@breeztech/breez-sdk-spark 0.23.1 → 0.24.1

package/nodejs/breez_sdk_spark_wasm.js

@@ -93,6 +93,13 @@ class BitcoinChainServiceHandle {
         const ret = wasm.bitcoinchainservicehandle_recommendedFees(this.__wbg_ptr);
         return ret;
     }
+    /**
+     * @returns {Promise<any>}
+     */
+    tipHeight() {
+        const ret = wasm.bitcoinchainservicehandle_tipHeight(this.__wbg_ptr);
+        return ret;
+    }
 }
 if (Symbol.dispose) BitcoinChainServiceHandle.prototype[Symbol.dispose] = BitcoinChainServiceHandle.prototype.free;
 exports.BitcoinChainServiceHandle = BitcoinChainServiceHandle;
@@ -241,6 +248,14 @@ class BreezSdk {
         const ret = wasm.breezsdk_exportUnilateralExitState(this.__wbg_ptr);
         return ret;
     }
+    /**
+     * @param {FetchClaimDepositQuoteRequest} request
+     * @returns {Promise<FetchClaimDepositQuoteResponse>}
+     */
+    fetchClaimDepositQuote(request) {
+        const ret = wasm.breezsdk_fetchClaimDepositQuote(this.__wbg_ptr, request);
+        return ret;
+    }
     /**
      * @param {FetchConversionLimitsRequest} request
      * @returns {Promise<FetchConversionLimitsResponse>}
@@ -1231,7 +1246,10 @@ class PasskeyClient {
         var ptr0 = isLikeNone(breez_api_key) ? 0 : passStringToWasm0(breez_api_key, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
         var len0 = WASM_VECTOR_LEN;
         const ret = wasm.passkeyclient_new(prf_provider, ptr0, len0, isLikeNone(config) ? 0 : addToExternrefTable0(config));
-        this.__wbg_ptr = ret;
+        if (ret[2]) {
+            throw takeFromExternrefTable0(ret[1]);
+        }
+        this.__wbg_ptr = ret[0];
         PasskeyClientFinalization.register(this, this.__wbg_ptr, this);
         return this;
     }
@@ -2141,10 +2159,6 @@ function __wbg_get_imports() {
             const ret = arg0.applyPaymentUpdate(arg1);
             return ret;
         }, arguments); },
-        __wbg_arrayBuffer_87e3ac06d961f7a0: function() { return handleError(function (arg0) {
-            const ret = arg0.arrayBuffer();
-            return ret;
-        }, arguments); },
         __wbg_beforeSend_e8a50acd6afd73ed: function() { return handleError(function (arg0, arg1, arg2) {
             var v0 = getArrayJsValueFromWasm0(arg1, arg2).slice();
             wasm.__wbindgen_free(arg1, arg2 * 4, 4);
@@ -3543,10 +3557,6 @@ function __wbg_get_imports() {
             const ret = arg0.syncUpdateRecordFromIncoming(arg1);
             return ret;
         }, arguments); },
-        __wbg_text_de416916b5c06490: function() { return handleError(function (arg0) {
-            const ret = arg0.text();
-            return ret;
-        }, arguments); },
         __wbg_then_20a157d939b514f5: function(arg0, arg1) {
             const ret = arg0.then(arg1);
             return ret;
@@ -3555,6 +3565,10 @@ function __wbg_get_imports() {
             const ret = arg0.then(arg1, arg2);
             return ret;
         },
+        __wbg_tipHeight_e14ddf8ed9a68d5a: function() { return handleError(function (arg0) {
