@derwinjs/db 0.3.0 → 0.4.0

package/dist/project-profile-store.d.ts

@@ -0,0 +1,31 @@
+/**
+ * ProjectProfileStore — Prisma implementation against Derwin's
+ * ProjectProfile table.
+ *
+ * QAP-Sprint4 Phase 1. Implements the ProjectProfileStore contract from
+ * @derwinjs/sdk (see packages/sdk/src/types/project-profile-store.ts) against
+ * the @derwinjs/db Prisma client. The Profile is Layer A — per-project
+ * domain ontology, 8-vector risk weights, critical flows, glossary, and
+ * dependency graph. Sprint 4 ships the read path; Sprint 6+ adds Profile
+ * evolution (writes from outcomes) on top of this same contract.
+ *
+ * Tenant isolation: the ProjectProfile.projectId column is `@unique`, so
+ * `findUnique({ where: { projectId } })` is the canonical scoping query —
+ * there is at most one row per project. As a defense-in-depth check we
+ * verify the returned row's projectId matches the requested one (a Prisma
+ * bug or schema drift could otherwise leak across tenants).
+ *
+ * JSON columns: domainOntology / riskProfile / criticalFlows / glossary /
+ * dependencies are typed as `Json` in the Prisma schema. We cast through
+ * `unknown` to the SDK's typed shapes on read; on write we cast in the
+ * other direction. The Profile authoring path (Sprint 6+) is the schema-
+ * narrowing chokepoint, not the storage layer.
+ */
+import { type PrismaClient } from './prisma.js';
+import { type ProjectProfileStore } from '@derwinjs/sdk';
+export interface PrismaProjectProfileStoreConfig {
+    /** Generated Prisma client. Pass an instance per process. */
+    prisma: PrismaClient;
+}
+export declare function createPrismaProjectProfileStore(config: PrismaProjectProfileStoreConfig): ProjectProfileStore;
+//# sourceMappingURL=project-profile-store.d.ts.map

package/dist/project-profile-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-profile-store.d.ts","sourceRoot":"","sources":["../src/project-profile-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAU,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAQL,KAAK,mBAAmB,EAEzB,MAAM,eAAe,CAAC;AAIvB,MAAM,WAAW,+BAA+B;IAC9C,6DAA6D;IAC7D,MAAM,EAAE,YAAY,CAAC;CACtB;AAID,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,+BAA+B,GACtC,mBAAmB,CA+ErB"}

