@igstack/app-catalog-backend-core 0.12.0 → 0.13.1

package/dist/db/client.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.mts","names":[],"sources":["../../src/db/client.ts"],"mappings":";;;;;AAWA;;iBAAgB,WAAA,CAAA,GAAe,YAAA;;;AAuB/B;;iBAAgB,WAAA,CAAY,MAAA,EAAQ,YAAA;;;AAQpC;;iBAAsB,SAAA,CAAA,GAAa,OAAA;;;AASnC;;iBAAsB,YAAA,CAAA,GAAgB,OAAA"}
+{"version":3,"file":"client.d.mts","names":[],"sources":["../../src/db/client.ts"],"mappings":";;;;;AAYA;;iBAAgB,WAAA,CAAA,GAAe,YAAA;;;AA8B/B;;iBAAgB,WAAA,CAAY,MAAA,EAAQ,YAAA;;;AAQpC;;iBAAsB,SAAA,CAAA,GAAa,OAAA;;;AASnC;;iBAAsB,YAAA,CAAA,GAAgB,OAAA"}

package/dist/db/client.mjs

@@ -1,4 +1,5 @@
 import { PrismaClient } from "../generated/prisma/client.mjs";
+import { buildPgSslConfig } from "./sslConfig.mjs";
 import { PrismaPg } from "@prisma/adapter-pg";
 import pg from "pg";
 
@@ -13,7 +14,11 @@ function getDbClient() {
 	if (!prismaClient) {
 		const databaseUrl = process.env.AC_CORE_DATABASE_URL;
 		if (!databaseUrl) throw new Error("PrismaClient not initialized. You must call createAcMiddleware() before using database functions, or set AC_CORE_DATABASE_URL environment variable for standalone usage.");
-		pool = new pg.Pool({ connectionString: databaseUrl });
+		const ssl = buildPgSslConfig();
+		pool = new pg.Pool({
+			connectionString: databaseUrl,
+			...ssl === void 0 ? {} : { ssl }
+		});
 		prismaClient = new PrismaClient({ adapter: new PrismaPg(pool) });
 	}
 	return prismaClient;

package/dist/db/client.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"client.mjs","names":[],"sources":["../../src/db/client.ts"],"sourcesContent":["import { PrismaClient } from '../generated/prisma/client'\nimport { PrismaPg } from '@prisma/adapter-pg'\nimport pg from 'pg'\n\nlet prismaClient: PrismaClient | null = null\nlet pool: pg.Pool | null = null\n\n/**\n * Gets the internal Prisma client instance.\n * Creates one if it doesn't exist.\n */\nexport function getDbClient(): PrismaClient {\n  if (!prismaClient) {\n    const databaseUrl = process.env.AC_CORE_DATABASE_URL\n    if (!databaseUrl) {\n      throw new Error(\n        'PrismaClient not initialized. You must call createAcMiddleware() before using database functions, ' +\n          'or set AC_CORE_DATABASE_URL environment variable for standalone usage.',\n      )\n    }\n\n    // Prisma 7 with adapter: Create pg pool and wrap with adapter\n    pool = new pg.Pool({ connectionString: databaseUrl })\n    const adapter = new PrismaPg(pool)\n\n    prismaClient = new PrismaClient({ adapter })\n  }\n  return prismaClient\n}\n\n/**\n * Sets the internal Prisma client instance.\n * Used by middleware to bridge with existing getDbClient() usage.\n */\nexport function setDbClient(client: PrismaClient): void {\n  prismaClient = client\n}\n\n/**\n * Connects to the database.\n * Call this before performing database operations.\n */\nexport async function connectDb(): Promise<void> {\n  const client = getDbClient()\n  await client.$connect()\n}\n\n/**\n * Disconnects from the database.\n * Call this when done with database operations (e.g., in scripts).\n */\nexport async function disconnectDb(): Promise<void> {\n  if (prismaClient) {\n    await prismaClient.$disconnect()\n    prismaClient = null\n  }\n  if (pool) {\n    await pool.end()\n    pool = null\n  }\n}\n"],"mappings":";;;;;AAIA,IAAI,eAAoC;AACxC,IAAI,OAAuB;;;;;AAM3B,SAAgB,cAA4B;AAC1C,KAAI,CAAC,cAAc;EACjB,MAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,YACH,OAAM,IAAI,MACR,2KAED;AAIH,SAAO,IAAI,GAAG,KAAK,EAAE,kBAAkB,aAAa,CAAC;AAGrD,iBAAe,IAAI,aAAa,EAAE,SAFlB,IAAI,SAAS,KAAK,EAES,CAAC;;AAE9C,QAAO;;;;;;AAOT,SAAgB,YAAY,QAA4B;AACtD,gBAAe;;;;;;AAOjB,eAAsB,YAA2B;AAE/C,OADe,aAAa,CACf,UAAU;;;;;;AAOzB,eAAsB,eAA8B;AAClD,KAAI,cAAc;AAChB,QAAM,aAAa,aAAa;AAChC,iBAAe;;AAEjB,KAAI,MAAM;AACR,QAAM,KAAK,KAAK;AAChB,SAAO"}
+{"version":3,"file":"client.mjs","names":[],"sources":["../../src/db/client.ts"],"sourcesContent":["import { PrismaClient } from '../generated/prisma/client'\nimport { PrismaPg } from '@prisma/adapter-pg'\nimport pg from 'pg'\nimport { buildPgSslConfig } from './sslConfig'\n\nlet prismaClient: PrismaClient | null = null\nlet pool: pg.Pool | null = null\n\n/**\n * Gets the internal Prisma client instance.\n * Creates one if it doesn't exist.\n */\nexport function getDbClient(): PrismaClient {\n  if (!prismaClient) {\n    const databaseUrl = process.env.AC_CORE_DATABASE_URL\n    if (!databaseUrl) {\n      throw new Error(\n        'PrismaClient not initialized. You must call createAcMiddleware() before using database functions, ' +\n          'or set AC_CORE_DATABASE_URL environment variable for standalone usage.',\n      )\n    }\n\n    // Prisma 7 with adapter: Create pg pool and wrap with adapter.\n    // SSL comes from PGSSLMODE/PGSSLROOTCERT via our helper (node-postgres\n    // doesn't honor those correctly for a connection-string pool — see\n    // buildPgSslConfig).\n    const ssl = buildPgSslConfig()\n    pool = new pg.Pool({\n      connectionString: databaseUrl,\n      ...(ssl === undefined ? {} : { ssl }),\n    })\n    const adapter = new PrismaPg(pool)\n\n    prismaClient = new PrismaClient({ adapter })\n  }\n  return prismaClient\n}\n\n/**\n * Sets the internal Prisma client instance.\n * Used by middleware to bridge with existing getDbClient() usage.\n */\nexport function setDbClient(client: PrismaClient): void {\n  prismaClient = client\n}\n\n/**\n * Connects to the database.\n * Call this before performing database operations.\n */\nexport async function connectDb(): Promise<void> {\n  const client = getDbClient()\n  await client.$connect()\n}\n\n/**\n * Disconnects from the database.\n * Call this when done with database operations (e.g., in scripts).\n */\nexport async function disconnectDb(): Promise<void> {\n  if (prismaClient) {\n    await prismaClient.$disconnect()\n    prismaClient = null\n  }\n  if (pool) {\n    await pool.end()\n    pool = null\n  }\n}\n"],"mappings":";;;;;;AAKA,IAAI,eAAoC;AACxC,IAAI,OAAuB;;;;;AAM3B,SAAgB,cAA4B;AAC1C,KAAI,CAAC,cAAc;EACjB,MAAM,cAAc,QAAQ,IAAI;AAChC,MAAI,CAAC,YACH,OAAM,IAAI,MACR,2KAED;EAOH,MAAM,MAAM,kBAAkB;AAC9B,SAAO,IAAI,GAAG,KAAK;GACjB,kBAAkB;GAClB,GAAI,QAAQ,SAAY,EAAE,GAAG,EAAE,KAAK;GACrC,CAAC;AAGF,iBAAe,IAAI,aAAa,EAAE,SAFlB,IAAI,SAAS,KAAK,EAES,CAAC;;AAE9C,QAAO;;;;;;AAOT,SAAgB,YAAY,QAA4B;AACtD,gBAAe;;;;;;AAOjB,eAAsB,YAA2B;AAE/C,OADe,aAAa,CACf,UAAU;;;;;;AAOzB,eAAsB,eAA8B;AAClD,KAAI,cAAc;AAChB,QAAM,aAAa,aAAa;AAChC,iBAAe;;AAEjB,KAAI,MAAM;AACR,QAAM,KAAK,KAAK;AAChB,SAAO"}

