const upserted = await prisma.classificationTrust.upsert({
+                where: {
+                    projectId_classification_surface: {
+                        projectId: input.projectId,
+                        classification: input.classification,
+                        surface: input.surface,
+                    },
+                },
+                create: {
+                    projectId: input.projectId,
+                    classification: input.classification,
+                    surface: input.surface,
+                    ...dataShared,
+                },
+                update: dataShared,
+            });
+            return mapRow(upserted);
+        },
+        async getTrust(key) {
+            // findFirst (not findUnique) — leaking the (classification, surface)
+            // composite's existence cross-tenant via P2025 vs null is the exact
+            // enumeration vector ADR-0009 / Pattern D guards against. With
+            // projectId in the WHERE, missing-row + wrong-tenant collapse to
+            // identical null returns.
+            const row = await prisma.classificationTrust.findFirst({
+                where: {
+                    projectId: key.projectId,
+                    classification: key.classification,
+                    surface: key.surface,
+                },
+            });
+            return row ? mapRow(row) : null;
+        },
+        async listTrust(filter) {
+            if (!filter.projectId) {
+                throw new ClassificationTrustStoreError('invalid_input', 'projectId is required for listTrust — there is no cross-tenant list query');
+            }
+            const where = {
+                projectId: filter.projectId,
+            };
+            if (filter.surface !== undefined) {
+                where.surface = Array.isArray(filter.surface) ? { in: filter.surface } : filter.surface;
+            }
+            if (filter.minTrustPercent !== undefined) {
+                where.trustPercent = { gte: filter.minTrustPercent };
+            }
+            if (filter.autoMergeEligible !== undefined) {
+                where.autoMergeEligible = filter.autoMergeEligible;
+            }
+            const limit = Math.max(1, Math.min(200, filter.limit ?? 50));
+            const rows = await prisma.classificationTrust.findMany({
+                where,
+                orderBy: { trustPercent: 'desc' },
+                take: limit,
+            });
+            return { trusts: rows.map(mapRow) };
+        },
+    };
+}
+// ─── Helpers ─────────────────────────────────────────────────────────────
+/** Convert a Prisma ClassificationTrust row to the SDK value type. */
+function mapRow(row) {
+    return {
+        id: row.id,
+        projectId: row.projectId,
+        classification: row.classification,
+        surface: row.surface,
+        attemptsLast30d: row.attemptsLast30d,
+        mergedClean: row.mergedClean,
+        mergedWithEdits: row.mergedWithEdits,
+        regressed: row.regressed,
+        reverted: row.reverted,
+        successScore: row.successScore,
+        trustPercent: row.trustPercent,
+        autoMergeEligible: row.autoMergeEligible,
+        lastComputedAt: row.lastComputedAt,
+    };
+}
+function validateUpsertInput(input) {
+    if (!input.projectId) {
+        throw new ClassificationTrustStoreError('invalid_input', 'projectId is required');
+    }
+    if (!input.classification) {
+        throw new ClassificationTrustStoreError('invalid_input', 'classification is required');
+    }
+    // Bucket counts: rolling 30-day aggregates that can never be negative.
+    const counts = [
+        ['attemptsLast30d', input.attemptsLast30d],
+        ['mergedClean', input.mergedClean],
+        ['mergedWithEdits', input.mergedWithEdits],
+        ['regressed', input.regressed],
+        ['reverted', input.reverted],
+    ];
+    for (const [name, value] of counts) {
+        if (!Number.isFinite(value) || value < 0) {
+            throw new ClassificationTrustStoreError('invalid_input', `${name} must be a non-negative finite number`);
+        }
+    }
+    // successScore: derived ratio, bounded [-1, 1] per the schema docstring.
+    if (!Number.isFinite(input.successScore) || input.successScore < -1 || input.successScore > 1) {
+        throw new ClassificationTrustStoreError('invalid_input', 'successScore must be in [-1, 1]');
+    }
+    // trustPercent: integer percent for operator UI; range + integer enforced
+    // here so the DB never stores a fractional or out-of-range percent.
+    if (!Number.isInteger(input.trustPercent) || input.trustPercent < 0 || input.trustPercent > 100) {
+        throw new ClassificationTrustStoreError('invalid_input', 'trustPercent must be an integer in [0, 100]');
+    }
+}
+//# sourceMappingURL=classification-trust-store.js.map