package/dist/project-profile-store.js

@@ -0,0 +1,156 @@
+/**
+ * ProjectProfileStore — Prisma implementation against Derwin's
+ * ProjectProfile table.
+ *
+ * QAP-Sprint4 Phase 1. Implements the ProjectProfileStore contract from
+ * @derwinjs/sdk (see packages/sdk/src/types/project-profile-store.ts) against
+ * the @derwinjs/db Prisma client. The Profile is Layer A — per-project
+ * domain ontology, 8-vector risk weights, critical flows, glossary, and
+ * dependency graph. Sprint 4 ships the read path; Sprint 6+ adds Profile
+ * evolution (writes from outcomes) on top of this same contract.
+ *
+ * Tenant isolation: the ProjectProfile.projectId column is `@unique`, so
+ * `findUnique({ where: { projectId } })` is the canonical scoping query —
+ * there is at most one row per project. As a defense-in-depth check we
+ * verify the returned row's projectId matches the requested one (a Prisma
+ * bug or schema drift could otherwise leak across tenants).
+ *
+ * JSON columns: domainOntology / riskProfile / criticalFlows / glossary /
+ * dependencies are typed as `Json` in the Prisma schema. We cast through
+ * `unknown` to the SDK's typed shapes on read; on write we cast in the
+ * other direction. The Profile authoring path (Sprint 6+) is the schema-
+ * narrowing chokepoint, not the storage layer.
+ */
+import { Prisma } from './prisma.js';
+import { ProjectProfileStoreError, } from '@derwinjs/sdk';
+// ─── Factory ─────────────────────────────────────────────────────────────
+export function createPrismaProjectProfileStore(config) {
+    const { prisma } = config;
+    return {
+        async getProfile(projectId) {
+            validateProjectId(projectId);
+            const row = await prisma.projectProfile.findUnique({ where: { projectId } });
+            if (!row) {
+                return null;
+            }
+            // Defense-in-depth: the @unique constraint on projectId means this
+            // mismatch shouldn't be reachable, but we still verify before
+            // returning. Anything else collapses tenant isolation.
+            if (row.projectId !== projectId) {
+                return null;
+            }
+            return mapProfile(row);
+        },
+        async putProfile(input) {
+            validatePutInput(input);
+            const now = new Date();
+            const dependencies = (input.dependencies ?? []);
+            const complianceTags = input.complianceTags ?? [];
+            let row;
+            try {
+                row = await prisma.projectProfile.upsert({
+                    where: { projectId: input.projectId },
+                    create: {
+                        projectId: input.projectId,
+                        // ProjectType enum is validated at the Prisma layer when the
+                        // row hits the database — invalid strings surface as a
+                        // PrismaClientKnownRequestError on the round-trip.
+                        type: input.type,
+                        domainOntology: input.domainOntology,
+                        riskProfile: input.riskProfile,
+                        criticalFlows: input.criticalFlows,
+                        glossary: input.glossary,
+                        dependencies,
+                        complianceTags,
+                        ingestedDocsHash: input.ingestedDocsHash,
+                        lastIngestedAt: input.lastIngestedAt,
+                        lastEvolvedAt: now,
+                    },
+                    update: {
+                        type: input.type,
+                        domainOntology: input.domainOntology,
+                        riskProfile: input.riskProfile,
+                        criticalFlows: input.criticalFlows,
+                        glossary: input.glossary,
+                        dependencies,
+                        complianceTags,
+                        ingestedDocsHash: input.ingestedDocsHash,
+                        lastIngestedAt: input.lastIngestedAt,
+                        lastEvolvedAt: now,
+                    },
+                });
+            }
+            catch (e) {
+                if (e instanceof Prisma.PrismaClientKnownRequestError && e.code === 'P2003') {
+                    throw new ProjectProfileStoreError('fk_violation', `Unknown projectId '${input.projectId}' — foreign key violation`, e);
+                }
+                throw e;
+            }
+            return {
+                profile: mapProfile(row),
+                ref: { id: row.id, projectId: row.projectId },
+            };
+        },
+    };
+}
+// ─── Helpers ─────────────────────────────────────────────────────────────
+/**
+ * Convert a Prisma ProjectProfile row to the SDK value type. Json columns
+ * are narrowed via cast through `unknown`. Top-level shape is sanity-checked
+ * before returning so malformed rows surface as a typed error rather than
+ * runtime explosions deep in the consumer.
+ */
+function mapProfile(row) {
+    const domainOntology = row.domainOntology;
+    const riskProfile = row.riskProfile;
+    const criticalFlows = row.criticalFlows;
+    const glossary = (row.glossary ?? {});
+    const dependencies = (row.dependencies ?? []);
+    // Defense-in-depth — top-level keys should at least be present. We don't
+    // deep-validate (that's the Profile authoring path's job), but we catch
+    // truly malformed rows instead of returning garbage.
+    if (!isObject(domainOntology) ||
+        !Array.isArray(domainOntology.entities) ||
+        !Array.isArray(domainOntology.actions) ||
+        !Array.isArray(domainOntology.roles)) {
+        throw new ProjectProfileStoreError('invalid_input', `Profile row ${row.id} has malformed domainOntology JSON`);
+    }
+    if (!isObject(riskProfile)) {
+        throw new ProjectProfileStoreError('invalid_input', `Profile row ${row.id} has malformed riskProfile JSON`);
+    }
+    return {
+        type: row.type,
+        domainOntology,
+        riskProfile,
+        criticalFlows: Array.isArray(criticalFlows) ? criticalFlows : [],
+        glossary,
+        dependencies: Array.isArray(dependencies) ? dependencies : [],
+        complianceTags: row.complianceTags,
+        ingestedDocsHash: row.ingestedDocsHash,
+        lastIngestedAt: row.lastIngestedAt,
+        lastEvolvedAt: row.lastEvolvedAt,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+    };
+}
+function isObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function validateProjectId(projectId) {
+    if (typeof projectId !== 'string' || !projectId.trim()) {
+        throw new ProjectProfileStoreError('invalid_input', 'projectId is required');
+    }
+}
+function validatePutInput(input) {
+    validateProjectId(input.projectId);
+    if (typeof input.type !== 'string' || !input.type.trim()) {
+        throw new ProjectProfileStoreError('invalid_input', 'type is required');
+    }
+    if (typeof input.ingestedDocsHash !== 'string' || !input.ingestedDocsHash.trim()) {
+        throw new ProjectProfileStoreError('invalid_input', 'ingestedDocsHash is required');
+    }
+    if (!(input.lastIngestedAt instanceof Date) || Number.isNaN(input.lastIngestedAt.getTime())) {
+        throw new ProjectProfileStoreError('invalid_input', 'lastIngestedAt must be a valid Date');
+    }
+}
+//# sourceMappingURL=project-profile-store.js.map

