@the-meridian/cli 0.1.0

package/dist/index.js

@@ -0,0 +1,4319 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { realpathSync } from "fs";
+import { fileURLToPath } from "url";
+import { Command } from "commander";
+
+// src/commands/db.ts
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join6 } from "path";
+
+// src/version.ts
+import { createRequire } from "module";
+var VERSION = (() => {
+  try {
+    const require2 = createRequire(import.meta.url);
+    const pkg = require2("../package.json");
+    return typeof pkg.version === "string" ? pkg.version : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+})();
+var USER_AGENT = `meridian-cli/${VERSION} (${process.platform} ${process.arch})`;
+
+// src/lib/api.ts
+import { hostname as osHostname } from "os";
+import { z as z2 } from "zod";
+
+// src/lib/api-types.ts
+import { z } from "zod";
+var idSchema = z.union([z.number(), z.string()]);
+var cliUserSchema = z.object({
+  id: idSchema,
+  name: z.string(),
+  email: z.string()
+}).loose();
+var orgSchema = z.object({
+  id: idSchema,
+  name: z.string(),
+  slug: z.string()
+}).loose();
+var appSummarySchema = z.object({
+  id: idSchema,
+  name: z.string(),
+  slug: z.string()
+}).loose();
+var meResponseSchema = z.object({
+  user: cliUserSchema,
+  orgs: z.array(orgSchema)
+}).loose();
+var deviceCodeResponseSchema = z.object({
+  device_code: z.string(),
+  user_code: z.string(),
+  verification_uri: z.string(),
+  verification_uri_complete: z.string().optional(),
+  interval: z.number().optional(),
+  expires_in: z.number().optional()
+}).loose();
+var deviceTokenResponseSchema = z.object({
+  token: z.string(),
+  expires_at: z.string().optional(),
+  user: cliUserSchema
+}).loose();
+var deviceInfoResponseSchema = z.object({
+  hostname: z.string(),
+  client_name: z.string(),
+  created_at: z.string().optional()
+}).loose();
+var devDatabaseStatusSchema = z.union([z.enum(["provisioning", "ready", "error"]), z.string()]);
+var devDatabaseSchema = z.object({
+  id: idSchema,
+  status: devDatabaseStatusSchema,
+  database: z.string(),
+  /** Nullish for an API older than per-developer Prisma shadow databases. */
+  shadow_database: z.string().nullish(),
+  mysql_user: z.string(),
+  instance_connection_name: z.string().nullish(),
+  region: z.string().nullish(),
+  created_at: z.string().nullish(),
+  /** Set by the API only while `status` is `error`; surfaced verbatim to the developer. */
+  error_message: z.string().nullish()
+}).loose();
+var devCredentialsSchema = z.object({
+  host: z.string(),
+  port: z.coerce.number(),
+  database: z.string(),
+  /**
+   * The developer's Prisma shadow database, reachable with these same
+   * credentials. Nullish for an API older than shadow databases, in which
+   * case no SHADOW_DATABASE_URL is written.
+   */
+  shadow_database: z.string().nullish(),
+  username: z.string(),
+  password: z.string(),
+  expires_at: z.string().nullish(),
+  /** Echoed from the (nullable) dev-database column, so it can be null. */
+  instance_connection_name: z.string().nullish()
+}).loose();
+var proxyTokenSchema = z.object({
+  access_token: z.string(),
+  expires_at: z.string().nullish(),
+  instance_connection_name: z.string().nullish()
+}).loose();
+var migrationRunInputSchema = z.object({
+  command: z.string(),
+  status: z.enum(["success", "failed", "rolled_back"]),
+  started_at: z.string(),
+  finished_at: z.string(),
+  output_excerpt: z.string().optional()
+});
+var migrationRunSchema = z.object({
+  id: idSchema.nullish(),
+  command: z.string(),
+  status: z.string(),
+  started_at: z.string().nullish(),
+  finished_at: z.string().nullish(),
+  output_excerpt: z.string().nullish(),
+  created_at: z.string().nullish()
+}).loose();
+
+// src/lib/errors.ts
+var CliError = class extends Error {
+  hint;
+  exitCode;
+  constructor(message, options = {}) {
+    super(message, options.cause !== void 0 ? { cause: options.cause } : void 0);
+    this.name = "CliError";
+    this.hint = options.hint;
+    this.exitCode = options.exitCode ?? 1;
+  }
+};
+var ApiError = class extends CliError {
+  status;
+  body;
+  /** `error` field from the response body, e.g. "authorization_pending". */
+  errorCode;
+  constructor(message, init) {
+    super(message, init);
+    this.name = "ApiError";
+    this.status = init.status;
+    this.body = init.body;
+    this.errorCode = init.errorCode;
+  }
+};
+function isCliError(error2) {
+  return error2 instanceof CliError;
+}
+function isApiError(error2) {
+  return error2 instanceof ApiError;
+}
+function notLoggedInError() {
+  return new CliError("You are not logged in to Meridian.", {
+    hint: "Run `meridian login` to authenticate this machine."
+  });
+}
+function notLinkedError() {
+  return new CliError("This project is not linked to a Meridian app.", {
+    hint: "Run `meridian link` in your project root to pick an organization and app."
+  });
+}
+function sessionExpiredError(cause) {
+  return new CliError("Your Meridian CLI token is no longer valid (401).", {
+    hint: "Run `meridian login` again to issue a fresh token.",
+    ...cause !== void 0 ? { cause } : {}
+  });
+}
+function nonInteractiveError(what, override) {
+  return new CliError(`Cannot prompt for ${what} in a non-interactive shell.`, {
+    hint: `Set ${override} to answer it up front.`
+  });
+}
+function describeError(error2) {
+  if (error2 instanceof Error) return error2.message;
+  if (typeof error2 === "string") return error2;
+  return String(error2);
+}
+
+// src/lib/api.ts
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_CLIENT_NAME = "meridian-cli";
+var MAX_MIGRATION_COMMAND_LENGTH = 499;
+var ApiClient = class _ApiClient {
+  baseUrl;
+  #token;
+  #fetchImpl;
+  #timeoutMs;
+  #userAgent;
+  constructor(options) {
+    this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.#token = options.token;
+    this.#fetchImpl = options.fetchImpl ?? fetch;
+    this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.#userAgent = options.userAgent;
+  }
+  get hasToken() {
+    return this.#token !== void 0;
+  }
+  /** Returns a new client carrying the given token; used right after login. */
+  withToken(token) {
+    return new _ApiClient({
+      baseUrl: this.baseUrl,
+      token,
+      fetchImpl: this.#fetchImpl,
+      timeoutMs: this.#timeoutMs,
+      ...this.#userAgent !== void 0 ? { userAgent: this.#userAgent } : {}
+    });
+  }
+  /**
+   * Performs one request and validates the response against `schema`. Pass
+   * `null` for endpoints whose body is irrelevant (e.g. logging a migration
+   * run) — the resolved value is then `undefined`.
+   */
+  async request(schema, method, path, options = {}) {
+    const auth = options.auth ?? true;
+    if (auth && this.#token === void 0) throw notLoggedInError();
+    const url = this.#buildUrl(path, options.query);
+    const headers = this.#buildHeaders(options.headers, options.body !== void 0, auth);
+    const response = await this.#fetchWithTimeout(url, method, headers, options.body, options.signal);
+    if (response.status === 404 && options.allow404 === true) {
+      await response.text().catch(() => "");
+      return null;
+    }
+    if (!response.ok) {
+      throw await toApiError(response, method, path);
+    }
+    if (schema === null) {
+      await response.text().catch(() => "");
+      return void 0;
+    }
+    const text = await response.text().catch(() => "");
+    const data = text.trim().length === 0 ? void 0 : parseJson(text, method, path);
+    return parseWithSchema(schema, data, method, path);
+  }
+  /** `POST /app/cli/device/code` — unauthenticated. */
+  async requestDeviceCode(input2 = {}) {
+    return this.request(deviceCodeResponseSchema, "POST", "/app/cli/device/code", {
+      auth: false,
+      body: {
+        client_name: input2.clientName ?? DEFAULT_CLIENT_NAME,
+        hostname: input2.hostname ?? osHostname()
+      }
+    });
+  }
+  /**
+   * `POST /app/cli/device/token` — a single poll attempt. On 428/429/410/403
+   * this resolves an `ApiError` whose `errorCode` is the RFC 8628-ish string
+   * from the body (`authorization_pending`, `slow_down`, ...); callers branch
+   * on that, not on `status`.
+   */
+  async pollDeviceTokenOnce(deviceCode) {
+    return this.request(deviceTokenResponseSchema, "POST", "/app/cli/device/token", {
+      auth: false,
+      body: { device_code: deviceCode }
+    });
+  }
+  /**
+   * `GET /app/cli/device/info` — the approval UI's endpoint, exposed here for
+   * completeness/tests. It sits behind `auth:api` (and rejects CLI tokens), so
+   * the token is attached when one is available rather than required.
+   */
+  async getDeviceInfo(userCode) {
+    return this.request(deviceInfoResponseSchema, "GET", "/app/cli/device/info", {
+      auth: this.hasToken,
+      query: { user_code: userCode }
+    });
+  }
+  async getMe() {
+    return this.request(meResponseSchema, "GET", "/app/cli/me");
+  }
+  async listApps(orgId) {
+    return this.request(z2.array(appSummarySchema), "GET", `/app/cli/orgs/${encodePathSegment(orgId)}/apps`);
+  }
+  /** Idempotent ensure/provision; may resolve with `status: "provisioning"` — poll `getDevDatabase` until `"ready"`. */
+  async ensureDevDatabase(appId) {
+    return this.request(devDatabaseSchema, "POST", `/app/cli/apps/${encodePathSegment(appId)}/dev-database`);
+  }
+  /** `null` when the app has no dev database provisioned yet (404). */
+  async getDevDatabase(appId) {
+    return this.request(
+      devDatabaseSchema,
+      "GET",
+      `/app/cli/apps/${encodePathSegment(appId)}/dev-database`,
+      { allow404: true }
+    );
+  }
+  async issueCredentials(appId) {
+    return this.request(
+      devCredentialsSchema,
+      "POST",
+      `/app/cli/apps/${encodePathSegment(appId)}/dev-database/credentials`
+    );
+  }
+  async issueProxyToken(appId) {
+    return this.request(
+      proxyTokenSchema,
+      "POST",
+      `/app/cli/apps/${encodePathSegment(appId)}/dev-database/proxy-token`
+    );
+  }
+  async resetDevDatabase(appId) {
+    return this.request(devDatabaseSchema, "POST", `/app/cli/apps/${encodePathSegment(appId)}/dev-database/reset`);
+  }
+  /** `command` is capped server-side at 500 characters, so a long `--` passthrough is trimmed here rather than rejected as a 422. */
+  async reportMigration(appId, run2) {
+    await this.request(null, "POST", `/app/cli/apps/${encodePathSegment(appId)}/dev-database/migrations`, {
+      body: { ...run2, command: truncate(run2.command, MAX_MIGRATION_COMMAND_LENGTH) }
+    });
+  }
+  async listMigrations(appId) {
+    return this.request(
+      z2.array(migrationRunSchema),
+      "GET",
+      `/app/cli/apps/${encodePathSegment(appId)}/dev-database/migrations`
+    );
+  }
+  #buildUrl(path, query) {
+    const url = new URL(`${this.baseUrl}${path}`);
+    if (query !== void 0) {
+      for (const [key, value] of Object.entries(query)) {
+        if (value !== void 0) url.searchParams.set(key, String(value));
+      }
+    }
+    return url.toString();
+  }
+  #buildHeaders(extra, hasBody, auth) {
+    const headers = { Accept: "application/json" };
+    if (hasBody) headers["Content-Type"] = "application/json";
+    if (auth && this.#token !== void 0) headers.Authorization = `Bearer ${this.#token}`;
+    if (this.#userAgent !== void 0) headers["User-Agent"] = this.#userAgent;
+    if (extra !== void 0) Object.assign(headers, extra);
+    return headers;
+  }
+  async #fetchWithTimeout(url, method, headers, body, externalSignal) {
+    const controller = new AbortController();
+    let timedOut = false;
+    const onExternalAbort = () => controller.abort();
+    if (externalSignal !== void 0) {
+      if (externalSignal.aborted) controller.abort();
+      else externalSignal.addEventListener("abort", onExternalAbort, { once: true });
+    }
+    const timeoutId = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, this.#timeoutMs);
+    try {
+      return await this.#fetchImpl(url, {
+        method,
+        headers,
+        ...body !== void 0 ? { body: JSON.stringify(body) } : {},
+        signal: controller.signal
+      });
+    } catch (error2) {
+      if (timedOut) {
+        throw new CliError(`Request to the Meridian API timed out after ${this.#timeoutMs}ms.`, {
+          hint: "The API may be slow or unreachable right now; try again in a moment.",
+          cause: error2
+        });
+      }
+      if (externalSignal?.aborted === true) throw error2;
+      throw new CliError(`Cannot reach the Meridian API at ${this.baseUrl}.`, {
+        hint: "Check your network connection, or set MERIDIAN_API_URL if you're targeting a different environment.",
+        cause: error2
+      });
+    } finally {
+      clearTimeout(timeoutId);
+      externalSignal?.removeEventListener("abort", onExternalAbort);
+    }
+  }
+};
+function encodePathSegment(id) {
+  return encodeURIComponent(String(id));
+}
+function parseJson(text, method, path) {
+  try {
+    return JSON.parse(text);
+  } catch (error2) {
+    throw new CliError(`The Meridian API returned a non-JSON response for ${method} ${path}.`, {
+      hint: "This usually means the CLI is out of date; try upgrading @the-meridian/cli.",
+      cause: error2
+    });
+  }
+}
+function parseWithSchema(schema, data, method, path) {
+  const result = schema.safeParse(data);
+  if (result.success) return result.data;
+  const issues = result.error.issues.slice(0, 3).map((issue) => `${issue.path.length > 0 ? issue.path.join(".") : "<root>"}: ${issue.message}`).join("; ");
+  throw new CliError(
+    `The Meridian API returned an unexpected payload for ${method} ${path}: ${truncate(issues, 300)}`,
+    {
+      hint: "This usually means the CLI is out of date; try upgrading @the-meridian/cli.",
+      cause: result.error
+    }
+  );
+}
+async function toApiError(response, method, path) {
+  const text = await response.text().catch(() => "");
+  let body;
+  if (text.trim().length === 0) body = void 0;
+  else {
+    try {
+      body = JSON.parse(text);
+    } catch {
+      body = text;
+    }
+  }
+  const errorCode = extractErrorCode(body);
+  const message = extractMessage(body) ?? `${method} ${path} failed with ${response.status} ${response.statusText}`.trim();
+  const hint2 = hintForError(response.status, errorCode);
+  return new ApiError(message, {
+    status: response.status,
+    body,
+    ...errorCode !== void 0 ? { errorCode } : {},
+    ...hint2 !== void 0 ? { hint: hint2 } : {}
+  });
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function envelopeError(body) {
+  const record = asRecord(body);
+  return record === void 0 ? void 0 : asRecord(record.error);
+}
+function firstFieldError(bag) {
+  const fields = asRecord(bag);
+  if (fields === void 0) return void 0;
+  for (const value of Object.values(fields)) {
+    if (Array.isArray(value) && typeof value[0] === "string") return value[0];
+    if (typeof value === "string") return value;
+  }
+  return void 0;
+}
+function extractMessage(body) {
+  const record = asRecord(body);
+  if (record === void 0) return void 0;
+  const envelope = envelopeError(body);
+  if (envelope !== void 0) {
+    const fieldError2 = firstFieldError(asRecord(envelope.details)?.fields);
+    if (fieldError2 !== void 0) return fieldError2;
+    if (typeof envelope.message === "string" && envelope.message.length > 0) return envelope.message;
+    if (typeof envelope.code === "string" && envelope.code.length > 0) return envelope.code;
+  }
+  const fieldError = firstFieldError(record.errors);
+  if (fieldError !== void 0) return fieldError;
+  if (typeof record.message === "string" && record.message.length > 0) return record.message;
+  if (typeof record.error === "string" && record.error.length > 0) return record.error;
+  return void 0;
+}
+function extractErrorCode(body) {
+  const envelope = envelopeError(body);
+  if (envelope !== void 0 && typeof envelope.code === "string") return envelope.code;
+  const record = asRecord(body);
+  return record !== void 0 && typeof record.error === "string" ? record.error : void 0;
+}
+var HINTS_BY_ERROR_CODE = {
+  dev_database_limit_reached: "This app has reached its allowance of development databases. Whoever owns the existing one can delete it, or an organization owner/admin can remove it from the Meridian dashboard.",
+  dev_database_over_storage_limit: "Run `meridian db reset` to drop and recreate the schema \u2014 reset and delete stay available while you're over the limit.",
+  FEATURE_NOT_ENTITLED: "Your organization's plan does not include managed development databases; upgrade it in the Meridian dashboard."
