@hasna/contacts 0.7.0 → 0.8.1

package/dist/server/index.js

@@ -36,53 +36,152 @@ import { verifyApiKey, ApiKeyStore } from "@hasna/contracts/auth";
 // src/generated/storage-kit/pool.ts
 import pg from "pg";
 
+// src/generated/storage-kit/own.ts
+function ownProp(source, key) {
+  if (source === null || source === undefined)
+    return;
+  const kind = typeof source;
+  if (kind !== "object" && kind !== "function")
+    return;
+  if (!Object.hasOwn(source, key))
+    return;
+  return source[key];
+}
+function ownString(source, key) {
+  const value = ownProp(source, key);
+  return typeof value === "string" ? value : undefined;
+}
+
 // src/generated/storage-kit/tls.ts
 import { readFileSync as readFileSync2 } from "fs";
-function sslModeFromConnectionString(connectionString) {
+var PG_TLS_QUERY_PARAMETERS = new Set([
+  "ssl",
+  "sslmode",
+  "sslrootcert",
+  "sslcert",
+  "sslkey",
+  "sslpassword",
+  "sslnegotiation",
+  "uselibpqcompat"
+]);
+var EXPLICIT_SSL_ON_VALUES = new Set(["1", "true", "yes", "on", "require"]);
+var EXPLICIT_SSL_OFF_VALUES = new Set(["0", "false", "no", "off", "disable"]);
+var SSLMODE_VALUES = new Map([
+  ["disable", "disable"],
+  ["allow", "prefer"],
+  ["prefer", "prefer"],
+  ["require", "require"],
+  ["verify-ca", "verify-ca"],
+  ["verify-full", "verify-full"]
+]);
+function connectionStringParts(connectionString) {
   const queryStart = connectionString.indexOf("?");
-  const params = new URLSearchParams(queryStart === -1 ? "" : connectionString.slice(queryStart + 1));
-  const sslmode = params.get("sslmode")?.trim().toLowerCase();
-  if (sslmode) {
-    switch (sslmode) {
-      case "disable":
-      case "prefer":
-      case "require":
-      case "verify-ca":
-      case "verify-full":
-        return sslmode;
-      case "allow":
-        return "prefer";
-      default:
-        throw new Error(`Unknown sslmode '${sslmode}' in connection string.`);
+  if (queryStart === -1) {
+    return { base: connectionString, fragment: "", params: new URLSearchParams };
+  }
+  const base = connectionString.slice(0, queryStart);
+  const queryAndFragment = connectionString.slice(queryStart + 1);
+  const fragmentStart = queryAndFragment.indexOf("#");
+  const query = fragmentStart === -1 ? queryAndFragment : queryAndFragment.slice(0, fragmentStart);
+  const fragment = fragmentStart === -1 ? "" : queryAndFragment.slice(fragmentStart);
+  return { base, fragment, params: new URLSearchParams(query) };
+}
+function tlsQueryValues(connectionString) {
+  const values = new Map;
+  for (const [key, value] of connectionStringParts(connectionString).params) {
+    const normalized = key.toLowerCase();
+    if (PG_TLS_QUERY_PARAMETERS.has(normalized))
+      values.set(normalized, value);
+  }
+  return values;
+}
+function connectionStringWithoutTlsParameters(connectionString) {
+  const { base, fragment, params } = connectionStringParts(connectionString);
+  for (const key of [...params.keys()]) {
+    if (PG_TLS_QUERY_PARAMETERS.has(key.toLowerCase()))
+      params.delete(key);
+  }
+  const query = params.toString();
+  return `${base}${query ? `?${query}` : ""}${fragment}`;
+}
+function rawSslMode(values) {
+  const raw = values.get("sslmode");
+  return raw === undefined ? undefined : raw.trim().toLowerCase();
+}
+function sslNegotiationFromConnectionString(connectionString) {
+  const value = tlsQueryValues(connectionString).get("sslnegotiation")?.trim().toLowerCase();
+  if (!value)
+    return;
+  if (value === "postgres" || value === "direct")
+    return value;
+  throw new Error(`Unknown sslnegotiation '${value}' in connection string; expected postgres or direct.`);
