@derwinjs/db 0.3.0 → 0.5.0

package/dist/scripts/smoke-seed-lifeline-profile.js

@@ -0,0 +1,130 @@
+/**
+ * Sprint 4 Phase 5 smoke — exercises the ProjectProfileStore against the real
+ * local Postgres by upserting the canonical Lifeline Profile from JSON.
+ *
+ * Run: pnpm --filter @derwinjs/db smoke:seed-lifeline-profile
+ *
+ * Prereqs:
+ *   - Local Postgres running on port 5433 (per Sprint 1 docker setup)
+ *   - DATABASE_URL set in packages/db/.env
+ *   - Migrations applied (Sprint 4 Phase 1 ProjectProfile model present)
+ *   - Seed run at least once so the Lifeline project row exists
+ *
+ * What this proves:
+ *   1. lifeline-profile.json parses and conforms to PutProfileInput
+ *   2. createPrismaProjectProfileStore().putProfile round-trips entities,
+ *      criticalFlows, glossary, dependencies, complianceTags
+ *   3. getProfile returns identical counts (no silent JSON column truncation)
+ *
+ * Idempotent: putProfile is upsert-shaped, so re-running just refreshes
+ * lastEvolvedAt/updatedAt without polluting the table. No cleanup needed.
+ *
+ * Prints "SPRINT4-PHASE5 PROFILE READY ✓" on success. Exits 1 on any failure.
+ */
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { PrismaClient } from '../prisma.js';
+import { createPrismaProjectProfileStore } from '../project-profile-store.js';
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const PROFILE_JSON_PATH = join(__dirname, '..', '..', 'seed-data', 'lifeline-profile.json');
+const prisma = new PrismaClient();
+const store = createPrismaProjectProfileStore({ prisma });
+async function main() {
+    // ─── Step 1: locate Lifeline project ────────────────────────────────
+    const lifeline = await prisma.project.findUnique({ where: { slug: 'lifeline' } });
+    if (!lifeline) {
+        throw new Error("Lifeline project (slug='lifeline') not found. Run `pnpm --filter @derwinjs/db db:seed` first.");
+    }
+    console.log(`✓ Found Lifeline project (id=${lifeline.id})`);
+    // ─── Step 2: load + parse the JSON ──────────────────────────────────
+    const raw = readFileSync(PROFILE_JSON_PATH, 'utf-8');
+    const parsed = JSON.parse(raw);
+    const lastIngestedAt = new Date(parsed.lastIngestedAt);
+    if (Number.isNaN(lastIngestedAt.getTime())) {
+        throw new Error(`lifeline-profile.json has invalid lastIngestedAt: ${parsed.lastIngestedAt}`);
+    }
+    console.log(`✓ Loaded lifeline-profile.json from ${PROFILE_JSON_PATH}`);
+    const expectedEntities = parsed.domainOntology.entities.length;
+    const expectedFlows = parsed.criticalFlows.length;
+    const expectedGlossary = Object.keys(parsed.glossary).length;
+    const expectedDeps = parsed.dependencies?.length ?? 0;
+    const expectedTags = parsed.complianceTags?.length ?? 0;
+    console.log(`  source counts → entities=${String(expectedEntities)} flows=${String(expectedFlows)} glossary=${String(expectedGlossary)} deps=${String(expectedDeps)} tags=${String(expectedTags)}`);
+    // ─── Step 3: putProfile (upsert) ────────────────────────────────────
+    const input = {
+        projectId: lifeline.id,
+        type: parsed.type,
+        domainOntology: parsed.domainOntology,
+        riskProfile: parsed.riskProfile,
+        criticalFlows: parsed.criticalFlows,
+        glossary: parsed.glossary,