package/dist/db/index.d.mts

@@ -1,4 +1,5 @@
 import { connectDb, disconnectDb, getDbClient, setDbClient } from "./client.mjs";
+import { buildPgSslConfig } from "./sslConfig.mjs";
 import { MakeTFromPrismaModel, ObjectKeys, ScalarFilter, ScalarKeys, TableSyncParamsPrisma, tableSyncPrisma } from "./tableSyncPrismaAdapter.mjs";
 import { TABLE_SYNC_MAGAZINE, TableSyncMagazine, TableSyncMagazineModelNameKey } from "./tableSyncMagazine.mjs";
 import { SyncAppCatalogResult, syncAppCatalog } from "./syncAppCatalog.mjs";

package/dist/db/sslConfig.d.mts

@@ -0,0 +1,28 @@
+import { ConnectionOptions } from "node:tls";
+
+//#region src/db/sslConfig.d.ts
+/**
+ * Build the node-postgres `ssl` PoolConfig option from libpq-style env vars,
+ * because node-postgres does NOT do this correctly on its own for a
+ * connection-string pool: its built-in env handling maps `PGSSLMODE=verify-full`
+ * to a bare `ssl: true` (Node's default trust store) and IGNORES `PGSSLROOTCERT`
+ * — so an RDS server cert signed by the Amazon RDS CA would fail to verify.
+ *
+ * We therefore construct the `ssl` object explicitly and pass it to `new
+ * pg.Pool({ connectionString, ssl })`. Semantics mirror libpq / pg-connection-string:
+ *   - verify-full → validate CA chain AND hostname (Node defaults; no overrides)
+ *   - verify-ca   → validate CA chain, skip hostname (checkServerIdentity no-op)
+ *   - require/prefer → encrypt but don't validate (unless a CA is given → verify-ca-like)
+ *   - no-verify   → encrypt, don't validate (rejectUnauthorized:false)
+ *   - disable / unset → no TLS
+ *
+ * `PGSSLROOTCERT` points at a CA bundle on disk (e.g. the Amazon RDS
+ * global-bundle.pem baked into the image).
+ *
+ * @returns a `ConnectionOptions` object, `false` for disabled, or `undefined`
+ *          to leave SSL unset (let node-postgres fall back to its defaults).
+ */
+declare function buildPgSslConfig(env?: NodeJS.ProcessEnv): ConnectionOptions | boolean | undefined;
+//#endregion
+export { buildPgSslConfig };
+//# sourceMappingURL=sslConfig.d.mts.map

package/dist/db/sslConfig.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sslConfig.d.mts","names":[],"sources":["../../src/db/sslConfig.ts"],"mappings":";;;;;AAwBA;;;;;;;;;;;;;;;;;;;iBAAgB,gBAAA,CACd,GAAA,GAAK,MAAA,CAAO,UAAA,GACX,iBAAA"}