+}
+function sslModeFromConnectionString(connectionString) {
+  const values = tlsQueryValues(connectionString);
+  const sslmode = rawSslMode(values);
+  if (sslmode !== undefined) {
+    const resolved = SSLMODE_VALUES.get(sslmode);
+    if (resolved)
+      return resolved;
+    throw new Error(`Unknown sslmode '${sslmode}' in connection string; expected one of ` + `${[...SSLMODE_VALUES.keys()].join(", ")}. Remove the parameter entirely to defer to ` + `PGSSLMODE \u2014 an empty value is not how that is spelled.`);
+  }
+  if (values.has("ssl")) {
+    const ssl = values.get("ssl")?.trim().toLowerCase() ?? "";
+    if (EXPLICIT_SSL_ON_VALUES.has(ssl))
+      return "require";
+    if (!EXPLICIT_SSL_OFF_VALUES.has(ssl)) {
+      throw new Error(`Unknown ssl value '${ssl}' in connection string.`);
     }
+    return "disable";
   }
-  const ssl = params.get("ssl")?.trim().toLowerCase();
-  if (ssl && ["1", "true", "yes", "on", "require"].includes(ssl))
+  const sslnegotiation = values.get("sslnegotiation")?.trim().toLowerCase();
+  if (sslnegotiation === "direct")
     return "require";
   return "disable";
 }
-function loadCaBundle(options) {
-  const env = options.env ?? process.env;
-  if (options.ca && options.ca.trim())
-    return options.ca;
-  const path = options.caCertPath ?? env.PGSSLROOTCERT ?? env.NODE_EXTRA_CA_CERTS;
+function loadCaBundle(connectionString, options) {
+  const env = ownProp(options, "env") ?? process.env;
+  const ca = ownString(options, "ca");
+  if (ca && ca.trim())
+    return ca;
+  const sslRootCert = tlsQueryValues(connectionString).get("sslrootcert")?.trim();
+  const path = ownString(options, "caCertPath") ?? (sslRootCert ? sslRootCert : undefined) ?? ownString(env, "PGSSLROOTCERT") ?? ownString(env, "NODE_EXTRA_CA_CERTS");
   if (path && path.trim())
     return readFileSync2(path.trim(), "utf8");
   return null;
 }
+function loadClientCertificate(connectionString) {
+  const values = tlsQueryValues(connectionString);
+  const material = {};
+  const certPath = values.get("sslcert")?.trim();
+  if (certPath)
+    material.cert = readFileSync2(certPath, "utf8");
+  const keyPath = values.get("sslkey")?.trim();
+  if (keyPath)
+    material.key = readFileSync2(keyPath, "utf8");
+  const passphrase = values.get("sslpassword");
+  if (passphrase)
+    material.passphrase = passphrase;
+  return material;
+}
 function resolveTlsConfig(connectionString, options = {}) {
   const mode = sslModeFromConnectionString(connectionString);
-  if (mode === "disable" || mode === "prefer") {
-    return;
-  }
-  const ca = loadCaBundle(options);
-  if (mode === "require") {
-    return ca ? { rejectUnauthorized: false, ca } : { rejectUnauthorized: false };
+  if (mode === "disable") {
+    const values = tlsQueryValues(connectionString);
+    const sslmode = rawSslMode(values);
+    const ssl = values.get("ssl")?.trim().toLowerCase();
+    const explicitlyOff = sslmode === "disable" || ssl !== undefined && EXPLICIT_SSL_OFF_VALUES.has(ssl);
+    return explicitlyOff ? false : undefined;
+  }
+  const ca = loadCaBundle(connectionString, options);
+  const clientCertificate = loadClientCertificate(connectionString);
+  if (mode === "prefer" || mode === "require") {
+    return { rejectUnauthorized: true, ...ca ? { ca } : {}, ...clientCertificate };
   }
   if (!ca) {
     throw new Error(`sslmode=${mode} requires a CA bundle. Set PGSSLROOTCERT (or pass caCertPath/ca) to the ` + `Amazon RDS global bundle: https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem`);
   }
-  return { rejectUnauthorized: true, ca };
+  return { rejectUnauthorized: true, ca, ...clientCertificate };
 }
 
