chore(db): harden workspace env wrappers

packages/db/src/destructive-db-guard.test.ts

@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 import { assertDestructiveDbAllowed } from "./destructive-db-guard.js";
-import { assertSafeSeedTarget } from "./safe-destructive-env.js";
+import { assertCapaKrakenDbTarget, assertSafeSeedTarget } from "./safe-destructive-env.js";
 
 const ORIGINAL_ENV = { ...process.env };
 
@@ -98,3 +98,35 @@ test("assertSafeSeedTarget rejects unexpected legacy disposable databases", () =
     /not in the destructive-tool allowlist/u,
   );
 });
+
+test("assertCapaKrakenDbTarget accepts non-destructive capakraken targets", () => {
+  setEnv({
+    DATABASE_URL: "postgresql://tester:secret@localhost:5432/capakraken_dev",
+  });
+
+  const target = assertCapaKrakenDbTarget("db:seed:holidays");
+
+  assert.equal(target.databaseName, "capakraken_dev");
+});
+
+test("assertCapaKrakenDbTarget rejects legacy non-capakraken targets", () => {
+  setEnv({
+    DATABASE_URL: "postgresql://tester:secret@localhost:5432/legacy_non_capakraken",
+  });
+
+  assert.throws(
+    () => assertCapaKrakenDbTarget("db:seed:holidays"),
+    /not a valid CapaKraken target/u,
+  );
+});
+
+test("assertCapaKrakenDbTarget explains missing env loading clearly", () => {
+  setEnv({
+    DATABASE_URL: undefined,
+  });
+
+  assert.throws(
+    () => assertCapaKrakenDbTarget("db:update:blueprints"),
+    /Run the command through the CapaKraken env wrappers/u,
+  );
+});