+        dependencies: parsed.dependencies ?? [],
+        complianceTags: parsed.complianceTags ?? [],
+        ingestedDocsHash: parsed.ingestedDocsHash,
+        lastIngestedAt,
+    };
+    const { profile, ref } = await store.putProfile(input);
+    console.log(`✓ putProfile → id=${ref.id} projectId=${ref.projectId}`);
+    assertProfileMatches(profile, input, {
+        expectedEntities,
+        expectedFlows,
+        expectedGlossary,
+        expectedDeps,
+        expectedTags,
+    });
+    // ─── Step 4: getProfile round-trip ──────────────────────────────────
+    const fetched = await store.getProfile(lifeline.id);
+    if (!fetched) {
+        throw new Error('getProfile returned null immediately after putProfile');
+    }
+    console.log(`✓ getProfile → returned profile for projectId=${lifeline.id}`);
+    assertProfileMatches(fetched, input, {
+        expectedEntities,
+        expectedFlows,
+        expectedGlossary,
+        expectedDeps,
+        expectedTags,
+    });
+    console.log('  round-trip counts match input (no JSON column truncation)');
+    // ─── Step 5: cross-tenant negative ──────────────────────────────────
+    const wrongTenant = await store.getProfile('not-a-real-project-id-99999');
+    if (wrongTenant !== null) {
+        throw new Error('Tenant isolation broken: getProfile with unknown projectId returned a row.');
+    }
+    console.log('✓ getProfile (unknown projectId) → null (tenant isolation OK)');
+    console.log('\nSPRINT4-PHASE5 PROFILE READY ✓');
+}
+function assertProfileMatches(profile, input, counts) {
+    if (profile.type !== input.type) {
+        throw new Error(`type mismatch: expected ${input.type}, got ${profile.type}`);
+    }
+    if (profile.domainOntology.entities.length !== counts.expectedEntities) {
+        throw new Error(`entities count mismatch: expected ${String(counts.expectedEntities)}, got ${String(profile.domainOntology.entities.length)}`);
+    }
+    if (profile.criticalFlows.length !== counts.expectedFlows) {
+        throw new Error(`criticalFlows count mismatch: expected ${String(counts.expectedFlows)}, got ${String(profile.criticalFlows.length)}`);
+    }
+    if (Object.keys(profile.glossary).length !== counts.expectedGlossary) {
+        throw new Error(`glossary terms count mismatch: expected ${String(counts.expectedGlossary)}, got ${String(Object.keys(profile.glossary).length)}`);
+    }
+    if (profile.dependencies.length !== counts.expectedDeps) {
+        throw new Error(`dependencies count mismatch: expected ${String(counts.expectedDeps)}, got ${String(profile.dependencies.length)}`);
+    }
+    if (profile.complianceTags.length !== counts.expectedTags) {
+        throw new Error(`complianceTags count mismatch: expected ${String(counts.expectedTags)}, got ${String(profile.complianceTags.length)}`);
+    }
+    if (profile.ingestedDocsHash !== input.ingestedDocsHash) {
+        throw new Error(`ingestedDocsHash mismatch: expected ${input.ingestedDocsHash}, got ${profile.ingestedDocsHash}`);
+    }
+}
+main()
+    .catch((err) => {
+    console.error('\n✗ Smoke failed:', err);
+    process.exitCode = 1;
+})
+    .finally(async () => {
+    await prisma.$disconnect();
+});
+//# sourceMappingURL=smoke-seed-lifeline-profile.js.map