package/dist/project-profile-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-profile-store.js","sourceRoot":"","sources":["../src/project-profile-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,MAAM,EAAqB,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,wBAAwB,GASzB,MAAM,eAAe,CAAC;AASvB,4EAA4E;AAE5E,MAAM,UAAU,+BAA+B,CAC7C,MAAuC;IAEvC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAE1B,OAAO;QACL,KAAK,CAAC,UAAU,CAAC,SAAS;YACxB,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAE7B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;YAC7E,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC;YACd,CAAC;YAED,mEAAmE;YACnE,8DAA8D;YAC9D,uDAAuD;YACvD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,KAAK;YACpB,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAExB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAqC,CAAC;YACpF,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC;YAElD,IAAI,GAAG,CAAC;YACR,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC;oBACvC,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;oBACrC,MAAM,EAAE;wBACN,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,6DAA6D;wBAC7D,uDAAuD;wBACvD,mDAAmD;wBACnD,IAAI,EAAE,KAAK,CAAC,IAAgD;wBAC5D,cAAc,EAAE,KAAK,CAAC,cAAkD;wBACxE,WAAW,EAAE,KAAK,CAAC,WAA+C;wBAClE,aAAa,EAAE,KAAK,CAAC,aAAiD;wBACtE,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,YAAY;wBACZ,cAAc;wBACd,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;wBACxC,cAAc,EAAE,KAAK,CAAC,cAAc;wBACpC,aAAa,EAAE,GAAG;qBACnB;oBACD,MAAM,EAAE;wBACN,IAAI,EAAE,KAAK,CAAC,IAAgD;wBAC5D,cAAc,EAAE,KAAK,CAAC,cAAkD;wBACxE,WAAW,EAAE,KAAK,CAAC,WAA+C;wBAClE,aAAa,EAAE,KAAK,CAAC,aAAiD;wBACtE,QAAQ,EAAE,KAAK,CAAC,QAAQ;wBACxB,YAAY;wBACZ,cAAc;wBACd,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;wBACxC,cAAc,EAAE,KAAK,CAAC,cAAc;wBACpC,aAAa,EAAE,GAAG;qBACnB;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,YAAY,MAAM,CAAC,6BAA6B,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC5E,MAAM,IAAI,wBAAwB,CAChC,cAAc,EACd,sBAAsB,KAAK,CAAC,SAAS,2BAA2B,EAChE,CAAC,CACF,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,CAAC;YACV,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC;gBACxB,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;aAC9C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E;;;;;GAKG;AACH,SAAS,UAAU,CAAC,GAA2D;IAC7E,MAAM,cAAc,GAAG,GAAG,CAAC,cAAkD,CAAC;IAC9E,MAAM,WAAW,GAAG,GAAG,CAAC,WAA4C,CAAC;IACrE,MAAM,aAAa,GAAG,GAAG,CAAC,aAAiD,CAAC;IAC5E,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAA+B,CAAC;IACpE,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAmC,CAAC;IAEhF,yEAAyE;IACzE,wEAAwE;IACxE,qDAAqD;IACrD,IACE,CAAC,QAAQ,CAAC,cAAc,CAAC;QACzB,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC;QACvC,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC;QACtC,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,CAAC,EACpC,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,eAAe,GAAG,CAAC,EAAE,oCAAoC,CAC1D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,wBAAwB,CAChC,eAAe,EACf,eAAe,GAAG,CAAC,EAAE,iCAAiC,CACvD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,cAAc;QACd,WAAW;QACX,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;QAChE,QAAQ;QACR,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE;QAC7D,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,cAAc,EAAE,GAAG,CAAC,cAAc;QAClC,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,wBAAwB,CAAC,eAAe,EAAE,uBAAuB,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAsB;IAC9C,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,wBAAwB,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC;QACjF,MAAM,IAAI,wBAAwB,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,cAAc,YAAY,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,wBAAwB,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;IAC7F,CAAC;AACH,CAAC"}