+            const ret = arg0.tipHeight();
+            return ret;
+        }, arguments); },
         __wbg_toString_15656af8d8e71f16: function(arg0, arg1, arg2) {
             const ret = arg1.toString(arg2);
             const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
@@ -3662,27 +3676,27 @@ function __wbg_get_imports() {
             return ret;
         },
         __wbindgen_cast_0000000000000002: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 395, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 400, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h3120db8c4a8a92b2);
             return ret;
         },
         __wbindgen_cast_0000000000000003: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("CloseEvent")], shim_idx: 395, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("CloseEvent")], shim_idx: 400, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h3120db8c4a8a92b2_2);
             return ret;
         },
         __wbindgen_cast_0000000000000004: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("ErrorEvent")], shim_idx: 395, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("ErrorEvent")], shim_idx: 400, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h3120db8c4a8a92b2_3);
             return ret;
         },
         __wbindgen_cast_0000000000000005: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("Event")], shim_idx: 395, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("Event")], shim_idx: 400, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h3120db8c4a8a92b2_4);
             return ret;
         },
         __wbindgen_cast_0000000000000006: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("MessageEvent")], shim_idx: 395, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [NamedExternref("MessageEvent")], shim_idx: 400, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h3120db8c4a8a92b2_5);
             return ret;
         },
@@ -3707,12 +3721,12 @@ function __wbg_get_imports() {
             return ret;
         },
         __wbindgen_cast_000000000000000b: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 400, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
-            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h1d6669a7b693932a);
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 405, ret: Unit, inner_ret: Some(Unit) }, mutable: true }) -> Externref`.
+            const ret = makeMutClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h484cd36e13f37bd7);
             return ret;
         },
         __wbindgen_cast_000000000000000c: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 429, ret: Unit, inner_ret: Some(Unit) }, mutable: false }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [], shim_idx: 434, ret: Unit, inner_ret: Some(Unit) }, mutable: false }) -> Externref`.
             const ret = makeClosure(arg0, arg1, wasm_bindgen__convert__closures_____invoke__h0fa3f876e31d2a3e);
             return ret;
         },
@@ -3804,8 +3818,8 @@ function __wbg_get_imports() {
     };
 }
 