package/dist/scripts/smoke-seed-lifeline-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smoke-seed-lifeline-profile.js","sourceRoot":"","sources":["../../src/scripts/smoke-seed-lifeline-profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AAE9E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,uBAAuB,CAAC,CAAC;AAE5F,MAAM,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;AAClC,MAAM,KAAK,GAAG,+BAA+B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAE1D,KAAK,UAAU,IAAI;IACjB,uEAAuE;IACvE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAClF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,gCAAgC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAE5D,uEAAuE;IACvE,MAAM,GAAG,GAAG,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAE5B,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,qDAAqD,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,uCAAuC,iBAAiB,EAAE,CAAC,CAAC;IAExE,MAAM,gBAAgB,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC/D,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC;IAClD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC7D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC;IACtD,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CACT,8BAA8B,MAAM,CAAC,gBAAgB,CAAC,UAAU,MAAM,CAAC,aAAa,CAAC,aAAa,MAAM,CAAC,gBAAgB,CAAC,SAAS,MAAM,CAAC,YAAY,CAAC,SAAS,MAAM,CAAC,YAAY,CAAC,EAAE,CACvL,CAAC;IAEF,uEAAuE;IACvE,MAAM,KAAK,GAAoB;QAC7B,SAAS,EAAE,QAAQ,CAAC,EAAE;QACtB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;QACvC,cAAc,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;QAC3C,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,cAAc;KACf,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,CAAC,EAAE,cAAc,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtE,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE;QACnC,gBAAgB;QAChB,aAAa;QACb,gBAAgB;QAChB,YAAY;QACZ,YAAY;KACb,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iDAAiD,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IAE5E,oBAAoB,CAAC,OAAO,EAAE,KAAK,EAAE;QACnC,gBAAgB;QAChB,aAAa;QACb,gBAAgB;QAChB,YAAY;QACZ,YAAY;KACb,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAE3E,uEAAuE;IACvE,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAAC;IAC1E,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAE7E,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;AAClD,CAAC;AAUD,SAAS,oBAAoB,CAC3B,OAAoB,EACpB,KAAsB,EACtB,MAAyB;IAEzB,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,CAAC,IAAI,SAAS,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,qCAAqC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAC9H,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,0CAA0C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CACtH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,SAAS,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAClI,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,yCAAyC,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CACnH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CACvH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,uCAAuC,KAAK,CAAC,gBAAgB,SAAS,OAAO,CAAC,gBAAgB,EAAE,CACjG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,IAAI,EAAE;KACH,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtB,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IACxC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC;KACD,OAAO,CAAC,KAAK,IAAI,EAAE;IAClB,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;AAC7B,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@derwinjs/db",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Prisma schema + migrations for Derwin's own Postgres. 14 models, project-namespaced. Per ADR-0005. Ships its own generated Prisma client (multi-platform binaries) for cross-consumer compatibility.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -33,8 +33,8 @@
   },
   "dependencies": {
     "@prisma/client": "^5.22.0",
-    "@derwinjs/core": "0.3.0",
-    "@derwinjs/sdk": "0.3.0"
+    "@derwinjs/core": "0.5.0",
+    "@derwinjs/sdk": "0.5.0"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^2.1.9",
@@ -64,6 +64,7 @@
     "smoke:qa-ticket-store": "tsx src/scripts/smoke-qa-ticket-store.ts",
     "smoke:auto-fix": "tsx src/scripts/smoke-auto-fix.ts",
     "smoke:learning-loop": "tsx src/scripts/smoke-learning-loop.ts",
-    "smoke:orchestration": "tsx src/scripts/smoke-orchestration.ts"
+    "smoke:orchestration": "tsx src/scripts/smoke-orchestration.ts",
+    "smoke:seed-lifeline-profile": "tsx src/scripts/smoke-seed-lifeline-profile.ts"
   }
 }