package/dist/scripts/smoke-seed-lifeline-profile.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Sprint 4 Phase 5 smoke — exercises the ProjectProfileStore against the real
+ * local Postgres by upserting the canonical Lifeline Profile from JSON.
+ *
+ * Run: pnpm --filter @derwinjs/db smoke:seed-lifeline-profile
+ *
+ * Prereqs:
+ *   - Local Postgres running on port 5433 (per Sprint 1 docker setup)
+ *   - DATABASE_URL set in packages/db/.env
+ *   - Migrations applied (Sprint 4 Phase 1 ProjectProfile model present)
+ *   - Seed run at least once so the Lifeline project row exists
+ *
+ * What this proves:
+ *   1. lifeline-profile.json parses and conforms to PutProfileInput
+ *   2. createPrismaProjectProfileStore().putProfile round-trips entities,
+ *      criticalFlows, glossary, dependencies, complianceTags
+ *   3. getProfile returns identical counts (no silent JSON column truncation)
+ *
+ * Idempotent: putProfile is upsert-shaped, so re-running just refreshes
+ * lastEvolvedAt/updatedAt without polluting the table. No cleanup needed.
+ *
+ * Prints "SPRINT4-PHASE5 PROFILE READY ✓" on success. Exits 1 on any failure.
+ */
+export {};
+//# sourceMappingURL=smoke-seed-lifeline-profile.d.ts.map

package/dist/scripts/smoke-seed-lifeline-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smoke-seed-lifeline-profile.d.ts","sourceRoot":"","sources":["../../src/scripts/smoke-seed-lifeline-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG"}