+};
+function hintForError(status, errorCode) {
+  if (errorCode !== void 0) {
+    const byCode = HINTS_BY_ERROR_CODE[errorCode];
+    if (byCode !== void 0) return byCode;
+  }
+  if (status === 401) return sessionExpiredError().hint;
+  if (status === 403) return "You may not have access to this organization or app; check your Meridian membership.";
+  if (status === 404) return "Run `meridian link` to select a valid organization and app.";
+  if (status === 409) {
+    return "The development database is not ready yet. Wait for provisioning to finish, then try again \u2014 `meridian dev` polls for you.";
+  }
+  if (status === 422) return "Check the request for validation errors and try again.";
+  if (status === 429) return "You're being rate limited by the Meridian API; wait a moment and try again.";
+  if (status >= 500) return "This looks like a server-side failure on the Meridian API; try again shortly.";
+  return void 0;
+}
+function truncate(text, max) {
+  return text.length > max ? `${text.slice(0, max)}\u2026` : text;
+}
+
+// src/lib/config.ts
+import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { dirname } from "path";
+import { z as z3 } from "zod";
+
+// src/lib/paths.ts
+import { homedir } from "os";
+import { join } from "path";
+function meridianHome() {
+  const override = process.env.MERIDIAN_HOME;
+  if (override !== void 0 && override !== "") return override;
+  return join(homedir(), ".meridian");
+}
+function globalConfigPath() {
+  return join(meridianHome(), "config.json");
+}
+function proxyBinDir() {
+  return join(meridianHome(), "bin");
+}
+function projectStateDir(root) {
+  return join(root, ".meridian");
+}
+function projectConfigPath(root) {
+  return join(projectStateDir(root), "project.json");
+}
+function snapshotsDir(root) {
+  return join(projectStateDir(root), "snapshots");
+}
+function envFilePath(root, fileName = ".env") {
+  return join(root, fileName);
+}
+
+// src/lib/config.ts
+var DEFAULT_API_BASE_URL = "https://api.the-meridian.ai";
+var configUserSchema = z3.object({
+  id: z3.union([z3.number(), z3.string()]),
+  name: z3.string(),
+  email: z3.string()
+});
+var globalConfigSchema = z3.object({
+  api_base_url: z3.string().exactOptional(),
+  token: z3.string().exactOptional(),
+  token_expires_at: z3.string().exactOptional(),
+  user: configUserSchema.exactOptional()
+}).loose();
+function readConfig() {
+  const path = globalConfigPath();
+  let raw;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (error2) {
+    if (isEnoent(error2)) return {};
+    throw new CliError(`Could not read ${path}.`, {
+      hint: "Check the file's permissions, then run `meridian login` again.",
+      cause: error2
+    });
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error2) {
+    throw new CliError(`${path} is not valid JSON.`, {
+      hint: "Fix or delete the file, then run `meridian login` again.",
+      cause: error2
+    });
+  }
+  const result = globalConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new CliError(`${path} does not look like a Meridian config file.`, {
+      hint: "Fix or delete the file, then run `meridian login` again.",
+      cause: result.error
+    });
+  }
+  return result.data;
+}
+function writeConfig(config) {
+  const path = globalConfigPath();
+  const dir = dirname(path);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const tmpPath = `${path}.tmp`;
+  writeFileSync(tmpPath, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+  renameSync(tmpPath, path);
+  chmodSync(path, 384);
+}
+function updateConfig(patch) {
+  const merged = { ...readConfig(), ...patch };
+  writeConfig(merged);
+  return merged;
+}
+function clearAuth() {
+  const current2 = readConfig();
+  const hadToken = current2.token !== void 0;
+  const next = {
+    ...current2.api_base_url !== void 0 ? { api_base_url: current2.api_base_url } : {}
+  };
+  writeConfig(next);
+  return hadToken;
+}
+function normalizeApiBaseUrl(url) {
+  return url.trim().replace(/\/+$/, "").replace(/\/app$/, "");
+}
+function resolveApiBaseUrl(override) {
+  if (override !== void 0 && override !== "") return normalizeApiBaseUrl(override);
+  const envValue = process.env.MERIDIAN_API_URL;
+  if (envValue !== void 0 && envValue !== "") return normalizeApiBaseUrl(envValue);
+  const config = readConfig();
+  if (config.api_base_url !== void 0 && config.api_base_url !== "") {
+    return normalizeApiBaseUrl(config.api_base_url);
+  }
+  return normalizeApiBaseUrl(DEFAULT_API_BASE_URL);
+}
+function getAuth() {
+  const config = readConfig();
+  if (config.token === void 0) return null;
+  return {
+    token: config.token,
+    ...config.token_expires_at !== void 0 ? { tokenExpiresAt: config.token_expires_at } : {},
+    ...config.user !== void 0 ? { user: config.user } : {}
+  };
+}
+function isEnoent(error2) {
+  return typeof error2 === "object" && error2 !== null && "code" in error2 && error2.code === "ENOENT";
+}
+
+// src/lib/context.ts
+var defaults = {
+  json: false,
+  quiet: false,
+  verbose: false,
+  yes: false
+};
+var current = { ...defaults };
+function setGlobalOptions(options) {
+  current = { ...current, ...options };
+}
+function getGlobalOptions() {
+  return current;
+}
+function isJsonOutput() {
+  return current.json;
+}
+function workingDirectory() {
+  return current.cwd ?? process.cwd();
+}
+
+// src/lib/client.ts
+function createApiClient(options = {}) {
+  const requireAuth = options.requireAuth ?? true;
+  const baseUrl = resolveApiBaseUrl(options.apiUrl ?? getGlobalOptions().apiUrl);
+  const token = options.token ?? getAuth()?.token;
+  if (requireAuth && token === void 0) throw notLoggedInError();
+  return new ApiClient({
+    baseUrl,
+    userAgent: USER_AGENT,
+    ...token !== void 0 ? { token } : {},
+    ...options.fetchImpl !== void 0 ? { fetchImpl: options.fetchImpl } : {}
+  });
+}
+
+// src/lib/db/connection.ts
+function connectionInfoFromCredentials(credentials, proxy) {
+  return {
+    host: proxy.host ?? "127.0.0.1",
+    port: proxy.port,
+    user: credentials.username,
+    password: credentials.password,
+    database: credentials.database
+  };
+}
+var createSqlConnection = async (info, options) => {
+  const { createConnection: createConnection2 } = await import("mysql2/promise");
+  const connection = await createConnection2({
+    host: info.host,
+    port: info.port,
+    user: info.user,
+    password: info.password,
+    database: info.database,
+    ...options?.multipleStatements !== void 0 ? { multipleStatements: options.multipleStatements } : {}
+  });
+  return connection;
+};
+async function closeQuietly(connection) {
+  try {
+    await connection.end();
+  } catch {
+    connection.destroy?.();
+  }
+}
+async function withConnection(info, fn, options = {}) {
+  const factory = options.factory ?? createSqlConnection;
+  const factoryOptions = options.multipleStatements !== void 0 ? { multipleStatements: options.multipleStatements } : {};
+  const connection = await factory(info, factoryOptions);
+  try {
+    return await fn(connection);
+  } finally {
+    await closeQuietly(connection);
+  }
+}
+async function waitForDatabase(info, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 3e4;
+  const intervalMs = options.intervalMs ?? 500;
+  const factory = options.factory ?? createSqlConnection;
+  const sleep = options.sleep ?? ((ms) => new Promise((resolve2) => setTimeout(resolve2, ms)));
+  const now = options.now ?? Date.now;
+  const deadline = now() + timeoutMs;
+  let lastError;
+  for (; ; ) {
+    try {
+      const connection = await factory(info);
+      try {
+        await connection.query("SELECT 1");
+      } finally {
+        await closeQuietly(connection);
+      }
+      return;
+    } catch (error2) {
+      lastError = error2;
+    }
+    if (now() >= deadline) throw toDatabaseError(lastError, info);
+    await sleep(intervalMs);
+  }
+}
+function extractErrorCode2(error2) {
+  if (typeof error2 === "object" && error2 !== null && "code" in error2) {
+    const code = error2.code;
+    if (typeof code === "string") return code;
+  }
+  return void 0;
+}
+function redactPassword(text, password) {
+  if (password === "") return text;
+  return text.split(password).join("***");
+}
+function toDatabaseError(error2, info) {
+  const target = `${info.host}:${info.port}/${info.database}`;
+  const code = extractErrorCode2(error2);
+  const build = (message, hint2) => new CliError(redactPassword(message, info.password), {
+    ...hint2 !== void 0 ? { hint: redactPassword(hint2, info.password) } : {},
+    cause: error2
+  });
+  if (code === "ER_ACCESS_DENIED_ERROR") {
+    return build(
+      `Access denied connecting to ${target} as "${info.user}".`,
+      "Database credentials are short-lived and rotate automatically \u2014 run `meridian dev` again to fetch fresh ones."
+    );
+  }
+  if (code === "ER_BAD_DB_ERROR") {
+    return build(
+      `Database "${info.database}" does not exist on ${target}.`,
+      "Run `meridian db reset` to recreate it."
+    );
+  }
+  if (code === "ECONNREFUSED") {
+    return build(
+      `Could not reach ${target} (${code}).`,
+      "Nothing is listening on that port. `meridian dev` and `meridian migrate` start the Cloud SQL Auth Proxy for you; start it first if you are connecting by hand."
+    );
+  }
+  if (code === "ETIMEDOUT" || code === "PROTOCOL_SEQUENCE_TIMEOUT") {
+    return build(
+      `Timed out waiting for MySQL at ${target} (${code}).`,
+      "The proxy is listening but the database never answered. Check that your network allows outbound connections to Cloud SQL (VPN, firewall, proxy), then retry with --verbose to see the proxy's own log output."
+    );
+  }
+  const detail2 = code ?? describeError(error2);
+  return build(`Database error connecting to ${target} as "${info.user}": ${detail2}`);
+}
+
+// src/lib/output.ts
+import pc from "picocolors";
+var state;
+function defaultStreams() {
+  return { out: process.stdout, err: process.stderr };
+}
+function computeDefaultColor(streams) {
+  return Boolean(
+    !process.env.NO_COLOR && (process.env.FORCE_COLOR ? true : Boolean(streams.err.isTTY))
+  );
+}
+function getState() {
+  if (state === void 0) {
+    const streams = defaultStreams();
+    state = {
+      streams,
+      mode: { json: false, quiet: false, verbose: false, color: computeDefaultColor(streams) }
+    };
+  }
+  return state;
+}
+function configureOutput(options) {
+  const current2 = getState();
+  const streamsChanged = options.streams !== void 0;
+  const streams = options.streams ?? current2.streams;
+  const color = options.color ?? (streamsChanged ? computeDefaultColor(streams) : current2.mode.color);
+  state = {
+    streams,
+    mode: {
+      json: options.json ?? current2.mode.json,
+      quiet: options.quiet ?? current2.mode.quiet,
+      verbose: options.verbose ?? current2.mode.verbose,
+      color
+    }
+  };
+}
+function getOutputMode() {
+  return { ...getState().mode };
+}
+function colors() {
+  return pc.createColors(getOutputMode().color);
+}
+var style = {
+  bold(s) {
+    return colors().bold(s);
+  },
+  dim(s) {
+    return colors().dim(s);
+  },
+  cyan(s) {
+    return colors().cyan(s);
+  },
+  green(s) {
+    return colors().green(s);
+  },
+  yellow(s) {
+    return colors().yellow(s);
+  },
+  red(s) {
+    return colors().red(s);
+  },
+  /** Highlights a command the user should run, e.g. `meridian login`. */
+  command(s) {
+    return colors().cyan(colors().bold(s));
+  },
+  /** Highlights a path or URL. */
+  path(s) {
+    return colors().underline(s);
+  }
+};
+function highlightBackticks(message) {
+  return message.replace(/`([^`]+)`/g, (_match, code) => style.command(code));
+}
+function indentLines(message, prefix) {
+  return message.split("\n").map((line) => `${prefix}${line}`).join("\n");
+}
+function suppressed() {
+  const mode = getOutputMode();
+  return mode.json || mode.quiet;
+}
+function writeErr(text) {
+  getState().streams.err.write(text);
+}
+function writeErrLine(text) {
+  writeErr(`${text}
+`);
+}
+function log(message = "") {
+  if (suppressed()) return;
+  writeErrLine(message);
+}
+function step(message) {
+  if (suppressed()) return;
+  writeErrLine(`${colors().cyan("\u2192")} ${message}`);
+}
+function success(message) {
+  if (suppressed()) return;
+  writeErrLine(`${colors().green("\u2714")} ${message}`);
+}
+function warn(message) {
+  writeErrLine(`${colors().yellow("\u26A0")} ${message}`);
+}
+function error(message) {
+  writeErrLine(`${colors().red("\u2716")} ${message}`);
+}
+function debug(message) {
+  const mode = getOutputMode();
+  if (suppressed() || !mode.verbose) return;
+  writeErrLine(colors().dim(`\xB7 ${message}`));
+}
+function detail(message) {
+  if (suppressed()) return;
+  writeErrLine(indentLines(message, "  "));
+}
+function detailAlways(message) {
+  writeErrLine(indentLines(message, "  "));
+}
+function keyValues(entries) {
+  if (suppressed()) return;
+  if (entries.length === 0) return;
+  const maxKeyLength = Math.max(...entries.map(([key]) => key.length));
+  for (const [key, value] of entries) {
+    writeErrLine(`  ${colors().dim(key.padEnd(maxKeyLength))}  ${value}`);
+  }
+}
+function hint(message) {
+  writeErrLine(indentLines(highlightBackticks(message), `  ${colors().dim("\u203A")} `));
+}
+function printJson(value) {
+  getState().streams.out.write(`${JSON.stringify(value, null, 2)}
+`);
+}
+function printLine(message) {
+  getState().streams.out.write(`${message}
+`);
+}
+var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var SPINNER_INTERVAL_MS = 80;
+var HIDE_CURSOR = "\x1B[?25l";
+var SHOW_CURSOR = "\x1B[?25h";
+var CLEAR_LINE = "\r\x1B[K";
+var SpinnerImpl = class {
+  #text;
+  #timer;
+  #frame = 0;
+  #running = false;
+  constructor(text) {
+    this.#text = text;
+  }
+  get text() {
+    return this.#text;
+  }
+  start(text) {
+    if (text !== void 0) this.#text = text;
+    if (getOutputMode().json || this.#running) return this;
+    this.#running = true;
+    if (!this.#animated()) {
+      this.#writeLine(`${colors().cyan("\u2192")} ${this.#text}`);
+      return this;
+    }
+    this.#writeRaw(HIDE_CURSOR);
+    this.#render();
+    this.#timer = setInterval(() => {
+      this.#frame = (this.#frame + 1) % SPINNER_FRAMES.length;
+      this.#render();
+    }, SPINNER_INTERVAL_MS);
+    this.#timer.unref();
+    return this;
+  }
+  update(text) {
+    this.#text = text;
+    if (getOutputMode().json || !this.#running || !this.#animated()) return this;
+    this.#render();
+    return this;
+  }
+  succeed(text) {
+    this.#finish(colors().green("\u2714"), text);
+  }
+  fail(text) {
+    this.#finish(colors().red("\u2716"), text);
+  }
+  stop() {
+    if (!this.#running) return;
+    this.#clearTimer();
+    if (this.#animated()) {
+      this.#writeRaw(CLEAR_LINE);
+      this.#writeRaw(SHOW_CURSOR);
+    }
+    this.#running = false;
+  }
+  #finish(mark, text) {
+    if (text !== void 0) this.#text = text;
+    if (getOutputMode().json) {
+      this.#running = false;
+      return;
+    }
+    const wasAnimated = this.#running && this.#animated();
+    this.#clearTimer();
+    if (wasAnimated) {
+      this.#writeRaw(CLEAR_LINE);
+      this.#writeRaw(SHOW_CURSOR);
+    }
+    this.#writeLine(`${mark} ${this.#text}`);
+    this.#running = false;
+  }
+  #clearTimer() {
+    if (this.#timer !== void 0) {
+      clearInterval(this.#timer);
+      this.#timer = void 0;
+    }
+  }
+  #render() {
+    const frame = SPINNER_FRAMES[this.#frame] ?? SPINNER_FRAMES[0];
+    const line = this.#truncate(`${colors().cyan(frame ?? "")} ${this.#text}`);
+    this.#writeRaw(`${CLEAR_LINE}${line}`);
+  }
+  #truncate(line) {
+    const columns = this.#columns();
+    if (columns === void 0 || line.length <= columns) return line;
+    return line.slice(0, Math.max(0, columns - 1));
+  }
+  #columns() {
+    const stream = getState().streams.err;
+    return typeof stream.columns === "number" ? stream.columns : void 0;
+  }
+  /** Full braille animation only makes sense on a TTY, outside quiet mode. */
+  #animated() {
+    const stream = getState().streams.err;
+    return stream.isTTY === true && !getOutputMode().quiet;
+  }