 // src/generated/storage-kit/query.ts
@@ -140,23 +239,58 @@ function createQueryClient(pool) {
 }
 
 // src/generated/storage-kit/pool.ts
+function ownPoolOptions(options) {
+  const own = Object.create(null);
+  const ca = ownString(options, "ca");
+  if (ca !== undefined)
+    own.ca = ca;
+  const caCertPath = ownString(options, "caCertPath");
+  if (caCertPath !== undefined)
+    own.caCertPath = caCertPath;
+  const env = ownProp(options, "env");
+  if (env !== undefined)
+    own.env = env;
+  const max = ownProp(options, "max");
+  if (max !== undefined)
+    own.max = max;
+  const idleTimeoutMillis = ownProp(options, "idleTimeoutMillis");
+  if (idleTimeoutMillis !== undefined)
+    own.idleTimeoutMillis = idleTimeoutMillis;
+  const connectionTimeoutMillis = ownProp(options, "connectionTimeoutMillis");
+  if (connectionTimeoutMillis !== undefined)
+    own.connectionTimeoutMillis = connectionTimeoutMillis;
+  const applicationName = ownString(options, "applicationName");
+  if (applicationName !== undefined)
+    own.applicationName = applicationName;
+  return own;
+}
 function createPgPool(options) {
-  const ssl = resolveTlsConfig(options.connectionString, {
-    ...options.ca !== undefined ? { ca: options.ca } : {},
-    ...options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {},
-    ...options.env !== undefined ? { env: options.env } : {}
+  const connectionString = ownString(options, "connectionString");
+  if (!connectionString || !connectionString.trim()) {
+    throw new Error("createPgPool requires an own `connectionString` on the options object.");
+  }
+  const own = ownPoolOptions(options);
+  const ssl = resolveTlsConfig(connectionString, {
+    ...own.ca !== undefined ? { ca: own.ca } : {},
+    ...own.caCertPath !== undefined ? { caCertPath: own.caCertPath } : {},
+    ...own.env !== undefined ? { env: own.env } : {}
   });
-  const config = { connectionString: options.connectionString };
+  const config = {
+    connectionString: connectionStringWithoutTlsParameters(connectionString)
+  };
   if (ssl !== undefined)
     config.ssl = ssl;
-  if (options.max !== undefined)
-    config.max = options.max;
-  if (options.idleTimeoutMillis !== undefined)
-    config.idleTimeoutMillis = options.idleTimeoutMillis;
-  if (options.connectionTimeoutMillis !== undefined)
-    config.connectionTimeoutMillis = options.connectionTimeoutMillis;
-  if (options.applicationName !== undefined)
-    config.application_name = options.applicationName;
+  const sslnegotiation = sslNegotiationFromConnectionString(connectionString);
+  if (sslnegotiation !== undefined)
+    config.sslnegotiation = sslnegotiation;
+  if (own.max !== undefined)
+    config.max = own.max;
+  if (own.idleTimeoutMillis !== undefined)
+    config.idleTimeoutMillis = own.idleTimeoutMillis;
+  if (own.connectionTimeoutMillis !== undefined)
+    config.connectionTimeoutMillis = own.connectionTimeoutMillis;
+  if (own.applicationName !== undefined)
+    config.application_name = own.applicationName;
   return new pg.Pool(config);
 }
 