package/dist/classification-trust-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification-trust-store.js","sourceRoot":"","sources":["../src/classification-trust-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EACL,6BAA6B,GAI9B,MAAM,eAAe,CAAC;AASvB,4EAA4E;AAE5E,MAAM,UAAU,oCAAoC,CAClD,MAA4C;IAE5C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAE1B,OAAO;QACL,KAAK,CAAC,WAAW,CAAC,KAAK;YACrB,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAE3B,wEAAwE;YACxE,uEAAuE;YACvE,2DAA2D;YAC3D,MAAM,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC;YAElC,MAAM,UAAU,GAAG;gBACjB,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;gBACtC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,cAAc;aACf,CAAC;YAEF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC;gBACvD,KAAK,EAAE;oBACL,gCAAgC,EAAE;wBAChC,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;wBACpC,OAAO,EAAE,KAAK,CAAC,OAAO;qBACvB;iBACF;gBACD,MAAM,EAAE;oBACN,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,GAAG,UAAU;iBACd;gBACD,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,GAAG;YAChB,qEAAqE;YACrE,oEAAoE;YACpE,+DAA+D;YAC/D,iEAAiE;YACjE,0BAA0B;YAC1B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC;gBACrD,KAAK,EAAE;oBACL,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,cAAc,EAAE,GAAG,CAAC,cAAc;oBAClC,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB;aACF,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,MAAM;YACpB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,6BAA6B,CACrC,eAAe,EACf,2EAA2E,CAC5E,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAyC;gBAClD,SAAS,EAAE,MAAM,CAAC,SAAS;aAC5B,CAAC;YAEF,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YAC1F,CAAC;YACD,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBACzC,KAAK,CAAC,YAAY,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC;YACvD,CAAC;YACD,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBAC3C,KAAK,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;YACrD,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;YAE7D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC;gBACrD,KAAK;gBACL,OAAO,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE;gBACjC,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;YAEH,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E,sEAAsE;AACtE,SAAS,MAAM,CACb,GAAgE;IAEhE,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,cAAc,EAAE,GAAG,CAAC,cAAc;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAqC;IAChE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,6BAA6B,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,IAAI,6BAA6B,CAAC,eAAe,EAAE,4BAA4B,CAAC,CAAC;IACzF,CAAC;IAED,uEAAuE;IACvE,MAAM,MAAM,GAAuB;QACjC,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC;QAC1C,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC;QAClC,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC;QAC1C,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC;QAC9B,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC;KAC7B,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,6BAA6B,CACrC,eAAe,EACf,GAAG,IAAI,uCAAuC,CAC/C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,6BAA6B,CAAC,eAAe,EAAE,iCAAiC,CAAC,CAAC;IAC9F,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,CAAC,IAAI,KAAK,CAAC,YAAY,GAAG,GAAG,EAAE,CAAC;QAChG,MAAM,IAAI,6BAA6B,CACrC,eAAe,EACf,6CAA6C,CAC9C,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/coverage-gap-reporter.d.ts

@@ -0,0 +1,35 @@
+/**
+ * CoverageGapReporter — Prisma-backed report listing tickets joined with
+ * their test-coverage signal status.
+ *
+ * QAP-019F (Sprint 2 Group D-3, Commit 3). Implements the
+ * CoverageGapReporter contract from @derwinjs/sdk under **Option β**.
+ *
+ * **Reframe vs Lifeline**: Lifeline's coverage-gap was a hardcoded list of
+ * dashboard ticket IDs joined LEFT against QARunResult to find tickets
+ * without a Playwright spec. Derwin doesn't ship dashboard-ticket parity
+ * (Sprint 4+ owns Profile-driven ticket inventory) and doesn't have
+ * QARunResult under Option β — per-test envelopes live as RawSignal records
+ * with `signalType='test_failure'`.
+ *
+ * The reframed query (Decision 3): a ticket "has coverage" if there exists
+ * at least one RawSignal with `signalType='test_failure'` and
+ * `qaTicketId=ticket.id`. Same dashboard intent ("tickets we track but
+ * lack signal evidence"), different mechanic.
+ *
+ * The query is two findMany calls:
+ *   1. List all QATickets in the project (id + display fields).
+ *   2. List the distinct qaTicketIds from RawSignals where
+ *      signalType='test_failure' in this project.
+ * Then we LEFT JOIN in memory: hasSignal = signalIds.has(ticket.id).
+ *
+ * Tenant isolation: every query scopes by projectId.
+ */
+import type { PrismaClient } from './prisma.js';
+import { type CoverageGapReporter } from '@derwinjs/sdk';
+export interface PrismaCoverageGapReporterConfig {
+    /** Generated Prisma client. Pass an instance per process. */
+    prisma: PrismaClient;
+}
+export declare function createPrismaCoverageGapReporter(config: PrismaCoverageGapReporterConfig): CoverageGapReporter;
+//# sourceMappingURL=coverage-gap-reporter.d.ts.map

package/dist/coverage-gap-reporter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage-gap-reporter.d.ts","sourceRoot":"","sources":["../src/coverage-gap-reporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAIL,KAAK,mBAAmB,EAEzB,MAAM,eAAe,CAAC;AAIvB,MAAM,WAAW,+BAA+B;IAC9C,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAID,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,+BAA+B,GACtC,mBAAmB,CAuDrB"}