-function wasm_bindgen__convert__closures_____invoke__h1d6669a7b693932a(arg0, arg1) {
-    wasm.wasm_bindgen__convert__closures_____invoke__h1d6669a7b693932a(arg0, arg1);
+function wasm_bindgen__convert__closures_____invoke__h484cd36e13f37bd7(arg0, arg1) {
+    wasm.wasm_bindgen__convert__closures_____invoke__h484cd36e13f37bd7(arg0, arg1);
 }
 
 function wasm_bindgen__convert__closures_____invoke__h0fa3f876e31d2a3e(arg0, arg1) {

package/nodejs/breez_sdk_spark_wasm_bg.wasm.d.ts

@@ -18,6 +18,7 @@ export const bitcoinchainservicehandle_getOutspend: (a: number, b: number, c: nu
 export const bitcoinchainservicehandle_getTransactionHex: (a: number, b: number, c: number) => any;
 export const bitcoinchainservicehandle_getTransactionStatus: (a: number, b: number, c: number) => any;
 export const bitcoinchainservicehandle_recommendedFees: (a: number) => any;
+export const bitcoinchainservicehandle_tipHeight: (a: number) => any;
 export const breezsdk_addContact: (a: number, b: any) => any;
 export const breezsdk_addEventListener: (a: number, b: any) => any;
 export const breezsdk_authorizeLightningAddressTransfer: (a: number, b: any) => any;
@@ -34,6 +35,7 @@ export const breezsdk_deleteContact: (a: number, b: number, c: number) => any;
 export const breezsdk_deleteLightningAddress: (a: number) => any;
 export const breezsdk_disconnect: (a: number) => any;
 export const breezsdk_exportUnilateralExitState: (a: number) => any;
+export const breezsdk_fetchClaimDepositQuote: (a: number, b: any) => any;
 export const breezsdk_fetchConversionLimits: (a: number, b: any) => any;
 export const breezsdk_getCrossChainRoutes: (a: number, b: any) => any;
 export const breezsdk_getInfo: (a: number, b: any) => any;
@@ -128,7 +130,7 @@ export const newSharedSdkContext: (a: any) => any;
 export const passkeyclient_checkAvailability: (a: number) => any;
 export const passkeyclient_connectWithPasskey: (a: number, b: any) => any;
 export const passkeyclient_labels: (a: number) => number;
-export const passkeyclient_new: (a: any, b: number, c: number, d: number) => number;
+export const passkeyclient_new: (a: any, b: number, c: number, d: number) => [number, number, number];
 export const passkeyclient_register: (a: number, b: any) => any;
 export const passkeyclient_signIn: (a: number, b: any) => any;
 export const passkeyclient_supportsImmediateMediation: (a: number) => any;
@@ -181,8 +183,8 @@ export const intounderlyingsource_cancel: (a: number) => void;
 export const intounderlyingsource_pull: (a: number, b: any) => any;
 export const __wbg_externalbreezsignerhandle_free: (a: number, b: number) => void;
 export const __wbg_defaultsessionstore_free: (a: number, b: number) => void;
-export const __wbg_externalsparksignerhandle_free: (a: number, b: number) => void;
 export const __wbg_externalsigningsignerhandle_free: (a: number, b: number) => void;
+export const __wbg_externalsparksignerhandle_free: (a: number, b: number) => void;
 export const __wbg_signingonlyexternalsigners_free: (a: number, b: number) => void;
 export const signingonlyexternalsigners_breezSigner: (a: number) => number;
 export const signingonlyexternalsigners_sparkSigner: (a: number) => number;
@@ -197,7 +199,7 @@ export const wasm_bindgen__convert__closures_____invoke__h3120db8c4a8a92b2_2: (a
 export const wasm_bindgen__convert__closures_____invoke__h3120db8c4a8a92b2_3: (a: number, b: number, c: any) => void;