@@ -4461,8 +4595,32 @@ async function runMigrate() {
   console.log("migrate: done");
   await closeCloud();
 }
+function handleEarlyArgs(argv) {
+  if (argv.includes("--help") || argv.includes("-h"))
+    return "help";
+  if (argv.includes("--version") || argv.includes("-V"))
+    return "version";
+  return "start";
+}
+function usage() {
+  return `usage: contacts-serve [--port <n>] [--host <h>]   Start the authenticated /v1 HTTP API over PostgreSQL
+       contacts-serve migrate                     Apply the PostgreSQL schema and exit
+       contacts-serve --version                   Print the version
+
+options:
+  --port <n>          listen port (default ${DEFAULT_PORT}; PORT)
+  --host <h>          bind host (default ${DEFAULT_HOST}; CONTACTS_HOST)
+  --help, -h          show this help and exit
+  --version, -V       print the package version and exit
+`;
+}
 async function main() {
-  if (process.argv.includes("--version") || process.argv.includes("-V")) {
+  const early = handleEarlyArgs(process.argv.slice(2));
+  if (early === "help") {
+    console.log(usage());
+    return;
+  }
+  if (early === "version") {
     console.log(getPackageVersion());
     return;
   }

package/hasna.contract.json

@@ -4,8 +4,8 @@
   "name": "contacts",
   "class": "service",
   "contractVersion": "v1",
-  "kitVersion": "0.14.2",
-  "description": "Contact and company management for AI coding agents. Public CLI, MCP, and SDK clients use one explicitly configured authenticated HTTPS /v1 authority and never open SQLite or PostgreSQL. contacts-serve is the server-only PostgreSQL/API-key boundary.",
+  "kitVersion": "1.0.2",
+  "description": "Contact and company management for AI coding agents. Public CLI, MCP, and SDK clients use one authenticated HTTPS /v1 authority resolved by the @hasna/contracts client chain (fleet gateway default https://api.hasna.com/contacts) and never open SQLite or PostgreSQL. contacts-serve is the server-only PostgreSQL/API-key boundary.",
   "bins": [
     "contacts",
     "contacts-mcp",
@@ -22,9 +22,21 @@
       "status": "supported",
       "bin": "contacts-serve",
       "authMode": "api-key",
-      "health": { "method": "GET", "path": "/health", "public": true },
-      "readiness": { "method": "GET", "path": "/ready", "public": true },
-      "version": { "method": "GET", "path": "/version", "public": true },
+      "health": {
+        "method": "GET",
+        "path": "/health",
+        "public": true
+      },
+      "readiness": {
+        "method": "GET",
+        "path": "/ready",
+        "public": true
+      },
+      "version": {
+        "method": "GET",
+        "path": "/version",
+        "public": true
+      },
       "apiBasePath": "/v1",
       "openApiPath": "/openapi.json"
     },
@@ -54,7 +66,9 @@
   ],
   "storage": {
     "backend": "postgresql",
-    "engines": ["postgresql"],
+    "engines": [
+      "postgresql"
+    ],
     "envPrefix": "HASNA_CONTACTS_",
     "aliasEnvPrefix": "CONTACTS_",
     "pgTestGate": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hasna/contacts",
-  "version": "0.7.0",
-  "description": "Contact management for AI coding agents \u2014 CLI + MCP + Web",
+  "version": "0.8.1",
+  "description": "Contact management for AI coding agents — CLI + MCP + Web",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -75,7 +75,7 @@
   "author": "Andrei Hasna <andrei@hasna.com>",
   "license": "Apache-2.0",
   "dependencies": {
-    "@hasna/contracts": "0.14.2",
+    "@hasna/contracts": "1.0.2",
     "@hasna/events": "^0.1.6",
     "chalk": "^5.4.1",
     "commander": "^13.1.0",

package/dist/lib/config.d.ts

@@ -1,7 +0,0 @@
-interface ContactsConfig {
-    db_path?: string;
-}
-export declare function readConfig(): ContactsConfig;
-export declare function writeConfig(config: ContactsConfig): void;
-export {};
-//# sourceMappingURL=config.d.ts.map

package/dist/lib/config.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAOA,UAAU,cAAc;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,UAAU,IAAI,cAAc,CAG3C;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAGxD"}