package/dist/db/sslConfig.mjs

@@ -0,0 +1,71 @@
+import { readFileSync } from "node:fs";
+
+//#region src/db/sslConfig.ts
+/**
+* Build the node-postgres `ssl` PoolConfig option from libpq-style env vars,
+* because node-postgres does NOT do this correctly on its own for a
+* connection-string pool: its built-in env handling maps `PGSSLMODE=verify-full`
+* to a bare `ssl: true` (Node's default trust store) and IGNORES `PGSSLROOTCERT`
+* — so an RDS server cert signed by the Amazon RDS CA would fail to verify.
+*
+* We therefore construct the `ssl` object explicitly and pass it to `new
+* pg.Pool({ connectionString, ssl })`. Semantics mirror libpq / pg-connection-string:
+*   - verify-full → validate CA chain AND hostname (Node defaults; no overrides)
+*   - verify-ca   → validate CA chain, skip hostname (checkServerIdentity no-op)
+*   - require/prefer → encrypt but don't validate (unless a CA is given → verify-ca-like)
+*   - no-verify   → encrypt, don't validate (rejectUnauthorized:false)
+*   - disable / unset → no TLS
+*
+* `PGSSLROOTCERT` points at a CA bundle on disk (e.g. the Amazon RDS
+* global-bundle.pem baked into the image).
+*
+* @returns a `ConnectionOptions` object, `false` for disabled, or `undefined`
+*          to leave SSL unset (let node-postgres fall back to its defaults).
+*/
+function buildPgSslConfig(env = process.env) {
+	const mode = env.PGSSLMODE;
+	const rootCertPath = env.PGSSLROOTCERT;
+	const readCa = () => {
+		if (!rootCertPath) return void 0;
+		try {
+			return readFileSync(rootCertPath, "utf8");
+		} catch (err) {
+			throw new Error(`PGSSLROOTCERT is set to "${rootCertPath}" but the CA bundle could not be read: ${err instanceof Error ? err.message : String(err)}`);
+		}
+	};
+	switch (mode) {
+		case "disable": return false;
+		case "verify-full": {
+			const ca = readCa();
+			if (!ca) throw new Error("PGSSLMODE=verify-full requires PGSSLROOTCERT to point at a CA bundle (node-postgres would otherwise use the system trust store, which does not include the Amazon RDS CA). Set PGSSLROOTCERT.");
+			return {
+				ca,
+				rejectUnauthorized: true
+			};
+		}
+		case "verify-ca": {
+			const ca = readCa();
+			if (!ca) throw new Error("PGSSLMODE=verify-ca requires PGSSLROOTCERT to point at a CA bundle.");
+			return {
+				ca,
+				rejectUnauthorized: true,
+				checkServerIdentity: () => void 0
+			};
+		}
+		case "require":
+		case "prefer": {
+			const ca = readCa();
+			return ca ? {
+				ca,
+				rejectUnauthorized: true,
+				checkServerIdentity: () => void 0
+			} : { rejectUnauthorized: false };
+		}
+		case "no-verify": return { rejectUnauthorized: false };
+		default: return;
+	}
+}
+
+//#endregion
+export { buildPgSslConfig };
+//# sourceMappingURL=sslConfig.mjs.map

package/dist/db/sslConfig.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sslConfig.mjs","names":[],"sources":["../../src/db/sslConfig.ts"],"sourcesContent":["import { readFileSync } from 'node:fs'\nimport type { ConnectionOptions } from 'node:tls'\n\n/**\n * Build the node-postgres `ssl` PoolConfig option from libpq-style env vars,\n * because node-postgres does NOT do this correctly on its own for a\n * connection-string pool: its built-in env handling maps `PGSSLMODE=verify-full`\n * to a bare `ssl: true` (Node's default trust store) and IGNORES `PGSSLROOTCERT`\n * — so an RDS server cert signed by the Amazon RDS CA would fail to verify.\n *\n * We therefore construct the `ssl` object explicitly and pass it to `new\n * pg.Pool({ connectionString, ssl })`. Semantics mirror libpq / pg-connection-string:\n *   - verify-full → validate CA chain AND hostname (Node defaults; no overrides)\n *   - verify-ca   → validate CA chain, skip hostname (checkServerIdentity no-op)\n *   - require/prefer → encrypt but don't validate (unless a CA is given → verify-ca-like)\n *   - no-verify   → encrypt, don't validate (rejectUnauthorized:false)\n *   - disable / unset → no TLS\n *\n * `PGSSLROOTCERT` points at a CA bundle on disk (e.g. the Amazon RDS\n * global-bundle.pem baked into the image).\n *\n * @returns a `ConnectionOptions` object, `false` for disabled, or `undefined`\n *          to leave SSL unset (let node-postgres fall back to its defaults).\n */\nexport function buildPgSslConfig(\n  env: NodeJS.ProcessEnv = process.env,\n): ConnectionOptions | boolean | undefined {\n  const mode = env.PGSSLMODE\n  const rootCertPath = env.PGSSLROOTCERT\n\n  const readCa = (): string | undefined => {\n    if (!rootCertPath) return undefined\n    try {\n      return readFileSync(rootCertPath, 'utf8')\n    } catch (err) {\n      throw new Error(\n        `PGSSLROOTCERT is set to \"${rootCertPath}\" but the CA bundle could not be read: ${\n          err instanceof Error ? err.message : String(err)\n        }`,\n      )\n    }\n  }\n\n  switch (mode) {\n    case 'disable':\n      return false\n\n    case 'verify-full': {\n      const ca = readCa()\n      if (!ca) {\n        throw new Error(\n          'PGSSLMODE=verify-full requires PGSSLROOTCERT to point at a CA bundle ' +\n            '(node-postgres would otherwise use the system trust store, which does ' +\n            'not include the Amazon RDS CA). Set PGSSLROOTCERT.',\n        )\n      }\n      // Node defaults: rejectUnauthorized=true (CA chain) + checkServerIdentity\n      // (hostname). That IS verify-full.\n      return { ca, rejectUnauthorized: true }\n    }\n\n    case 'verify-ca': {\n      const ca = readCa()\n      if (!ca) {\n        throw new Error(\n          'PGSSLMODE=verify-ca requires PGSSLROOTCERT to point at a CA bundle.',\n        )\n      }\n      // Validate the CA chain but skip hostname matching.\n      return {\n        ca,\n        rejectUnauthorized: true,\n        checkServerIdentity: () => undefined,\n      }\n    }\n\n    case 'require':\n    case 'prefer': {\n      const ca = readCa()\n      // With a CA, behave like verify-ca (validate chain, skip hostname);\n      // without one, encrypt but don't validate.\n      return ca\n        ? { ca, rejectUnauthorized: true, checkServerIdentity: () => undefined }\n        : { rejectUnauthorized: false }\n    }\n\n    case 'no-verify':\n      return { rejectUnauthorized: false }\n\n    default:\n      // Unset / unknown: leave SSL unset so callers/pg keep prior behavior.\n      return undefined\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,iBACd,MAAyB,QAAQ,KACQ;CACzC,MAAM,OAAO,IAAI;CACjB,MAAM,eAAe,IAAI;CAEzB,MAAM,eAAmC;AACvC,MAAI,CAAC,aAAc,QAAO;AAC1B,MAAI;AACF,UAAO,aAAa,cAAc,OAAO;WAClC,KAAK;AACZ,SAAM,IAAI,MACR,4BAA4B,aAAa,yCACvC,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAEnD;;;AAIL,SAAQ,MAAR;EACE,KAAK,UACH,QAAO;EAET,KAAK,eAAe;GAClB,MAAM,KAAK,QAAQ;AACnB,OAAI,CAAC,GACH,OAAM,IAAI,MACR,gMAGD;AAIH,UAAO;IAAE;IAAI,oBAAoB;IAAM;;EAGzC,KAAK,aAAa;GAChB,MAAM,KAAK,QAAQ;AACnB,OAAI,CAAC,GACH,OAAM,IAAI,MACR,sEACD;AAGH,UAAO;IACL;IACA,oBAAoB;IACpB,2BAA2B;IAC5B;;EAGH,KAAK;EACL,KAAK,UAAU;GACb,MAAM,KAAK,QAAQ;AAGnB,UAAO,KACH;IAAE;IAAI,oBAAoB;IAAM,2BAA2B;IAAW,GACtE,EAAE,oBAAoB,OAAO;;EAGnC,KAAK,YACH,QAAO,EAAE,oBAAoB,OAAO;EAEtC,QAEE"}