 export const wasm_bindgen__convert__closures_____invoke__h3120db8c4a8a92b2_4: (a: number, b: number, c: any) => void;
 export const wasm_bindgen__convert__closures_____invoke__h3120db8c4a8a92b2_5: (a: number, b: number, c: any) => void;
-export const wasm_bindgen__convert__closures_____invoke__h1d6669a7b693932a: (a: number, b: number) => void;
+export const wasm_bindgen__convert__closures_____invoke__h484cd36e13f37bd7: (a: number, b: number) => void;
 export const wasm_bindgen__convert__closures_____invoke__h0fa3f876e31d2a3e: (a: number, b: number) => void;
 export const __wbindgen_malloc: (a: number, b: number) => number;
 export const __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;

package/nodejs/mysql-storage/index.cjs

@@ -801,7 +801,7 @@ class MysqlStorage {
   async listDeposits() {
     try {
       const [rows] = await this.pool.query(
-        "SELECT txid, vout, amount_sats, is_mature, claim_error, refund_tx, refund_tx_id, instant_claim_status FROM brz_unclaimed_deposits WHERE user_id = ?",
+        "SELECT txid, vout, amount_sats, is_mature, claim_error, refund_tx, refund_tx_id, instant_claim_status, refund_state FROM brz_unclaimed_deposits WHERE user_id = ?",
         [this.identity]
       );
 
@@ -815,6 +815,7 @@ class MysqlStorage {
         refundTx: row.refund_tx,
         refundTxId: row.refund_tx_id,
         instantClaimStatus: parseJson(row.instant_claim_status),
+        refundState: parseJson(row.refund_state),
       }));
     } catch (error) {
       throw new StorageError(
@@ -829,16 +830,23 @@ class MysqlStorage {
       if (payload.type === "claimError") {
         await this.pool.query(
           `UPDATE brz_unclaimed_deposits
-           SET claim_error = ?, refund_tx = NULL, refund_tx_id = NULL
+           SET claim_error = ?
            WHERE user_id = ? AND txid = ? AND vout = ?`,
           [JSON.stringify(payload.error), this.identity, txid, vout]
         );
       } else if (payload.type === "refund") {
         await this.pool.query(
           `UPDATE brz_unclaimed_deposits
-           SET refund_tx = ?, refund_tx_id = ?, claim_error = NULL
+           SET refund_tx = ?, refund_tx_id = ?, refund_state = ?, claim_error = NULL
            WHERE user_id = ? AND txid = ? AND vout = ?`,
-          [payload.refundTx, payload.refundTxid, this.identity, txid, vout]
+          [
+            payload.refundTx,
+            payload.refundTxid,
+            JSON.stringify(payload.state),
+            this.identity,
+            txid,
+            vout,
+          ]
         );
       } else if (payload.type === "instantClaim") {
         await this.pool.query(
@@ -847,6 +855,19 @@ class MysqlStorage {
            WHERE user_id = ? AND txid = ? AND vout = ?`,
           [JSON.stringify(payload.status), this.identity, txid, vout]
         );
+      } else if (payload.type === "refundBroadcastState") {
+        await this.pool.query(
+          `UPDATE brz_unclaimed_deposits
+           SET refund_state = ?
+           WHERE user_id = ? AND txid = ? AND vout = ? AND refund_tx_id = ?`,
+          [
+            JSON.stringify(payload.state),
+            this.identity,
+            txid,
+            vout,
+            payload.refundTxid,
+          ]
+        );
       } else {
         throw new StorageError(`Unknown payload type: ${payload.type}`);
       }
@@ -1558,13 +1579,120 @@ function defaultMysqlStorageConfig(connectionString) {
   };
 }
 
