@fadhilp/stateql 0.4.1 → 0.4.2

package/README.md

@@ -80,6 +80,11 @@ stql connect --env SQLITE_DATABASE --name local --read-only
 ```
 
 A connection accepts exactly one direct target, `--env`, or `--profile` source.
+For PostgreSQL, StateQL preserves strict TLS verification by normalizing
+`sslmode=prefer`, `require`, and `verify-ca` to `verify-full` before opening the
+adapter. Use `sslmode=verify-full` explicitly for clarity. Setting
+`uselibpqcompat=true` opts out and keeps libpq-compatible SSL semantics.
+
 MySQL uses positional `?` parameters. MariaDB compatibility is not currently
 claimed.
 

package/dist/src/adapters.d.ts

@@ -37,3 +37,4 @@ export declare function createAdapterContext(timeoutMs: number, signal?: AbortSi
 export declare function createAdapter(connection: ConnectionRecord, context: AdapterContext, input: {
     source: string;
 }): Promise<Adapter>;
+export declare function normalizePostgresConnectionString(source: string): string;

package/dist/src/adapters.js

@@ -182,6 +182,23 @@ class SQLiteAdapter {
         this.pending.clear();
     }
 }
+const STRICT_POSTGRES_SSL_MODE_ALIASES = new Set(["prefer", "require", "verify-ca"]);
+export function normalizePostgresConnectionString(source) {
+    try {
+        const url = new URL(source);
+        const parameters = [...url.searchParams.entries()];
+        const libpqCompat = parameters.filter(([key]) => key === "uselibpqcompat").at(-1)?.[1];
+        const sslMode = parameters.filter(([key]) => key === "sslmode").at(-1)?.[1];
+        if (libpqCompat === "true" || !sslMode || !STRICT_POSTGRES_SSL_MODE_ALIASES.has(sslMode))
+            return source;
+        url.searchParams.delete("sslmode");
+        url.searchParams.append("sslmode", "verify-full");
+        return url.toString();
+    }
+    catch {
+        return source;
+    }
+}
 class PostgresAdapter {
     readOnly;
     context;
@@ -194,7 +211,7 @@ class PostgresAdapter {
         this.context = context;
         const timeout = Math.min(2_147_483_647, remainingMilliseconds(context));
         this.client = new Client({
-            connectionString: source,
+            connectionString: normalizePostgresConnectionString(source),
             connectionTimeoutMillis: timeout,
             statement_timeout: timeout,
         });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fadhilp/stateql",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "Stateful, agent-oriented database CLI for safe result reuse",
   "repository": {
     "type": "git",