fix(db): protege conexoes e migrations de homologacao

scripts/_bootstrap.ts

@@ -1,8 +1,10 @@
 import path from "node:path";
-import { adapterEnv, identityShimEnabled, isDeployedEnv, requireDatabaseUrl } from "../src/config/env";
+import { adapterEnv, identityShimEnabled, isDeployedEnv } from "../src/config/env";
 import { exitOnInvalidConfig } from "../src/config/fail-fast";
+import { buildPostgresOptions, databaseUrlFor, scrubDbError, type DbPurpose } from "../src/infra/db/connection-policy";
 import { createFileDb } from "../src/infra/db/pglite";
 import { createPostgresDb } from "../src/infra/db/postgres";
+import { assertDatabaseGuard } from "../src/infra/db/target-guard";
 import type { Db } from "../src/infra/db/types";
 
 /**
@@ -10,11 +12,20 @@ import type { Db } from "../src/infra/db/types";
  * obrigatória: cair em PGlite com um segredo ausente faria uma migração
  * silenciosa num arquivo local parecer sucesso.
  */
-export async function openOperationalDb(): Promise<Db> {
-  const databaseUrl = requireDatabaseUrl();
-  if (databaseUrl) return createPostgresDb(databaseUrl);
+export async function openOperationalDb(purpose: DbPurpose): Promise<Db> {
+  const databaseUrl = databaseUrlFor(purpose);
+  if (databaseUrl) {
+    const db = createPostgresDb(databaseUrl, buildPostgresOptions(databaseUrl, purpose));
+    try {
+      await assertDatabaseGuard(db, purpose, databaseUrl);
+      return db;
+    } catch (error) {
+      await db.close().catch(() => undefined);
+      throw error;
+    }
+  }
   if (isDeployedEnv()) {
-    throw new Error("DATABASE_URL é obrigatória fora de development.");
+    throw new Error("DATABASE_URL é obrigatória fora do PGlite de development.");
   }
   const dataDir = path.join(process.cwd(), ".data", "pglite");
   const { mkdir } = await import("node:fs/promises");
@@ -47,17 +58,16 @@ export function runScript(name: string, body: () => Promise<void>): void {
       process.exitCode ??= 0;
     },
     (error: unknown) => {
-      const label = error instanceof Error ? `${error.name}: ${error.message}` : "erro";
-      console.error(`[${name}] ${label}`);
+      console.error(`[${name}] ${scrubDbError(error)}`);
       process.exit(1);
     },
   );
 }
 
 /** Abre o banco, executa e fecha, mesmo em caso de falha. */
-export function runWithDb(name: string, body: (db: Db) => Promise<void>): void {
+export function runWithDb(name: string, purpose: DbPurpose, body: (db: Db) => Promise<void>): void {
   runScript(name, async () => {
-    const db = await openOperationalDb();
+    const db = await openOperationalDb(purpose);
     try {
       await body(db);
     } finally {