+/**
+ * Translates the `ssl-mode` URL parameter into mysql2's `ssl` option.
+ * mysql2 does not understand `ssl-mode`, so it is stripped from the URI here.
+ *
+ * Spellings mirror the Rust SDK:
+ * - absent or `disabled`: no TLS
+ * - `preferred` / `required` / `verify_identity`: TLS with certificate chain
+ *   and hostname verification
+ * - `verify_ca`: chain verification only
+ * - `no-verify`: TLS without certificate verification (explicit opt-in)
+ *
+ * An unrecognized value throws rather than silently downgrading to plaintext.
+ * Pin a private CA with `ssl-ca=<path>` (required for `verify_ca`); for the
+ * hostname-verified modes, adding the CA to Node's trust store
+ * (e.g. NODE_EXTRA_CA_CERTS) also works, though it extends the store rather
+ * than pinning.
+ */
+function extractSslMode(connectionString) {
+  const queryIndex = connectionString.indexOf("?");
+  if (queryIndex === -1) {
+    return { connectionString, ssl: undefined };
+  }
+  const base = connectionString.slice(0, queryIndex);
+  const retained = [];
+  let sslMode;
+  let sslCaPath;
+  for (const param of connectionString.slice(queryIndex + 1).split("&")) {
+    const eq = param.indexOf("=");
+    const key = (eq === -1 ? param : param.slice(0, eq)).toLowerCase();
+    if (
+      eq !== -1 &&
+      (key === "ssl-mode" || key === "ssl_mode" || key === "sslmode")
+    ) {
+      sslMode = param.slice(eq + 1).toLowerCase();
+    } else if (
+      eq !== -1 &&
+      (key === "ssl-ca" || key === "ssl_ca" || key === "sslca")
+    ) {
+      sslCaPath = decodeURIComponent(param.slice(eq + 1));
+    } else {
+      retained.push(param);
+    }
+  }
+  if (sslMode === undefined && sslCaPath === undefined) {
+    return { connectionString, ssl: undefined };
+  }
+  const rebuilt = retained.length ? `${base}?${retained.join("&")}` : base;
+  if (sslMode === undefined) {
+    // ssl-ca alone is stripped (mysql2 would reject it as an unknown option)
+    // but has no effect without an ssl-mode.
+    return { connectionString: rebuilt, ssl: undefined };
+  }
+  const ca =
+    sslCaPath === undefined
+      ? undefined
+      : require("fs").readFileSync(sslCaPath).toString();
+  return { connectionString: rebuilt, ssl: sslOptionForMode(sslMode, ca) };
+}
+
+function sslOptionForMode(mode, ca) {
+  switch (mode) {
+    case "disabled":
+    case "disable":
+      return undefined;
+    case "preferred":
+    case "prefer":
+    case "required":
+    case "require":
+    case "verify_identity":
+    case "verify-identity":
+    case "verifyidentity":
+    case "verify-full":
+    case "verify_full":
+      // mysql2 checks the hostname only when verifyIdentity is set;
+      // rejectUnauthorized alone verifies just the chain.
+      return {
+        rejectUnauthorized: true,
+        verifyIdentity: true,
+        ...(ca !== undefined && { ca }),
+      };
+    case "verify_ca":
+    case "verify-ca":
+    case "verifyca":
+      // Without a pinned CA, chain-only verification accepts a certificate
+      // from any trusted CA for any host, which authenticates nothing.
+      if (ca === undefined) {
+        throw new StorageError(
+          "ssl-mode=verify_ca requires ssl-ca=<path>; supply the CA to pin, " +
+            "or use ssl-mode=required / verify_identity for " +
+            "hostname-verified TLS"
+        );
+      }
+      return { rejectUnauthorized: true, ca };
+    case "no-verify":
+    case "no_verify":
+    case "noverify":
+      return { rejectUnauthorized: false };
+    default:
+      throw new StorageError(
+        `Unrecognized ssl-mode value \`${mode}\`; expected one of: ` +
+          "disabled, preferred, required, verify_ca, verify_identity, no-verify"
+      );
+  }
+}
+
 /**
  * Create a mysql2 pool from a config object.
  * The returned pool can be shared across multiple store implementations.
  */
 function createMysqlPool(config) {
+  const { connectionString, ssl } = extractSslMode(config.connectionString);
   return mysql.createPool({
-    uri: config.connectionString,
+    uri: connectionString,
+    ...(ssl !== undefined && { ssl }),
     connectionLimit: config.maxPoolSize,
     connectTimeout: (config.createTimeoutSecs || 0) * 1000 || 10000,
     idleTimeout: (config.recycleTimeoutSecs || 0) * 1000 || 10000,

