@trycompai/db 2.2.0 → 2.3.1

package/dist/schema.prisma

@@ -630,20 +630,35 @@ model CustomRequirement {
   description String
   identifier  String
 
-  organizationId    String
-  organization      Organization    @relation(fields: [organizationId], references: [id], onDelete: Cascade)
-  customFrameworkId String
+  organizationId String
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  // A custom requirement hangs off either a CustomFramework (the org authored
+  // a whole new framework) or a single FrameworkInstance (the org tacked an
+  // extra requirement onto a platform framework like ISO 27001). Exactly one
+  // of these is set — enforced by a DB CHECK constraint.
+  customFrameworkId String?
   // Composite FK onto (id, organizationId) so tenant consistency with the
   // referenced CustomFramework is enforced at the DB level.
-  customFramework   CustomFramework @relation(fields: [customFrameworkId, organizationId], references: [id, organizationId], onDelete: Cascade)
+  customFramework   CustomFramework? @relation(fields: [customFrameworkId, organizationId], references: [id, organizationId], onDelete: Cascade)
+
+  frameworkInstanceId String?
+  // Composite FK onto (id, organizationId) so a per-instance custom requirement
+  // can only point at an FI in its own org.
+  frameworkInstance   FrameworkInstance? @relation(fields: [frameworkInstanceId, organizationId], references: [id, organizationId], onDelete: Cascade)
 
   requirementMaps RequirementMap[]
 
   createdAt DateTime @default(now())
   updatedAt DateTime @default(now()) @updatedAt
 
+  // Identifier uniqueness scoped to whichever parent is set. Postgres treats
+  // NULLs as distinct in unique indexes, so the inactive parent column doesn't
+  // collide across rows.
   @@unique([customFrameworkId, identifier])
+  @@unique([frameworkInstanceId, identifier])
   @@index([organizationId])
+  @@index([frameworkInstanceId])
 }
 
 // ===== device.prisma =====
@@ -1139,7 +1154,14 @@ model FrameworkInstance {
   requirementsMapped RequirementMap[]
   timelineInstances  TimelineInstance[]
   syncOperations     FrameworkSyncOperation[]
+  // Per-instance custom requirements (used when an org tacks an extra requirement
+  // onto a platform framework instance). Custom requirements attached to a
+  // CustomFramework hang off CustomFramework.requirements instead.
+  customRequirements CustomRequirement[]
 
+  // (id, organizationId) is the composite-FK target for CustomRequirement.frameworkInstanceId
+  // so a per-instance custom requirement can only point at an FI in its own org.
+  @@unique([id, organizationId])
   @@unique([organizationId, frameworkId])
   @@unique([organizationId, customFrameworkId])
   @@index([customFrameworkId])
@@ -2983,6 +3005,8 @@ model Trust {
   hipaa         Boolean @default(false)
   pci_dss       Boolean @default(false)
   iso9001       Boolean @default(false)
+  pipeda        Boolean @default(false)
+  ccpa          Boolean @default(false)
 
   soc2_status      FrameworkStatus @default(started)
   soc2type1_status FrameworkStatus @default(started)
@@ -2995,6 +3019,8 @@ model Trust {
   hipaa_status     FrameworkStatus @default(started)
   pci_dss_status   FrameworkStatus @default(started)
   iso9001_status   FrameworkStatus @default(started)
+  pipeda_status    FrameworkStatus @default(started)
+  ccpa_status      FrameworkStatus @default(started)
 
   // Overview section for public trust portal
   overviewTitle   String?
@@ -3032,6 +3058,8 @@ enum TrustFramework {
   pci_dss
   nen_7510
   iso_9001
+  pipeda
+  ccpa
 }
 
 model TrustResource {

package/dist/ssl-config.d.ts

@@ -1,5 +1,4 @@
 export type SslConfig = undefined | {
-    ca: string;
     checkServerIdentity: () => undefined;
 } | {
     rejectUnauthorized: false;

package/dist/ssl-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssl-config.d.ts","sourceRoot":"","sources":["../src/ssl-config.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GACjB,SAAS,GACT;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,mBAAmB,EAAE,MAAM,SAAS,CAAA;CAAE,GACpD;IAAE,kBAAkB,EAAE,KAAK,CAAA;CAAE,CAAC;AAgBlC,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAe,GAC5C,SAAS,CAQX"}
+{"version":3,"file":"ssl-config.d.ts","sourceRoot":"","sources":["../src/ssl-config.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GACjB,SAAS,GACT;IAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;CAAE,GACxC;IAAE,kBAAkB,EAAE,KAAK,CAAA;CAAE,CAAC;AAgBlC,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,EACnB,GAAG,GAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAe,GAC5C,SAAS,CAcX"}

package/dist/ssl-config.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveSslConfig = resolveSslConfig;
-const rds_ca_bundle_1 = require("./rds-ca-bundle");
 const LOCAL_HOSTNAMES = new Set(['localhost', '127.0.0.1', '::1']);
 function isLocalhostUrl(connectionString) {
     try {
@@ -20,9 +19,15 @@ function resolveSslConfig(databaseUrl, env = process.env) {
         return undefined;
     if (env.PRISMA_ALLOW_INSECURE_TLS === '1')
         return { rejectUnauthorized: false };
-    // Verified TLS using the inlined AWS RDS CA bundle. Skip the hostname check
-    // because connections may traverse an AWS NLB whose hostname isn't in the
-    // RDS Proxy cert's SAN list. The chain check still rejects forged or
-    // wrong-CA certs.
-    return { ca: rds_ca_bundle_1.RDS_CA_BUNDLE, checkServerIdentity: () => undefined };
+    // Verified TLS via Node's default trust store, which includes Amazon Root
+    // CA 1 — where AWS RDS Proxy chains terminate. Hostname check is skipped
+    // because connections traverse an AWS NLB whose hostname isn't in the RDS
+    // Proxy cert's SAN list; the chain check still rejects forged or wrong-CA
+    // certs.
+    //
+    // Previously this returned `{ ca: RDS_CA_BUNDLE, ... }` — but `ssl.ca`
+    // *replaces* Node's trust store rather than augmenting it, and the bundle
+    // only contains regional RDS CAs (not Amazon Root CA 1), so RDS Proxy
+    // chain validation failed at runtime (P1011 / TlsConnectionError).
+    return { checkServerIdentity: () => undefined };
 }

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@trycompai/db",
     "description": "Database package with Prisma client and schema for Comp AI",
-    "version": "2.2.0",
+    "version": "2.3.1",
     "dependencies": {
         "@prisma/adapter-pg": "7.6.0",
         "@prisma/client": "7.6.0",
@@ -36,7 +36,6 @@
     },
     "files": [
         "dist",
-        "certs",
         "README.md",
         "INTEGRATION_GUIDE.md"
     ],