+  #writeLine(text) {
+    this.#writeRaw(`${text}
+`);
+  }
+  #writeRaw(text) {
+    getState().streams.err.write(text);
+  }
+};
+function spinner(text) {
+  return new SpinnerImpl(text);
+}
+async function withSpinner(text, fn, options = {}) {
+  const active = spinner(text).start();
+  try {
+    const value = await fn(active);
+    const successText = typeof options.success === "function" ? options.success(value) : options.success;
+    active.succeed(successText);
+    return value;
+  } catch (err) {
+    active.fail(options.fail);
+    throw err;
+  }
+}
+function buildJsonError(err) {
+  const payload = { message: err.message };
+  if (err.hint !== void 0) payload.hint = err.hint;
+  if (isApiError(err)) payload.status = err.status;
+  return payload;
+}
+function truncate2(text, max) {
+  return text.length > max ? `${text.slice(0, max)}\u2026` : text;
+}
+function safeStringify(value) {
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+function reportError(err) {
+  const mode = getOutputMode();
+  if (isApiError(err)) {
+    error(err.message);
+    if (err.hint !== void 0) hint(err.hint);
+    detailAlways(`status: ${err.status}`);
+    if (mode.verbose && err.body !== void 0) detailAlways(truncate2(safeStringify(err.body), 500));
+    if (mode.json) printJson({ error: buildJsonError(err) });
+    return err.exitCode;
+  }
+  if (isCliError(err)) {
+    error(err.message);
+    if (err.hint !== void 0) hint(err.hint);
+    if (mode.verbose && err.stack !== void 0) detailAlways(err.stack);
+    if (mode.json) printJson({ error: buildJsonError(err) });
+    return err.exitCode;
+  }
+  const message = describeError(err);
+  error(message);
+  if (err instanceof Error && err.stack !== void 0) detailAlways(err.stack);
+  if (mode.json) printJson({ error: { message } });
+  return 1;
+}
+
+// src/lib/options.ts
+function parseIntegerOption(raw, flag, range = {}) {
+  if (raw === void 0) return void 0;
+  const value = Number(raw);
+  const { min, max } = range;
+  const isValid = Number.isInteger(value) && (min === void 0 || value >= min) && (max === void 0 || value <= max);
+  if (!isValid) {
+    const bounds = min !== void 0 && max !== void 0 ? ` between ${min} and ${max}` : min !== void 0 ? ` of at least ${min}` : "";
+    throw new CliError(`${flag} expects a whole number${bounds}, but got "${raw}".`, {
+      hint: `Pass a valid value, e.g. \`${flag} ${min ?? 1}\`.`
+    });
+  }
+  return value;
+}
+function parsePortOption(raw, flag = "--port") {
+  return parseIntegerOption(raw, flag, { min: 1, max: 65535 });
+}
+
+// src/lib/prompts.ts
+import { confirm, input, select } from "@inquirer/prompts";
+function isInteractive() {
+  if (interactiveOverride !== void 0) return interactiveOverride;
+  return process.stdin.isTTY === true && process.stderr.isTTY === true && !process.env.CI && !process.env.MERIDIAN_NON_INTERACTIVE;
+}
+function isAssumeYes() {
+  if (assumeYesOverride !== void 0) return assumeYesOverride;
+  return Boolean(process.env.MERIDIAN_YES);
+}
+var interactiveOverride;
+var assumeYesOverride;
+function configurePrompts(options) {
+  if (options.assumeYes !== void 0) assumeYesOverride = options.assumeYes;
+  if (options.interactive !== void 0) interactiveOverride = options.interactive;
+}
+function matchChoice(choices, raw) {
+  const target = raw.trim().toLowerCase();
+  return choices.find((choice) => {
+    const value = String(choice.value).trim().toLowerCase();
+    const name = choice.name.trim().toLowerCase();
+    return value === target || name === target;
+  });
+}
+function listChoiceNames(choices) {
+  return choices.map((choice) => choice.name).join(", ");
+}
+function describeOverride(flag, envVar) {
+  const parts = [flag, envVar].filter((part) => part !== void 0);
+  return parts.length > 0 ? parts.join(" or ") : "the appropriate flag";
+}
+async function selectOne(options) {
+  const { message, choices, envVar, answer, flag } = options;
+  if (choices.length === 0) {
+    throw new CliError("Nothing to choose from.");
+  }
+  if (answer !== void 0) {
+    const match = matchChoice(choices, answer);
+    if (match === void 0) {
+      throw new CliError(`"${answer}" is not a valid choice for ${message}.`, {
+        hint: `Valid options: ${listChoiceNames(choices)}.`
+      });
+    }
+    return match.value;
+  }
+  if (envVar !== void 0) {
+    const envValue = process.env[envVar];
+    if (envValue !== void 0 && envValue !== "") {
+      const match = matchChoice(choices, envValue);
+      if (match === void 0) {
+        throw new CliError(`${envVar}="${envValue}" is not a valid choice for ${message}.`, {
+          hint: `Valid options: ${listChoiceNames(choices)}.`
+        });
+      }
+      return match.value;
+    }
+  }
+  if (choices.length === 1) {
+    const only = choices[0];
+    if (only !== void 0) return only.value;
+  }
+  if (!isInteractive()) {
+    throw nonInteractiveError(message, describeOverride(flag, envVar));
+  }
+  const promptImpl = options.promptImpl ?? select;
+  try {
+    return await promptImpl(
+      {
+        message,
+        choices: choices.map((choice) => ({
+          value: choice.value,
+          name: choice.name,
+          ...choice.description !== void 0 ? { description: choice.description } : {}
+        })),
+        ...options.default !== void 0 ? { default: options.default } : {}
+      },
+      { output: process.stderr }
+    );
+  } catch (err) {
+    throw toPromptError(err);
+  }
+}
+function confirmOverrideText(flag) {
+  return `${flag ?? "--yes"} (or MERIDIAN_YES)`;
+}
+async function confirmAction(options) {
+  const assumeYes = options.assumeYes ?? isAssumeYes();
+  if (assumeYes) return true;
+  if (!isInteractive()) {
+    throw nonInteractiveError(options.message, confirmOverrideText(options.flag));
+  }
+  const promptImpl = options.promptImpl ?? confirm;
+  try {
+    return await promptImpl(
+      {
+        message: options.message,
+        ...options.default !== void 0 ? { default: options.default } : {}
+      },
+      { output: process.stderr }
+    );
+  } catch (err) {
+    throw toPromptError(err);
+  }
+}
+async function confirmDestructive(options) {
+  const assumeYes = options.assumeYes ?? isAssumeYes();
+  if (assumeYes) return true;
+  if (!isInteractive()) {
+    throw nonInteractiveError(options.message, confirmOverrideText(options.flag));
+  }
+  const promptImpl = options.promptImpl ?? input;
+  let typed;
+  try {
+    typed = await promptImpl(
+      { message: `${options.message} Type "${options.phrase}" to confirm:` },
+      { output: process.stderr }
+    );
+  } catch (err) {
+    throw toPromptError(err);
+  }
+  return typed.trim() === options.phrase;
+}
+function toPromptError(error2) {
+  if (error2 instanceof Error && error2.name === "ExitPromptError") {
+    return new CliError("Aborted.", { exitCode: 130, cause: error2 });
+  }
+  return error2;
+}
+
+// src/lib/project.ts
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, parse, resolve } from "path";
+import { z as z4 } from "zod";
+var projectConfigSchema = z4.object({
+  org_id: z4.union([z4.number(), z4.string()]),
+  app_id: z4.union([z4.number(), z4.string()]),
+  app_name: z4.string().exactOptional(),
+  dev_command: z4.string().exactOptional(),
+  skip_datasource_check: z4.boolean().exactOptional()
+});
+var GITIGNORE_ENTRIES = ["snapshots/", "*.log", "tmp/"];
+function findProjectRoot(startDir) {
+  let dir = resolve(startDir ?? process.cwd());
+  const { root } = parse(dir);
+  while (true) {
+    if (existsSync(projectConfigPath(dir))) return dir;
+    if (dir === root) return null;
+    dir = dirname2(dir);
+  }
+}
+function readProject(startDir) {
+  const root = findProjectRoot(startDir);
+  if (root === null) return null;
+  const path = projectConfigPath(root);
+  let raw;
+  try {
+    raw = readFileSync2(path, "utf8");
+  } catch (error2) {
+    if (isEnoent2(error2)) return null;
+    throw new CliError(`Could not read ${path}.`, {
+      hint: "Run `meridian link` to relink this project.",
+      cause: error2
+    });
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error2) {
+    throw new CliError(`${path} is not valid JSON.`, {
+      hint: "Run `meridian link` to relink this project.",
+      cause: error2
+    });
+  }
+  const result = projectConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new CliError(`${path} is not a valid Meridian project file.`, {
+      hint: "Run `meridian link` to relink this project.",
+      cause: result.error
+    });
+  }
+  return { root, config: result.data };
+}
+function requireProject(startDir) {
+  const project = readProject(startDir);
+  if (project === null) throw notLinkedError();
+  return project;
+}
+function writeProject(root, config) {
+  const resolvedRoot = resolve(root);
+  mkdirSync2(projectStateDir(resolvedRoot), { recursive: true });
+  writeFileSync2(projectConfigPath(resolvedRoot), `${JSON.stringify(config, null, 2)}
+`);
+  ensureProjectStateIgnore(resolvedRoot);
+}
+function removeProject(root) {
+  const path = projectConfigPath(resolve(root));
+  if (!existsSync(path)) return false;
+  rmSync(path);
+  return true;
+}
+function ensureProjectStateIgnore(root) {
+  const resolvedRoot = resolve(root);
+  const stateDir = projectStateDir(resolvedRoot);
+  mkdirSync2(stateDir, { recursive: true });
+  const gitignorePath = `${stateDir}/.gitignore`;
+  let existingLines = [];
+  if (existsSync(gitignorePath)) {
+    existingLines = readFileSync2(gitignorePath, "utf8").split("\n");
+  }
+  const missing = GITIGNORE_ENTRIES.filter((entry) => !existingLines.includes(entry));
+  if (existingLines.length > 0 && missing.length === 0) return;
+  const lines = [...existingLines.filter((line) => line.trim() !== ""), ...missing];
+  writeFileSync2(gitignorePath, `${lines.join("\n")}
+`);
+}
+function resolveProjectRoot(cwd) {
+  if (cwd !== void 0) return findProjectRoot(cwd);
+  return findProjectRoot();
+}
+function isEnoent2(error2) {
+  return typeof error2 === "object" && error2 !== null && "code" in error2 && error2.code === "ENOENT";
+}
+
+// src/lib/run.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { delimiter, join as join2 } from "path";
+import crossSpawn from "cross-spawn";
+var MAX_OUTPUT_LENGTH = 8 * 1024;
+function toEnoentError(command, cause) {
+  return new CliError(`Could not run \`${command}\`: command not found.`, {
+    hint: `Make sure \`${command}\` is installed and on your PATH.`,
+    cause
+  });
+}
+function isEnoent3(error2) {
+  return typeof error2 === "object" && error2 !== null && "code" in error2 && error2.code === "ENOENT";
+}
+function parseCommandString(command) {
+  const tokens = [];
+  let current2 = "";
+  let hasCurrent = false;
+  let quote = null;
+  let i = 0;
+  while (i < command.length) {
+    const ch = command.charAt(i);
+    if (quote !== null) {
+      if (ch === quote) {
+        quote = null;
+      } else {
+        current2 += ch;
+        hasCurrent = true;
+      }
+      i++;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      hasCurrent = true;
+      i++;
+      continue;
+    }
+    if (ch === "\\" && i + 1 < command.length) {
+      current2 += command.charAt(i + 1);
+      hasCurrent = true;
+      i += 2;
+      continue;
+    }
+    if (ch === " " || ch === "	") {
+      if (hasCurrent) {
+        tokens.push(current2);
+        current2 = "";
+        hasCurrent = false;
+      }
+      i++;
+      continue;
+    }
+    current2 += ch;
+    hasCurrent = true;
+    i++;
+  }
+  if (quote !== null) {
+    throw new CliError(`Unbalanced ${quote} quote in command: ${command}`);
+  }
+  if (hasCurrent) tokens.push(current2);
+  const [first, ...rest] = tokens;
+  if (first === void 0) {
+    throw new CliError("Cannot parse an empty command string.");
+  }
+  return { command: first, args: rest };
+}
+function attachOutputCapture(child, onData) {
+  child.stdout?.on("data", onData);
+  child.stderr?.on("data", onData);
+}
+function makeOutputCollector() {
+  let output = "";
+  return {
+    append(chunk) {
+      output += chunk.toString();
+      if (output.length > MAX_OUTPUT_LENGTH) output = output.slice(output.length - MAX_OUTPUT_LENGTH);
+    },
+    get: () => output
+  };
+}
+function runProcess(command, args, options) {
+  const spawnFn = options.spawnImpl ?? crossSpawn;
+  const inherit = options.inherit ?? true;
+  return new Promise((resolve2, reject) => {
+    const child = spawnFn(command, args, {
+      cwd: options.cwd,
+      env: options.env ?? process.env,
+      stdio: inherit ? "inherit" : ["ignore", "pipe", "pipe"]
+    });
+    const collector = makeOutputCollector();
+    if (!inherit) attachOutputCapture(child, collector.append);
+    let settled = false;
+    child.once("error", (error2) => {
+      if (settled) return;
+      settled = true;
+      reject(isEnoent3(error2) ? toEnoentError(command, error2) : error2);
+    });
+    child.once("close", (code, signal) => {
+      if (settled) return;
+      settled = true;
+      resolve2({ code: code ?? 0, signal, output: collector.get() });
+    });
+  });
+}
+function runNpx(args, options) {
+  const baseEnv = options.env ?? process.env;
+  const binDir = join2(options.cwd, "node_modules", ".bin");
+  const path = baseEnv.PATH;
+  const env = {
+    ...baseEnv,
+    PATH: path !== void 0 && path !== "" ? `${binDir}${delimiter}${path}` : binDir
+  };
+  return runProcess("npx", args, { ...options, env });
+}
+function trySignal(child, signal) {
+  try {
+    child.kill(signal);
+  } catch (error2) {
+    if (!isEsrch(error2)) throw error2;
+  }
+}
+function isEsrch(error2) {
+  return typeof error2 === "object" && error2 !== null && "code" in error2 && error2.code === "ESRCH";
+}
+function startProcess(command, args, options) {
+  const spawnFn = options.spawnImpl ?? crossSpawn;
+  const inherit = options.inherit ?? true;
+  const env = { ...options.env ?? process.env, [DEV_GUARD_ENV]: "1" };
+  const child = spawnFn(command, args, {
+    cwd: options.cwd,
+    env,
+    stdio: inherit ? "inherit" : ["ignore", "pipe", "pipe"]
+  });
+  const collector = makeOutputCollector();
+  if (!inherit) attachOutputCapture(child, collector.append);
+  const exited = new Promise((resolve2, reject) => {
+    child.once("error", (error2) => {
+      reject(isEnoent3(error2) ? toEnoentError(command, error2) : error2);
+    });
+    child.once("close", (code, signal) => {
+      resolve2({ code: code ?? 0, signal, output: collector.get() });
+    });
+  });
+  let stopped = false;
+  const stop = async (signal = "SIGTERM", graceMs = 5e3) => {
+    if (stopped) {
+      await exited.catch(() => void 0);
+      return;
+    }
+    stopped = true;
+    trySignal(child, signal);
+    const killTimer = setTimeout(() => {
+      trySignal(child, "SIGKILL");
+    }, graceMs);
+    killTimer.unref?.();
+    try {
+      await exited;
+    } catch {
+    } finally {
+      clearTimeout(killTimer);
+    }
+  };
+  return {
+    get pid() {
+      return child.pid;
+    },
+    exited,
+    stop
+  };
+}
+var DEV_GUARD_ENV = "MERIDIAN_DEV_ACTIVE";
+function isInsideDevSession(env = process.env) {
+  return env[DEV_GUARD_ENV] === "1";
+}
+var RUNNER_PREFIXES = [["npx"], ["npm", "exec"], ["pnpm", "dlx"], ["yarn", "dlx"]];
+function stripRunnerPrefix(tokens) {
+  for (const prefix of RUNNER_PREFIXES) {
+    if (prefix.length <= tokens.length && prefix.every((part, i) => tokens[i] === part)) {
+      return tokens.slice(prefix.length);
+    }
+  }
+  return tokens;
+}
+function isMeridianBinary(token) {
+  if (token === void 0) return false;
+  return token === "meridian" || token.endsWith("/meridian") || token.endsWith("\\meridian");
+}
+function assertNotSelfInvoking(command) {
+  let tokens;
+  try {
+    const parsed = parseCommandString(command);
+    tokens = [parsed.command, ...parsed.args];
+  } catch {
+    return;
+  }
+  const rest = stripRunnerPrefix(tokens);
+  if (isMeridianBinary(rest[0]) && rest[1] === "dev") {
+    throw new CliError("`meridian dev` cannot run itself as the app's dev command.", {
+      hint: "Set `dev_command` in .meridian/project.json to the underlying command (e.g. `next dev`), because `meridian dev` runs `npm run dev` by default."