package/nodejs/mysql-storage/migrations.cjs

@@ -568,6 +568,22 @@ class MysqlMigrationManager {
           `ALTER TABLE brz_unclaimed_deposits ADD COLUMN instant_claim_status JSON NULL`,
         ],
       },
+      {
+        // Only the Declined shape changed, and clearing it costs at most one
+        // extra quote. Submitted rows are left alone: their shape is unchanged
+        // and they are the only guard against re-claiming a settling deposit.
+        name: "Clear declined instant claim status after its shape changed",
+        sql: [
+          `UPDATE brz_unclaimed_deposits SET instant_claim_status = NULL
+             WHERE LOWER(CAST(instant_claim_status AS CHAR)) LIKE '%declined%'`,
+        ],
+      },
+      {
+        name: "Add refund state to brz_unclaimed_deposits",
+        sql: [
+          `ALTER TABLE brz_unclaimed_deposits ADD COLUMN refund_state JSON NULL`,
+        ],
+      },
     ];
   }
 }

package/nodejs/mysql-token-store/index.cjs

@@ -1247,9 +1247,116 @@ class MysqlTokenStore {
   }
 }
 
+/**
+ * Translates the `ssl-mode` URL parameter into mysql2's `ssl` option.
+ * mysql2 does not understand `ssl-mode`, so it is stripped from the URI here.
+ *
+ * Spellings mirror the Rust SDK:
+ * - absent or `disabled`: no TLS
+ * - `preferred` / `required` / `verify_identity`: TLS with certificate chain
+ *   and hostname verification
+ * - `verify_ca`: chain verification only
+ * - `no-verify`: TLS without certificate verification (explicit opt-in)
+ *
+ * An unrecognized value throws rather than silently downgrading to plaintext.
+ * Pin a private CA with `ssl-ca=<path>` (required for `verify_ca`); for the
+ * hostname-verified modes, adding the CA to Node's trust store
+ * (e.g. NODE_EXTRA_CA_CERTS) also works, though it extends the store rather
+ * than pinning.
+ */
+function extractSslMode(connectionString) {
+  const queryIndex = connectionString.indexOf("?");
+  if (queryIndex === -1) {
+    return { connectionString, ssl: undefined };
+  }
+  const base = connectionString.slice(0, queryIndex);
+  const retained = [];
+  let sslMode;
+  let sslCaPath;
+  for (const param of connectionString.slice(queryIndex + 1).split("&")) {
+    const eq = param.indexOf("=");
+    const key = (eq === -1 ? param : param.slice(0, eq)).toLowerCase();
+    if (
+      eq !== -1 &&
+      (key === "ssl-mode" || key === "ssl_mode" || key === "sslmode")
+    ) {
+      sslMode = param.slice(eq + 1).toLowerCase();
+    } else if (
+      eq !== -1 &&
+      (key === "ssl-ca" || key === "ssl_ca" || key === "sslca")
+    ) {
+      sslCaPath = decodeURIComponent(param.slice(eq + 1));
+    } else {
+      retained.push(param);
+    }
+  }
+  if (sslMode === undefined && sslCaPath === undefined) {
+    return { connectionString, ssl: undefined };
+  }
+  const rebuilt = retained.length ? `${base}?${retained.join("&")}` : base;
+  if (sslMode === undefined) {
+    // ssl-ca alone is stripped (mysql2 would reject it as an unknown option)
+    // but has no effect without an ssl-mode.
+    return { connectionString: rebuilt, ssl: undefined };
+  }
+  const ca =
+    sslCaPath === undefined
+      ? undefined
+      : require("fs").readFileSync(sslCaPath).toString();
+  return { connectionString: rebuilt, ssl: sslOptionForMode(sslMode, ca) };
+}
+
+function sslOptionForMode(mode, ca) {
+  switch (mode) {
+    case "disabled":
+    case "disable":
+      return undefined;
+    case "preferred":
+    case "prefer":
+    case "required":
+    case "require":
+    case "verify_identity":
+    case "verify-identity":
+    case "verifyidentity":
+    case "verify-full":
+    case "verify_full":
+      // mysql2 checks the hostname only when verifyIdentity is set;
+      // rejectUnauthorized alone verifies just the chain.
+      return {
+        rejectUnauthorized: true,
+        verifyIdentity: true,
+        ...(ca !== undefined && { ca }),
+      };
+    case "verify_ca":
+    case "verify-ca":
+    case "verifyca":
+      // Without a pinned CA, chain-only verification accepts a certificate
+      // from any trusted CA for any host, which authenticates nothing.
+      if (ca === undefined) {
+        throw new TokenStoreError(
+          "ssl-mode=verify_ca requires ssl-ca=<path>; supply the CA to pin, " +
+            "or use ssl-mode=required / verify_identity for " +
+            "hostname-verified TLS"
+        );
+      }
+      return { rejectUnauthorized: true, ca };
+    case "no-verify":
+    case "no_verify":
+    case "noverify":
+      return { rejectUnauthorized: false };
+    default:
+      throw new TokenStoreError(
+        `Unrecognized ssl-mode value \`${mode}\`; expected one of: ` +
+          "disabled, preferred, required, verify_ca, verify_identity, no-verify"
+      );
+  }
+}
+
 function createMysqlPool(config) {
+  const { connectionString, ssl } = extractSslMode(config.connectionString);
   return mysql.createPool({
-    uri: config.connectionString,
+    uri: connectionString,
+    ...(ssl !== undefined && { ssl }),
     connectionLimit: config.maxPoolSize,
     connectTimeout: (config.createTimeoutSecs || 0) * 1000 || 10000,
     idleTimeout: (config.recycleTimeoutSecs || 0) * 1000 || 10000,

