fix: clarify durable postgres blocker diagnostics

scripts/src/dev-runtime-migration.mjs

@@ -16,7 +16,8 @@ import {
   RUNTIME_DURABLE_ADAPTER_DRIVER_MISSING,
   RUNTIME_DURABLE_ADAPTER_MIGRATION_BLOCKED,
   RUNTIME_DURABLE_ADAPTER_QUERY_BLOCKED,
-  RUNTIME_DURABLE_ADAPTER_SCHEMA_BLOCKED
+  RUNTIME_DURABLE_ADAPTER_SCHEMA_BLOCKED,
+  RUNTIME_DURABLE_ADAPTER_SSL_BLOCKED
 } from "../../internal/db/runtime-store.mjs";
 import { DEV_DB_ENV_CONTRACT } from "../../internal/cloud/db-contract.mjs";
 import { ENVIRONMENT_DEV } from "../../internal/protocol/index.mjs";
@@ -572,6 +573,7 @@ function conclusionReadySummary(report) {
 }
 
 function blockerScope(blocker) {
+  if (blocker === RUNTIME_DURABLE_ADAPTER_SSL_BLOCKED) return "runtime-migration-ssl";
   if (blocker === RUNTIME_DURABLE_ADAPTER_AUTH_BLOCKED) return "runtime-migration-auth";
   if (blocker === RUNTIME_DURABLE_ADAPTER_SCHEMA_BLOCKED) return "runtime-migration-schema";
   if (blocker === RUNTIME_DURABLE_ADAPTER_MIGRATION_BLOCKED) return "runtime-migration-ledger";
@@ -588,6 +590,13 @@ function classifyMigrationError(error) {
       summary: "Postgres driver is unavailable for DEV runtime migration apply."
     };
   }
+  if (isMigrationSslError(error)) {
+    return {
+      blocker: RUNTIME_DURABLE_ADAPTER_SSL_BLOCKED,
+      errorCode,
+      summary: "DEV runtime migration reached Postgres, but SSL negotiation or SSL mode compatibility blocked apply."
+    };
+  }
   if (["28P01", "28000", "42501"].includes(errorCode)) {
     return {
       blocker: RUNTIME_DURABLE_ADAPTER_AUTH_BLOCKED,
@@ -609,6 +618,32 @@ function classifyMigrationError(error) {
   };
 }
 
+function isMigrationSslError(error) {
+  const errorCode = typeof error?.code === "string" ? error.code : "";
+  if (errorCode.startsWith("ERR_SSL") || errorCode.startsWith("ERR_TLS")) {
+    return true;
+  }
+  if ([
+    "DEPTH_ZERO_SELF_SIGNED_CERT",
+    "SELF_SIGNED_CERT_IN_CHAIN",
+    "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+    "UNABLE_TO_GET_ISSUER_CERT_LOCALLY",
+    "CERT_HAS_EXPIRED"
+  ].includes(errorCode)) {
+    return true;
+  }
+  const message = typeof error?.message === "string" ? error.message.toLowerCase() : "";
+  return [
+    "does not support ssl",
+    "ssl is not enabled",
+    "ssl negotiation",
+    "ssl off",
+    "server requires ssl",
+    "before secure tls connection",
+    "tls handshake"
+  ].some((pattern) => message.includes(pattern));
+}
+
 async function writeReport(report, reportPath, root) {
   const absolute = path.resolve(root, reportPath);
   await mkdir(path.dirname(absolute), { recursive: true });