+    });
+  }
+}
+function readPackageScript(root, name) {
+  try {
+    const raw = readFileSync3(join2(root, "package.json"), "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const scripts = parsed.scripts;
+    if (typeof scripts !== "object" || scripts === null) return null;
+    const value = scripts[name];
+    return typeof value === "string" ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/lib/env-file.ts
+import {
+  chmodSync as chmodSync2,
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync3,
+  readFileSync as readFileSync4,
+  renameSync as renameSync2,
+  statSync,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { dirname as dirname3 } from "path";
+var CREATED_ENV_MODE = 384;
+var MANAGED_HEADER = "# Managed by the Meridian CLI \u2014 DATABASE_URL is rewritten by `meridian dev`.";
+var LINE_RE = /^([ \t]*)(export[ \t]+)?([A-Za-z_][A-Za-z0-9_]*)([ \t]*=[ \t]*)(.*)$/;
+function splitLines(content) {
+  const lines = [];
+  let start = 0;
+  for (let i = 0; i < content.length; i++) {
+    if (content.charAt(i) !== "\n") continue;
+    const hasCr = i > start && content.charAt(i - 1) === "\r";
+    const end = hasCr ? i - 1 : i;
+    lines.push({ text: content.slice(start, end), eol: hasCr ? "\r\n" : "\n" });
+    start = i + 1;
+  }
+  if (start < content.length) lines.push({ text: content.slice(start), eol: "" });
+  return lines;
+}
+function detectDominantEol(lines) {
+  let crlf = 0;
+  let lf = 0;
+  for (const line of lines) {
+    if (line.eol === "\r\n") crlf++;
+    else if (line.eol === "\n") lf++;
+  }
+  return crlf > lf ? "\r\n" : "\n";
+}
+function matchLine(text) {
+  const match = LINE_RE.exec(text);
+  if (match === null) return null;
+  return {
+    indent: match[1] ?? "",
+    prefix: match[2] ?? "",
+    key: match[3] ?? "",
+    eq: match[4] ?? "",
+    rest: match[5] ?? ""
+  };
+}
+function unescapeDoubleQuoted(inner) {
+  return inner.replace(/\\(.)/g, (_full, ch) => ch === "n" ? "\n" : ch);
+}
+function decodeEnvValue(raw) {
+  const trimmed = raw.trim();
+  if (trimmed.length >= 2 && trimmed.startsWith('"') && trimmed.endsWith('"')) {
+    return unescapeDoubleQuoted(trimmed.slice(1, -1));
+  }
+  if (trimmed.length >= 2 && trimmed.startsWith("'") && trimmed.endsWith("'")) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+function formatEnvValue(value) {
+  const needsQuoting = value === "" || /[\s#"'$]/.test(value);
+  if (!needsQuoting) return value;
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n");
+  return `"${escaped}"`;
+}
+function upsertEnvContent(content, patch) {
+  const lines = splitLines(content);
+  const keys = [];
+  const toAppend = [];
+  let changed = false;
+  for (const [key, value] of Object.entries(patch)) {
+    let foundIndex = -1;
+    for (let i = lines.length - 1; i >= 0; i--) {
+      const line2 = lines[i];
+      if (line2 === void 0) continue;
+      const match2 = matchLine(line2.text);
+      if (match2 !== null && match2.key === key) {
+        foundIndex = i;
+        break;
+      }
+    }
+    if (foundIndex === -1) {
+      toAppend.push({ key, value });
+      keys.push({ key, next: value, action: "created" });
+      changed = true;
+      continue;
+    }
+    const line = lines[foundIndex];
+    const match = line === void 0 ? null : matchLine(line.text);
+    if (line === void 0 || match === null) continue;
+    const previous = decodeEnvValue(match.rest);
+    if (previous === value) {
+      keys.push({ key, previous, next: value, action: "unchanged" });
+      continue;
+    }
+    lines[foundIndex] = {
+      text: `${match.indent}${match.prefix}${key}${match.eq}${formatEnvValue(value)}`,
+      eol: line.eol
+    };
+    keys.push({ key, previous, next: value, action: "updated" });
+    changed = true;
+  }
+  if (toAppend.length > 0) {
+    const dominantEol = detectDominantEol(lines);
+    const lastIndex = lines.length - 1;
+    const lastLine = lines[lastIndex];
+    if (lastLine !== void 0 && lastLine.eol === "") {
+      lines[lastIndex] = { text: lastLine.text, eol: dominantEol };
+    }
+    for (const { key, value } of toAppend) {
+      lines.push({ text: `${key}=${formatEnvValue(value)}`, eol: dominantEol });
+    }
+  }
+  const nextContent = lines.map((line) => line.text + line.eol).join("");
+  return { content: nextContent, changed, keys };
+}
+function isEnoent4(error2) {
+  return typeof error2 === "object" && error2 !== null && "code" in error2 && error2.code === "ENOENT";
+}
+function writeExact(path, content, mode) {
+  writeFileSync3(path, content, { mode });
+  try {
+    chmodSync2(path, mode);
+  } catch {
+  }
+}
+function patchEnvFile(envPath, patch, options = {}) {
+  const backupEnabled = options.backup ?? true;
+  let existing = null;
+  let mode;
+  try {
+    existing = readFileSync4(envPath, "utf8");
+    mode = statSync(envPath).mode & 511;
+  } catch (error2) {
+    if (!isEnoent4(error2)) {
+      throw new CliError(`Could not read ${envPath}.`, {
+        hint: "Check the file's permissions and try again.",
+        cause: error2
+      });
+    }
+  }
+  const created = existing === null;
+  const baseContent = existing !== null ? existing : `${MANAGED_HEADER}
+`;
+  const targetMode = mode ?? CREATED_ENV_MODE;
+  const { content: nextContent, changed, keys } = upsertEnvContent(baseContent, patch);
+  let backedUp = false;
+  if (existing !== null && changed && backupEnabled) {
+    const backupPath = `${envPath}.backup`;
+    if (!existsSync2(backupPath)) {
+      writeExact(backupPath, existing, targetMode);
+      backedUp = true;
+    }
+  }
+  if (created || changed) {
+    mkdirSync3(dirname3(envPath), { recursive: true });
+    const tmpPath = `${envPath}.${process.pid}.tmp`;
+    writeExact(tmpPath, nextContent, targetMode);
+    renameSync2(tmpPath, envPath);
+  }
+  return { path: envPath, created, backedUp, changed: created || changed, keys };
+}
+function buildDatabaseUrl(input2) {
+  const host = input2.host ?? "127.0.0.1";
+  const user = encodeURIComponent(input2.username);
+  const pass = encodeURIComponent(input2.password);
+  const hasParams = input2.params !== void 0 && Object.keys(input2.params).length > 0;
+  const query = hasParams ? `?${new URLSearchParams(input2.params).toString()}` : "";
+  return `mysql://${user}:${pass}@${host}:${input2.port}/${input2.database}${query}`;
+}
+function redactDatabaseUrl(url) {
+  return url.replace(/^(mysql:\/\/[^:@/]+):([^@]*)@/, "$1:****@");
+}
+
+// src/lib/port.ts
+import { createServer } from "net";
+var DEFAULT_START_PORT = 3307;
+var DEFAULT_ATTEMPTS = 20;
+var MAX_PORT = 65535;
+function isPortFree(port, host = "127.0.0.1") {
+  return new Promise((resolve2) => {
+    const server = createServer();
+    server.once("error", () => {
+      resolve2(false);
+    });
+    server.once("listening", () => {
+      server.close(() => resolve2(true));
+    });
+    server.listen({ port, host, exclusive: true });
+  });
+}
+function bindEphemeralPort(host) {
+  return new Promise((resolve2) => {
+    const server = createServer();
+    server.once("error", () => resolve2(null));
+    server.listen({ port: 0, host, exclusive: true }, () => {
+      const address = server.address();
+      const port = typeof address === "object" && address !== null ? address.port : null;
+      server.close(() => resolve2(port));
+    });
+  });
+}
+async function findFreePort(options = {}) {
+  const host = options.host ?? "127.0.0.1";
+  const start = options.start ?? DEFAULT_START_PORT;
+  const attempts = options.attempts ?? DEFAULT_ATTEMPTS;
+  if (options.preferred !== void 0 && await isPortFree(options.preferred, host)) {
+    return options.preferred;
+  }
+  for (let offset = 0; offset < attempts; offset++) {
+    const candidate = start + offset;
+    if (candidate > MAX_PORT) break;
+    if (await isPortFree(candidate, host)) return candidate;
+  }
+  const ephemeral = await bindEphemeralPort(host);
+  if (ephemeral === null) {
+    throw new CliError("Could not find a free local port for the Cloud SQL Auth Proxy.", {
+      hint: "Close other applications using local ports and try again."
+    });
+  }
+  return ephemeral;
+}
+
+// src/lib/prisma.ts
+import { existsSync as existsSync3, readFileSync as readFileSync5, readdirSync, statSync as statSync2, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname4, join as join3, relative } from "path";
+var REQUIRED_URL_ENV = "DATABASE_URL";
+var REQUIRED_SHADOW_URL_ENV = "SHADOW_DATABASE_URL";
+var REQUIRED_PROVIDER = "mysql";
+var BYPASS_HINT = `Set \`"skip_datasource_check": true\` in .meridian/project.json to run anyway.`;
+function stripComments(source) {
+  let out = "";
+  let inString = false;
+  let i = 0;
+  while (i < source.length) {
+    const ch = source.charAt(i);
+    if (inString) {
+      if (ch === "\\" && i + 1 < source.length) {
+        out += ch + source.charAt(i + 1);
+        i += 2;
+        continue;
+      }
+      if (ch === '"') inString = false;
+      out += ch;
+      i++;
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      out += ch;
+      i++;
+      continue;
+    }
+    if (ch === "/" && source.charAt(i + 1) === "/") {
+      while (i < source.length && source.charAt(i) !== "\n") i++;
+      continue;
+    }
+    out += ch;
+    i++;
+  }
+  return out;
+}
+function isDirectory(path) {
+  try {
+    return statSync2(path).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function findPrismaSchemas(root) {
+  const paths = [];
+  const single = join3(root, "prisma", "schema.prisma");
+  if (existsSync3(single)) paths.push(single);
+  const folder = join3(root, "prisma", "schema");
+  if (isDirectory(folder)) {
+    for (const entry of readdirSync(folder).sort()) {
+      if (entry.endsWith(".prisma")) paths.push(join3(folder, entry));
+    }
+  }
+  const bare = join3(root, "schema.prisma");
+  if (existsSync3(bare)) paths.push(bare);
+  return paths;
+}
+function parseUrl(body, key) {
+  const fromEnv = new RegExp(`\\b${key}\\s*=\\s*env\\(\\s*"([^"]*)"\\s*\\)`).exec(body);
+  if (fromEnv?.[1] !== void 0) return { kind: "env", name: fromEnv[1] };
+  const literal = new RegExp(`\\b${key}\\s*=\\s*"([^"]*)"`).exec(body);
+  if (literal?.[1] !== void 0) return { kind: "literal", value: literal[1] };
+  return null;
+}
+function parseDatasource(source) {
+  const block = /datasource\s+(\w+)\s*\{([^}]*)\}/.exec(stripComments(source));
+  if (block === null) return null;
+  const name = block[1] ?? "db";
+  const body = block[2] ?? "";
+  const provider = /\bprovider\s*=\s*"([^"]*)"/.exec(body);
+  return {
+    name,
+    provider: provider?.[1] ?? null,
+    url: parseUrl(body, "url"),
+    shadowUrl: parseUrl(body, "shadowDatabaseUrl")
+  };
+}
+function readPrismaDatasource(root) {
+  for (const path of findPrismaSchemas(root)) {
+    let source;
+    try {
+      source = readFileSync5(path, "utf8");
+    } catch {
+      continue;
+    }
+    const parsed = parseDatasource(source);
+    if (parsed !== null) return { ...parsed, schemaPath: relative(root, path) };
+  }
+  return null;
+}
+function missingShadowDatabaseUrl(root) {
+  const datasource = readPrismaDatasource(root);
+  if (datasource === null || datasource.shadowUrl !== null) return null;
+  return datasource.schemaPath;
+}
+function alignAssignments(lines) {
+  const parsed = lines.map((line) => /^(\s*)([A-Za-z_]\w*)\s*=\s*(.*)$/.exec(line));
+  const widest = parsed.reduce((max, match) => Math.max(max, match?.[2]?.length ?? 0), 0);
+  return lines.map((line, index) => {
+    const match = parsed[index];
+    if (match === void 0 || match === null) return line;
+    return `${match[1]}${(match[2] ?? "").padEnd(widest)} = ${match[3] ?? ""}`;
+  });
+}
+function addShadowDatabaseUrl(root) {
+  const datasource = readPrismaDatasource(root);
+  if (datasource === null) throw new CliError("No Prisma datasource found to add `shadowDatabaseUrl` to.");
+  const absolute = join3(root, datasource.schemaPath);
+  const source = readFileSync5(absolute, "utf8");
+  const lines = source.split("\n");
+  const open = lines.findIndex((line) => new RegExp(`^\\s*datasource\\s+${datasource.name}\\s*\\{`).test(line));
+  if (open === -1) throw new CliError(`Could not locate the \`${datasource.name}\` datasource in ${datasource.schemaPath}.`);
+  const close = lines.findIndex((line, index) => index > open && /^\s*\}/.test(line));
+  if (close === -1) throw new CliError(`\`${datasource.schemaPath}\` has an unterminated datasource block.`);
+  const urlLine = lines.findIndex((line, index) => index > open && index < close && /^\s*url\s*=/.test(line));
+  const insertAfter = urlLine === -1 ? open : urlLine;
+  const indent = /^(\s*)/.exec(lines[insertAfter] ?? "")?.[1];
+  const body = [
+    ...lines.slice(open + 1, insertAfter + 1),
+    `${urlLine === -1 ? "  " : indent}shadowDatabaseUrl = env("${REQUIRED_SHADOW_URL_ENV}")`,
+    ...lines.slice(insertAfter + 1, close)
+  ];
+  const patched = [...lines.slice(0, open + 1), ...alignAssignments(body), ...lines.slice(close)];
+  writeFileSync4(absolute, patched.join("\n"));
+  return datasource.schemaPath;
+}
+function wrongUrlError(datasource, url) {
+  const problem = url.kind === "literal" ? `hardcodes \`url = "${url.value}"\`` : `reads \`env("${url.name}")\`, but Meridian sets \`${REQUIRED_URL_ENV}\``;
+  return new CliError(
+    `\`${datasource.schemaPath}\` ${problem}, so this command would not touch the managed development database.`,
+    {
+      hint: `Change the \`${datasource.name}\` datasource to \`url = env("${REQUIRED_URL_ENV}")\` with \`provider = "${REQUIRED_PROVIDER}"\`. Migrations generated against another database use dialect-specific SQL and have to be regenerated. ${BYPASS_HINT}`
+    }
+  );
+}
+function wrongProviderError(datasource, provider) {
+  return new CliError(
+    `\`${datasource.schemaPath}\` sets \`provider = "${provider}"\`, but the managed development database is MySQL.`,
+    {
+      hint: `Change the \`${datasource.name}\` datasource to \`provider = "${REQUIRED_PROVIDER}"\` and regenerate any migrations generated for ${provider}, which use dialect-specific SQL. ${BYPASS_HINT}`
+    }
+  );
+}
+function assertManagedDatasource(root) {
+  const datasource = readPrismaDatasource(root);
+  if (datasource === null || datasource.url === null) return;
+  if (datasource.url.kind !== "env" || datasource.url.name !== REQUIRED_URL_ENV) {
+    throw wrongUrlError(datasource, datasource.url);
+  }
+  if (datasource.provider !== null && datasource.provider !== REQUIRED_PROVIDER) {
+    throw wrongProviderError(datasource, datasource.provider);
+  }
+}
+function assertShadowDatasource(root) {
+  const datasource = readPrismaDatasource(root);
+  if (datasource === null) return;
+  const shadow = datasource.shadowUrl;
+  if (shadow !== null && shadow.kind === "env" && shadow.name === REQUIRED_SHADOW_URL_ENV) return;
+  const problem = shadow === null ? "declares no `shadowDatabaseUrl`" : shadow.kind === "literal" ? `hardcodes \`shadowDatabaseUrl = "${shadow.value}"\`` : `reads \`env("${shadow.name}")\` for its shadow database, but Meridian sets \`${REQUIRED_SHADOW_URL_ENV}\``;
+  throw new CliError(`\`${datasource.schemaPath}\` ${problem}.`, {
+    hint: `\`prisma migrate dev\` diffs your migrations in a throwaway shadow database, and your dev user cannot create one \u2014 so Meridian provisions it for you and exports \`${REQUIRED_SHADOW_URL_ENV}\`. Add \`shadowDatabaseUrl = env("${REQUIRED_SHADOW_URL_ENV}")\` to the \`${datasource.name}\` datasource. ${BYPASS_HINT}`
+  });
+}
+var FOREIGN_DIALECT_DDL = /\b(?:CREATE\s+(?:UNIQUE\s+)?(?:TABLE|INDEX)|ALTER\s+TABLE|REFERENCES)\s+"/i;
+function migrationSqlPaths(root) {
+  const schemas = findPrismaSchemas(root);
+  const roots = new Set(schemas.map((schema) => join3(dirname4(schema), "migrations")));
+  roots.add(join3(root, "prisma", "migrations"));
+  const paths = [];
+  for (const dir of roots) {
+    if (!isDirectory(dir)) continue;
+    for (const entry of readdirSync(dir).sort()) {
+      const sql = join3(dir, entry, "migration.sql");
+      if (existsSync3(sql)) paths.push(sql);
+    }
+  }
+  return paths;
+}
+function findForeignDialectMigration(root) {
+  const offender = migrationSqlPaths(root).find((path) => {
+    try {
+      return FOREIGN_DIALECT_DDL.test(readFileSync5(path, "utf8"));
+    } catch {
+      return false;
+    }
+  });
+  return offender === void 0 ? null : relative(root, offender);
+}
+function foreignDialectExplanation(offender) {
+  return `\`${offender}\` was generated for SQLite or Postgres \u2014 it quotes identifiers with double quotes, which MySQL reads as string literals. Migration SQL is dialect-specific and cannot be replayed against MySQL. If this history has only ever run locally, delete \`prisma/migrations\` and re-run to regenerate it for MySQL; run \`meridian db reset\` first if an earlier attempt already failed, since Prisma records that failure in \`_prisma_migrations\` and will not continue while it is there.`;
+}
+function assertMigrationDialect(root) {
+  const offender = findForeignDialectMigration(root);
+  if (offender === null) return;
+  throw new CliError(`\`${offender}\` was written for a different database engine and cannot apply to MySQL.`, {
+    hint: `${foreignDialectExplanation(offender)} Pass \`--allow-foreign-migrations\` to try anyway.`
+  });
+}
+function diagnoseMigrationFailure(root) {
+  const offender = findForeignDialectMigration(root);
+  return offender === null ? null : foreignDialectExplanation(offender);
+}
+
+// src/lib/proxy/binary.ts
+import { createHash } from "crypto";
+import { chmodSync as chmodSync3, existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync6, renameSync as renameSync3, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
+import { join as join4 } from "path";
+var PROXY_VERSION = "2.24.1";
+var PROXY_CHECKSUMS = Object.freeze({
+  "cloud-sql-proxy.darwin.amd64": "67a38444d03fe77a8b11036f96fe5d2379640088bb6e338737fb48d97c58cf48",
+  "cloud-sql-proxy.darwin.arm64": "fd374545705f2aa687d8e525a2efcbb9d356cc8af60d4dfa1a330cb59a7f9450",
+  "cloud-sql-proxy.linux.386": "cf731f4becfb5a2de61f2998b2d660c5fb8f3067cbd3b86f5783ae9049c06f24",
+  "cloud-sql-proxy.linux.amd64": "fae2766aac9d614a2bdef2f2a7778f3d054f3acd5ff07a81a9e300bd471512eb",
+  "cloud-sql-proxy.linux.arm64": "da49fd73b0d33c0ab8e5dfc19dfb104cdd969ebd355eef8fd3b079c20a723c82",
+  "cloud-sql-proxy.x64.exe": "01ec54c69dbb8118c0b181c33ff1469a5cdb2dddb49eb86b0b173f6c55dea0bc",
+  "cloud-sql-proxy.x86.exe": "98c3b1897c80f2bc0b241b4452c18557a00cd86f89e4d7449c4ff1316e243c44"
+});
+var ASSET_NAME_BY_PLATFORM_ARCH = Object.freeze({
+  "darwin:arm64": "cloud-sql-proxy.darwin.arm64",
+  "darwin:x64": "cloud-sql-proxy.darwin.amd64",
+  "linux:x64": "cloud-sql-proxy.linux.amd64",
+  "linux:arm64": "cloud-sql-proxy.linux.arm64",
+  "linux:ia32": "cloud-sql-proxy.linux.386",
+  "win32:x64": "cloud-sql-proxy.x64.exe",
+  "win32:ia32": "cloud-sql-proxy.x86.exe"
+});
+function defaultVersion() {
+  const override = process.env.MERIDIAN_PROXY_VERSION;
+  if (override !== void 0 && override !== "") return override;
+  return PROXY_VERSION;
+}
+function resolveProxyAsset(options) {
+  const platform = options?.platform ?? process.platform;
+  const arch = options?.arch ?? process.arch;
+  const version = options?.version ?? defaultVersion();
+  const assetName = ASSET_NAME_BY_PLATFORM_ARCH[`${platform}:${arch}`];
+  if (assetName === void 0) {
+    throw new CliError(`The Cloud SQL Auth Proxy has no published build for ${platform}/${arch}.`, {
+      hint: "Set MERIDIAN_PROXY_PATH to the path of a proxy binary you install yourself."