package/dist/index.d.mts

@@ -24,6 +24,7 @@ import { ScreenshotRestControllerConfig, registerScreenshotRestController } from
 import { SyncAssetsConfig, syncAssets } from "./modules/assets/syncAssets.mjs";
 import { checkAllLinks, printLinkCheckReport } from "./modules/appCatalog/checkLinks.mjs";
 import { connectDb, disconnectDb, getDbClient, setDbClient } from "./db/client.mjs";
+import { buildPgSslConfig } from "./db/sslConfig.mjs";
 import { MakeTFromPrismaModel, ObjectKeys, ScalarFilter, ScalarKeys, TableSyncParamsPrisma, tableSyncPrisma } from "./db/tableSyncPrismaAdapter.mjs";
 import { TABLE_SYNC_MAGAZINE, TableSyncMagazine, TableSyncMagazineModelNameKey } from "./db/tableSyncMagazine.mjs";
 import { SyncAppCatalogResult, syncAppCatalog } from "./db/syncAppCatalog.mjs";
@@ -34,4 +35,4 @@ import { injectCustomScripts } from "./middleware/htmlInjection.mjs";
 import { runLighthouseKeeperDemo } from "./modules/lighthouseKeeper/demo.mjs";
 import { APP_CATALOG_AI_SYSTEM_PROMPT, createAppCatalogAITools } from "./modules/lighthouseKeeper/tools.mjs";
 import { getBuildPipelineId, getFrontendPackageVersion, getVersionInfo } from "./utils/versionUtils.mjs";
-export { APP_CATALOG_AI_SYSTEM_PROMPT, AcAppIndexed, AcAppPageIndexed, AcAppUiIndexed, AcAppsMeta, type AcAuthConfig, AcBackendAppDto, AcBackendAppInput, AcBackendAppUIBaseInput, AcBackendAppUIInput, AcBackendCredentialInput, AcBackendDataFreshness, AcBackendDataSourceInput, AcBackendDataSourceInputCommon, AcBackendDataSourceInputDb, AcBackendDataSourceInputKafka, AcBackendDataVersion, AcBackendDeployableInput, AcBackendDeployment, AcBackendDeploymentInput, AcBackendEnvironmentInput, AcBackendPageInput, type AcBackendProvider, AcBackendTagDescriptionDataIndexed, AcBackendTagFixedTagValue, AcBackendTagsDescriptionDataIndexed, AcBackendUiDefaultsInput, AcBackendVersionsRequestParams, AcBackendVersionsReturn, AcContextIndexed, type AcDatabaseConfig, AcDatabaseManager, AcEnvIndexed, type AcFeatureToggles, type AcLifecycleHooks, type AcLighthouseKeeperConfig, type AcMcpServerConfig, AcMetaDictionary, type AcMiddlewareOptions, type AcMiddlewareResult, AcResourceIndexed, type AcStaticControllerContract, type AcTrpcContext, type AcTrpcContextOptions, AccessRequest, AppAccessRequest, AppApprovalMethod, AppCatalogCompanySpecificBackend, AppCatalogData, AppCategory, AppRole, AppVersionInfo, ApprovalMethod, ApprovalMethodConfig, ApprovalMethodType, ApprovalUrl, type AssetRestControllerConfig, type AuthRouter, type BetterAuth, CustomConfig, Freshness, Group, GroupingTagDefinition, GroupingTagValue, type IconRestControllerConfig, type MakeTFromPrismaModel, type MiddlewareContext, type ObjectKeys, Person, PersonTeamConfig, type Resource, Role, type ScalarFilter, type ScalarKeys, type ScreenshotRestControllerConfig, ServiceConfig, SourceReference, type SyncAppCatalogResult, type SyncAssetsConfig, TABLE_SYNC_MAGAZINE, type TRPCRouter, type TableSyncMagazine, type TableSyncMagazineModelNameKey, type TableSyncParamsPrisma, Tag, TierVariant, type UpsertIconInput, VersionInfo, checkAllLinks, connectDb, createAcMiddleware, createAcTrpcContext, createAppCatalogAITools, createAuth, createAuthRouter, createTrpcRouter, disconnectDb, getAssetByName, getBuildPipelineId, getDbClient, getFrontendPackageVersion, getVersionInfo, injectCustomScripts, printLinkCheckReport, registerAssetRestController, registerAuthRoutes, registerIconRestController, registerScreenshotRestController, runLighthouseKeeperDemo, setDbClient, staticControllerContract, syncAppCatalog, syncAssets, tableSyncPrisma, upsertIcon, upsertIcons };
+export { APP_CATALOG_AI_SYSTEM_PROMPT, AcAppIndexed, AcAppPageIndexed, AcAppUiIndexed, AcAppsMeta, type AcAuthConfig, AcBackendAppDto, AcBackendAppInput, AcBackendAppUIBaseInput, AcBackendAppUIInput, AcBackendCredentialInput, AcBackendDataFreshness, AcBackendDataSourceInput, AcBackendDataSourceInputCommon, AcBackendDataSourceInputDb, AcBackendDataSourceInputKafka, AcBackendDataVersion, AcBackendDeployableInput, AcBackendDeployment, AcBackendDeploymentInput, AcBackendEnvironmentInput, AcBackendPageInput, type AcBackendProvider, AcBackendTagDescriptionDataIndexed, AcBackendTagFixedTagValue, AcBackendTagsDescriptionDataIndexed, AcBackendUiDefaultsInput, AcBackendVersionsRequestParams, AcBackendVersionsReturn, AcContextIndexed, type AcDatabaseConfig, AcDatabaseManager, AcEnvIndexed, type AcFeatureToggles, type AcLifecycleHooks, type AcLighthouseKeeperConfig, type AcMcpServerConfig, AcMetaDictionary, type AcMiddlewareOptions, type AcMiddlewareResult, AcResourceIndexed, type AcStaticControllerContract, type AcTrpcContext, type AcTrpcContextOptions, AccessRequest, AppAccessRequest, AppApprovalMethod, AppCatalogCompanySpecificBackend, AppCatalogData, AppCategory, AppRole, AppVersionInfo, ApprovalMethod, ApprovalMethodConfig, ApprovalMethodType, ApprovalUrl, type AssetRestControllerConfig, type AuthRouter, type BetterAuth, CustomConfig, Freshness, Group, GroupingTagDefinition, GroupingTagValue, type IconRestControllerConfig, type MakeTFromPrismaModel, type MiddlewareContext, type ObjectKeys, Person, PersonTeamConfig, type Resource, Role, type ScalarFilter, type ScalarKeys, type ScreenshotRestControllerConfig, ServiceConfig, SourceReference, type SyncAppCatalogResult, type SyncAssetsConfig, TABLE_SYNC_MAGAZINE, type TRPCRouter, type TableSyncMagazine, type TableSyncMagazineModelNameKey, type TableSyncParamsPrisma, Tag, TierVariant, type UpsertIconInput, VersionInfo, buildPgSslConfig, checkAllLinks, connectDb, createAcMiddleware, createAcTrpcContext, createAppCatalogAITools, createAuth, createAuthRouter, createTrpcRouter, disconnectDb, getAssetByName, getBuildPipelineId, getDbClient, getFrontendPackageVersion, getVersionInfo, injectCustomScripts, printLinkCheckReport, registerAssetRestController, registerAuthRoutes, registerIconRestController, registerScreenshotRestController, runLighthouseKeeperDemo, setDbClient, staticControllerContract, syncAppCatalog, syncAssets, tableSyncPrisma, upsertIcon, upsertIcons };

