Draft: move to Prisma ORM

.github/workflows/build.yml

@@ -13,12 +13,12 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [20.x]
+        node-version: [25.x]
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v6
     - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v6
       with:
         node-version: ${{ matrix.node-version }}
         cache: 'yarn'

.gitignore

@@ -64,3 +64,5 @@ typings/
 .idea/
 
 build/
+
+/generated/prisma

.vscode/settings.json

@@ -1,16 +1,22 @@
 {
     "editor.formatOnSave": true,
     "files.insertFinalNewline": true,
-    "javascript.preferences.quoteStyle": "single",
-    "typescript.preferences.quoteStyle": "single",
-    "javascript.preferences.importModuleSpecifier": "relative",
-    "typescript.preferences.importModuleSpecifier": "relative",
+    "js/ts.preferences.quoteStyle": "single",
+    "js/ts.preferences.importModuleSpecifier": "relative",
     "files.exclude": {
-        "node_modules": true
+        "**/.git": false,
+        "**/.svn": false,
+        "**/.hg": false,
+        "**/CVS": false,
+        "**/.DS_Store": false,
+        "**/Thumbs.db": false,
+        "node_modules": false,
+        "**/.idea": false
     },
     "npm.packageManager": "yarn",
     "files.eol": "\n",
     "editor.insertSpaces": true,
     "editor.tabSize": 4,
-    "typescript.enablePromptUseWorkspaceTsdk": true
+    "js/ts.tsdk.promptToUseWorkspaceVersion": true,
+    "explorerExclude.backup": {}
 }

Database.Dockerfile

@@ -9,8 +9,4 @@ RUN apt-get update && apt-get install -y postgresql-15-cron && apt-get clean
 RUN echo "shared_preload_libraries='pg_cron'" >> /usr/share/postgresql/postgresql.conf.sample
 RUN echo "cron.database_name = '${POSTGRES_DB}'" >> /usr/share/postgresql/postgresql.conf.sample
 
-# Create the pg_cron extension
-RUN echo "CREATE EXTENSION pg_cron;" >> /docker-entrypoint-initdb.d/init-cron-schema.sql
-
-# Run the init-cron-schema.sql script during container startup
-CMD ["sh", "-c", "chmod +x /docker-entrypoint-initdb.d/init-cron-schema.sql && /usr/local/bin/docker-entrypoint.sh postgres"]
+# pg_cron extension is created by Prisma migrations at bot startup

Dockerfile

@@ -6,5 +6,7 @@ COPY . .
 
 RUN apk --no-cache add curl \
     && yarn install --frozen-lockfile \
-    && yarn env-gen \
-    && curl -fsS https://dotenvx.sh/install.sh | sh
+    && yarn build \
+    && yarn prisma generate \
+    && curl -fsS https://dotenvx.sh/install.sh | sh \
+    && chmod +x /app/scripts/entrypoint.sh

biome.json

@@ -1,6 +1,12 @@
 {
-    "$schema": "https://biomejs.dev/schemas/2.2.4/schema.json",
-    "assist": { "actions": { "source": { "organizeImports": "on" } } },
+    "$schema": "https://biomejs.dev/schemas/2.4.16/schema.json",
+    "assist": {
+        "actions": {
+            "source": {
+                "organizeImports": "on"
+            }
+        }
+    },
     "vcs": {
         "enabled": true,
         "clientKind": "git",

docker-compose.yaml

@@ -46,12 +46,25 @@ services:
     build:
       context: .
       dockerfile: ./Dockerfile
-    command: dotenvx run --convention=nextjs -- yarn start
+    command: dotenvx run --convention=nextjs -- sh /app/scripts/entrypoint.sh
     volumes:
       - bot_logs:/var/log/datadrop/
     depends_on:
       database:
         condition: service_healthy
+      redis:
+        condition: service_healthy
+
+  redis:
+    <<: [*network, *restart-policy, *logging]
+    image: redis:7.2-alpine
+    ports:
+      - "${REDIS_PORT:-6379}:6379"
+    healthcheck:
+      test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
+      interval: 5s
+      timeout: 2s
+      retries: 5
 
 volumes:
   postgres:

docs/README.md

@@ -0,0 +1,25 @@
+# DataDrop Documentation
+
+This folder is the project knowledge base for Issue 93 and related implementation work.
+
+## What is in here
+
+- [Issue 93 Specification](specs/issue-93-specification.md)
+- [Architecture](specs/architecture.md)
+- [Membership State Machine](specs/state-machine.md)
+- [BPMN-Style Lifecycle](specs/bpmn-lifecycle.md)
+- [MVP Scope](specs/mvp-scope.md)
+- [Discord API and Discord.js Sources](specs/discord-sources.md)
+- [GitHub Sources](specs/github-sources.md)
+- [Strict Traceability Matrix](specs/traceability-matrix.md)
+- [Roadmap Beyond MVP](specs/non-mvp-roadmap.md)
+
+## Visual Assets
+
+- Feature list snapshot: ![Issue 93 Feature Map](assets/issue-93-feature-list.svg)
+- Project visual marker: ![DataDrop Visual Marker](assets/datadrop-visual-marker.svg)
+
+## Notes
+
+- Mermaid diagrams are embedded directly in markdown files.
+- Any statement tied to Discord API or Discord.js behavior is sourced in [Discord API and Discord.js Sources](specs/discord-sources.md).