package/prisma/migrations/20260506180000_enable_pgvector_and_vector_column/migration.sql

@@ -0,0 +1,12 @@
+-- Sprint 5 Phase 1 — Enable pgvector extension + migrate RAGCorpus.embedding to vector(1536)
+-- The corpus is empty at v0.4.0 — DROP+ADD is safe (no data loss).
+-- Index uses HNSW with cosine ops for similarity search per pgvector docs.
+
+CREATE EXTENSION IF NOT EXISTS vector;
+
+ALTER TABLE "derwin"."rag_corpus" DROP COLUMN IF EXISTS "embedding";
+ALTER TABLE "derwin"."rag_corpus" ADD COLUMN "embedding" vector(1536);
+
+CREATE INDEX "rag_corpus_embedding_hnsw_idx"
+  ON "derwin"."rag_corpus"
+  USING hnsw ("embedding" vector_cosine_ops);

package/prisma/schema.prisma

@@ -11,9 +11,11 @@
 //   2. A multi-project broken-fixture E2E that asserts isolation
 //      (added in Sprint 13 / QAP-130).
 //
-// pgvector convention: `embedding Bytes?` on RAGCorpus is the v1 storage type.
-// QAP-076 (Sprint 7 — RAG corpus add) switches it to a pgvector `vector(1536)`
-// column once the extension is enabled in QAP-036.
+// pgvector convention: Sprint 5 Phase 1 enabled the pgvector extension and
+// migrated `RAGCorpus.embedding` to `vector(1536)`. The column is typed as
+// `Unsupported("vector(1536)")` because Prisma 5.22.0 has no native vector
+// type — reads/writes use raw SQL via `$queryRaw` / `$executeRaw`. The HNSW
+// index with `vector_cosine_ops` lives in the migration SQL.
 //
 // Multi-schema: every model + enum is in the `derwin` Postgres schema (not
 // `public`). This isolates Derwin's tables from each consumer's existing
@@ -494,16 +496,17 @@ model ClassificationTrust {
 }
 
 // Successful past fixes used as in-context examples for new dispatches.
-// Embedding column is Bytes for v1; QAP-076 (Sprint 7) switches to pgvector.
+// Embedding column is `vector(1536)` (pgvector); Sprint 5 Phase 1 enabled the
+// extension and migrated from `Bytes?`. See file header for query convention.
 model RAGCorpus {
   id             String          @id @default(cuid())
   projectId      String
   classification String
   surface        SurfaceCategory
 
-  promptText String @db.Text // the prompt that produced the fix
-  diff       String @db.Text // the unified diff that worked
-  embedding  Bytes? // for semantic search
+  promptText String                       @db.Text // the prompt that produced the fix
+  diff       String                       @db.Text // the unified diff that worked
+  embedding  Unsupported("vector(1536)")? // pgvector — Sprint 5 Phase 1 enabled the extension. Queries via raw SQL because Prisma 5.22.0 doesn't have native vector type support.
 
   fixAttemptId   String // back-reference to the source attempt
   outcomeQuality Float // priority weight; declines if later usage shows problems

package/prisma/seed.ts

@@ -6,15 +6,39 @@
  * minimal — just one Project (Lifeline) with its first ProjectProfile, a
  * default Policy, and a single SpendLedger row to verify FKs work.
  *
- * Real Profile content gets generated in QAP-047 (Sprint 4) by ingesting
- * Lifeline's actual docs. This seed is a placeholder that resembles what the
- * generated Profile will look like, so the dev experience isn't empty.
+ * Profile content lives in `seed-data/lifeline-profile.json` (Sprint 4
+ * Phase 5). The JSON is the canonical Lifeline Profile authored against the
+ * product brief §7.1 and is hot-swappable when ingestion (QAP-047) ships.
  *
- * Status: scaffolded in QAP-005. Ingestion-driven seeds replace this in QAP-047.
+ * Status: scaffolded in QAP-005; data externalized to JSON in Sprint 4 Phase 5.
  */
 
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
 import { PrismaClient, ProjectMode, ProjectType } from '../src/prisma.js';
 
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+
+interface LifelineProfileSeed {
+  type: string;
+  domainOntology: unknown;
+  riskProfile: unknown;
+  criticalFlows: unknown;
+  glossary: unknown;
+  dependencies: unknown;
+  complianceTags: string[];
+  ingestedDocsHash: string;
+  lastIngestedAt: string;
+}
+
+const lifelineProfilePath = join(__dirname, '..', 'seed-data', 'lifeline-profile.json');
+const lifelineProfileData = JSON.parse(
+  readFileSync(lifelineProfilePath, 'utf-8'),
+) as LifelineProfileSeed;
+
 const prisma = new PrismaClient();
 
 async function main() {
@@ -36,75 +60,33 @@ async function main() {
   });
   console.log(`  ✓ Project: ${lifeline.slug} (${lifeline.id})`);
 
