fix: e2e seed timestamps and production safety guard

apps/dashboard/e2e/global-setup.ts

@@ -2,6 +2,12 @@ import { seedDatabase } from './seed-db'
 
 export default async function globalSetup() {
   const dbUrl = process.env['TURSO_DATABASE_URL']
-  if (!dbUrl?.startsWith('file:')) return // Only seed local file DBs
-  await seedDatabase(dbUrl)
+  if (!dbUrl) return
+
+  const isSeedable = dbUrl.startsWith('file:') || /^libsql:\/\/switchflag-pr-\d+-/.test(dbUrl)
+
+  if (!isSeedable) return
+
+  const authToken = process.env['TURSO_AUTH_TOKEN']
+  await seedDatabase(dbUrl, authToken)
 }

apps/dashboard/e2e/seed-db.ts

@@ -13,7 +13,7 @@ const personaIds = Object.values(PERSONAS)
 
 export async function seedDatabase(dbUrl: string, authToken?: string) {
   const client = createClient({ url: dbUrl, ...(authToken ? { authToken } : {}) })
-  const now = Math.floor(Date.now() / 1000)
+  const now = Date.now()
 
   // Clean existing seed data (idempotent)
   await client.executeMultiple(`
@@ -82,13 +82,32 @@ export async function seedDatabase(dbUrl: string, authToken?: string) {
   console.log('Seed complete — created org + project + %d personas', Object.keys(PERSONAS).length)
 }
 
+function assertSafeToSeed(url: string): void {
+  // Layer 1: Block production Vercel environment
+  if (process.env['VERCEL_ENV'] === 'production') {
+    throw new Error('FATAL: refusing to seed — VERCEL_ENV is production')
+  }
+
+  // Layer 2: Allowlist — only known-safe URL patterns
+  const isSafe =
+    url.startsWith('file:') || // Local file DB (CI + local dev)
+    /^libsql:\/\/switchflag-pr-\d+-/.test(url) // Ephemeral PR DB (preview-db.yml)
+
+  if (!isSafe) {
+    throw new Error(
+      `FATAL: refusing to seed "${url}" — only local file DBs and ephemeral PR databases (switchflag-pr-*) are allowed`
+    )
+  }
+}
+
 // CLI entry point: tsx e2e/seed-db.ts
 if (import.meta.url === `file://${process.argv[1]}`) {
   const url = process.env['TURSO_DATABASE_URL']
   if (!url) {
     console.error('TURSO_DATABASE_URL is required')
     process.exit(1)
   }
+  assertSafeToSeed(url)
   const token = process.env['TURSO_AUTH_TOKEN']
   await seedDatabase(url, token)
 }