spfn 0.2.0-beta.57 → 0.2.0-beta.59

package/README.md

@@ -69,6 +69,9 @@ already exists). See [Scaffold structure](#scaffold-structure) for what lands on
 |--------|-------------|
 | `-y, --yes` | Skip prompts, use defaults |
 
+Generated projects pin `drizzle-orm` and `drizzle-kit` to `1.0.0-rc.4`, matching
+`@spfn/core` and the rest of the published SPFN database packages.
+
 ### `spfn add <package>`
 
 Installs an SPFN ecosystem package and applies its pre-built migrations. The package
@@ -181,6 +184,12 @@ loaded `.env` chain.
 > `db push` is for development. For production, use `db generate` + `db migrate` to keep
 > migration history.
 
+Database TLS is controlled by `DATABASE_URL`. Loopback URLs (`localhost`, `127.0.0.1`,
+and `::1`) default to `ssl: false`; add an explicit `sslmode` when the local server uses
+TLS. For a TLS connection with a self-signed certificate, set
+`SPFN_DB_INSECURE_TLS=1` to disable certificate verification. This opt-in never enables
+TLS by itself and `sslmode=disable` remains authoritative.
+
 ### `spfn env`
 
 Schema-driven environment variable tooling (schema comes from a package's `envSchema`,