+    });
+  }
+  const downloadUrl = `https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v${version}/${assetName}`;
+  const sha256Value = version === PROXY_VERSION ? PROXY_CHECKSUMS[assetName] : void 0;
+  const fileName = `cloud-sql-proxy-${version}-${platform}-${arch}${platform === "win32" ? ".exe" : ""}`;
+  return {
+    version,
+    assetName,
+    downloadUrl,
+    ...sha256Value !== void 0 ? { sha256: sha256Value } : {},
+    fileName
+  };
+}
+function sha256(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
+var CHECKSUM_ROW_PATTERN = /\[([^\]]+)]\([^)]*\)\s*\|\s*([0-9a-fA-F]{64})/g;
+function parseChecksumTable(releaseBody) {
+  const table = {};
+  for (const match of releaseBody.matchAll(CHECKSUM_ROW_PATTERN)) {
+    const name = match[1];
+    const hash = match[2];
+    if (name !== void 0 && hash !== void 0) table[name] = hash.toLowerCase();
+  }
+  return table;
+}
+var RELEASE_API_URL = "https://api.github.com/repos/GoogleCloudPlatform/cloud-sql-proxy/releases/tags";
+var checksumCache = /* @__PURE__ */ new Map();
+async function resolveExpectedChecksum(asset, fetchImpl) {
+  if (asset.sha256 !== void 0) return asset.sha256;
+  const cacheKey = `${asset.version}:${asset.assetName}`;
+  const cached = checksumCache.get(cacheKey);
+  if (cached !== void 0) return cached;
+  const skipAllowed = process.env.MERIDIAN_PROXY_SKIP_CHECKSUM === "1";
+  const url = `${RELEASE_API_URL}/v${asset.version}`;
+  let response;
+  try {
+    response = await fetchImpl(url, { headers: { Accept: "application/vnd.github+json" } });
+  } catch (error2) {
+    if (skipAllowed) return void 0;
+    throw new CliError(`Could not reach ${url} to look up the checksum for cloud-sql-proxy v${asset.version}.`, {
+      hint: "Check your network connection, or set MERIDIAN_PROXY_SKIP_CHECKSUM=1 to install without verifying the checksum, at your own risk.",
+      cause: error2
+    });
+  }
+  if (!response.ok) {
+    if (skipAllowed) return void 0;
+    throw new CliError(
+      `Could not determine the sha256 checksum for cloud-sql-proxy v${asset.version} (GitHub release lookup for ${url} returned HTTP ${response.status}).`,
+      {
+        hint: "Set MERIDIAN_PROXY_SKIP_CHECKSUM=1 to install without verifying the checksum, at your own risk."
+      }
+    );
+  }
+  const rawBody = await response.text();
+  let releaseNotes = rawBody;
+  try {
+    const parsed = JSON.parse(rawBody);
+    if (typeof parsed === "object" && parsed !== null && "body" in parsed && typeof parsed.body === "string") {
+      releaseNotes = parsed.body;
+    }
+  } catch {
+  }
+  const checksum = parseChecksumTable(releaseNotes)[asset.assetName];
+  if (checksum !== void 0) {
+    checksumCache.set(cacheKey, checksum);
+    return checksum;
+  }
+  if (skipAllowed) return void 0;
+  throw new CliError(
+    `Could not find a published sha256 checksum for ${asset.assetName} in the cloud-sql-proxy v${asset.version} release notes.`,
+    { hint: "Set MERIDIAN_PROXY_SKIP_CHECKSUM=1 to install without verifying the checksum, at your own risk." }
+  );
+}
+function parseContentLength(header) {
+  if (header === null) return void 0;
+  const value = Number(header);
+  return Number.isFinite(value) ? value : void 0;
+}
+async function readResponseBody(response, onProgress) {
+  const total = parseContentLength(response.headers.get("content-length"));
+  if (response.body === null) {
+    const buffer = Buffer.from(await response.arrayBuffer());
+    onProgress?.(buffer.byteLength, total);
+    return buffer;
+  }
+  const reader = response.body.getReader();
+  const chunks = [];
+  let received = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (value !== void 0) {
+      chunks.push(value);
+      received += value.byteLength;
+      onProgress?.(received, total);
+    }
+  }
+  return Buffer.concat(chunks);
+}
+async function ensureProxyBinary(options = {}) {
+  const overridePath = process.env.MERIDIAN_PROXY_PATH;
+  if (overridePath !== void 0 && overridePath !== "") {
+    if (!existsSync4(overridePath)) {
+      throw new CliError(`MERIDIAN_PROXY_PATH is set to ${overridePath}, but that file does not exist.`, {
+        hint: "Fix or unset MERIDIAN_PROXY_PATH."
+      });
+    }
+    return overridePath;
+  }
+  const asset = resolveProxyAsset(options.version !== void 0 ? { version: options.version } : {});
+  const dir = options.dir ?? proxyBinDir();
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const targetPath = join4(dir, asset.fileName);
+  mkdirSync4(dir, { recursive: true });
+  if (!options.force && existsSync4(targetPath)) {
+    const cached = readFileSync6(targetPath);
+    const expected2 = await resolveExpectedChecksum(asset, fetchImpl);
+    if (expected2 === void 0 || sha256(cached) === expected2) return targetPath;
+    rmSync2(targetPath, { force: true });
+  }
+  const response = await fetchImpl(asset.downloadUrl);
+  if (!response.ok) {
+    throw new CliError(
+      `Failed to download the Cloud SQL Auth Proxy v${asset.version} from ${asset.downloadUrl} (HTTP ${response.status}).`,
+      {
+        hint: "Check your network connection (and any corporate proxy settings), or set MERIDIAN_PROXY_PATH to a proxy binary you install yourself."
+      }
+    );
+  }
+  const buffer = await readResponseBody(response, options.onProgress);
+  const expected = await resolveExpectedChecksum(asset, fetchImpl);
+  const actual = sha256(buffer);
+  if (expected !== void 0 && actual !== expected) {
+    throw new CliError(
+      `Checksum mismatch for ${asset.assetName}: expected ${expected.slice(0, 12)}..., got ${actual.slice(0, 12)}....`,
+      {
+        hint: "This can happen after a corrupted download or an untrusted network. Try again; if it persists, report this."
+      }
+    );
+  }
+  const tmpPath = join4(dir, `.${asset.fileName}.${process.pid}.tmp`);
+  writeFileSync5(tmpPath, buffer);
+  chmodSync3(tmpPath, 493);
+  renameSync3(tmpPath, targetPath);
+  return targetPath;
+}
+
+// src/lib/proxy/proxy.ts
+import { spawn } from "child_process";
+import { createConnection } from "net";
+var PROBE_INTERVAL_MS = 150;
+var KILL_GRACE_MS = 2e3;
+var CRASH_BACKOFFS_MS = [200, 1e3, 3e3];
+var MAX_CRASH_RESTARTS = CRASH_BACKOFFS_MS.length;
+var REFRESH_RETRY_BACKOFFS_MS = [3e4, 6e4, 12e4];
+var MIN_REFRESH_DELAY_MS = 6e4;
+var LOG_RING_SIZE = 20;
+var STDERR_TAIL_LINES = 10;
+function buildProxyArgs(input2) {
+  return ["--address", input2.host, "--port", String(input2.port), input2.instanceConnectionName];
+}
+function buildProxyEnv(accessToken, base = process.env) {
+  return { ...base, CSQL_PROXY_TOKEN: accessToken };
+}
+function defaultProbe(host, port) {
+  return new Promise((resolve2) => {
+    const socket = createConnection({ host, port });
+    const finish = (ok) => {
+      socket.removeAllListeners();
+      socket.destroy();
+      resolve2(ok);
+    };
+    socket.once("connect", () => finish(true));
+    socket.once("error", () => finish(false));
+    socket.setTimeout(1e3, () => finish(false));
+  });
+}
+function computeRefreshDelayMs(token, refreshSkewMs, assumedLifetimeMs) {
+  let expiresAtMs;
+  if (token.expires_at !== void 0) {
+    const parsed = new Date(token.expires_at).getTime();
+    if (!Number.isNaN(parsed)) expiresAtMs = parsed;
+  }
+  const effectiveExpiryMs = expiresAtMs ?? Date.now() + assumedLifetimeMs;
+  return Math.max(effectiveExpiryMs - Date.now() - refreshSkewMs, MIN_REFRESH_DELAY_MS);
+}
+function buildStartupFailureError(code, signal, lastLines) {
+  const tail = lastLines.slice(-STDERR_TAIL_LINES).join("\n");
+  const lower = tail.toLowerCase();
+  let hint2 = "Run `meridian dev` again; if this keeps happening, check the instance connection name and your network.";
+  if (lower.includes("iam") || lower.includes("permission") || lower.includes("forbidden")) {
+    hint2 = "The Meridian API's service account may be missing roles/cloudsql.client on the dev Cloud SQL instance. Contact Meridian support.";
+  } else if (lower.includes("invalid token") || lower.includes("401") || lower.includes("unauthorized")) {
+    hint2 = "The access token appears to have expired. Retry `meridian dev` to mint a fresh one.";
+  } else if (lower.includes("address already in use")) {
+    hint2 = "Another process is already listening on that port. Free it up, or retry with a different port.";
+  }
+  const summary = `The Cloud SQL Auth Proxy exited before it was ready (code ${code ?? "null"}, signal ${signal ?? "null"}).`;
+  return new CliError(tail === "" ? summary : `${summary}
+${tail}`, { hint: hint2 });
+}
+function waitForReady(child, probeImpl, host, port, timeoutMs, setTimeoutImpl, getLastLines) {
+  return new Promise((resolve2, reject) => {
+    let settled = false;
+    let pollTimer;
+    let timeoutTimer;
+    const cleanup = () => {
+      if (pollTimer !== void 0) clearTimeout(pollTimer);
+      if (timeoutTimer !== void 0) clearTimeout(timeoutTimer);
+      child.off("exit", onExit);
+    };
+    function onExit(code, signal) {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(buildStartupFailureError(code, signal, getLastLines()));
+    }
+    function poll() {
+      if (settled) return;
+      probeImpl(host, port).then((ok) => {
+        if (settled) return;
+        if (ok) {
+          settled = true;
+          cleanup();
+          resolve2();
+        } else {
+          pollTimer = setTimeoutImpl(poll, PROBE_INTERVAL_MS);
+        }
+      }).catch(() => {
+        if (!settled) pollTimer = setTimeoutImpl(poll, PROBE_INTERVAL_MS);
+      });
+    }
+    child.on("exit", onExit);
+    timeoutTimer = setTimeoutImpl(() => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(
+        new CliError(`Timed out after ${timeoutMs}ms waiting for the Cloud SQL Auth Proxy to accept connections.`, {
+          hint: "The instance may be slow to reach, or readyTimeoutMs may need to be raised."
+        })
+      );
+    }, timeoutMs);
+    poll();
+  });
+}
+async function startProxy(options) {
+  const host = options.host ?? "127.0.0.1";
+  const spawnImpl = options.spawnImpl ?? spawn;
+  const probeImpl = options.probeImpl ?? defaultProbe;
+  const setTimeoutImpl = options.setTimeoutImpl ?? setTimeout;
+  const refreshSkewMs = options.refreshSkewMs ?? 5 * 6e4;
+  const assumedLifetimeMs = options.assumedLifetimeMs ?? 55 * 6e4;
+  const readyTimeoutMs = options.readyTimeoutMs ?? 3e4;
+  const emit = (event) => options.onEvent?.(event);
+  let stopped = false;
+  let running = false;
+  let expectingExit = false;
+  let currentToken = options.token;
+  let child;
+  let refreshTimer;
+  let crashTimer;
+  let refreshBackoffIndex = 0;
+  let crashRestartsRemaining = MAX_CRASH_RESTARTS;
+  let attemptCounter = 0;
+  let cleanupFns = [];
+  const knownTokens = /* @__PURE__ */ new Set();
+  const logRing = [];
+  function trackToken(token) {
+    if (token.access_token !== "") knownTokens.add(token.access_token);
+  }
+  function redact(text) {
+    let result = text;
+    for (const token of knownTokens) result = result.split(token).join("<redacted>");
+    return result;
+  }
+  function pushLog(line) {
+    const safeLine = redact(line);
+    logRing.push(safeLine);
+    if (logRing.length > LOG_RING_SIZE) logRing.shift();
+    emit({ type: "log", line: safeLine });
+  }
+  function wireOutput(c) {
+    for (const stream of [c.stdout, c.stderr]) {
+      if (stream === null) continue;
+      let buffer = "";
+      const onData = (chunk) => {
+        buffer += chunk.toString();
+        const lines = buffer.split("\n");
+        buffer = lines.pop() ?? "";
+        for (const line of lines) pushLog(line);
+      };
+      stream.on("data", onData);
+      cleanupFns.push(() => stream.off("data", onData));
+    }
+  }
+  function wireExit(c) {
+    c.once("exit", (code, signal) => {
+      if (child !== c) return;
+      const wasRunning = running;
+      const wasExpected = expectingExit;
+      running = false;
+      expectingExit = false;
+      emit({ type: "exit", code, signal });
+      if (stopped || wasExpected || !wasRunning) return;
+      void handleCrash();
+    });
+  }
+  async function spawnChild() {
+    attemptCounter += 1;
+    emit({ type: "starting", attempt: attemptCounter });
+    const args = buildProxyArgs({
+      instanceConnectionName: options.instanceConnectionName,
+      host,
+      port: options.port
+    });
+    const c = spawnImpl(options.binaryPath, args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      env: buildProxyEnv(currentToken.access_token, options.env)
+    });
+    child = c;
+    wireOutput(c);
+    wireExit(c);
+    try {
+      await waitForReady(c, probeImpl, host, options.port, readyTimeoutMs, setTimeoutImpl, () => logRing.slice());
+    } catch (error2) {
+      expectingExit = true;
+      await killChild(c);
+      if (child === c) child = void 0;
+      throw error2;
+    }
+    emit({ type: "ready", port: options.port });
+  }
+  function killChild(c) {
+    if (c.exitCode !== null || c.signalCode !== null) return Promise.resolve();
+    return new Promise((resolve2) => {
+      let settled = false;
+      let killTimer;
+      const onExit = () => {
+        if (settled) return;
+        settled = true;
+        if (killTimer !== void 0) clearTimeout(killTimer);
+        resolve2();
+      };
+      c.once("exit", onExit);
+      c.kill("SIGTERM");
+      killTimer = setTimeoutImpl(() => {
+        if (!settled) c.kill("SIGKILL");
+      }, KILL_GRACE_MS);
+    });
+  }
+  function scheduleRefresh(token) {
+    if (stopped || options.refreshToken === void 0) return;
+    if (refreshTimer !== void 0) clearTimeout(refreshTimer);
+    const delayMs = computeRefreshDelayMs(token, refreshSkewMs, assumedLifetimeMs);
+    refreshTimer = setTimeoutImpl(() => {
+      refreshTimer = void 0;
+      void handleRefreshFire();
+    }, delayMs);
+  }
+  function scheduleRefreshRetry() {
+    if (stopped) return;
+    const delayMs = REFRESH_RETRY_BACKOFFS_MS[Math.min(refreshBackoffIndex, REFRESH_RETRY_BACKOFFS_MS.length - 1)] ?? 12e4;
+    refreshBackoffIndex += 1;
+    if (refreshTimer !== void 0) clearTimeout(refreshTimer);
+    refreshTimer = setTimeoutImpl(() => {
+      refreshTimer = void 0;
+      void handleRefreshFire();
+    }, delayMs);
+  }
+  async function handleRefreshFire() {
+    if (stopped || options.refreshToken === void 0) return;
+    let newToken;
+    try {
+      newToken = await options.refreshToken();
+    } catch (error2) {
+      emit({ type: "error", message: redact(`Token refresh failed: ${describeError(error2)}`) });
+      scheduleRefreshRetry();
+      return;
+    }
+    if (stopped) return;
+    trackToken(newToken);
+    currentToken = newToken;
+    expectingExit = true;
+    emit({ type: "restarting", reason: "token-refresh" });
+    try {
+      const previous = child;
+      if (previous !== void 0) await killChild(previous);
+      await spawnChild();
+    } catch (error2) {
+      emit({ type: "error", message: redact(`Restart after token refresh failed: ${describeError(error2)}`) });
+      scheduleRefreshRetry();
+      return;
+    }
+    running = true;
+    refreshBackoffIndex = 0;
+    emit({ type: "token-refreshed", ...newToken.expires_at !== void 0 ? { expiresAt: newToken.expires_at } : {} });
+    scheduleRefresh(newToken);
+  }
+  async function handleCrash() {
+    if (stopped) return;
+    if (crashRestartsRemaining <= 0) {
+      const tail = logRing.slice(-STDERR_TAIL_LINES).join("\n");
+      emit({
+        type: "error",
+        message: `The Cloud SQL Auth Proxy crashed repeatedly and could not be restarted.${tail === "" ? "" : `
+${tail}`}`
+      });
+      return;
+    }
+    const attemptIndex = MAX_CRASH_RESTARTS - crashRestartsRemaining;
+    const delayMs = CRASH_BACKOFFS_MS[attemptIndex] ?? (CRASH_BACKOFFS_MS[CRASH_BACKOFFS_MS.length - 1] ?? 3e3);
+    crashRestartsRemaining -= 1;
+    emit({ type: "restarting", reason: "crash" });
+    crashTimer = setTimeoutImpl(() => {
+      crashTimer = void 0;
+      if (stopped) return;
+      spawnChild().then(() => {
+        running = true;
+      }).catch((error2) => {
+        emit({ type: "error", message: redact(describeError(error2)) });
+        void handleCrash();
+      });
+    }, delayMs);
+  }
+  async function refresh() {
+    if (stopped) return;
+    if (options.refreshToken === void 0) {
+      throw new CliError("Cannot refresh the Cloud SQL Auth Proxy token: no refreshToken() was configured.");
+    }
+    if (refreshTimer !== void 0) {
+      clearTimeout(refreshTimer);
+      refreshTimer = void 0;
+    }
+    refreshBackoffIndex = 0;
+    await handleRefreshFire();
+  }
+  async function stop() {
+    if (stopped) return;
+    stopped = true;
+    if (refreshTimer !== void 0) clearTimeout(refreshTimer);
+    refreshTimer = void 0;
+    if (crashTimer !== void 0) clearTimeout(crashTimer);
+    crashTimer = void 0;
+    for (const cleanup of cleanupFns) cleanup();
+    cleanupFns = [];
+    const current2 = child;
+    if (current2 !== void 0) {
+      expectingExit = true;
+      await killChild(current2);
+    }
+    running = false;
+    child = void 0;
+  }
+  trackToken(currentToken);
+  await spawnChild();
+  running = true;
+  scheduleRefresh(currentToken);
+  return {
+    host,
+    port: options.port,
+    instanceConnectionName: options.instanceConnectionName,
+    get running() {
+      return running;
+    },
+    refresh,
+    stop
+  };
+}
+
+// src/lib/signals.ts
+var SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+var SIGNAL_EXIT_CODES = {
+  SIGHUP: 129,
+  SIGINT: 130,
+  SIGTERM: 143
+};
+var FORCE_EXIT_CODE = 130;
+var DEFAULT_HANDLER_TIMEOUT_MS = 8e3;
+var handlers = [];
+var signalListeners;
+var isShuttingDown = false;
+var hasRun = false;
+var exitImpl = (code) => process.exit(code);
+function attachListeners() {
+  if (signalListeners !== void 0) return;
+  const listeners = /* @__PURE__ */ new Map();
+  for (const signal of SIGNALS) {
+    const listener = () => {
+      void handleSignal(signal);
+    };
+    process.on(signal, listener);
+    listeners.set(signal, listener);
+  }
+  signalListeners = listeners;
+}
+function detachListeners() {
+  if (signalListeners === void 0) return;
+  for (const [signal, listener] of signalListeners) {
+    process.off(signal, listener);
+  }
+  signalListeners = void 0;
+}
+async function handleSignal(signal) {
+  if (isShuttingDown) {
+    exitImpl(FORCE_EXIT_CODE);
+    return;
+  }
+  isShuttingDown = true;
+  await runShutdownHandlers({ signal });
+  process.exitCode = exitCodeForSignal(signal);
+}
+function runHandlerWithTimeout(handler, reason, timeoutMs) {
+  return new Promise((resolve2) => {
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      resolve2();
+    }, timeoutMs);
+    timer.unref?.();
+    Promise.resolve().then(() => handler(reason)).catch(() => {
+    }).then(() => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve2();
+    });
+  });
+}
+function onShutdown(handler) {
+  handlers.push(handler);
+  attachListeners();
+  let unregistered = false;
+  return () => {
+    if (unregistered) return;
+    unregistered = true;
+    const index = handlers.indexOf(handler);
+    if (index !== -1) handlers.splice(index, 1);
+    if (handlers.length === 0) detachListeners();
+  };
+}
+async function runShutdownHandlers(reason = {}, timeoutMs = DEFAULT_HANDLER_TIMEOUT_MS) {
+  if (hasRun) return;
+  hasRun = true;
+  const toRun = [...handlers].reverse();
+  for (const handler of toRun) {
+    await runHandlerWithTimeout(handler, reason, timeoutMs);
+  }
+}
+function exitCodeForSignal(signal) {
+  return SIGNAL_EXIT_CODES[signal] ?? 128;
+}
+
+// src/lib/session.ts
+function defaultSleep(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+function resolveDeps(overrides) {
+  return {
+    ensureProxyBinary,
+    startProxy,
+    findFreePort,
+    patchEnvFile,
+    waitForDatabase,
+    sleep: defaultSleep,
+    now: () => Date.now(),
+    ...overrides
+  };
+}
+var DEFAULT_POLL_TIMEOUT_MS = 5 * 6e4;
+var DEFAULT_POLL_INTERVAL_MS = 2e3;
+var NOT_FOUND_GRACE_MS = 3e4;
+var DEFAULT_PORT_START = 3307;
+var DEV_DATABASE_ID_ENV = "MERIDIAN_DEV_DATABASE_ID";
+function provisioningFailedError(devDatabase) {
+  const reason = devDatabase.error_message;
+  const detail2 = typeof reason === "string" && reason.trim() !== "" ? ` ${reason.trim()}` : "";
+  return new CliError(`Provisioning the development database failed.${detail2}`, {
+    hint: "Check the Meridian dashboard for details, or contact support if this keeps happening."
