fix(credentials): describe saved-connection TLS modes as the drivers apply them

- MySQL Required verifies the certificate chain but not the host name (like
  VERIFY_CA), and both Preferred and Required refuse a server without TLS.
- SQL Server Encrypt connection requests TLS; a server that does not support
  encryption gets an unencrypted session rather than an error.
- PostgreSQL Preferred can be downgraded by an on-path attacker, so the hint
  and docs steer to Required when the server supports TLS.
- Picker options are keyed by each operation schema's value type, so a mode
  the operations add or drop fails to compile instead of drifting.

Author: waleedlatif1

apps/docs/content/docs/integrations/mssql.mdx

@@ -16,7 +16,7 @@ Use [Microsoft SQL Server](https://www.microsoft.com/sql-server) to query or mod
 
 In **Integrations**, add a connection with the host, port, database, username, password, and transport-security settings. Sim proves the connection with `SELECT 1` before saving it encrypted, then reads it on the server for each run; the block, the workflow, and agents never see the password. Reconnect the connection from Integrations when its credentials change. The runtime must be able to reach the database host.
 
-- **Encrypt connection** encrypts the connection with TLS; leave it enabled.
+- **Encrypt connection** requests TLS; leave it enabled. A server that does not support encryption gets an unencrypted session rather than an error, so confirm the server has encryption on.
 - **Trust server certificate** skips certificate validation. Enable it only for a server with a self-signed certificate you trust.
 - Named instances are not supported; give the instance a static TCP port and connect to that port.
 

apps/docs/content/docs/integrations/mysql.mdx

@@ -19,7 +19,8 @@ Query returns rows and a row count. Insert, update, and delete operations accept
 In **Integrations**, add a connection with the host, port, database, username, password, and transport-security settings. Sim proves the connection with `SELECT 1` before saving it encrypted, then reads it on the server for each run; the block, the workflow, and agents never see the password. Reconnect the connection from Integrations when its credentials change. The runtime must be able to reach the database host.
 
 - **Preferred** encrypts without verifying the server certificate.
-- **Required** encrypts and verifies the server certificate against the runtime's trust store.
+- **Required** encrypts and verifies the certificate chain against the runtime's trust store, but does not check the host name, like MySQL's `VERIFY_CA`.
+- Both refuse a server that offers no TLS rather than connect unencrypted, so Sim's **Preferred** behaves like MySQL's `REQUIRED`, not its `PREFERRED`.
 - **Disabled** never encrypts. Use it only on a network whose confidentiality you control.
 
 Workflows built before saved connections keep their inline connection fields and run unchanged.

apps/docs/content/docs/integrations/postgresql.mdx

@@ -16,7 +16,7 @@ Use [PostgreSQL](https://www.postgresql.org/) to query and modify rows, execute
 
 In **Integrations**, add a connection with the host, port, database, username, password, and transport-security settings. Sim proves the connection with `SELECT 1` before saving it encrypted, then reads it on the server for each run; the block, the workflow, and agents never see the password. Reconnect the connection from Integrations when its credentials change. The runtime must be able to reach the database host.
 
-- **Preferred** encrypts when the server offers TLS and otherwise connects without it.
+- **Preferred** encrypts when the server offers TLS and otherwise connects without it. An attacker on the network can force that fallback, so choose **Required** when the server supports TLS.
 - **Required** always encrypts but does not verify the server certificate, like libpq's `sslmode=require`.
 - **Disabled** never encrypts. Use it only on a network whose confidentiality you control.
 

apps/sim/lib/credentials/database-connections/descriptors.ts

@@ -10,6 +10,9 @@
  * Server-side verification and resolution live in
  * `@/lib/credentials/database-connections/server`.
  */
+import type { MssqlToggle } from '@/lib/internal/mssql/schema'
+import type { MysqlSslMode } from '@/lib/internal/mysql/schema'
+import type { PostgresqlSslMode } from '@/lib/internal/postgresql/schema'
 import {
   MSSQL_SERVICE_ACCOUNT_PROVIDER_ID,
   MYSQL_SERVICE_ACCOUNT_PROVIDER_ID,
@@ -43,16 +46,14 @@ export interface DatabaseConnectionDescriptor {
   docsUrl: string
 }
 