docs/specs/architecture.md

@@ -0,0 +1,68 @@
+# Architecture
+
+## Context
+
+DataDrop has two behavior entrypoints:
+
+1. Discord Bot runtime
+2. Web App + Backend API
+
+Both must enforce the same business rules and write to the same domain model.
+
+## High-Level System Diagram
+
+```mermaid
+flowchart LR
+    U[User] -->|Discord Client| D[Discord Platform]
+    U -->|Browser| W[Web App]
+
+    D -->|Gateway Events| B[DataDrop Bot]
+    B -->|Commands, role updates, onboarding checks| D
+
+    W -->|JWT-authenticated calls| A[DataDrop Backend API]
+    A --> DB[(PostgreSQL)]
+    B --> DB
+
+    DB --> Q[Dead Letter Queue]
+    Q --> R[Staff Remediation Panel]
+
+    A --> O[Audit and Security Logs]
+    B --> O
+```
+
+## Tenant and Access Flow
+
+```mermaid
+sequenceDiagram
+    participant User
+    participant Web as Web App
+    participant Discord as Discord OAuth API
+    participant API as Backend API
+    participant DB as PostgreSQL
+
+    User->>Web: Login with Discord
+    Web->>Discord: OAuth exchange
+    Discord-->>Web: user identity + guild list
+    Web->>API: fetch guilds known by DataDrop for user
+    API->>DB: read guild memberships and roles
+    DB-->>API: guilds from platform scope
+    API-->>Web: intersection list for guild selector
+    User->>Web: select guild
+    Web->>API: request guild context
+    API->>DB: action-time authorization check
+    DB-->>API: allowed or denied
+    API-->>Web: scoped response
+```
+
+## Cross-Entrypoint Consistency
+
+Design rule:
+
+- Bot and API writes use strict optimistic locking
+- Transition preconditions include expected state and expected version
+- Conflict retries are bounded
+- Retry exhaustion creates dead-letter records
+
+## Source Notes
+
+For Discord gateway and member update semantics, see [Discord API and Discord.js Sources](discord-sources.md).

docs/specs/bpmn-lifecycle.md

@@ -0,0 +1,47 @@
+# BPMN-Style Lifecycle Flow
+
+This document captures the intended operational flow for onboarding, eligibility, rules acceptance, verification, and admin override handling.
+
+## Flow Diagram
+
+```mermaid
+flowchart TD
+    A[Member joins guild] --> B[Discord onboarding starts]
+    B --> C{Onboarding completed?}
+    C -->|No| B
+    C -->|Yes| D[Eligibility evaluation from roles and rules]
+
+    D --> E{Eligible?}
+    E -->|No| X[RejectedNotEligible]
+    E -->|Yes| F[RulesAccepted]
+
+    F --> G[VerificationPending]
+    G --> H{Verification success?}
+    H -->|Code verified| I[Verified]
+    H -->|Admin implicit verification valid| I
+    H -->|Deadline exceeded| J[Kicked or Rejected]
+
+    G --> K{Admin implicit verification request}
+    K -->|State != VerificationPending| L[Hard reject override]
+    K -->|Email missing| M[Hard fail override]
+    K -->|State ok and email present| I
+
+    I --> N{Reverification campaign targeted?}
+    N -->|No| O[Remain Verified]
+    N -->|Yes| P[Return to VerificationPending]
+```
+
+## Rule Highlights
+
+1. Rules acceptance remains per guild because onboarding is a guild-bound Discord flow.
+2. Global verification identity does not bypass guild onboarding acceptance.
+3. Manual implicit verification is constrained to `VerificationPending` and requires email presence.
+4. Historical override does not provide permanent bypass entitlement in future campaigns.
+
+## Discord-Specific Notes
+
+1. Member updates are observed through gateway member update events.
+2. Onboarding and member flags are platform-defined by Discord.
+3. Membership screening and pending semantics are Discord-defined.
+
+Reference all platform-specific semantics through [Discord API and Discord.js Sources](discord-sources.md).