package/dist/index.js

@@ -869,7 +869,7 @@ var init_deployment_config = __esm({
 
 // src/utils/version.ts
 function getCliVersion() {
-  return "0.2.0-beta.57";
+  return "0.2.0-beta.59";
 }
 function getTagFromVersion(version) {
   const match = version.match(/-([a-z]+)\./i);
@@ -896,8 +896,8 @@ async function setupPackageJson(cwd, packageJsonPath, packageJson, packageManage
   const spfnTag = getSpfnTag();
   packageJson.dependencies["@spfn/core"] = spfnTag;
   packageJson.dependencies["@sinclair/typebox"] = "^0.34.0";
-  packageJson.dependencies["drizzle-orm"] = "^0.45.0";
-  packageJson.dependencies["drizzle-typebox"] = "^0.1.0";
+  packageJson.dependencies["drizzle-orm"] = "1.0.0-rc.4";
+  packageJson.dependencies["drizzle-typebox"] = "^0.3.3";
   packageJson.dependencies["postgres"] = "^3.4.0";
   packageJson.dependencies["pg"] = "^8.16.3";
   packageJson.dependencies["spfn"] = spfnTag;
@@ -908,7 +908,7 @@ async function setupPackageJson(cwd, packageJsonPath, packageJson, packageManage
   packageJson.devDependencies["@types/node"] = "^20.11.0";
   packageJson.devDependencies["tsx"] = "^4.20.6";
   packageJson.devDependencies["tsup"] = "^8.5.0";
-  packageJson.devDependencies["drizzle-kit"] = "^0.31.5";
+  packageJson.devDependencies["drizzle-kit"] = "1.0.0-rc.4";
   packageJson.devDependencies["dotenv"] = "^17.2.3";
   if (!packageJson.scripts["build"]) {
     packageJson.scripts["build"] = "next build --turbopack";
@@ -2770,19 +2770,56 @@ import chalk10 from "chalk";
 import ora6 from "ora";
 import { env } from "@spfn/core/config";
 import { loadEnv } from "@spfn/core/server";
-function shouldRelaxDbTls(databaseUrl) {
-  if (process.env.SPFN_DB_INSECURE_TLS === "1" || process.env.SPFN_DB_INSECURE_TLS === "true") {
-    return true;
-  }
+var TLS_SSL_MODES = /* @__PURE__ */ new Set(["no-verify", "prefer", "require", "verify-ca", "verify-full"]);
+function parseDatabaseUrl(databaseUrl) {
   if (!databaseUrl) {
-    return false;
+    return void 0;
   }
   try {
-    const host = new URL(databaseUrl).hostname.replace(/^\[|\]$/g, "");
-    return host === "localhost" || host === "127.0.0.1" || host === "::1";
+    return new URL(databaseUrl);
   } catch {
-    return false;
+    return void 0;
+  }
+}
+function isLoopbackDatabaseUrl(databaseUrl) {
+  const host = databaseUrl.hostname.replace(/^\[|\]$/g, "");
+  return host === "localhost" || host === "127.0.0.1" || host === "::1";
+}
+function requestsDbTls(databaseUrl) {
+  const sslMode = databaseUrl.searchParams.get("sslmode")?.toLowerCase();
+  if (sslMode) {
+    return TLS_SSL_MODES.has(sslMode);
+  }
+  return databaseUrl.searchParams.get("ssl")?.toLowerCase() === "true";
+}
+function insecureDbTlsEnabled() {
+  return process.env.SPFN_DB_INSECURE_TLS === "1" || process.env.SPFN_DB_INSECURE_TLS === "true";
+}
+function shouldRelaxDbTls(databaseUrl) {
+  const parsedUrl = parseDatabaseUrl(databaseUrl);
+  const sslMode = parsedUrl?.searchParams.get("sslmode")?.toLowerCase();
+  return insecureDbTlsEnabled() && parsedUrl !== void 0 && requestsDbTls(parsedUrl) && sslMode !== "no-verify";
+}
+function resolvePushConnectionConfig(databaseUrl) {
+  const parsedUrl = parseDatabaseUrl(databaseUrl);
+  if (!parsedUrl) {
+    return { connectionString: databaseUrl };
+  }
+  const sslMode = parsedUrl.searchParams.get("sslmode")?.toLowerCase();
+  const hasExplicitSslSetting = parsedUrl.searchParams.has("sslmode") || parsedUrl.searchParams.has("ssl");
+  if (sslMode === "disable") {
+    return { connectionString: databaseUrl, ssl: false };
+  }
+  const tlsRequested = requestsDbTls(parsedUrl);
+  if (!hasExplicitSslSetting && isLoopbackDatabaseUrl(parsedUrl)) {
+    return { connectionString: databaseUrl, ssl: false };
+  }
+  if (!tlsRequested || !insecureDbTlsEnabled()) {
+    return { connectionString: databaseUrl };
   }
+  parsedUrl.searchParams.set("sslmode", "no-verify");
+  parsedUrl.searchParams.delete("ssl");
+  return { connectionString: parsedUrl.toString() };
 }
 function validateDatabasePrerequisites() {
   loadEnv();
@@ -2881,10 +2918,10 @@ async function createPushConnection() {
   }
   const pg = await import("pg");
   const { drizzle } = await import("drizzle-orm/node-postgres");
+  const connectionConfig = resolvePushConnectionConfig(env.DATABASE_URL);
   const pool = new pg.default.Pool({
-    connectionString: env.DATABASE_URL,
-    max: 1,
-    ...shouldRelaxDbTls(env.DATABASE_URL) ? { ssl: { rejectUnauthorized: false } } : {}
+    ...connectionConfig,
+    max: 1
   });
   const db = drizzle({ client: pool });
   return {
@@ -3148,7 +3185,7 @@ import ora7 from "ora";
 import net from "net";
 import chalk15 from "chalk";
 import prompts4 from "prompts";
-function parseDatabaseUrl(dbUrl) {
+function parseDatabaseUrl2(dbUrl) {
   try {
     const url = new URL(dbUrl);
     return {
@@ -3400,7 +3437,7 @@ async function dbBackup(options) {
     console.log(chalk18.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     process.exit(1);
   }
-  const dbInfo = parseDatabaseUrl(dbUrl);
+  const dbInfo = parseDatabaseUrl2(dbUrl);
   const backupDir = await ensureBackupDir();
   const timestamp = formatTimestamp();
   const format = options.format || "sql";
@@ -3660,7 +3697,7 @@ async function dbDrop() {
     console.log(chalk21.yellow("\n\u{1F4A1} Tip: Add DATABASE_URL to your .env file"));
     process.exit(1);
   }
-  const dbInfo = parseDatabaseUrl(env6.DATABASE_URL);
+  const dbInfo = parseDatabaseUrl2(env6.DATABASE_URL);
   console.log(chalk21.yellow("\u26A0\uFE0F  WARNING: This will drop all tables in your database!"));
   console.log(chalk21.dim(`   Target: ${dbInfo.database} @ ${dbInfo.host}:${dbInfo.port}
 `));
@@ -3784,7 +3821,7 @@ async function dbRestore(backupFile, options = {}) {
       console.log("");
     }
   }
-  const dbInfo = parseDatabaseUrl(dbUrl);
+  const dbInfo = parseDatabaseUrl2(dbUrl);
   const { confirm } = await prompts6({
     type: "confirm",
     name: "confirm",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spfn",
-  "version": "0.2.0-beta.57",
+  "version": "0.2.0-beta.59",
   "description": "Superfunction CLI - Add SPFN to your Next.js project",
   "type": "module",
   "bin": {