@everystack/server 0.4.3 → 0.4.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -151,8 +151,8 @@
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/cli": "0.4.12",
     "@everystack/auth": "0.4.0",
+    "@everystack/cli": "0.4.18",
     "@everystack/pg-tools": "0.4.0"
   },
   "scripts": {

package/src/db.ts

@@ -96,6 +96,34 @@ export function getJwtSecret(): Uint8Array {
   throw new Error('JWT_SECRET not set — link an sst.Secret or set process.env.JWT_SECRET');
 }
 
+/**
+ * The ssl option for a connection URL: an explicit `sslmode` query param wins
+ * (return no override — postgres.js honors the URL natively), otherwise default
+ * to 'require' (RDS). This is what lets ONE handler serve both venues: local
+ * Postgres appends `?sslmode=disable` to its URL, deployed stages carry no
+ * param and keep TLS. An unparseable URL fails toward TLS and lets the connect
+ * report the real error.
+ */
+export function sslOptionForUrl(url: string): 'require' | undefined {
+  try {
+    return new URL(url).searchParams.has('sslmode') ? undefined : 'require';
+  } catch {
+    return 'require';
+  }
+}
+
+/** postgres.js options shared by every connection — ssl derived from the URL. */
+function connectionOptions(url: string, maxConnections?: number): Parameters<typeof postgres>[1] {
+  const ssl = sslOptionForUrl(url);
+  return {
+    max: maxConnections ?? 1,
+    idle_timeout: 60,
+    connect_timeout: 5,
+    max_lifetime: 60 * 5,
+    ...(ssl ? { ssl } : {}),
+  };
+}
+
 // Lazy singleton DB connection
 let dbInstance: ReturnType<typeof drizzle> | null = null;
 let sqlClient: ReturnType<typeof postgres> | null = null;
@@ -110,13 +138,7 @@ export function createDb<T extends Record<string, unknown>>(
   if (dbInstance) return { db: dbInstance, schema };
 
   const url = getDatabaseUrl();
-  sqlClient = postgres(url, {
-    max: options?.maxConnections ?? 1,
-    idle_timeout: 60,
-    connect_timeout: 5,
-    max_lifetime: 60 * 5,
-    ssl: 'require',
-  });
+  sqlClient = postgres(url, connectionOptions(url, options?.maxConnections));
   dbInstance = drizzle(sqlClient, { schema });
   return { db: dbInstance, schema };
 }
@@ -242,13 +264,7 @@ export function createAdminDb<T extends Record<string, unknown>>(
     return createDb(schema, options);
   }
 
-  adminSqlClient = postgres(adminUrl, {
-    max: options?.maxConnections ?? 1,
-    idle_timeout: 60,
-    connect_timeout: 5,
-    max_lifetime: 60 * 5,
-    ssl: 'require',
-  });
+  adminSqlClient = postgres(adminUrl, connectionOptions(adminUrl, options?.maxConnections));
   adminDbInstance = drizzle(adminSqlClient, { schema });
   return { db: adminDbInstance, schema };
 }
@@ -314,13 +330,7 @@ export function createReadDb<T extends Record<string, unknown>>(
   const url = getReadDatabaseUrl();
   if (!url) return createDb(schema, options);
 
-  readSqlClient = postgres(url, {
-    max: options?.maxConnections ?? 1,
-    idle_timeout: 60,
-    connect_timeout: 5,
-    max_lifetime: 60 * 5,
-    ssl: 'require',
-  });
+  readSqlClient = postgres(url, connectionOptions(url, options?.maxConnections));
   readDbInstance = drizzle(readSqlClient, { schema });
   return { db: readDbInstance, schema };
 }