chore(db): harden workspace env wrappers

packages/db/src/safe-destructive-env.ts

@@ -1,4 +1,4 @@
-import { assertDestructiveDbAllowed } from "./destructive-db-guard.js";
+import { assertDestructiveDbAllowed, formatTarget, parseDatabaseUrl } from "./destructive-db-guard.js";
 
 const TEST_DATABASE_NAMES = [
   "capakraken_test",
@@ -12,3 +12,23 @@ export function assertSafeSeedTarget(commandName: string) {
     allowedDatabaseNames: TEST_DATABASE_NAMES,
   });
 }
+
+export function assertCapaKrakenDbTarget(commandName: string) {
+  const rawUrl = process.env.DATABASE_URL;
+
+  if (!rawUrl) {
+    throw new Error(
+      `${commandName} aborted: DATABASE_URL is not configured. Run the command through the CapaKraken env wrappers so the workspace env files are loaded.`,
+    );
+  }
+
+  const target = parseDatabaseUrl(rawUrl);
+
+  if (!target.databaseName.startsWith("capakraken")) {
+    throw new Error(
+      `${commandName} aborted: database '${target.databaseName}' is not a valid CapaKraken target. Target=${formatTarget(target)}`,
+    );
+  }
+
+  return target;
+}