package/dist/index.mjs

@@ -1,3 +1,4 @@
+import { buildPgSslConfig } from "./db/sslConfig.mjs";
 import { connectDb, disconnectDb, getDbClient, setDbClient } from "./db/client.mjs";
 import { createAuthRouter } from "./modules/auth/authRouter.mjs";
 import { createTrpcRouter } from "./server/controller.mjs";
@@ -21,4 +22,4 @@ import { APP_CATALOG_AI_SYSTEM_PROMPT, createAppCatalogAITools } from "./modules
 import { runLighthouseKeeperDemo } from "./modules/lighthouseKeeper/demo.mjs";
 import { getBuildPipelineId, getFrontendPackageVersion, getVersionInfo } from "./utils/versionUtils.mjs";
 
-export { APP_CATALOG_AI_SYSTEM_PROMPT, AcDatabaseManager, TABLE_SYNC_MAGAZINE, checkAllLinks, connectDb, createAcMiddleware, createAcTrpcContext, createAppCatalogAITools, createAuth, createAuthRouter, createTrpcRouter, disconnectDb, getAssetByName, getBuildPipelineId, getDbClient, getFrontendPackageVersion, getVersionInfo, injectCustomScripts, printLinkCheckReport, registerAssetRestController, registerAuthRoutes, registerIconRestController, registerScreenshotRestController, runLighthouseKeeperDemo, setDbClient, staticControllerContract, syncAppCatalog, syncAssets, tableSyncPrisma, upsertIcon, upsertIcons };
+export { APP_CATALOG_AI_SYSTEM_PROMPT, AcDatabaseManager, TABLE_SYNC_MAGAZINE, buildPgSslConfig, checkAllLinks, connectDb, createAcMiddleware, createAcTrpcContext, createAppCatalogAITools, createAuth, createAuthRouter, createTrpcRouter, disconnectDb, getAssetByName, getBuildPipelineId, getDbClient, getFrontendPackageVersion, getVersionInfo, injectCustomScripts, printLinkCheckReport, registerAssetRestController, registerAuthRoutes, registerIconRestController, registerScreenshotRestController, runLighthouseKeeperDemo, setDbClient, staticControllerContract, syncAppCatalog, syncAssets, tableSyncPrisma, upsertIcon, upsertIcons };

package/dist/middleware/database.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"database.d.mts","names":[],"sources":["../../src/middleware/database.ts"],"mappings":";;;;;;AAsBA;;cAAa,iBAAA;EAAA,QACH,MAAA;EAAA,QACA,IAAA;EAAA,QACA,MAAA;cAEI,MAAA,EAAQ,gBAAA;EAmCO;;;;EA3B3B,SAAA,CAAA,GAAa,YAAA;EAsBP,OAAA,CAAA,GAAW,OAAA;EAKX,UAAA,CAAA,GAAc,OAAA;AAAA"}
+{"version":3,"file":"database.d.mts","names":[],"sources":["../../src/middleware/database.ts"],"mappings":";;;;;;AAuBA;;cAAa,iBAAA;EAAA,QACH,MAAA;EAAA,QACA,IAAA;EAAA,QACA,MAAA;cAEI,MAAA,EAAQ,gBAAA;EAyCO;;;;EAjC3B,SAAA,CAAA,GAAa,YAAA;EA4BP,OAAA,CAAA,GAAW,OAAA;EAKX,UAAA,CAAA,GAAc,OAAA;AAAA"}

package/dist/middleware/database.mjs

@@ -1,4 +1,5 @@
 import { PrismaClient } from "../generated/prisma/client.mjs";
+import { buildPgSslConfig } from "../db/sslConfig.mjs";
 import { setDbClient } from "../db/client.mjs";
 import { PrismaPg } from "@prisma/adapter-pg";
 import pg from "pg";
@@ -29,7 +30,11 @@ var AcDatabaseManager = class {
 	getClient() {
 		if (!this.client) {
 			const datasourceUrl = formatConnectionUrl(this.config);
-			this.pool = new pg.Pool({ connectionString: datasourceUrl });
+			const ssl = buildPgSslConfig();
+			this.pool = new pg.Pool({
+				connectionString: datasourceUrl,
+				...ssl === void 0 ? {} : { ssl }
+			});
 			this.client = new PrismaClient({
 				adapter: new PrismaPg(this.pool),
 				log: process.env.NODE_ENV === "development" ? ["warn", "error"] : ["warn", "error"]