package/dist/scripts/smoke-seed-lifeline-profile.js

@@ -0,0 +1,130 @@
+/**
+ * Sprint 4 Phase 5 smoke — exercises the ProjectProfileStore against the real
+ * local Postgres by upserting the canonical Lifeline Profile from JSON.
+ *
+ * Run: pnpm --filter @derwinjs/db smoke:seed-lifeline-profile
+ *
+ * Prereqs:
+ *   - Local Postgres running on port 5433 (per Sprint 1 docker setup)
+ *   - DATABASE_URL set in packages/db/.env
+ *   - Migrations applied (Sprint 4 Phase 1 ProjectProfile model present)
+ *   - Seed run at least once so the Lifeline project row exists
+ *
+ * What this proves:
+ *   1. lifeline-profile.json parses and conforms to PutProfileInput
+ *   2. createPrismaProjectProfileStore().putProfile round-trips entities,
+ *      criticalFlows, glossary, dependencies, complianceTags
+ *   3. getProfile returns identical counts (no silent JSON column truncation)
+ *
+ * Idempotent: putProfile is upsert-shaped, so re-running just refreshes
+ * lastEvolvedAt/updatedAt without polluting the table. No cleanup needed.
+ *
+ * Prints "SPRINT4-PHASE5 PROFILE READY ✓" on success. Exits 1 on any failure.
+ */
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { PrismaClient } from '../prisma.js';
+import { createPrismaProjectProfileStore } from '../project-profile-store.js';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const PROFILE_JSON_PATH = join(__dirname, '..', '..', 'seed-data', 'lifeline-profile.json');
+const prisma = new PrismaClient();
+const store = createPrismaProjectProfileStore({ prisma });
+async function main() {
+    // ─── Step 1: locate Lifeline project ────────────────────────────────
+    const lifeline = await prisma.project.findUnique({ where: { slug: 'lifeline' } });
+    if (!lifeline) {
+        throw new Error("Lifeline project (slug='lifeline') not found. Run `pnpm --filter @derwinjs/db db:seed` first.");
+    }
+    console.log(`✓ Found Lifeline project (id=${lifeline.id})`);
+    // ─── Step 2: load + parse the JSON ──────────────────────────────────
+    const raw = readFileSync(PROFILE_JSON_PATH, 'utf-8');
+    const parsed = JSON.parse(raw);
+    const lastIngestedAt = new Date(parsed.lastIngestedAt);
+    if (Number.isNaN(lastIngestedAt.getTime())) {
+        throw new Error(`lifeline-profile.json has invalid lastIngestedAt: ${parsed.lastIngestedAt}`);
+    }
+    console.log(`✓ Loaded lifeline-profile.json from ${PROFILE_JSON_PATH}`);
+    const expectedEntities = parsed.domainOntology.entities.length;
+    const expectedFlows = parsed.criticalFlows.length;
+    const expectedGlossary = Object.keys(parsed.glossary).length;
+    const expectedDeps = parsed.dependencies?.length ?? 0;
+    const expectedTags = parsed.complianceTags?.length ?? 0;
+    console.log(`  source counts → entities=${String(expectedEntities)} flows=${String(expectedFlows)} glossary=${String(expectedGlossary)} deps=${String(expectedDeps)} tags=${String(expectedTags)}`);
+    // ─── Step 3: putProfile (upsert) ────────────────────────────────────
+    const input = {
+        projectId: lifeline.id,
+        type: parsed.type,
+        domainOntology: parsed.domainOntology,
+        riskProfile: parsed.riskProfile,
+        criticalFlows: parsed.criticalFlows,
+        glossary: parsed.glossary,
+        dependencies: parsed.dependencies ?? [],
+        complianceTags: parsed.complianceTags ?? [],
+        ingestedDocsHash: parsed.ingestedDocsHash,
+        lastIngestedAt,
+    };
+    const { profile, ref } = await store.putProfile(input);
+    console.log(`✓ putProfile → id=${ref.id} projectId=${ref.projectId}`);
+    assertProfileMatches(profile, input, {
+        expectedEntities,
+        expectedFlows,
+        expectedGlossary,
+        expectedDeps,
+        expectedTags,
+    });
+    // ─── Step 4: getProfile round-trip ──────────────────────────────────
+    const fetched = await store.getProfile(lifeline.id);
+    if (!fetched) {
+        throw new Error('getProfile returned null immediately after putProfile');
+    }
+    console.log(`✓ getProfile → returned profile for projectId=${lifeline.id}`);
+    assertProfileMatches(fetched, input, {
+        expectedEntities,
+        expectedFlows,
+        expectedGlossary,
+        expectedDeps,
+        expectedTags,
+    });
+    console.log('  round-trip counts match input (no JSON column truncation)');
+    // ─── Step 5: cross-tenant negative ──────────────────────────────────
+    const wrongTenant = await store.getProfile('not-a-real-project-id-99999');
+    if (wrongTenant !== null) {
+        throw new Error('Tenant isolation broken: getProfile with unknown projectId returned a row.');
+    }
+    console.log('✓ getProfile (unknown projectId) → null (tenant isolation OK)');
+    console.log('\nSPRINT4-PHASE5 PROFILE READY ✓');
+}
+function assertProfileMatches(profile, input, counts) {
+    if (profile.type !== input.type) {
+        throw new Error(`type mismatch: expected ${input.type}, got ${profile.type}`);
+    }
+    if (profile.domainOntology.entities.length !== counts.expectedEntities) {
+        throw new Error(`entities count mismatch: expected ${String(counts.expectedEntities)}, got ${String(profile.domainOntology.entities.length)}`);
+    }
+    if (profile.criticalFlows.length !== counts.expectedFlows) {
+        throw new Error(`criticalFlows count mismatch: expected ${String(counts.expectedFlows)}, got ${String(profile.criticalFlows.length)}`);
+    }
+    if (Object.keys(profile.glossary).length !== counts.expectedGlossary) {
+        throw new Error(`glossary terms count mismatch: expected ${String(counts.expectedGlossary)}, got ${String(Object.keys(profile.glossary).length)}`);
+    }
+    if (profile.dependencies.length !== counts.expectedDeps) {
+        throw new Error(`dependencies count mismatch: expected ${String(counts.expectedDeps)}, got ${String(profile.dependencies.length)}`);
+    }
+    if (profile.complianceTags.length !== counts.expectedTags) {
+        throw new Error(`complianceTags count mismatch: expected ${String(counts.expectedTags)}, got ${String(profile.complianceTags.length)}`);
+    }
+    if (profile.ingestedDocsHash !== input.ingestedDocsHash) {
+        throw new Error(`ingestedDocsHash mismatch: expected ${input.ingestedDocsHash}, got ${profile.ingestedDocsHash}`);
+    }
+}
+main()
+    .catch((err) => {
+    console.error('\n✗ Smoke failed:', err);
+    process.exitCode = 1;
+})
+    .finally(async () => {
+    await prisma.$disconnect();
+});
+//# sourceMappingURL=smoke-seed-lifeline-profile.js.map

