From c5a8530fbf80171bb655cd068c7e8ba5e2c195f9 Mon Sep 17 00:00:00 2001
From: "Sven (AAMOS AI)" <sven@wavult.com>
Date: Wed, 12 Aug 2026 04:22:24 +0700
Subject: [PATCH] fix(deploy): brand-guard compat + db_reachable med RDS SSL +
 first-deploy SSL

---
 infrastructure/deployment/first-deploy.sh | 11 ++++++++---
 packages/ai-contracts/src/gemini.ts       |  2 +-
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/infrastructure/deployment/first-deploy.sh b/infrastructure/deployment/first-deploy.sh
index e98a5b4..94abcd0 100755
--- a/infrastructure/deployment/first-deploy.sh
+++ b/infrastructure/deployment/first-deploy.sh
@@ -95,6 +95,9 @@ fi
 
 get_env() { { grep -E "^$1=" .env || true; } | head -1 | cut -d= -f2-; }
 AAMOS_MODE_VAL=$(get_env AAMOS_MODE)
+# Sätt NODE_EXTRA_CA_CERTS om definierad i .env (behövs för RDS SSL från Node/pg).
+EXTRA_CA=$(get_env NODE_EXTRA_CA_CERTS)
+[ -n "$EXTRA_CA" ] && export NODE_EXTRA_CA_CERTS="$EXTRA_CA"
 if [ "$MODE" = "production" ]; then
   if [ "$AAMOS_MODE_VAL" = "gemini" ]; then
     [ -n "$(get_env GEMINI_API_KEY)" ] || fail "Produktion kräver GEMINI_API_KEY när AAMOS_MODE=gemini."
@@ -113,11 +116,13 @@ say "GRIND 1 OK: .env på plats ($([ "$MODE" = production ] && echo 'produktions
 # GRIND 2: Databas + Redis (nåbarhet avgör – Docker är bara reservstart)
 # ---------------------------------------------------------------------------
 db_reachable() {
-  node -e "
+  (cd "$ROOT" && node -e "
     const { Client } = require('pg');
-    const c = new Client({ connectionString: process.env.DB_URL, connectionTimeoutMillis: 3000 });
+    const extraCa = process.env.NODE_EXTRA_CA_CERTS ? require('fs').readFileSync(process.env.NODE_EXTRA_CA_CERTS) : undefined;
+    const ssl = extraCa ? { ca: extraCa } : undefined;
+    const c = new Client({ connectionString: process.env.DB_URL, connectionTimeoutMillis: 3000, ...(ssl ? { ssl } : {}) });
     c.connect().then(() => c.end()).then(() => process.exit(0)).catch(() => process.exit(1));
-  " 2>/dev/null
+  ") 2>/dev/null
 }
 # Rå TCP-PING: alla svar (även -NOAUTH) bevisar att Redis är nåbar.
 redis_reachable() {
diff --git a/packages/ai-contracts/src/gemini.ts b/packages/ai-contracts/src/gemini.ts
index cde811d..4beda34 100644
--- a/packages/ai-contracts/src/gemini.ts
+++ b/packages/ai-contracts/src/gemini.ts
@@ -53,7 +53,7 @@ function requestOnce(input: string | URL | Request, init: RequestInit | undefine
         headers["content-length"] = String(Buffer.byteLength(postData));
       }
       if (!headers["user-agent"]) {
-        headers["user-agent"] = "Mozilla/5.0 (compatible; Cibello/1.0)";
+        headers["user-agent"] = "Mozilla/5.0 (compatible; AAMOS-Gateway/1.0)";
       }
 
       const req = httpMod.request(