package/dist/middleware/database.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"database.mjs","names":[],"sources":["../../src/middleware/database.ts"],"sourcesContent":["import { PrismaClient } from '../generated/prisma/client'\nimport { PrismaPg } from '@prisma/adapter-pg'\nimport pg from 'pg'\nimport type { AcDatabaseConfig } from './types'\nimport { setDbClient } from '../db/client'\n\n/**\n * Formats a database connection URL from structured config.\n */\nfunction formatConnectionUrl(config: AcDatabaseConfig): string {\n  if ('url' in config) {\n    return config.url\n  }\n\n  const { host, port, database, username, password, schema = 'public' } = config\n  return `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}?schema=${schema}`\n}\n\n/**\n * Internal database manager used by the middleware.\n * Handles connection URL formatting and lifecycle.\n */\nexport class AcDatabaseManager {\n  private client: PrismaClient | null = null\n  private pool: pg.Pool | null = null\n  private config: AcDatabaseConfig\n\n  constructor(config: AcDatabaseConfig) {\n    this.config = config\n  }\n\n  /**\n   * Get or create the Prisma client instance.\n   * Uses lazy initialization for flexibility.\n   */\n  getClient(): PrismaClient {\n    if (!this.client) {\n      const datasourceUrl = formatConnectionUrl(this.config)\n\n      // Prisma 7 with adapter: Create pg pool and wrap with adapter\n      this.pool = new pg.Pool({ connectionString: datasourceUrl })\n      const adapter = new PrismaPg(this.pool)\n\n      this.client = new PrismaClient({\n        adapter,\n        log:\n          process.env.NODE_ENV === 'development'\n            ? ['warn', 'error']\n            : ['warn', 'error'],\n      })\n\n      // Bridge with existing backend-core getDbClient() usage\n      setDbClient(this.client)\n    }\n    return this.client\n  }\n\n  async connect(): Promise<void> {\n    const client = this.getClient()\n    await client.$connect()\n  }\n\n  async disconnect(): Promise<void> {\n    if (this.client) {\n      await this.client.$disconnect()\n      this.client = null\n    }\n    if (this.pool) {\n      await this.pool.end()\n      this.pool = null\n    }\n  }\n}\n"],"mappings":";;;;;;;;;AASA,SAAS,oBAAoB,QAAkC;AAC7D,KAAI,SAAS,OACX,QAAO,OAAO;CAGhB,MAAM,EAAE,MAAM,MAAM,UAAU,UAAU,UAAU,SAAS,aAAa;AACxE,QAAO,gBAAgB,SAAS,GAAG,mBAAmB,SAAS,CAAC,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,UAAU;;;;;;AAOxG,IAAa,oBAAb,MAA+B;CAK7B,YAAY,QAA0B;gBAJA;cACP;AAI7B,OAAK,SAAS;;;;;;CAOhB,YAA0B;AACxB,MAAI,CAAC,KAAK,QAAQ;GAChB,MAAM,gBAAgB,oBAAoB,KAAK,OAAO;AAGtD,QAAK,OAAO,IAAI,GAAG,KAAK,EAAE,kBAAkB,eAAe,CAAC;AAG5D,QAAK,SAAS,IAAI,aAAa;IAC7B,SAHc,IAAI,SAAS,KAAK,KAAK;IAIrC,KACE,QAAQ,IAAI,aAAa,gBACrB,CAAC,QAAQ,QAAQ,GACjB,CAAC,QAAQ,QAAQ;IACxB,CAAC;AAGF,eAAY,KAAK,OAAO;;AAE1B,SAAO,KAAK;;CAGd,MAAM,UAAyB;AAE7B,QADe,KAAK,WAAW,CAClB,UAAU;;CAGzB,MAAM,aAA4B;AAChC,MAAI,KAAK,QAAQ;AACf,SAAM,KAAK,OAAO,aAAa;AAC/B,QAAK,SAAS;;AAEhB,MAAI,KAAK,MAAM;AACb,SAAM,KAAK,KAAK,KAAK;AACrB,QAAK,OAAO"}
+{"version":3,"file":"database.mjs","names":[],"sources":["../../src/middleware/database.ts"],"sourcesContent":["import { PrismaClient } from '../generated/prisma/client'\nimport { PrismaPg } from '@prisma/adapter-pg'\nimport pg from 'pg'\nimport type { AcDatabaseConfig } from './types'\nimport { setDbClient } from '../db/client'\nimport { buildPgSslConfig } from '../db/sslConfig'\n\n/**\n * Formats a database connection URL from structured config.\n */\nfunction formatConnectionUrl(config: AcDatabaseConfig): string {\n  if ('url' in config) {\n    return config.url\n  }\n\n  const { host, port, database, username, password, schema = 'public' } = config\n  return `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${database}?schema=${schema}`\n}\n\n/**\n * Internal database manager used by the middleware.\n * Handles connection URL formatting and lifecycle.\n */\nexport class AcDatabaseManager {\n  private client: PrismaClient | null = null\n  private pool: pg.Pool | null = null\n  private config: AcDatabaseConfig\n\n  constructor(config: AcDatabaseConfig) {\n    this.config = config\n  }\n\n  /**\n   * Get or create the Prisma client instance.\n   * Uses lazy initialization for flexibility.\n   */\n  getClient(): PrismaClient {\n    if (!this.client) {\n      const datasourceUrl = formatConnectionUrl(this.config)\n\n      // Prisma 7 with adapter: Create pg pool and wrap with adapter.\n      // SSL from PGSSLMODE/PGSSLROOTCERT via buildPgSslConfig (node-postgres\n      // doesn't apply those correctly to a connection-string pool).\n      const ssl = buildPgSslConfig()\n      this.pool = new pg.Pool({\n        connectionString: datasourceUrl,\n        ...(ssl === undefined ? {} : { ssl }),\n      })\n      const adapter = new PrismaPg(this.pool)\n\n      this.client = new PrismaClient({\n        adapter,\n        log:\n          process.env.NODE_ENV === 'development'\n            ? ['warn', 'error']\n            : ['warn', 'error'],\n      })\n\n      // Bridge with existing backend-core getDbClient() usage\n      setDbClient(this.client)\n    }\n    return this.client\n  }\n\n  async connect(): Promise<void> {\n    const client = this.getClient()\n    await client.$connect()\n  }\n\n  async disconnect(): Promise<void> {\n    if (this.client) {\n      await this.client.$disconnect()\n      this.client = null\n    }\n    if (this.pool) {\n      await this.pool.end()\n      this.pool = null\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;AAUA,SAAS,oBAAoB,QAAkC;AAC7D,KAAI,SAAS,OACX,QAAO,OAAO;CAGhB,MAAM,EAAE,MAAM,MAAM,UAAU,UAAU,UAAU,SAAS,aAAa;AACxE,QAAO,gBAAgB,SAAS,GAAG,mBAAmB,SAAS,CAAC,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,UAAU;;;;;;AAOxG,IAAa,oBAAb,MAA+B;CAK7B,YAAY,QAA0B;gBAJA;cACP;AAI7B,OAAK,SAAS;;;;;;CAOhB,YAA0B;AACxB,MAAI,CAAC,KAAK,QAAQ;GAChB,MAAM,gBAAgB,oBAAoB,KAAK,OAAO;GAKtD,MAAM,MAAM,kBAAkB;AAC9B,QAAK,OAAO,IAAI,GAAG,KAAK;IACtB,kBAAkB;IAClB,GAAI,QAAQ,SAAY,EAAE,GAAG,EAAE,KAAK;IACrC,CAAC;AAGF,QAAK,SAAS,IAAI,aAAa;IAC7B,SAHc,IAAI,SAAS,KAAK,KAAK;IAIrC,KACE,QAAQ,IAAI,aAAa,gBACrB,CAAC,QAAQ,QAAQ,GACjB,CAAC,QAAQ,QAAQ;IACxB,CAAC;AAGF,eAAY,KAAK,OAAO;;AAE1B,SAAO,KAAK;;CAGd,MAAM,UAAyB;AAE7B,QADe,KAAK,WAAW,CAClB,UAAU;;CAGzB,MAAM,aAA4B;AAChC,MAAI,KAAK,QAAQ;AACf,SAAM,KAAK,OAAO,aAAa;AAC/B,QAAK,SAAS;;AAEhB,MAAI,KAAK,MAAM;AACb,SAAM,KAAK,KAAK,KAAK;AACrB,QAAK,OAAO"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@igstack/app-catalog-backend-core",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "description": "Backend core library for App Catalog",
   "homepage": "https://github.com/lislon/app-catalog",
   "repository": {
@@ -45,8 +45,8 @@
     "tsyringe": "^4.10.0",
     "yaml": "^2.8.0",
     "zod": "^4.3.5",
-    "@igstack/app-catalog-shared-core": "0.12.0",
-    "@igstack/app-catalog-table-sync": "0.12.0"
+    "@igstack/app-catalog-shared-core": "0.13.1",
+    "@igstack/app-catalog-table-sync": "0.13.1"
   },
   "devDependencies": {
     "@tanstack/vite-config": "^0.4.3",
@@ -73,7 +73,7 @@
   "engines": {
     "node": ">=24"
   },
-  "gitHead": "34de03d23f3923a85c8a3b4d0bc6ff2d83c799d3",
+  "gitHead": "1a7efd91a8e67bea65020e30913ffbbf593c7412",
   "scripts": {
     "build": "tsdown",
     "build:lenient": "tsdown",