package/dist/coverage-gap-reporter.js

@@ -0,0 +1,84 @@
+/**
+ * CoverageGapReporter — Prisma-backed report listing tickets joined with
+ * their test-coverage signal status.
+ *
+ * QAP-019F (Sprint 2 Group D-3, Commit 3). Implements the
+ * CoverageGapReporter contract from @derwinjs/sdk under **Option β**.
+ *
+ * **Reframe vs Lifeline**: Lifeline's coverage-gap was a hardcoded list of
+ * dashboard ticket IDs joined LEFT against QARunResult to find tickets
+ * without a Playwright spec. Derwin doesn't ship dashboard-ticket parity
+ * (Sprint 4+ owns Profile-driven ticket inventory) and doesn't have
+ * QARunResult under Option β — per-test envelopes live as RawSignal records
+ * with `signalType='test_failure'`.
+ *
+ * The reframed query (Decision 3): a ticket "has coverage" if there exists
+ * at least one RawSignal with `signalType='test_failure'` and
+ * `qaTicketId=ticket.id`. Same dashboard intent ("tickets we track but
+ * lack signal evidence"), different mechanic.
+ *
+ * The query is two findMany calls:
+ *   1. List all QATickets in the project (id + display fields).
+ *   2. List the distinct qaTicketIds from RawSignals where
+ *      signalType='test_failure' in this project.
+ * Then we LEFT JOIN in memory: hasSignal = signalIds.has(ticket.id).
+ *
+ * Tenant isolation: every query scopes by projectId.
+ */
+import { CoverageGapReporterError, } from '@derwinjs/sdk';
+// ─── Factory ─────────────────────────────────────────────────────────────
+export function createPrismaCoverageGapReporter(config) {
+    const { prisma } = config;
+    return {
+        async getCoverageGap(filter) {
+            validateFilter(filter);
+            // 1. All tickets in the project — minimal fields the contract returns.
+            const tickets = await prisma.qATicket.findMany({
+                where: { projectId: filter.projectId },
+                orderBy: { createdAt: 'desc' },
+                select: {
+                    id: true,
+                    title: true,
+                    classification: true,
+                    status: true,
+                    createdAt: true,
+                },
+            });
+            if (tickets.length === 0) {
+                return { tickets: [] };
+            }
+            // 2. Distinct qaTicketIds with at least one test_failure signal.
+            //
+            // RawSignal.qaTicketId is FK-scoped to QATicket; tenant-isolation
+            // happens via the parent ticket projectId filter when we join.
+            // We restrict the lookup to this project's ticket ids to keep the
+            // query bounded.
+            const ticketIds = tickets.map((t) => t.id);
+            const signalRows = await prisma.rawSignal.findMany({
+                where: {
+                    signalType: 'test_failure',
+                    qaTicketId: { in: ticketIds },
+                },
+                select: { qaTicketId: true },
+                distinct: ['qaTicketId'],
+            });
+            const ticketIdsWithSignal = new Set(signalRows.map((r) => r.qaTicketId).filter((id) => id !== null));
+            const rows = tickets.map((t) => ({
+                id: t.id,
+                title: t.title,
+                classification: t.classification,
+                status: t.status,
+                createdAt: t.createdAt,
+                hasSignal: ticketIdsWithSignal.has(t.id),
+            }));
+            return { tickets: rows };
+        },
+    };
+}
+// ─── Validation ──────────────────────────────────────────────────────────
+function validateFilter(filter) {
+    if (typeof filter.projectId !== 'string' || filter.projectId.length === 0) {
+        throw new CoverageGapReporterError('invalid_input', 'CoverageGapReporter: projectId is required');
+    }
+}
+//# sourceMappingURL=coverage-gap-reporter.js.map

package/dist/coverage-gap-reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage-gap-reporter.js","sourceRoot":"","sources":["../src/coverage-gap-reporter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EACL,wBAAwB,GAKzB,MAAM,eAAe,CAAC;AASvB,4EAA4E;AAE5E,MAAM,UAAU,+BAA+B,CAC7C,MAAuC;IAEvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAE1B,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,MAAyB;YAC5C,cAAc,CAAC,MAAM,CAAC,CAAC;YAEvB,uEAAuE;YACvE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC7C,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;gBACtC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;gBAC9B,MAAM,EAAE;oBACN,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE,IAAI;oBACX,cAAc,EAAE,IAAI;oBACpB,MAAM,EAAE,IAAI;oBACZ,SAAS,EAAE,IAAI;iBAChB;aACF,CAAC,CAAC;YAEH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACzB,CAAC;YAED,iEAAiE;YACjE,EAAE;YACF,kEAAkE;YAClE,+DAA+D;YAC/D,kEAAkE;YAClE,iBAAiB;YACjB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC;gBACjD,KAAK,EAAE;oBACL,UAAU,EAAE,cAAc;oBAC1B,UAAU,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE;iBAC9B;gBACD,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;gBAC5B,QAAQ,EAAE,CAAC,YAAY,CAAC;aACzB,CAAC,CAAC;YACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC,CAC9E,CAAC;YAEF,MAAM,IAAI,GAA2B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvD,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,cAAc,EAAE,CAAC,CAAC,cAAc;gBAChC,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;aACzC,CAAC,CAAC,CAAC;YAEJ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E,SAAS,cAAc,CAAC,MAAyB;IAC/C,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,4CAA4C,CAC7C,CAAC;IACJ,CAAC;AACH,CAAC"}