fix(db): implementa identidade persistente segura para homologacao

scripts/init-project-identity.ts

@@ -0,0 +1,34 @@
+import { buildPostgresOptions, databaseUrlFor, DatabaseGuardError } from "../src/infra/db/connection-policy";
+import { createPostgresDb } from "../src/infra/db/postgres";
+import { assertInitAuthorized, installProjectIdentity } from "../src/infra/db/project-identity";
+import { assertAdminTarget } from "../src/infra/db/target-guard";
+import { bootstrapScript, runScript } from "./_bootstrap";
+
+/**
+ * Grava `adaptador_guard.project_identity` uma única vez.
+ * Exige ADAPTER_INIT_PROJECT_IDENTITY=1 e o destino administrativo já conferido.
+ * Migrate, seed e deploy não chamam este script.
+ */
+try {
+  assertInitAuthorized(process.env);
+} catch (error) {
+  const code = error instanceof DatabaseGuardError ? error.code : "init_recusada";
+  console.error(`[init-project-identity] ${code}`);
+  process.exit(1);
+}
+
+bootstrapScript("init-project-identity");
+
+runScript("init-project-identity", async () => {
+  const databaseUrl = databaseUrlFor("admin");
+  if (!databaseUrl) throw new DatabaseGuardError("url_ausente");
+  const db = createPostgresDb(databaseUrl, buildPostgresOptions(databaseUrl, "admin"));
+  try {
+    await assertAdminTarget(db);
+    const ref = process.env.ADAPTER_DB_PROJECT_REF?.trim() ?? "";
+    const result = await installProjectIdentity(db, ref);
+    console.log(`identidade: ${result}`);
+  } finally {
+    await db.close().catch(() => undefined);
+  }
+});