@trycompai/db 2.2.0 → 2.3.0

package/dist/ssl-config.d.ts

@@ -1,5 +1,4 @@
 export type SslConfig = undefined | {
-    ca: string;
     checkServerIdentity: () => undefined;
 } | {
     rejectUnauthorized: false;

package/dist/ssl-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssl-config.d.ts","sourceRoot":"","sources":["../src/ssl-config.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GACjB,SAAS,GACT;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,SAAS,CAAA;CAAE,GACpD;IAAE,kBAAkB,EAAE,KAAK,CAAA;CAAE,CAAC;AAgBlC,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAe,GAC5C,SAAS,CAQX"}
+{"version":3,"file":"ssl-config.d.ts","sourceRoot":"","sources":["../src/ssl-config.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GACjB,SAAS,GACT;IAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;CAAE,GACxC;IAAE,kBAAkB,EAAE,KAAK,CAAA;CAAE,CAAC;AAgBlC,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAe,GAC5C,SAAS,CAcX"}

package/dist/ssl-config.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveSslConfig = resolveSslConfig;
-const rds_ca_bundle_1 = require("./rds-ca-bundle");
 const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1']);
 function isLocalhostUrl(connectionString) {
     try {
@@ -20,9 +19,15 @@ function resolveSslConfig(databaseUrl, env = process.env) {
         return undefined;
     if (env.PRISMA_ALLOW_INSECURE_TLS === '1')
         return { rejectUnauthorized: false };
-    // Verified TLS using the inlined AWS RDS CA bundle. Skip the hostname check
-    // because connections may traverse an AWS NLB whose hostname isn't in the
-    // RDS Proxy cert's SAN list. The chain check still rejects forged or
-    // wrong-CA certs.
-    return { ca: rds_ca_bundle_1.RDS_CA_BUNDLE, checkServerIdentity: () => undefined };
+    // Verified TLS via Node's default trust store, which includes Amazon Root
+    // CA 1 — where AWS RDS Proxy chains terminate. Hostname check is skipped
+    // because connections traverse an AWS NLB whose hostname isn't in the RDS
+    // Proxy cert's SAN list; the chain check still rejects forged or wrong-CA
+    // certs.
+    //
+    // Previously this returned `{ ca: RDS_CA_BUNDLE, ... }` — but `ssl.ca`
+    // *replaces* Node's trust store rather than augmenting it, and the bundle
+    // only contains regional RDS CAs (not Amazon Root CA 1), so RDS Proxy
+    // chain validation failed at runtime (P1011 / TlsConnectionError).
+    return { checkServerIdentity: () => undefined };
 }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@trycompai/db",
     "description": "Database package with Prisma client and schema for Comp AI",
-    "version": "2.2.0",
+    "version": "2.3.0",
     "dependencies": {
         "@prisma/adapter-pg": "7.6.0",
         "@prisma/client": "7.6.0",
@@ -36,7 +36,6 @@
     },
     "files": [
         "dist",
-        "certs",
         "README.md",
         "INTEGRATION_GUIDE.md"
     ],