feat(migrate-ts): ledger baseline marker (recordBaseline / baselineRecord)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: dmealing

server/typescript/packages/migrate-ts/src/apply/ledger.ts

@@ -193,3 +193,42 @@ export async function appliedRecords(
   }
   return map;
 }
+
+/** Reserved ledger name for the baseline marker (sorts before any timestamped migration). */
+export const BASELINE_NAME = "0000-baseline";
+
+/**
+ * Record (or overwrite) the baseline marker — the snapshot checksum captured when
+ * `migrate baseline` seeded the reference snapshot. Lets a later check detect a
+ * snapshot that was hand-edited out of sync with the migration chain.
+ */
+export async function recordBaseline(
+  db: Kysely<Record<string, unknown>>,
+  dialect: LedgerDialect = "sqlite",
+  checksum: string,
+  opts?: LedgerOptions,
+): Promise<void> {
+  const ledger = resolveLedger(dialect, opts);
+  await ensureLedger(db, dialect, opts);
+  const appliedAt = new Date().toISOString();
+  // Upsert: delete any prior baseline, then insert (portable across sqlite/pg).
+  await sql`DELETE FROM ${ledger.ref} WHERE name = ${BASELINE_NAME}`.execute(db);
+  await sql`
+    INSERT INTO ${ledger.ref} (name, applied_at, checksum)
+    VALUES (${BASELINE_NAME}, ${appliedAt}, ${checksum})
+  `.execute(db);
+}
+
+/** Read the baseline marker, or null if none recorded. */
+export async function baselineRecord(
+  db: Kysely<Record<string, unknown>>,
+  dialect: LedgerDialect = "sqlite",
+  opts?: LedgerOptions,
+): Promise<{ name: string; checksum: string } | null> {
+  const ledger = resolveLedger(dialect, opts);
+  const result = await sql<{ name: string; checksum: string }>`
+    SELECT name, checksum FROM ${ledger.ref} WHERE name = ${BASELINE_NAME}
+  `.execute(db);
+  const row = result.rows[0];
+  return row ? { name: row.name, checksum: row.checksum } : null;
+}

server/typescript/packages/migrate-ts/test/integrity/baseline-marker.test.ts

@@ -0,0 +1,26 @@
+// test/integrity/baseline-marker.test.ts
+import { describe, test, expect, afterAll } from "bun:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { Kysely } from "kysely";
+import { LibsqlDialect } from "@libsql/kysely-libsql";
+import { ensureLedger, recordBaseline, baselineRecord } from "../../src/apply/ledger.js";
+
+const tmps: string[] = [];
+function db(file: string) { return new Kysely<Record<string, unknown>>({ dialect: new LibsqlDialect({ url: `file:${file}` }) }); }
+async function root() { const d = await mkdtemp(join(tmpdir(), "baseline-")); tmps.push(d); return d; }
+afterAll(async () => { for (const d of tmps) await rm(d, { recursive: true, force: true }); });
+
+describe("ledger baseline marker", () => {
+  test("recordBaseline stores the checksum; baselineRecord reads it back", async () => {
+    const k = db(join(await root(), "b.db"));
+    try {
+      await ensureLedger(k, "sqlite");
+      expect(await baselineRecord(k, "sqlite")).toBeNull();
+      await recordBaseline(k, "sqlite", "abc123checksum");
+      const rec = await baselineRecord(k, "sqlite");
+      expect(rec?.checksum).toBe("abc123checksum");
+    } finally { await k.destroy(); }
+  });
+});