package/nodejs/mysql-tree-store/index.cjs

@@ -1348,10 +1348,117 @@ class MysqlTreeStore {
   }
 }
 
+/**
+ * Translates the `ssl-mode` URL parameter into mysql2's `ssl` option.
+ * mysql2 does not understand `ssl-mode`, so it is stripped from the URI here.
+ *
+ * Spellings mirror the Rust SDK:
+ * - absent or `disabled`: no TLS
+ * - `preferred` / `required` / `verify_identity`: TLS with certificate chain
+ *   and hostname verification
+ * - `verify_ca`: chain verification only
+ * - `no-verify`: TLS without certificate verification (explicit opt-in)
+ *
+ * An unrecognized value throws rather than silently downgrading to plaintext.
+ * Pin a private CA with `ssl-ca=<path>` (required for `verify_ca`); for the
+ * hostname-verified modes, adding the CA to Node's trust store
+ * (e.g. NODE_EXTRA_CA_CERTS) also works, though it extends the store rather
+ * than pinning.
+ */
+function extractSslMode(connectionString) {
+  const queryIndex = connectionString.indexOf("?");
+  if (queryIndex === -1) {
+    return { connectionString, ssl: undefined };
+  }
+  const base = connectionString.slice(0, queryIndex);
+  const retained = [];
+  let sslMode;
+  let sslCaPath;
+  for (const param of connectionString.slice(queryIndex + 1).split("&")) {
+    const eq = param.indexOf("=");
+    const key = (eq === -1 ? param : param.slice(0, eq)).toLowerCase();
+    if (
+      eq !== -1 &&
+      (key === "ssl-mode" || key === "ssl_mode" || key === "sslmode")
+    ) {
+      sslMode = param.slice(eq + 1).toLowerCase();
+    } else if (
+      eq !== -1 &&
+      (key === "ssl-ca" || key === "ssl_ca" || key === "sslca")
+    ) {
+      sslCaPath = decodeURIComponent(param.slice(eq + 1));
+    } else {
+      retained.push(param);
+    }
+  }
+  if (sslMode === undefined && sslCaPath === undefined) {
+    return { connectionString, ssl: undefined };
+  }
+  const rebuilt = retained.length ? `${base}?${retained.join("&")}` : base;
+  if (sslMode === undefined) {
+    // ssl-ca alone is stripped (mysql2 would reject it as an unknown option)
+    // but has no effect without an ssl-mode.
+    return { connectionString: rebuilt, ssl: undefined };
+  }
+  const ca =
+    sslCaPath === undefined
+      ? undefined
+      : require("fs").readFileSync(sslCaPath).toString();
+  return { connectionString: rebuilt, ssl: sslOptionForMode(sslMode, ca) };
+}
+
+function sslOptionForMode(mode, ca) {
+  switch (mode) {
+    case "disabled":
+    case "disable":
+      return undefined;
+    case "preferred":
+    case "prefer":
+    case "required":
+    case "require":
+    case "verify_identity":
+    case "verify-identity":
+    case "verifyidentity":
+    case "verify-full":
+    case "verify_full":
+      // mysql2 checks the hostname only when verifyIdentity is set;
+      // rejectUnauthorized alone verifies just the chain.
+      return {
+        rejectUnauthorized: true,
+        verifyIdentity: true,
+        ...(ca !== undefined && { ca }),
+      };
+    case "verify_ca":
+    case "verify-ca":
+    case "verifyca":
+      // Without a pinned CA, chain-only verification accepts a certificate
+      // from any trusted CA for any host, which authenticates nothing.
+      if (ca === undefined) {
+        throw new TreeStoreError(
+          "ssl-mode=verify_ca requires ssl-ca=<path>; supply the CA to pin, " +
+            "or use ssl-mode=required / verify_identity for " +
+            "hostname-verified TLS"
+        );
+      }
+      return { rejectUnauthorized: true, ca };
+    case "no-verify":
+    case "no_verify":
+    case "noverify":
+      return { rejectUnauthorized: false };
+    default:
+      throw new TreeStoreError(
+        `Unrecognized ssl-mode value \`${mode}\`; expected one of: ` +
+          "disabled, preferred, required, verify_ca, verify_identity, no-verify"
+      );
+  }
+}
+
 /** Create a mysql2 pool from a config object. */
 function createMysqlPool(config) {
+  const { connectionString, ssl } = extractSslMode(config.connectionString);
   return mysql.createPool({
-    uri: config.connectionString,
+    uri: connectionString,
+    ...(ssl !== undefined && { ssl }),
     connectionLimit: config.maxPoolSize,
     connectTimeout: (config.createTimeoutSecs || 0) * 1000 || 10000,
     idleTimeout: (config.recycleTimeoutSecs || 0) * 1000 || 10000,