package/dist/scripts/smoke-seed-lifeline-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smoke-seed-lifeline-profile.js","sourceRoot":"","sources":["../../src/scripts/smoke-seed-lifeline-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAE9E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,uBAAuB,CAAC,CAAC;AAE5F,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;AAClC,MAAM,KAAK,GAAG,+BAA+B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAE1D,KAAK,UAAU,IAAI;IACjB,uEAAuE;IACvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAE5D,uEAAuE;IACvE,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAE5B,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,qDAAqD,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,uCAAuC,iBAAiB,EAAE,CAAC,CAAC;IAExE,MAAM,gBAAgB,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC/D,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;IAClD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC7D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CACT,8BAA8B,MAAM,CAAC,gBAAgB,CAAC,UAAU,MAAM,CAAC,aAAa,CAAC,aAAa,MAAM,CAAC,gBAAgB,CAAC,SAAS,MAAM,CAAC,YAAY,CAAC,SAAS,MAAM,CAAC,YAAY,CAAC,EAAE,CACvL,CAAC;IAEF,uEAAuE;IACvE,MAAM,KAAK,GAAoB;QAC7B,SAAS,EAAE,QAAQ,CAAC,EAAE;QACtB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACvC,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;QAC3C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,cAAc;KACf,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,CAAC,EAAE,cAAc,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE;QACnC,gBAAgB;QAChB,aAAa;QACb,gBAAgB;QAChB,YAAY;QACZ,YAAY;KACb,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iDAAiD,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IAE5E,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE;QACnC,gBAAgB;QAChB,aAAa;QACb,gBAAgB;QAChB,YAAY;QACZ,YAAY;KACb,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAE3E,uEAAuE;IACvE,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;IAC1E,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAE7E,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAClD,CAAC;AAUD,SAAS,oBAAoB,CAC3B,OAAoB,EACpB,KAAsB,EACtB,MAAyB;IAEzB,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,IAAI,SAAS,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,qCAAqC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAC9H,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CACtH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAClI,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CACnH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,CAAC,gBAAgB,SAAS,OAAO,CAAC,gBAAgB,EAAE,CACjG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtB,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC;KACD,OAAO,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;AAC7B,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@derwinjs/db",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Prisma schema + migrations for Derwin's own Postgres. 14 models, project-namespaced. Per ADR-0005. Ships its own generated Prisma client (multi-platform binaries) for cross-consumer compatibility.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -33,8 +33,8 @@
   },
   "dependencies": {
     "@prisma/client": "^5.22.0",
-    "@derwinjs/core": "0.3.0",
-    "@derwinjs/sdk": "0.3.0"
+    "@derwinjs/core": "0.4.0",
+    "@derwinjs/sdk": "0.4.0"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^2.1.9",
@@ -64,6 +64,7 @@
     "smoke:qa-ticket-store": "tsx src/scripts/smoke-qa-ticket-store.ts",
     "smoke:auto-fix": "tsx src/scripts/smoke-auto-fix.ts",
     "smoke:learning-loop": "tsx src/scripts/smoke-learning-loop.ts",
-    "smoke:orchestration": "tsx src/scripts/smoke-orchestration.ts"
+    "smoke:orchestration": "tsx src/scripts/smoke-orchestration.ts",
+    "smoke:seed-lifeline-profile": "tsx src/scripts/smoke-seed-lifeline-profile.ts"
   }
 }

