feat: verified-TLS to RDS from every runtime

[Marfuen]

Summary

Make every Postgres connection from this monorepo use verified TLS to RDS — closes the silent-MITM exposure that came from rejectUnauthorized: false defaults.

• Commit AWS RDS global CA bundle (public file from truststore.pki.rds.amazonaws.com, ~165KB, safe to publish — same trust model as Mozilla shipping the trusted-root list)
• Make every Prisma client strict: throws at boot rather than silently downgrading. Inline pattern in each app's prisma/client.ts; shared resolveSslConfig helper in packages/db for that package's tests
• Skip hostname check when CA bundle is present, keep cert-chain check. Required because RDS connections traverse an AWS NLB whose hostname isn't in the RDS Proxy cert's SANs (this is what was causing the staging error)
• Trigger.dev: caBundleExtension ships the cert into the deploy bundle and registers NODE_EXTRA_CA_CERTS via addLayer({ deploy: { env } }) — verified end-to-end with --local-build
• Vercel: outputFileTracingIncludes in next.config.ts for app + portal so the cert is bundled into the deployed function

Why this is safer

Before: any non-localhost connection silently used { rejectUnauthorized: false }. Encrypted but unauthenticated — an attacker with on-path access could MITM with any cert.

After:

• Cert chain verification is enforced (an attacker would need a cert signed by AWS RDS's CA, which requires the AWS-held private key)
• Hostname check is bypassed for the NLB hop only because we control the network path (private VPC); skipping it doesn't admit any new attacker class beyond what chain verification already excludes
• Misconfigured environments crash loudly at boot instead of silently MITM-able

Pre-merge required (post-deploy actions in the checklist)

See docs/plans/secure-rds-tls-deploy-checklist.md:

1. Vercel (apps/app + apps/portal): set NODE_EXTRA_CA_CERTS=/var/task/packages/db/certs/rds-global-bundle.pem on each project. If a preview throws "Refusing to connect" or "ENOENT", swap to /vercel/path0/....
2. Trigger.dev (api + app, staging + prod): once a real task run confirms TLS works, drop the legacy opt-in:

   bunx trigger.dev@4.4.3 envvars remove PRISMA_ALLOW_INSECURE_TLS --env <env>
   

3. API Docker (apps/api/Dockerfile.multistage): no action — already installs the bundle.

Verification done

• packages/db tests: 8/8 pass (covers strict throw + chain-only + insecure opt-in + localhost branches)
• apps/api/Dockerfile.multistage build: image inspected, NODE_EXTRA_CA_CERTS=/usr/local/share/aws-rds-ca-bundle.pem, file present (165408 bytes)
• Trigger.dev --local-build for both api and app projects: extension copies cert into bundle, env var registered in manifest. App project actually deployed to staging during verification (20260506.5, deployment izoen4nv) — the hostname-fix is live there
• Typecheck: no new errors introduced (pre-existing errors in test fixtures and a billing-module mismatch are unrelated)

Test plan

• Run any policy task in Trigger.dev staging — the Hostname/IP does not match certificate's altnames error should be gone
• Vercel preview deploy of apps/app and apps/portal with NODE_EXTRA_CA_CERTS set — boot logs should not contain "Refusing to connect"
• Real Postgres queries succeed end-to-end on each runtime
• Drop PRISMA_ALLOW_INSECURE_TLS=1 from Trigger.dev environments and confirm tasks still run

🤖 Generated with Claude Code

---

Summary by cubic

Enforces verified TLS for all Postgres connections to RDS across every runtime, with lazy-initialized Prisma clients so Next.js builds don’t throw. Also fixes @trycompai/db/ssl-config types to point to dist for npm consumers.

• New Features

  • Strict TLS in Prisma clients for apps/api, apps/app, apps/portal, and apps/framework-editor. Non-local connects require NODE_EXTRA_CA_CERTS or an explicit PRISMA_ALLOW_INSECURE_TLS=1 opt-in. Hostname check is skipped for AWS NLB; chain verification stays enforced. Clients are lazy-initialized to avoid throwing during next build.
  • AWS RDS global CA bundle at packages/db/certs/rds-global-bundle.pem. Bundled in Next.js via outputFileTracingIncludes and in Trigger.dev via a caBundleExtension that copies the cert and sets NODE_EXTRA_CA_CERTS.
  • Added resolveSslConfig in @trycompai/db with tests.

• Migration

  • Vercel (apps/app, apps/portal): set NODE_EXTRA_CA_CERTS to /var/task/packages/db/certs/rds-global-bundle.pem or /vercel/path0/packages/db/certs/rds-global-bundle.pem.
  • Trigger.dev (api, app): the extension ships the cert and sets the env var; after verifying runs, remove PRISMA_ALLOW_INSECURE_TLS.
  • API Docker: no changes needed.

^{Written for commit 60a4452. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Ready	Preview, Comment	May 6, 2026 0:41am
comp-framework-editor	Ready	Preview, Comment	May 6, 2026 0:41am
portal	Ready	Preview, Comment	May 6, 2026 0:41am

[cubic-dev-ai]

1 issue found across 17 files

Confidence score: 4/5

• This PR is likely safe to merge, with one moderate packaging issue rather than a runtime blocker (severity 5/10, high confidence).
• In packages/db/package.json, the new subpath export’s types field points to source instead of emitted declarations in dist, which can break TypeScript type resolution for consumers after publish.
• Pay close attention to packages/db/package.json - ensure the subpath types target references the published dist declaration file.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/db/package.json">

<violation number="1" location="packages/db/package.json:29">
P2: Point the new subpath export's `types` entry at the emitted declaration file in `dist`; the source file is not published.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review, or fix all with cubic.}

[claudfuen]

🎉 This PR is included in version 3.44.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