@trycompai/db 2.1.3 → 2.3.0

package/dist/ssl-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssl-config.d.ts","sourceRoot":"","sources":["../src/ssl-config.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GACjB,SAAS,GACT;IAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;CAAE,GACxC;IAAE,kBAAkB,EAAE,KAAK,CAAA;CAAE,CAAC;AAgBlC,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAe,GAC5C,SAAS,CAeX"}
+{"version":3,"file":"ssl-config.d.ts","sourceRoot":"","sources":["../src/ssl-config.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GACjB,SAAS,GACT;IAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;CAAE,GACxC;IAAE,kBAAkB,EAAE,KAAK,CAAA;CAAE,CAAC;AAgBlC,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAe,GAC5C,SAAS,CAcX"}

package/dist/ssl-config.js

@@ -15,18 +15,19 @@ function isLocalhostUrl(connectionString) {
     }
 }
 function resolveSslConfig(databaseUrl, env = process.env) {
-    const isLocalhost = isLocalhostUrl(databaseUrl);
-    const hasCABundle = !!env.NODE_EXTRA_CA_CERTS;
-    const allowInsecure = env.PRISMA_ALLOW_INSECURE_TLS === '1';
-    if (isLocalhost)
+    if (isLocalhostUrl(databaseUrl))
         return undefined;
-    // Verified TLS: rely on Node's TLS context (NODE_EXTRA_CA_CERTS adds the AWS
-    // RDS CA to the trust store). Skip hostname check because connections may
-    // traverse an AWS NLB whose hostname isn't in the RDS Proxy cert's SAN list.
-    // The chain check still rejects forged or wrong-CA certs.
-    if (hasCABundle)
-        return { checkServerIdentity: () => undefined };
-    if (allowInsecure)
+    if (env.PRISMA_ALLOW_INSECURE_TLS === '1')
         return { rejectUnauthorized: false };
-    throw new Error('Refusing to connect to a non-local Postgres without TLS verification. Set NODE_EXTRA_CA_CERTS to a CA bundle, or set PRISMA_ALLOW_INSECURE_TLS=1 if you intentionally want unverified TLS.');
+    // Verified TLS via Node's default trust store, which includes Amazon Root
+    // CA 1 — where AWS RDS Proxy chains terminate. Hostname check is skipped
+    // because connections traverse an AWS NLB whose hostname isn't in the RDS
+    // Proxy cert's SAN list; the chain check still rejects forged or wrong-CA
+    // certs.
+    //
+    // Previously this returned `{ ca: RDS_CA_BUNDLE, ... }` — but `ssl.ca`
+    // *replaces* Node's trust store rather than augmenting it, and the bundle
+    // only contains regional RDS CAs (not Amazon Root CA 1), so RDS Proxy
+    // chain validation failed at runtime (P1011 / TlsConnectionError).
+    return { checkServerIdentity: () => undefined };
 }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@trycompai/db",
     "description": "Database package with Prisma client and schema for Comp AI",
-    "version": "2.1.3",
+    "version": "2.3.0",
     "dependencies": {
         "@prisma/adapter-pg": "7.6.0",
         "@prisma/client": "7.6.0",
@@ -36,7 +36,6 @@
     },
     "files": [
         "dist",
-        "certs",
         "README.md",
         "INTEGRATION_GUIDE.md"
     ],