package/src/__tests__/sslConfig.test.ts

@@ -0,0 +1,90 @@
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { buildPgSslConfig } from '../db/sslConfig'
+
+const CA_PEM =
+  '-----BEGIN CERTIFICATE-----\nMIIB...fake...\n-----END CERTIFICATE-----\n'
+
+describe('buildPgSslConfig', () => {
+  let dir: string
+  let caPath: string
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'sslcfg-'))
+    caPath = join(dir, 'ca.pem')
+    writeFileSync(caPath, CA_PEM)
+  })
+  afterEach(() => rmSync(dir, { recursive: true, force: true }))
+
+  const env = (over: Record<string, string | undefined>): NodeJS.ProcessEnv =>
+    over as NodeJS.ProcessEnv
+
+  it('returns undefined when PGSSLMODE is unset (leave pg defaults)', () => {
+    expect(buildPgSslConfig(env({}))).toBeUndefined()
+  })
+
+  it('returns false for disable', () => {
+    expect(buildPgSslConfig(env({ PGSSLMODE: 'disable' }))).toBe(false)
+  })
+
+  it('verify-full loads the CA and keeps full validation', () => {
+    const ssl = buildPgSslConfig(
+      env({ PGSSLMODE: 'verify-full', PGSSLROOTCERT: caPath }),
+    )
+    expect(ssl).toMatchObject({ ca: CA_PEM, rejectUnauthorized: true })
+    // verify-full must NOT disable hostname checking
+    expect(
+      (ssl as { checkServerIdentity?: unknown }).checkServerIdentity,
+    ).toBeUndefined()
+  })
+
+  it('verify-full throws without a CA (would silently use system store otherwise)', () => {
+    expect(() => buildPgSslConfig(env({ PGSSLMODE: 'verify-full' }))).toThrow(
+      /PGSSLROOTCERT/,
+    )
+  })
+
+  it('verify-ca validates the chain but skips hostname', () => {
+    const ssl = buildPgSslConfig(
+      env({ PGSSLMODE: 'verify-ca', PGSSLROOTCERT: caPath }),
+    ) as {
+      ca: string
+      rejectUnauthorized: boolean
+      checkServerIdentity: () => unknown
+    }
+    expect(ssl.ca).toBe(CA_PEM)
+    expect(ssl.rejectUnauthorized).toBe(true)
+    expect(typeof ssl.checkServerIdentity).toBe('function')
+    expect(ssl.checkServerIdentity()).toBeUndefined()
+  })
+
+  it('no-verify encrypts without validation', () => {
+    expect(buildPgSslConfig(env({ PGSSLMODE: 'no-verify' }))).toEqual({
+      rejectUnauthorized: false,
+    })
+  })
+
+  it('require without a CA does not validate', () => {
+    expect(buildPgSslConfig(env({ PGSSLMODE: 'require' }))).toEqual({
+      rejectUnauthorized: false,
+    })
+  })
+
+  it('require WITH a CA validates the chain (verify-ca-like)', () => {
+    const ssl = buildPgSslConfig(
+      env({ PGSSLMODE: 'require', PGSSLROOTCERT: caPath }),
+    ) as { ca: string; rejectUnauthorized: boolean }
+    expect(ssl.ca).toBe(CA_PEM)
+    expect(ssl.rejectUnauthorized).toBe(true)
+  })
+
+  it('throws a clear error when the CA path is unreadable', () => {
+    expect(() =>
+      buildPgSslConfig(
+        env({ PGSSLMODE: 'verify-full', PGSSLROOTCERT: '/no/such/ca.pem' }),
+      ),
+    ).toThrow(/could not be read/)
+  })
+})

package/src/db/client.ts

@@ -1,6 +1,7 @@
 import { PrismaClient } from '../generated/prisma/client'
 import { PrismaPg } from '@prisma/adapter-pg'
 import pg from 'pg'
+import { buildPgSslConfig } from './sslConfig'
 
 let prismaClient: PrismaClient | null = null
 let pool: pg.Pool | null = null
@@ -19,8 +20,15 @@ export function getDbClient(): PrismaClient {
       )
     }
 