-  // ─── 2. Profile (placeholder; real one lands in QAP-047) ────────────
+  // ─── 2. Profile (data sourced from seed-data/lifeline-profile.json) ──
+  const lastIngestedAt = new Date(lifelineProfileData.lastIngestedAt);
   const profile = await prisma.projectProfile.upsert({
     where: { projectId: lifeline.id },
-    update: {},
+    update: {
+      type: lifelineProfileData.type as ProjectType,
+      domainOntology: lifelineProfileData.domainOntology as object,
+      riskProfile: lifelineProfileData.riskProfile as object,
+      criticalFlows: lifelineProfileData.criticalFlows as object,
+      glossary: lifelineProfileData.glossary as object,
+      dependencies: lifelineProfileData.dependencies as object,
+      complianceTags: lifelineProfileData.complianceTags,
+      ingestedDocsHash: lifelineProfileData.ingestedDocsHash,
+      lastIngestedAt,
+      lastEvolvedAt: new Date(),
+    },
     create: {
       projectId: lifeline.id,
-      type: ProjectType.ERP,
-      domainOntology: {
-        entities: [
-          'Patient',
-          'Booking',
-          'Provider',
-          'Encounter',
-          'ChartNote',
-          'Payment',
-          'Location',
-        ],
-        actions: ['book', 'arrive', 'sign', 'bill', 'refund', 'export'],
-        roles: ['admin', 'provider', 'patient', 'front-desk'],
-      },
-      // 8-vector risk weights — see product brief §3.1 + §7.1
-      riskProfile: {
-        codeHealth: 0.8,
-        functionalCorrectness: 1.0,
-        uiUxIntegrity: 0.5,
-        perfResilience: 0.7,
-        security: 0.9,
-        complianceAudit: 1.0, // HIPAA gates this to max
-        multiTenantSafety: 1.0,
-        operationalHealth: 0.7,
-      },
-      criticalFlows: [
-        {
-          name: 'patient-signup-to-first-booking',
-          steps: ['signup', 'verify-email', 'browse-services', 'book', 'confirmation'],
-        },
-        {
-          name: 'booking-to-arrived-to-encounter-to-signed-chart',
-          steps: ['arrive', 'check-in', 'encounter-start', 'chart-note', 'sign'],
-        },
-        {
-          name: 'chart-sign-to-bill-to-payment',
-          steps: ['sign', 'bill-create', 'payment-process', 'reconcile'],
-        },
-        {
-          name: 'admin-onboard-new-tenant',
-          steps: ['create-location', 'invite-providers', 'configure-services'],
-        },
-        {
-          name: 'patient-data-export',
-          steps: ['request', 'verify-identity', 'package', 'deliver'],
-        },
-      ],
-      glossary: {
-        Tenant: 'medspa Location (NOT customer org)',
-        Ticket: 'roadmap item (NOT support ticket)',
-        Patient: 'end-user receiving services',
-        Provider: 'licensed practitioner',
-        Encounter: 'a recorded patient-provider interaction',
-      },
-      dependencies: [
-        { name: 'Vagaro', kind: 'scheduling', integration: 'cron-pull' },
-        { name: 'Stripe', kind: 'payments', integration: 'webhook' },
-        { name: 'Twilio', kind: 'sms', integration: 'webhook' },
-        { name: 'Anthropic API', kind: 'llm', integration: 'http' },
-      ],
-      complianceTags: ['HIPAA', 'SOC 2 (in progress)'],
-      ingestedDocsHash: 'seed-placeholder',
-      lastIngestedAt: new Date(),
+      type: lifelineProfileData.type as ProjectType,
+      domainOntology: lifelineProfileData.domainOntology as object,
+      riskProfile: lifelineProfileData.riskProfile as object,
+      criticalFlows: lifelineProfileData.criticalFlows as object,
+      glossary: lifelineProfileData.glossary as object,
+      dependencies: lifelineProfileData.dependencies as object,
+      complianceTags: lifelineProfileData.complianceTags,
+      ingestedDocsHash: lifelineProfileData.ingestedDocsHash,
+      lastIngestedAt,
       lastEvolvedAt: new Date(),
     },
   });
@@ -168,7 +150,7 @@ async function main() {
   });
   console.log(`  ✓ SpendLedger: seed marker`);
 
-  console.log('\nSeeded Lifeline. Real Profile generation lands in QAP-047 (Sprint 4).');
+  console.log('\nSeeded Lifeline. Profile data: packages/db/seed-data/lifeline-profile.json');
 }
 
 main()