+  });
+}
+function provisioningTimeoutError() {
+  return new CliError("Timed out waiting for the development database to be provisioned.", {
+    hint: "Try `meridian dev` again in a few minutes, and check the Meridian dashboard for its status."
+  });
+}
+function provisioningNotFoundError() {
+  return new CliError("The Meridian API never finished creating the development database.", {
+    hint: "Try `meridian dev` again; if this keeps happening, contact Meridian support."
+  });
+}
+async function pollDevDatabase(client, appId, options, spinner2) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_POLL_TIMEOUT_MS;
+  const intervalMs = options.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+  const sleep = options.sleep ?? defaultSleep;
+  const now = options.now ?? Date.now;
+  const start = now();
+  const report = (status) => {
+    const elapsedMs = now() - start;
+    spinner2.update(`Provisioning the development database... (${status}, ${Math.round(elapsedMs / 1e3)}s)`);
+    options.onStatus?.(status, elapsedMs);
+  };
+  let current2 = await client.ensureDevDatabase(appId);
+  report(current2.status);
+  if (current2.status === "ready") return current2;
+  if (current2.status === "error") throw provisioningFailedError(current2);
+  let notFoundSince;
+  for (; ; ) {
+    if (now() - start >= timeoutMs) throw provisioningTimeoutError();
+    await sleep(intervalMs);
+    const fetched = await client.getDevDatabase(appId);
+    if (fetched === null) {
+      if (notFoundSince === void 0) notFoundSince = now();
+      if (now() - notFoundSince >= NOT_FOUND_GRACE_MS) throw provisioningNotFoundError();
+      report("provisioning");
+      continue;
+    }
+    notFoundSince = void 0;
+    current2 = fetched;
+    report(current2.status);
+    if (current2.status === "ready") return current2;
+    if (current2.status === "error") throw provisioningFailedError(current2);
+  }
+}
+async function ensureDevDatabaseReady(client, appId, options = {}) {
+  return withSpinner(
+    "Provisioning the development database...",
+    (spinner2) => pollDevDatabase(client, appId, options, spinner2),
+    { success: (db) => `Development database "${db.database}" is ready.` }
+  );
+}
+function toProxyToken(token) {
+  return {
+    access_token: token.access_token,
+    ...typeof token.expires_at === "string" ? { expires_at: token.expires_at } : {}
+  };
+}
+function formatMb(bytes) {
+  return (bytes / (1024 * 1024)).toFixed(1);
+}
+function firstNonEmpty(...values) {
+  for (const value of values) {
+    if (typeof value === "string" && value.trim() !== "") return value;
+  }
+  return void 0;
+}
+function devDatabaseIdValue(devDatabase) {
+  return firstNonEmpty(String(devDatabase.id));
+}
+function logEnvPatch(result, databaseUrl, wroteShadow) {
+  const redacted = redactDatabaseUrl(databaseUrl);
+  const names = wroteShadow ? "DATABASE_URL and SHADOW_DATABASE_URL" : "DATABASE_URL";
+  if (result.created) {
+    success(`Created ${result.path} with DATABASE_URL=${redacted}`);
+  } else if (result.changed) {
+    success(`Updated ${names} in ${result.path} (${redacted})`);
+  } else {
+    debug(`${result.path} already has the correct ${names}.`);
+  }
+  if (result.backedUp) detail(`Backed up the previous file to ${result.path}.backup`);
+}
+function handleProxyEvent(event) {
+  switch (event.type) {
+    case "starting":
+      debug(`Starting the Cloud SQL Auth Proxy (attempt ${event.attempt}).`);
+      return;
+    case "ready":
+      debug(`Cloud SQL Auth Proxy listening on port ${event.port}.`);
+      return;
+    case "log":
+      debug(event.line);
+      return;
+    case "token-refreshed":
+      step("Refreshed the Cloud SQL Auth Proxy token.");
+      return;
+    case "restarting":
+      if (event.reason === "crash") warn("The Cloud SQL Auth Proxy crashed; restarting it.");
+      else debug("Restarting the Cloud SQL Auth Proxy with a refreshed token...");
+      return;
+    case "exit":
+      debug(`Cloud SQL Auth Proxy exited (code ${event.code ?? "null"}, signal ${event.signal ?? "null"}).`);
+      return;
+    case "error":
+      warn(`Cloud SQL Auth Proxy error: ${event.message} Restart \`meridian dev\` if the database becomes unreachable.`);
+      return;
+  }
+}
+async function startDevSession(options = {}) {
+  const deps = resolveDeps(options.deps);
+  let proxy;
+  try {
+    const project = options.project ?? requireProject(workingDirectory());
+    if (project.config.skip_datasource_check !== true) assertManagedDatasource(project.root);
+    const client = options.client ?? createApiClient();
+    const appId = project.config.app_id;
+    const devDatabase = await ensureDevDatabaseReady(client, appId, { sleep: deps.sleep, now: deps.now });
+    const credentials = await withSpinner(
+      "Fetching database credentials...",
+      () => client.issueCredentials(appId),
+      {
+        success: (creds) => `Fetched credentials for database "${creds.database}"${typeof creds.expires_at === "string" ? ` (expire ${creds.expires_at})` : ""}.`
+      }
+    );
+    const proxyToken = await withSpinner(
+      "Requesting a Cloud SQL Auth Proxy token...",
+      () => client.issueProxyToken(appId),
+      { success: "Issued a Cloud SQL Auth Proxy token." }
+    );
+    const binaryPath = await withSpinner(
+      "Preparing the Cloud SQL Auth Proxy...",
+      (spinner2) => {
+        const ensureOptions = {
+          onProgress: (received, total) => {
+            spinner2.update(
+              total !== void 0 ? `Downloading the Cloud SQL Auth Proxy... (${formatMb(received)}/${formatMb(total)} MB)` : `Downloading the Cloud SQL Auth Proxy... (${formatMb(received)} MB)`
+            );
+          }
+        };
+        return deps.ensureProxyBinary(ensureOptions);
+      },
+      { success: "Cloud SQL Auth Proxy is ready." }
+    );
+    const findPortOptions = { start: DEFAULT_PORT_START };
+    if (options.port !== void 0) findPortOptions.preferred = options.port;
+    const port = await deps.findFreePort(findPortOptions);
+    if (options.port !== void 0 && port !== options.port) {
+      throw new CliError(`Port ${options.port} is already in use.`, {
+        hint: "Pick a different port with --port, or free up that port and try again."
+      });
+    }
+    const instanceConnectionName = firstNonEmpty(
+      credentials.instance_connection_name,
+      proxyToken.instance_connection_name,
+      devDatabase.instance_connection_name
+    );
+    if (instanceConnectionName === void 0) {
+      throw new CliError("The Meridian API did not return a Cloud SQL instance connection name.", {
+        hint: "Try again, or contact Meridian support if this persists."
+      });
+    }
+    proxy = await withSpinner(
+      `Starting the Cloud SQL Auth Proxy on 127.0.0.1:${port}...`,
+      () => deps.startProxy({
+        binaryPath,
+        instanceConnectionName,
+        token: toProxyToken(proxyToken),
+        port,
+        ...options.refreshToken !== false ? { refreshToken: async () => toProxyToken(await client.issueProxyToken(appId)) } : {},
+        onEvent: handleProxyEvent
+      }),
+      { success: `Cloud SQL Auth Proxy listening on 127.0.0.1:${port}.` }
+    );
+    const connection = connectionInfoFromCredentials(credentials, { host: proxy.host, port: proxy.port });
+    if (options.waitForDb !== false) {
+      await withSpinner(
+        "Waiting for MySQL to accept connections...",
+        () => deps.waitForDatabase(connection),
+        { success: "MySQL is accepting connections." }
+      );
+    }
+    const databaseUrl = buildDatabaseUrl({
+      username: credentials.username,
+      password: credentials.password,
+      port: proxy.port,
+      database: credentials.database
+    });
+    const shadowDatabase = firstNonEmpty(credentials.shadow_database, devDatabase.shadow_database);
+    const shadowDatabaseUrl = shadowDatabase === void 0 ? void 0 : buildDatabaseUrl({
+      username: credentials.username,
+      password: credentials.password,
+      port: proxy.port,
+      database: shadowDatabase
+    });
+    const devDatabaseId = devDatabaseIdValue(devDatabase);
+    let envPatch;
+    if (options.patchEnv !== false) {
+      const envPath = envFilePath(project.root, options.envFile);
+      const patch = {
+        DATABASE_URL: databaseUrl,
+        ...shadowDatabaseUrl !== void 0 ? { SHADOW_DATABASE_URL: shadowDatabaseUrl } : {}
+      };
+      envPatch = deps.patchEnvFile(envPath, patch, { backup: true });
+      logEnvPatch(envPatch, databaseUrl, shadowDatabaseUrl !== void 0);
+    }
+    let unregisterShutdown;
+    const stop = async () => {
+      if (unregisterShutdown !== void 0) {
+        const unregister = unregisterShutdown;
+        unregisterShutdown = void 0;
+        unregister();
+      }
+      if (proxy !== void 0) await proxy.stop();
+    };
+    if (options.handleSignals !== false) {
+      unregisterShutdown = onShutdown(() => stop());
+    }
+    return {
+      project,
+      devDatabase,
+      credentials,
+      connection,
+      databaseUrl,
+      ...shadowDatabaseUrl !== void 0 ? { shadowDatabaseUrl } : {},
+      proxy,
+      env: {
+        ...process.env,
+        DATABASE_URL: databaseUrl,
+        ...shadowDatabaseUrl !== void 0 ? { SHADOW_DATABASE_URL: shadowDatabaseUrl } : {},
+        ...devDatabaseId !== void 0 ? { [DEV_DATABASE_ID_ENV]: devDatabaseId } : {}
+      },
+      ...envPatch !== void 0 ? { envPatch } : {},
+      stop
+    };
+  } catch (error2) {
+    if (proxy !== void 0) {
+      await proxy.stop().catch(() => {
+      });
+    }
+    if (isCliError(error2)) throw error2;
+    throw new CliError(`Failed to start the Meridian development session: ${describeError(error2)}`, { cause: error2 });
+  }
+}
+
+// src/commands/db-shell-repl.ts
+import { accessSync, constants as fsConstants } from "fs";
+import { delimiter as delimiter2, join as join5 } from "path";
+import { createInterface } from "readline";
+function candidateNames(name) {
+  if (process.platform !== "win32") return [name];
+  if (/\.[^./\\]+$/.test(name)) return [name];
+  const pathExt = process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM";
+  const extensions = pathExt.split(";").filter((ext) => ext !== "");
+  return [name, ...extensions.map((ext) => `${name}${ext.toLowerCase()}`)];
+}
+function findExecutable(name) {
+  const pathValue = process.env.PATH ?? "";
+  const dirs = pathValue.split(delimiter2).filter((dir) => dir !== "");
+  const candidates = candidateNames(name);
+  for (const dir of dirs) {
+    for (const candidate of candidates) {
+      const fullPath = join5(dir, candidate);
+      try {
+        accessSync(fullPath, fsConstants.X_OK);
+        return fullPath;
+      } catch {
+        continue;
+      }
+    }
+  }
+  return null;
+}
+function isResultSetHeaderLike(value) {
+  return typeof value === "object" && value !== null && "affectedRows" in value && typeof value.affectedRows === "number";
+}
+function interpretQueryResult(raw) {
+  const first = Array.isArray(raw) ? raw[0] : raw;
+  if (Array.isArray(first)) {
+    return { kind: "rows", rows: first };
+  }
+  if (isResultSetHeaderLike(first)) {
+    return { kind: "write", affectedRows: first.affectedRows };
+  }
+  return { kind: "write", affectedRows: 0 };
+}
+var MAX_CELL_WIDTH = 60;
+function cellText(value) {
+  if (value === null || value === void 0) return "NULL";
+  if (value instanceof Date) return value.toISOString();
+  if (Buffer.isBuffer(value)) return value.toString("hex");
+  return String(value);
+}
+function truncateCell(text) {
+  return text.length > MAX_CELL_WIDTH ? `${text.slice(0, MAX_CELL_WIDTH - 1)}\u2026` : text;
+}
+function formatTable(rows) {
+  if (rows.length === 0) return "(0 rows)";
+  const columns = Object.keys(rows[0] ?? {});
+  const cells = rows.map((row) => columns.map((column) => truncateCell(cellText(row[column]))));
+  const widths = columns.map((column, i) => Math.max(column.length, ...cells.map((row) => row[i]?.length ?? 0)));
+  const renderRow = (values) => values.map((value, i) => value.padEnd(widths[i] ?? 0)).join("  ");
+  const lines = [
+    renderRow(columns),
+    renderRow(widths.map((width) => "-".repeat(width))),
+    ...cells.map((row) => renderRow(row)),
+    `(${rows.length} row${rows.length === 1 ? "" : "s"})`
+  ];
+  return lines.join("\n");
+}
+async function printQueryOutcome(raw, json) {
+  const outcome = interpretQueryResult(raw);
+  if (outcome.kind === "rows") {
+    if (json) printJson(outcome.rows);
+    else printLine(formatTable(outcome.rows));
+    return;
+  }
+  if (json) printJson({ affected_rows: outcome.affectedRows });
+  else printLine(`Query OK, ${outcome.affectedRows} row${outcome.affectedRows === 1 ? "" : "s"} affected.`);
+}
+async function runStatement(connection, connectionInfo, sql, json = false) {
+  try {
+    const raw = await connection.query(sql);
+    await printQueryOutcome(raw, json);
+    return true;
+  } catch (err) {
+    const dbError = toDatabaseError(err, connectionInfo);
+    error(dbError.message);
+    if (dbError.hint !== void 0) hint(dbError.hint);
+    return false;
+  }
+}
+async function executeStatement(connection, connectionInfo, sql, options = {}) {
+  const ok = await runStatement(connection, connectionInfo, sql, options.json === true);
+  return ok ? 0 : 1;
+}
+var EXIT_COMMANDS = /* @__PURE__ */ new Set(["exit", "quit", "\\q"]);
+function runRepl(options) {
+  const { connection, connectionInfo, input: input2, output } = options;
+  const rl = createInterface({ input: input2, output, prompt: `meridian(${connectionInfo.database})> ` });
+  let buffer = "";
+  let settled = false;
+  return new Promise((resolve2) => {
+    const finish = (code) => {
+      if (settled) return;
+      settled = true;
+      rl.close();
+      resolve2(code);
+    };
+    rl.on("line", (line) => {
+      const trimmed = line.trim();
+      if (buffer === "" && EXIT_COMMANDS.has(trimmed.toLowerCase())) {
+        finish(0);
+        return;
+      }
+      buffer = buffer === "" ? line : `${buffer}
+${line}`;
+      if (!trimmed.endsWith(";")) {
+        if (!settled) rl.prompt();
+        return;
+      }
+      const statement = buffer;
+      buffer = "";
+      void runStatement(connection, connectionInfo, statement).then(() => {
+        if (!settled) rl.prompt();
+      });
+    });
+    rl.on("SIGINT", () => {
+      if (buffer !== "") {
+        buffer = "";
+        output.write("\n");
+        if (!settled) rl.prompt();
+      } else {
+        finish(0);
+      }
+    });
+    rl.once("close", () => finish(0));
+    rl.prompt();
+  });
+}
+
+// src/commands/db.ts
+function defaultDbDeps() {
+  return {
+    startDevSession,
+    ensureDevDatabaseReady,
+    createApiClient,
+    runNpx,
+    runProcess,
+    createConnection: createSqlConnection,
+    findExecutable,
+    requireProject
+  };
+}
+function hasSeedConfigured(root) {
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync7(join6(root, "package.json"), "utf8"));
+  } catch {
+    return false;
+  }
+  const prismaSeed = parsed.prisma?.seed;
+  if (typeof prismaSeed === "string" && prismaSeed !== "") return true;
+  const seedScript = parsed.scripts?.seed;
+  return typeof seedScript === "string" && seedScript !== "";
+}
+async function runDbReset(options = {}) {
+  const deps = { ...defaultDbDeps(), ...options.deps };
+  const json = isJsonOutput();
+  const project = deps.requireProject(workingDirectory());
+  const client = deps.createApiClient({});
+  const appId = project.config.app_id;
+  const devDatabase = await deps.ensureDevDatabaseReady(client, appId);
+  const database = devDatabase.database;
+  const confirmed = await confirmDestructive({
+    message: `This will drop every table in ${database}. Type the database name to confirm.`,
+    phrase: database,
+    assumeYes: isAssumeYes(),
+    ...deps.destructiveImpl !== void 0 ? { promptImpl: deps.destructiveImpl } : {}
+  });
+  if (!confirmed) {
+    log("Aborted.");
+    if (json) {
+      printJson({
+        reset: false,
+        database,
+        app_id: appId,
+        migrated: false,
+        seeded: false,
+        aborted: true
+      });
+    }
+    return 0;
+  }