package/prisma/seed.ts

@@ -6,15 +6,39 @@
  * minimal — just one Project (Lifeline) with its first ProjectProfile, a
  * default Policy, and a single SpendLedger row to verify FKs work.
  *
- * Real Profile content gets generated in QAP-047 (Sprint 4) by ingesting
- * Lifeline's actual docs. This seed is a placeholder that resembles what the
- * generated Profile will look like, so the dev experience isn't empty.
+ * Profile content lives in `seed-data/lifeline-profile.json` (Sprint 4
+ * Phase 5). The JSON is the canonical Lifeline Profile authored against the
+ * product brief §7.1 and is hot-swappable when ingestion (QAP-047) ships.
  *
- * Status: scaffolded in QAP-005. Ingestion-driven seeds replace this in QAP-047.
+ * Status: scaffolded in QAP-005; data externalized to JSON in Sprint 4 Phase 5.
  */
 
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
 import { PrismaClient, ProjectMode, ProjectType } from '../src/prisma.js';
 
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+interface LifelineProfileSeed {
+  type: string;
+  domainOntology: unknown;
+  riskProfile: unknown;
+  criticalFlows: unknown;
+  glossary: unknown;
+  dependencies: unknown;
+  complianceTags: string[];
+  ingestedDocsHash: string;
+  lastIngestedAt: string;
+}
+
+const lifelineProfilePath = join(__dirname, '..', 'seed-data', 'lifeline-profile.json');
+const lifelineProfileData = JSON.parse(
+  readFileSync(lifelineProfilePath, 'utf-8'),
+) as LifelineProfileSeed;
+
 const prisma = new PrismaClient();
 
 async function main() {
@@ -36,75 +60,33 @@ async function main() {
   });
   console.log(`  ✓ Project: ${lifeline.slug} (${lifeline.id})`);
 