-    // Prisma 7 with adapter: Create pg pool and wrap with adapter
-    pool = new pg.Pool({ connectionString: databaseUrl })
+    // Prisma 7 with adapter: Create pg pool and wrap with adapter.
+    // SSL comes from PGSSLMODE/PGSSLROOTCERT via our helper (node-postgres
+    // doesn't honor those correctly for a connection-string pool — see
+    // buildPgSslConfig).
+    const ssl = buildPgSslConfig()
+    pool = new pg.Pool({
+      connectionString: databaseUrl,
+      ...(ssl === undefined ? {} : { ssl }),
+    })
     const adapter = new PrismaPg(pool)
 
     prismaClient = new PrismaClient({ adapter })

package/src/db/index.ts

@@ -1,5 +1,6 @@
 // Database connection
 export { connectDb, disconnectDb, getDbClient, setDbClient } from './client'
+export { buildPgSslConfig } from './sslConfig'
 
 // Table sync utilities
 export {

package/src/db/sslConfig.ts

@@ -0,0 +1,94 @@
+import { readFileSync } from 'node:fs'
+import type { ConnectionOptions } from 'node:tls'
+
+/**
+ * Build the node-postgres `ssl` PoolConfig option from libpq-style env vars,
+ * because node-postgres does NOT do this correctly on its own for a
+ * connection-string pool: its built-in env handling maps `PGSSLMODE=verify-full`
+ * to a bare `ssl: true` (Node's default trust store) and IGNORES `PGSSLROOTCERT`
+ * — so an RDS server cert signed by the Amazon RDS CA would fail to verify.
+ *
+ * We therefore construct the `ssl` object explicitly and pass it to `new
+ * pg.Pool({ connectionString, ssl })`. Semantics mirror libpq / pg-connection-string:
+ *   - verify-full → validate CA chain AND hostname (Node defaults; no overrides)
+ *   - verify-ca   → validate CA chain, skip hostname (checkServerIdentity no-op)
+ *   - require/prefer → encrypt but don't validate (unless a CA is given → verify-ca-like)
+ *   - no-verify   → encrypt, don't validate (rejectUnauthorized:false)
+ *   - disable / unset → no TLS
+ *
+ * `PGSSLROOTCERT` points at a CA bundle on disk (e.g. the Amazon RDS
+ * global-bundle.pem baked into the image).
+ *
+ * @returns a `ConnectionOptions` object, `false` for disabled, or `undefined`
+ *          to leave SSL unset (let node-postgres fall back to its defaults).
+ */
+export function buildPgSslConfig(
+  env: NodeJS.ProcessEnv = process.env,
+): ConnectionOptions | boolean | undefined {
+  const mode = env.PGSSLMODE
+  const rootCertPath = env.PGSSLROOTCERT
+
+  const readCa = (): string | undefined => {
+    if (!rootCertPath) return undefined
+    try {
+      return readFileSync(rootCertPath, 'utf8')
+    } catch (err) {
+      throw new Error(
+        `PGSSLROOTCERT is set to "${rootCertPath}" but the CA bundle could not be read: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      )
+    }
+  }
+
+  switch (mode) {
+    case 'disable':
+      return false
+
+    case 'verify-full': {
+      const ca = readCa()
+      if (!ca) {
+        throw new Error(
+          'PGSSLMODE=verify-full requires PGSSLROOTCERT to point at a CA bundle ' +
+            '(node-postgres would otherwise use the system trust store, which does ' +
+            'not include the Amazon RDS CA). Set PGSSLROOTCERT.',
+        )
+      }
+      // Node defaults: rejectUnauthorized=true (CA chain) + checkServerIdentity
+      // (hostname). That IS verify-full.
+      return { ca, rejectUnauthorized: true }
+    }
+
+    case 'verify-ca': {
+      const ca = readCa()
+      if (!ca) {
+        throw new Error(
+          'PGSSLMODE=verify-ca requires PGSSLROOTCERT to point at a CA bundle.',
+        )
+      }
+      // Validate the CA chain but skip hostname matching.
+      return {
+        ca,
+        rejectUnauthorized: true,
+        checkServerIdentity: () => undefined,
+      }
+    }
+
+    case 'require':
+    case 'prefer': {
+      const ca = readCa()
+      // With a CA, behave like verify-ca (validate chain, skip hostname);
+      // without one, encrypt but don't validate.
+      return ca
+        ? { ca, rejectUnauthorized: true, checkServerIdentity: () => undefined }
+        : { rejectUnauthorized: false }
+    }
+
+    case 'no-verify':
+      return { rejectUnauthorized: false }
+
+    default:
+      // Unset / unknown: leave SSL unset so callers/pg keep prior behavior.
+      return undefined
+  }
+}

package/src/index.ts

@@ -59,6 +59,7 @@ export {
 
 // Database utilities
 export {
+  buildPgSslConfig,
   connectDb,
   disconnectDb,
   getDbClient,

package/src/middleware/database.ts

@@ -3,6 +3,7 @@ import { PrismaPg } from '@prisma/adapter-pg'
 import pg from 'pg'
 import type { AcDatabaseConfig } from './types'
 import { setDbClient } from '../db/client'
+import { buildPgSslConfig } from '../db/sslConfig'
 
 /**
  * Formats a database connection URL from structured config.
@@ -37,8 +38,14 @@ export class AcDatabaseManager {
     if (!this.client) {
       const datasourceUrl = formatConnectionUrl(this.config)
 
-      // Prisma 7 with adapter: Create pg pool and wrap with adapter
-      this.pool = new pg.Pool({ connectionString: datasourceUrl })
+      // Prisma 7 with adapter: Create pg pool and wrap with adapter.
+      // SSL from PGSSLMODE/PGSSLROOTCERT via buildPgSslConfig (node-postgres
+      // doesn't apply those correctly to a connection-string pool).
+      const ssl = buildPgSslConfig()
+      this.pool = new pg.Pool({
+        connectionString: datasourceUrl,
+        ...(ssl === undefined ? {} : { ssl }),
+      })
       const adapter = new PrismaPg(this.pool)
 
       this.client = new PrismaClient({