+  await withSpinner(`Resetting ${database}...`, () => client.resetDevDatabase(appId), {
+    success: `Reset ${database}.`
+  });
+  let wantMigrate = options.migrate === true;
+  let wantSeed = options.seed === true;
+  if (!wantMigrate && !wantSeed) {
+    if (isInteractive()) {
+      wantMigrate = await confirmAction({
+        message: "Run `npx prisma migrate deploy` now?",
+        default: false,
+        ...deps.confirmImpl !== void 0 ? { promptImpl: deps.confirmImpl } : {}
+      });
+      if (hasSeedConfigured(project.root)) {
+        wantSeed = await confirmAction({
+          message: "Seed the database now?",
+          default: false,
+          ...deps.confirmImpl !== void 0 ? { promptImpl: deps.confirmImpl } : {}
+        });
+      }
+    } else {
+      hint("Run `npx prisma migrate deploy` and `npx prisma db seed` to finish setting up the database.");
+    }
+  }
+  let migrated = false;
+  let seeded = false;
+  let followUpExitCode = 0;
+  if (wantMigrate || wantSeed) {
+    let session;
+    try {
+      session = await deps.startDevSession({
+        ...options.port !== void 0 ? { port: options.port } : {},
+        ...options.envFile !== void 0 ? { envFile: options.envFile } : {}
+      });
+      if (wantMigrate) {
+        const result = await deps.runNpx(["prisma", "migrate", "deploy"], {
+          cwd: session.project.root,
+          env: session.env,
+          inherit: true
+        });
+        migrated = result.code === 0;
+        if (result.code !== 0) {
+          error(`\`npx prisma migrate deploy\` exited with code ${result.code}.`);
+          followUpExitCode = result.code;
+        }
+      }
+      if (followUpExitCode === 0 && wantSeed) {
+        const result = await deps.runNpx(["prisma", "db", "seed"], {
+          cwd: session.project.root,
+          env: session.env,
+          inherit: true
+        });
+        seeded = result.code === 0;
+        if (result.code !== 0) {
+          error(`\`npx prisma db seed\` exited with code ${result.code}.`);
+          hint("Make sure `prisma.seed` (or your Prisma 6 seed config) is set in package.json.");
+          followUpExitCode = result.code;
+        }
+      }
+    } finally {
+      if (session !== void 0) await session.stop();
+    }
+  }
+  if (json) {
+    printJson({ reset: true, database, app_id: appId, migrated, seeded, aborted: false });
+  }
+  return followUpExitCode;
+}
+async function runDbSeed(options = {}) {
+  const deps = { ...defaultDbDeps(), ...options.deps };
+  const json = isJsonOutput();
+  let session;
+  try {
+    session = await deps.startDevSession({
+      ...options.port !== void 0 ? { port: options.port } : {},
+      ...options.envFile !== void 0 ? { envFile: options.envFile } : {}
+    });
+    const args = ["prisma", "db", "seed", ...options.extraArgs ?? []];
+    const result = await deps.runNpx(args, {
+      cwd: session.project.root,
+      env: session.env,
+      inherit: true
+    });
+    if (result.code === 0) {
+      success("Seeded the development database.");
+    } else {
+      error(`\`npx prisma db seed\` exited with code ${result.code}.`);
+      hint("Make sure `prisma.seed` (or your Prisma 6 seed config) is set in package.json.");
+    }
+    if (json) printJson({ seeded: result.code === 0, exit_code: result.code });
+    return result.code;
+  } finally {
+    if (session !== void 0) await session.stop();
+  }
+}
+async function runDbShell(options = {}) {
+  const deps = { ...defaultDbDeps(), ...options.deps };
+  const json = isJsonOutput();
+  let session;
+  try {
+    session = await deps.startDevSession({
+      waitForDb: true,
+      ...options.port !== void 0 ? { port: options.port } : {},
+      ...options.envFile !== void 0 ? { envFile: options.envFile } : {},
+      ...options.env === false ? { patchEnv: false } : {}
+    });
+    const info = session.connection;
+    const wantRepl = options.repl === true;
+    const mysqlPath = wantRepl ? null : deps.findExecutable(process.platform === "win32" ? "mysql.exe" : "mysql");
+    if (mysqlPath !== null) {
+      step(`Connecting to ${style.bold(info.database)} on ${info.host}:${info.port} with the mysql client...`);
+      const args = ["--host", info.host, "--port", String(info.port), "--user", info.user, "--database", info.database];
+      if (options.execute !== void 0) args.push(`--execute=${options.execute}`);
+      const env = { ...session.env, MYSQL_PWD: info.password };
+      const result = await deps.runProcess(mysqlPath, args, { cwd: session.project.root, env, inherit: true });
+      return result.code;
+    }
+    step(`Connecting to ${style.bold(info.database)} on ${info.host}:${info.port}...`);
+    return await withConnection(
+      info,
+      async (connection) => {
+        if (options.execute !== void 0) {
+          return executeStatement(connection, info, options.execute, { json });
+        }
+        return runRepl({ connection, connectionInfo: info, input: process.stdin, output: process.stdout });
+      },
+      { factory: deps.createConnection }
+    );
+  } finally {
+    if (session !== void 0) await session.stop();
+  }
+}
+async function runAndSetExitCode(fn) {
+  const code = await fn();
+  if (code !== 0) process.exitCode = code;
+}
+function registerDbCommand(program) {
+  const db = program.command("db").description("Manage the Meridian-managed MySQL development database: reset, seed, or open a SQL shell.");
+  db.action(() => {
+    db.outputHelp();
+  });
+  db.command("reset").description("Drop and recreate every table in the development database (keeps the MySQL user).").option("--migrate", "run `npx prisma migrate deploy` afterwards, without asking").option("--seed", "run `npx prisma db seed` afterwards, without asking").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to update (defaults to .env)").action(async (opts) => {
+    await runAndSetExitCode(
+      () => runDbReset({
+        ...opts.migrate === true ? { migrate: true } : {},
+        ...opts.seed === true ? { seed: true } : {},
+        ...opts.port !== void 0 ? { port: opts.port } : {},
+        ...opts.envFile !== void 0 ? { envFile: opts.envFile } : {}
+      })
+    );
+  });
+  db.command("seed").description("Run `npx prisma db seed` with the Cloud SQL Auth Proxy up and DATABASE_URL set.").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to update (defaults to .env)").passThroughOptions().argument("[args...]", "extra arguments forwarded to `npx prisma db seed` (put them after `--`)").action(async (args, opts) => {
+    await runAndSetExitCode(
+      () => runDbSeed({
+        ...opts.port !== void 0 ? { port: opts.port } : {},
+        ...opts.envFile !== void 0 ? { envFile: opts.envFile } : {},
+        ...args.length > 0 ? { extraArgs: args } : {}
+      })
+    );
+  });
+  db.command("shell").description("Open a SQL shell against the development database (the `mysql` client if available, otherwise a built-in REPL).").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to read/patch (defaults to .env)").option("--repl", "force the built-in SQL REPL even when `mysql` is on PATH").option("-e, --execute <sql>", "run one SQL statement and exit").option("--no-env", "do not patch DATABASE_URL into the project's .env file").action(async (opts) => {
+    await runAndSetExitCode(
+      () => runDbShell({
+        ...opts.port !== void 0 ? { port: opts.port } : {},
+        ...opts.envFile !== void 0 ? { envFile: opts.envFile } : {},
+        ...opts.repl === true ? { repl: true } : {},
+        ...opts.execute !== void 0 ? { execute: opts.execute } : {},
+        ...opts.env === false ? { env: false } : {}
+      })
+    );
+  });
+}
+
+// src/commands/dev.ts
+function defaultDeps() {
+  return { startDevSession, startProcess, readPackageScript, requireProject };
+}
+var RECURSION_HINT = "Set `dev_command` in `.meridian/project.json` to the underlying command (e.g. `next dev`), or run `meridian dev -- next dev` to bypass the script entirely.";
+function selfInvokingScriptError() {
+  return new CliError('This project\'s "dev" script runs `meridian dev`, which would start it again in a loop.', {
+    hint: RECURSION_HINT
+  });
+}
+function nestedSessionError() {
+  return new CliError("`meridian dev` is already running in this process tree.", {
+    hint: `Use the dev server that session started, or stop it first. ${RECURSION_HINT}`
+  });
+}
+function scriptReentersMeridianDev(script) {
+  try {
+    assertNotSelfInvoking(script);
+    return false;
+  } catch {
+    return true;
+  }
+}
+function resolvePassthroughCommand(argv) {
+  const [command, ...args] = argv;
+  return { command, args, display: argv.join(" ") };
+}
+function resolveConfiguredCommand(devCommand) {
+  assertNotSelfInvoking(devCommand);
+  const { command, args } = parseCommandString(devCommand);
+  return { command, args, display: devCommand };
+}
+function noDevScriptError() {
+  return new CliError('This project has no "dev" script.', {
+    hint: "Run `meridian dev -- <your command>`, or set `dev_command` in `.meridian/project.json`."
+  });
+}
+function resolveDefaultCommand(deps, root) {
+  const script = deps.readPackageScript(root, "dev");
+  if (script === null) throw noDevScriptError();
+  if (scriptReentersMeridianDev(script)) throw selfInvokingScriptError();
+  const display = "npm run dev";
+  assertNotSelfInvoking(display);
+  return { command: "npm", args: ["run", "dev"], display };
+}
+function resolveDevCommand(deps, project, passthrough) {
+  if (passthrough !== void 0 && passthrough.length > 0) return resolvePassthroughCommand(passthrough);
+  if (project.config.dev_command !== void 0) return resolveConfiguredCommand(project.config.dev_command);
+  return resolveDefaultCommand(deps, project.root);
+}
+function appLabel(project) {
+  return project.config.app_name ?? String(project.config.app_id);
+}
+function printDevSummary(session, noEnv) {
+  const envEntry = noEnv ? "not touched (--no-env)" : session.envPatch !== void 0 ? session.envPatch.path : "unchanged";
+  const entries = [
+    ["App", appLabel(session.project)],
+    ["Database", session.devDatabase.database],
+    ["Proxy", `127.0.0.1:${session.proxy.port}`],
+    ["Env file", envEntry],
+    ["DATABASE_URL", redactDatabaseUrl(session.databaseUrl)]
+  ];
+  if (typeof session.credentials.expires_at === "string") {
+    entries.push(["Credentials expire", session.credentials.expires_at]);
+  }
+  log();
+  keyValues(entries);
+  log();
+}
+function buildDevJsonPayload(session) {
+  return {
+    app: appLabel(session.project),
+    database: session.devDatabase.database,
+    proxy: { host: session.proxy.host, port: session.proxy.port },
+    database_url: redactDatabaseUrl(session.databaseUrl),
+    env_file: session.envPatch?.path ?? null,
+    credentials_expire_at: session.credentials.expires_at ?? null
+  };
+}
+async function runDev(options = {}) {
+  const deps = { ...defaultDeps(), ...options.deps };
+  if (isInsideDevSession()) throw nestedSessionError();
+  const project = deps.requireProject(workingDirectory());
+  const resolved = resolveDevCommand(deps, project, options.command);
+  const json = isJsonOutput();
+  const sessionOptions = {
+    project,
+    patchEnv: options.noEnv !== true,
+    ...options.port !== void 0 ? { port: options.port } : {},
+    ...options.envFile !== void 0 ? { envFile: options.envFile } : {}
+  };
+  const session = await deps.startDevSession(sessionOptions);
+  let unregisterShutdown;
+  try {
+    if (json) {
+      printJson(buildDevJsonPayload(session));
+    } else {
+      printDevSummary(session, options.noEnv === true);
+      step(`Starting ${resolved.display}...`);
+    }
+    const child = deps.startProcess(resolved.command, resolved.args, {
+      cwd: project.root,
+      env: session.env,
+      inherit: true
+    });
+    unregisterShutdown = onShutdown(async () => {
+      await child.stop();
+      await session.stop();
+    });
+    const result = await child.exited;
+    unregisterShutdown();
+    unregisterShutdown = void 0;
+    await session.stop();
+    if (result.signal !== null) return exitCodeForSignal(result.signal);
+    if (result.code !== 0) log(style.dim(`${resolved.display} exited with code ${result.code}.`));
+    return result.code;
+  } catch (error2) {
+    unregisterShutdown?.();
+    await session.stop().catch(() => {
+    });
+    throw error2;
+  }
+}
+function registerDevCommand(program) {
+  program.command("dev").description("Run the managed dev database proxy and your app's dev server together.").option("--port <port>", "preferred local port for the Cloud SQL Auth Proxy").option("--env-file <file>", "the .env file to patch, relative to the project root (default .env)").option("--no-env", "don't touch any .env file; just print the DATABASE_URL for manual use").argument("[command...]", "run this instead of the app's dev script, e.g. `meridian dev -- next dev`").passThroughOptions().action(async (command, opts) => {
+    const port = parsePortOption(opts.port);
+    const code = await runDev({
+      ...command.length > 0 ? { command } : {},
+      ...port !== void 0 ? { port } : {},
+      ...opts.envFile !== void 0 ? { envFile: opts.envFile } : {},
+      ...opts.env === false ? { noEnv: true } : {}
+    });
+    process.exitCode = code;
+  });
+}
+
+// src/commands/link.ts
+import { existsSync as existsSync5 } from "fs";
+import { join as join7 } from "path";
+function defaultDeps2() {
+  return { createClient: createApiClient };
+}
+function formatOrg(org) {
+  return `${org.name} (${org.slug})`;
+}
+function formatApp(app) {
+  return `${app.name} (${app.slug})`;
+}
+function resolveChoiceAnswer(choices, raw, keysOf) {
+  const target = raw.trim().toLowerCase();
+  const match = choices.find((choice) => keysOf(choice.value).some((key) => key.toLowerCase() === target));
+  return match !== void 0 ? match.name : raw;
+}
+async function runLink(options = {}) {
+  const deps = { ...defaultDeps2(), ...options.deps };
+  const json = isJsonOutput();
+  const root = resolveProjectRoot(workingDirectory()) ?? workingDirectory();
+  if (!existsSync5(join7(root, "package.json"))) {
+    log(`No package.json found in ${style.path(root)}.`);
+    const proceed = await confirmAction({
+      message: "Link this directory to a Meridian app anyway?",
+      flag: "--force",
+      ...options.force === true ? { assumeYes: true } : {},
+      ...deps.confirmImpl !== void 0 ? { promptImpl: deps.confirmImpl } : {}
+    });
+    if (!proceed) throw new CliError("Aborted.");
+  }
+  const existing = readProject(root);
+  if (existing !== null) {
+    log("This directory is already linked:");
+    keyValues([
+      ["App", existing.config.app_name ?? String(existing.config.app_id)],
+      ["Org", String(existing.config.org_id)]
+    ]);
+    const relink = await confirmAction({
+      message: "Re-link this project?",
+      flag: "--force",
+      ...options.force === true ? { assumeYes: true } : {},
+      ...deps.confirmImpl !== void 0 ? { promptImpl: deps.confirmImpl } : {}
+    });
+    if (!relink) throw new CliError("Aborted.");
+  }
+  const client = deps.createClient({});
+  const me = await client.getMe();
+  const orgs = me.orgs;
+  if (orgs.length === 0) {
+    throw new CliError("Your Meridian account has no organizations yet.", {
+      hint: "Create one in the Meridian dashboard, then run `meridian link` again."
+    });
+  }
+  const orgChoices = orgs.map((org2) => ({ value: org2, name: formatOrg(org2) }));
+  const orgCandidate = options.org ?? process.env.MERIDIAN_ORG;
+  const orgAnswer = orgCandidate !== void 0 ? resolveChoiceAnswer(orgChoices, orgCandidate, (org2) => [String(org2.id), org2.name, org2.slug]) : void 0;
+  const org = await selectOne({
+    message: "Select an organization",
+    choices: orgChoices,
+    envVar: "MERIDIAN_ORG",
+    flag: "--org",
+    ...orgAnswer !== void 0 ? { answer: orgAnswer } : {},
+    ...deps.selectImpl !== void 0 ? { promptImpl: deps.selectImpl } : {}
+  });
+  log(`Organization: ${style.bold(formatOrg(org))}`);
+  const apps = await client.listApps(org.id);
+  if (apps.length === 0) {
+    throw new CliError(`Organization "${org.name}" has no apps yet.`, {
+      hint: "Create an app in the Meridian dashboard, then run `meridian link` again."