-const SSL_MODE_OPTIONS = [
-  { value: 'preferred', label: 'Preferred' },
-  { value: 'required', label: 'Required' },
-  { value: 'disabled', label: 'Disabled' },
-] as const
-
-const TOGGLE_OPTIONS = [
-  { value: 'enabled', label: 'Enabled' },
-  { value: 'disabled', label: 'Disabled' },
-] as const
+/**
+ * Picker options in display order. Keyed by the operation schema's own value
+ * type, so a value the operations add or drop fails to compile here instead of
+ * drifting between the picker and what a save accepts.
+ */
+function optionsFrom<Value extends string>(labels: Record<Value, string>) {
+  return Object.entries<string>(labels).map(([value, label]) => ({ value, label }))
+}
 
 export const DATABASE_CONNECTION_DESCRIPTORS: Record<
   DatabaseConnectionProviderId,
@@ -68,9 +69,13 @@ export const DATABASE_CONNECTION_DESCRIPTORS: Record<
       {
         id: 'ssl',
         label: 'SSL mode',
-        options: SSL_MODE_OPTIONS,
-        defaultValue: 'preferred',
-        hint: 'Required encrypts the connection without verifying the server certificate; Preferred falls back to an unencrypted connection when the server offers no TLS.',
+        options: optionsFrom<PostgresqlSslMode>({
+          preferred: 'Preferred',
+          required: 'Required',
+          disabled: 'Disabled',
+        }),
+        defaultValue: 'preferred' satisfies PostgresqlSslMode,
+        hint: 'Required encrypts the connection without verifying the server certificate. Preferred falls back to an unencrypted connection when the server offers no TLS, which an attacker on the network can force; choose Required when the server supports TLS.',
       },
     ],
     docsUrl: 'https://docs.sim.ai/integrations/postgresql',
@@ -85,9 +90,13 @@ export const DATABASE_CONNECTION_DESCRIPTORS: Record<
       {
         id: 'ssl',
         label: 'SSL mode',
-        options: SSL_MODE_OPTIONS,
-        defaultValue: 'preferred',
-        hint: 'Required encrypts the connection and verifies the server certificate; Preferred encrypts without verifying it.',
+        options: optionsFrom<MysqlSslMode>({
+          preferred: 'Preferred',
+          required: 'Required',
+          disabled: 'Disabled',
+        }),
+        defaultValue: 'preferred' satisfies MysqlSslMode,
+        hint: "Required encrypts the connection and verifies the certificate chain against the runtime's trust store, but not the host name (like MySQL's VERIFY_CA). Preferred encrypts without verifying the certificate. Both refuse a server that offers no TLS rather than connect unencrypted.",
       },
     ],
     docsUrl: 'https://docs.sim.ai/integrations/mysql',
@@ -102,15 +111,15 @@ export const DATABASE_CONNECTION_DESCRIPTORS: Record<
       {
         id: 'encrypt',
         label: 'Encrypt connection',
-        options: TOGGLE_OPTIONS,
-        defaultValue: 'enabled',
-        hint: 'Encrypts the connection with TLS.',
+        options: optionsFrom<MssqlToggle>({ enabled: 'Enabled', disabled: 'Disabled' }),
+        defaultValue: 'enabled' satisfies MssqlToggle,
+        hint: 'Requests TLS. A server that does not support encryption gets an unencrypted session rather than an error.',
       },
       {
         id: 'trustServerCertificate',
         label: 'Trust server certificate',
-        options: [...TOGGLE_OPTIONS].reverse(),
-        defaultValue: 'disabled',
+        options: optionsFrom<MssqlToggle>({ disabled: 'Disabled', enabled: 'Enabled' }),
+        defaultValue: 'disabled' satisfies MssqlToggle,
         hint: 'Enable only for a server with a self-signed certificate; it skips certificate validation.',
       },
     ],