-  // ─── 2. Profile (placeholder; real one lands in QAP-047) ────────────
+  // ─── 2. Profile (data sourced from seed-data/lifeline-profile.json) ──
+  const lastIngestedAt = new Date(lifelineProfileData.lastIngestedAt);
   const profile = await prisma.projectProfile.upsert({
     where: { projectId: lifeline.id },
-    update: {},
+    update: {
+      type: lifelineProfileData.type as ProjectType,
+      domainOntology: lifelineProfileData.domainOntology as object,
+      riskProfile: lifelineProfileData.riskProfile as object,
+      criticalFlows: lifelineProfileData.criticalFlows as object,
+      glossary: lifelineProfileData.glossary as object,
+      dependencies: lifelineProfileData.dependencies as object,
+      complianceTags: lifelineProfileData.complianceTags,
+      ingestedDocsHash: lifelineProfileData.ingestedDocsHash,
+      lastIngestedAt,
+      lastEvolvedAt: new Date(),
+    },
     create: {
       projectId: lifeline.id,
-      type: ProjectType.ERP,
-      domainOntology: {
-        entities: [
-          'Patient',
-          'Booking',
-          'Provider',
-          'Encounter',
-          'ChartNote',
-          'Payment',
-          'Location',
-        ],
-        actions: ['book', 'arrive', 'sign', 'bill', 'refund', 'export'],
-        roles: ['admin', 'provider', 'patient', 'front-desk'],
-      },
-      // 8-vector risk weights — see product brief §3.1 + §7.1
-      riskProfile: {
-        codeHealth: 0.8,
-        functionalCorrectness: 1.0,
-        uiUxIntegrity: 0.5,
-        perfResilience: 0.7,
-        security: 0.9,
-        complianceAudit: 1.0, // HIPAA gates this to max
-        multiTenantSafety: 1.0,
-        operationalHealth: 0.7,
-      },
-      criticalFlows: [
-        {
-          name: 'patient-signup-to-first-booking',
-          steps: ['signup', 'verify-email', 'browse-services', 'book', 'confirmation'],
-        },
-        {
-          name: 'booking-to-arrived-to-encounter-to-signed-chart',
-          steps: ['arrive', 'check-in', 'encounter-start', 'chart-note', 'sign'],
-        },
-        {
-          name: 'chart-sign-to-bill-to-payment',
-          steps: ['sign', 'bill-create', 'payment-process', 'reconcile'],
-        },
-        {
-          name: 'admin-onboard-new-tenant',
-          steps: ['create-location', 'invite-providers', 'configure-services'],
-        },
-        {
-          name: 'patient-data-export',
-          steps: ['request', 'verify-identity', 'package', 'deliver'],
-        },
-      ],
-      glossary: {
-        Tenant: 'medspa Location (NOT customer org)',
-        Ticket: 'roadmap item (NOT support ticket)',
-        Patient: 'end-user receiving services',
-        Provider: 'licensed practitioner',
-        Encounter: 'a recorded patient-provider interaction',
-      },
-      dependencies: [
-        { name: 'Vagaro', kind: 'scheduling', integration: 'cron-pull' },
-        { name: 'Stripe', kind: 'payments', integration: 'webhook' },
-        { name: 'Twilio', kind: 'sms', integration: 'webhook' },
-        { name: 'Anthropic API', kind: 'llm', integration: 'http' },
-      ],
-      complianceTags: ['HIPAA', 'SOC 2 (in progress)'],
-      ingestedDocsHash: 'seed-placeholder',
-      lastIngestedAt: new Date(),
+      type: lifelineProfileData.type as ProjectType,
+      domainOntology: lifelineProfileData.domainOntology as object,
+      riskProfile: lifelineProfileData.riskProfile as object,
+      criticalFlows: lifelineProfileData.criticalFlows as object,
+      glossary: lifelineProfileData.glossary as object,
+      dependencies: lifelineProfileData.dependencies as object,
+      complianceTags: lifelineProfileData.complianceTags,
+      ingestedDocsHash: lifelineProfileData.ingestedDocsHash,
+      lastIngestedAt,
       lastEvolvedAt: new Date(),
     },
   });
@@ -168,7 +150,7 @@ async function main() {
   });
   console.log(`  ✓ SpendLedger: seed marker`);
 
-  console.log('\nSeeded Lifeline. Real Profile generation lands in QAP-047 (Sprint 4).');
+  console.log('\nSeeded Lifeline. Profile data: packages/db/seed-data/lifeline-profile.json');
 }
 
 main()