+    });
+  }
+  const appChoices = apps.map((app2) => ({ value: app2, name: formatApp(app2) }));
+  const appCandidate = options.app ?? process.env.MERIDIAN_APP;
+  const appAnswer = appCandidate !== void 0 ? resolveChoiceAnswer(appChoices, appCandidate, (app2) => [String(app2.id), app2.name, app2.slug]) : void 0;
+  const app = await selectOne({
+    message: "Select an app",
+    choices: appChoices,
+    envVar: "MERIDIAN_APP",
+    flag: "--app",
+    ...appAnswer !== void 0 ? { answer: appAnswer } : {},
+    ...deps.selectImpl !== void 0 ? { promptImpl: deps.selectImpl } : {}
+  });
+  log(`App: ${style.bold(formatApp(app))}`);
+  const config = {
+    org_id: org.id,
+    app_id: app.id,
+    app_name: app.name,
+    ...options.devCommand !== void 0 ? { dev_command: options.devCommand } : {}
+  };
+  writeProject(root, config);
+  if (json) {
+    printJson({ ...config, root });
+    return;
+  }
+  success(`Linked ${style.path(root)} to ${app.name}.`);
+  keyValues([
+    ["Org", formatOrg(org)],
+    ["App", formatApp(app)],
+    ["Root", root]
+  ]);
+  log();
+  hint("Run `meridian dev` to start your local dev server against the managed database.");
+}
+function registerLinkCommand(program) {
+  program.command("link").description("Link this project to a Meridian organization and app.").option("--org <idOrName>", "organization to link (id, name, or slug)").option("--app <idOrName>", "app to link (id, name, or slug)").option("--dev-command <cmd>", "override the command `meridian dev` runs (defaults to `npm run dev`)").option("--force", "overwrite an existing link, and skip the missing-package.json warning, without prompting").action(async (opts) => {
+    await runLink({
+      ...opts.org !== void 0 ? { org: opts.org } : {},
+      ...opts.app !== void 0 ? { app: opts.app } : {},
+      ...opts.devCommand !== void 0 ? { devCommand: opts.devCommand } : {},
+      ...opts.force === true ? { force: true } : {}
+    });
+  });
+}
+
+// src/commands/login.ts
+import { hostname as osHostname3 } from "os";
+
+// src/auth/device-flow.ts
+import { hostname as osHostname2 } from "os";
+var DEFAULT_CLIENT_NAME2 = "meridian-cli";
+var DEFAULT_INTERVAL_SECONDS = 5;
+var DEFAULT_EXPIRES_IN_SECONDS = 900;
+var SLOW_DOWN_INCREMENT_MS = 5e3;
+var MAX_CONSECUTIVE_TRANSIENT_FAILURES = 3;
+var DEFAULT_MAX_WAIT_MS = 15 * 60 * 1e3;
+function defaultSleep2(ms) {
+  return new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+function deniedError() {
+  return new CliError("Authorization was denied in the browser.", {
+    hint: "Run `meridian login` again if you want to retry."
+  });
+}
+function expiredError(expiresInSeconds) {
+  const minutes = Math.max(1, Math.round(expiresInSeconds / 60));
+  return new CliError("The login request expired before it was approved.", {
+    hint: `Run \`meridian login\` again and approve it in the browser within ${minutes} minute${minutes === 1 ? "" : "s"}.`
+  });
+}
+function timedOutError() {
+  return new CliError("Timed out waiting for the login to be approved.", {
+    hint: "Run `meridian login` again and approve the request promptly in the browser."
+  });
+}
+function invalidGrantError() {
+  return new CliError("This login request is no longer valid.", {
+    hint: "Run `meridian login` again to start a new one."
+  });
+}
+function isTransientFailure(error2) {
+  if (isApiError(error2)) return error2.status >= 500;
+  return isCliError(error2);
+}
+async function runDeviceFlow(options) {
+  const { client } = options;
+  const sleep = options.sleep ?? defaultSleep2;
+  const now = options.now ?? Date.now;
+  const maxWaitMs = options.maxWaitMs ?? DEFAULT_MAX_WAIT_MS;
+  const code = await client.requestDeviceCode({
+    clientName: options.clientName ?? DEFAULT_CLIENT_NAME2,
+    hostname: options.hostname ?? osHostname2()
+  });
+  await options.onCode?.(code);
+  const expiresInSeconds = code.expires_in ?? DEFAULT_EXPIRES_IN_SECONDS;
+  let intervalMs = Math.max(1, code.interval ?? DEFAULT_INTERVAL_SECONDS) * 1e3;
+  const start = now();
+  const deadline = Math.min(start + expiresInSeconds * 1e3, start + maxWaitMs);
+  let attempt = 1;
+  let consecutiveFailures = 0;
+  while (true) {
+    if (now() >= deadline) throw timedOutError();
+    options.onPoll?.(attempt);
+    try {
+      return await client.pollDeviceTokenOnce(code.device_code);
+    } catch (error2) {
+      if (isApiError(error2)) {
+        if (error2.errorCode === "authorization_pending") {
+          consecutiveFailures = 0;
+          await sleep(intervalMs);
+          attempt += 1;
+          continue;
+        }
+        if (error2.errorCode === "slow_down" || error2.status === 429) {
+          intervalMs += SLOW_DOWN_INCREMENT_MS;
+          options.onSlowDown?.(intervalMs);
+          consecutiveFailures = 0;
+          await sleep(intervalMs);
+          attempt += 1;
+          continue;
+        }
+        if (error2.errorCode === "access_denied") throw deniedError();
+        if (error2.errorCode === "expired_token") throw expiredError(expiresInSeconds);
+        if (error2.errorCode === "invalid_grant") throw invalidGrantError();
+      }
+      if (!isTransientFailure(error2)) throw error2;
+      consecutiveFailures += 1;
+      if (consecutiveFailures > MAX_CONSECUTIVE_TRANSIENT_FAILURES) throw error2;
+      await sleep(intervalMs);
+      attempt += 1;
+    }
+  }
+}
+function formatUserCode(code) {
+  const cleaned = code.trim().toUpperCase().replace(/[^A-Z0-9]/g, "");
+  if (cleaned.length === 8) return `${cleaned.slice(0, 4)}-${cleaned.slice(4)}`;
+  return cleaned;
+}
+
+// src/commands/login.ts
+async function defaultOpenUrl(url) {
+  const { default: open } = await import("open");
+  await open(url);
+}
+function defaultDeps3() {
+  return { createClient: createApiClient, runDeviceFlow, openUrl: defaultOpenUrl };
+}
+function shouldOpenBrowser(noBrowser) {
+  if (noBrowser === true) return false;
+  if (process.env.MERIDIAN_NO_BROWSER) return false;
+  if (process.env.CI) return false;
+  return isInteractive();
+}
+function toConfigUser(user) {
+  return { id: user.id, name: user.name, email: user.email };
+}
+function printLoginJson(user, tokenExpiresAt, apiBaseUrl) {
+  printJson({ user, token_expires_at: tokenExpiresAt, api_base_url: apiBaseUrl });
+}
+function hintUnlessLinked(json) {
+  if (json) return;
+  if (readProject(workingDirectory()) !== null) return;
+  hint("Run `meridian link` to connect this project to a Meridian app.");
+}
+async function runLogin(options = {}) {
+  const deps = { ...defaultDeps3(), ...options.deps };
+  const json = isJsonOutput();
+  if (options.force !== true) {
+    const auth = getAuth();
+    if (auth !== null) {
+      const client2 = deps.createClient({ requireAuth: false, token: auth.token });
+      try {
+        const me = await client2.getMe();
+        const user2 = toConfigUser(me.user);
+        updateConfig({ user: user2 });
+        if (json) {
+          printLoginJson(user2, auth.tokenExpiresAt, client2.baseUrl);
+        } else {
+          log(`Already logged in as ${user2.name} <${user2.email}>`);
+          hint("Run `meridian login --force` to re-authenticate.");
+        }
+        return;
+      } catch (error2) {
+        if (!(isApiError(error2) && error2.status === 401)) throw error2;
+      }
+    }
+  }
+  const client = deps.createClient({ requireAuth: false });
+  const hostname = options.hostname ?? osHostname3();
+  const wait = spinner("Waiting for approval in the browser\u2026");
+  const startedAt = Date.now();
+  const tokenResponse = await deps.runDeviceFlow({
+    client,
+    hostname,
+    onCode: async (code) => {
+      const target = code.verification_uri_complete ?? code.verification_uri;
+      if (!json) {
+        log();
+        log(`  ${style.bold(formatUserCode(code.user_code))}`);
+        log();
+        log(`Visit: ${style.path(code.verification_uri)}`);
+        log("Waiting for you to approve this login in the browser\u2026");
+      }
+      let opened = false;
+      if (shouldOpenBrowser(options.noBrowser)) {
+        try {
+          await deps.openUrl(target);
+          opened = true;
+        } catch {
+          warn("Could not open the browser automatically.");
+        }
+      }
+      if (!opened && !json) log(`Open this URL to continue: ${style.path(target)}`);
+      if (!json) wait.start();
+    },
+    onPoll: () => {
+      const elapsedSeconds = Math.round((Date.now() - startedAt) / 1e3);
+      wait.update(`Waiting for approval in the browser\u2026 (${elapsedSeconds}s)`);
+    }
+  });
+  wait.stop();
+  const user = toConfigUser(tokenResponse.user);
+  const storeApiBaseUrl = client.baseUrl !== DEFAULT_API_BASE_URL;
+  updateConfig({
+    token: tokenResponse.token,
+    ...tokenResponse.expires_at !== void 0 ? { token_expires_at: tokenResponse.expires_at } : {},
+    user,
+    ...storeApiBaseUrl ? { api_base_url: client.baseUrl } : {}
+  });
+  if (json) {
+    printLoginJson(user, tokenResponse.expires_at, client.baseUrl);
+  } else {
+    success(`Logged in as ${user.name} <${user.email}>`);
+    hintUnlessLinked(json);
+  }
+}
+function registerLoginCommand(program) {
+  program.command("login").description("Authenticate this machine with Meridian via a device-code login in your browser.").option("--force", "re-authenticate even when a valid token is already stored").option("--no-browser", "print the verification URL instead of opening it").option("--hostname <name>", "hostname reported to Meridian for this device (defaults to the machine hostname)").action(async (opts) => {
+    await runLogin({
+      ...opts.force === true ? { force: true } : {},
+      ...opts.browser === false ? { noBrowser: true } : {},
+      ...typeof opts.hostname === "string" ? { hostname: opts.hostname } : {}
+    });
+  });
+}
+
+// src/commands/logout.ts
+async function runLogout() {
+  const hadToken = clearAuth();
+  if (isJsonOutput()) {
+    printJson({ logged_out: hadToken });
+    return;
+  }
+  if (hadToken) success("Logged out.");
+  else log("You were not logged in.");
+  hint("`.meridian/project.json` is untouched; run `meridian unlink` to remove a linked project.");
+}
+function registerLogoutCommand(program) {
+  program.command("logout").description("Clear the Meridian CLI token stored on this machine.").action(async () => {
+    await runLogout();
+  });
+}
+
+// src/lib/db/snapshot.ts
+import { mkdir, readFile, readdir, rm, stat } from "fs/promises";
+import { join as join8 } from "path";
+function snapshotFileName(date = /* @__PURE__ */ new Date()) {
+  return `${date.toISOString().replace(/[:.]/g, "-")}.sql`;
+}
+var SKIP_SNAPSHOT_HINT = "Re-run with --skip-snapshot to bypass snapshotting (not recommended before a schema-changing migration).";
+async function loadMysqldump() {
+  const mod = await import("mysqldump");
+  const dump = mod.default.default ?? mod.default;
+  return dump;
+}
+async function createSnapshot(info, options) {
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const createdAt = now();
+  const tables = await countTables(info, options.factory);
+  if (tables === 0) {
+    return { path: null, bytes: 0, createdAt, tables: 0 };
+  }
+  const dump = options.dumpImpl ?? await loadMysqldump();
+  await mkdir(options.dir, { recursive: true });
+  const path = join8(options.dir, snapshotFileName(createdAt));
+  try {
+    await dump({
+      connection: {
+        host: info.host,
+        port: info.port,
+        user: info.user,
+        password: info.password,
+        database: info.database
+      },
+      dumpToFile: path,
+      dump: {
+        schema: { table: { ifNotExist: false, dropIfExist: true }, engine: false },
+        data: { format: false, verbose: false },
+        trigger: {}
+      }
+    });
+  } catch (error2) {
+    throw new CliError(`Could not snapshot the development database: ${describeError(error2)}`, {
+      hint: SKIP_SNAPSHOT_HINT,
+      cause: error2
+    });
+  }
+  let bytes;
+  try {
+    bytes = (await stat(path)).size;
+  } catch (error2) {
+    throw new CliError("Could not snapshot the development database: the dump did not produce a file.", {
+      hint: SKIP_SNAPSHOT_HINT,
+      cause: error2
+    });
+  }
+  if (bytes === 0) {
+    throw new CliError("Could not snapshot the development database: the dump produced an empty file.", {
+      hint: SKIP_SNAPSHOT_HINT
+    });
+  }
+  return { path, bytes, createdAt, tables };
+}
+function quoteSqlString(value) {
+  return `'${value.replace(/\\/g, "\\\\").replace(/'/g, "''")}'`;
+}
+function readCount(result) {
+  const groups = Array.isArray(result) ? result : [result];
+  for (const group of groups) {
+    const rows = Array.isArray(group) ? group : [group];
+    for (const row of rows) {
+      if (typeof row === "object" && row !== null && "count" in row) {
+        const parsed = Number(row.count);
+        if (Number.isFinite(parsed)) return parsed;
+      }
+    }
+  }
+  return void 0;
+}
+async function countTables(info, factory = createSqlConnection) {
+  let connection;
+  try {
+    connection = await factory(info);
+  } catch {
+    return 1;
+  }
+  try {
+    const result = await connection.query(
+      `SELECT COUNT(*) AS \`count\` FROM information_schema.tables WHERE table_schema = ${quoteSqlString(info.database)}`
+    );
+    return readCount(result) ?? 1;
+  } catch {
+    return 1;
+  } finally {
+    try {
+      await connection.end();
+    } catch {
+      connection.destroy?.();
+    }
+  }
+}
+async function restoreSnapshot(info, snapshotPath, options = {}) {
+  const factory = options.factory ?? createSqlConnection;
+  const sql = await readFile(snapshotPath, "utf8");
+  const statements = splitSqlStatements(sql);
+  const connection = await factory(info, { multipleStatements: true });
+  try {
+    await connection.query("SET FOREIGN_KEY_CHECKS=0");
+    await connection.query("SET SQL_MODE='NO_AUTO_VALUE_ON_ZERO'");
+    for (const [index, statement] of statements.entries()) {
+      try {
+        await connection.query(statement);
+      } catch (error2) {
+        throw new CliError(
+          `Snapshot replay failed at statement ${index + 1} of ${statements.length}: ${statement.slice(0, 200)}`,
+          {
+            hint: `Inspect the failure, then replay the snapshot by hand with \`mysql < ${snapshotPath}\`.`,
+            cause: error2
+          }
+        );
+      }
+      options.onProgress?.(index + 1, statements.length);
+    }
+    await connection.query("SET FOREIGN_KEY_CHECKS=1");
+  } finally {
+    await connection.end();
+  }
+  return { statements: statements.length };
+}
+function splitSqlStatements(sql) {
+  const statements = [];
+  let delimiter3 = ";";
+  let buffer = "";
+  let i = 0;
+  const n = sql.length;
+  const flush = () => {
+    const trimmed = buffer.trim();
+    buffer = "";
+    if (trimmed !== "") statements.push(trimmed);
+  };
+  while (i < n) {
+    if (buffer.trim() === "" && sql.slice(i, i + 10).toUpperCase() === "DELIMITER ") {
+      const lineEnd = sql.indexOf("\n", i);
+      const line = lineEnd === -1 ? sql.slice(i) : sql.slice(i, lineEnd);
+      const newDelimiter = line.slice("DELIMITER".length).trim();
+      if (newDelimiter !== "") {
+        delimiter3 = newDelimiter;
+        buffer = "";
+        i = lineEnd === -1 ? n : lineEnd + 1;
+        continue;
+      }
+    }
+    const ch = sql[i];
+    if (ch === "-" && sql[i + 1] === "-" && (sql[i + 2] === void 0 || /\s/.test(sql[i + 2] ?? ""))) {
+      const lineEnd = sql.indexOf("\n", i);
+      i = lineEnd === -1 ? n : lineEnd + 1;
+      buffer += "\n";
+      continue;
+    }
+    if (ch === "#") {
+      const lineEnd = sql.indexOf("\n", i);
+      i = lineEnd === -1 ? n : lineEnd + 1;
+      buffer += "\n";
+      continue;
+    }
+    if (ch === "/" && sql[i + 1] === "*") {
+      const isExecutableHint = sql[i + 2] === "!";
+      const end = sql.indexOf("*/", i + 2);
+      const commentEnd = end === -1 ? n : end + 2;
+      buffer += isExecutableHint ? sql.slice(i, commentEnd) : " ";
+      i = commentEnd;
+      continue;
+    }
+    if (ch === "'" || ch === '"' || ch === "`") {
+      const quote = ch;
+      let j = i + 1;
+      let text = ch;
+      while (j < n) {
+        const c = sql[j];
+        if (c === "\\" && quote !== "`") {
+          text += sql.slice(j, j + 2);
+          j += 2;
+          continue;
+        }
+        if (c === quote) {
+          if (sql[j + 1] === quote) {
+            text += quote + quote;
+            j += 2;
+            continue;
+          }
+          text += quote;
+          j += 1;
+          break;
+        }
+        text += c;
+        j += 1;
+      }
+      buffer += text;
+      i = j;
+      continue;
+    }
+    if (sql.startsWith(delimiter3, i)) {
+      flush();
+      i += delimiter3.length;
+      continue;
+    }
+    buffer += ch;
+    i += 1;
+  }
+  flush();
+  return statements;
+}
+function isEnoent5(error2) {
+  return typeof error2 === "object" && error2 !== null && "code" in error2 && error2.code === "ENOENT";
+}
+function parseSnapshotDate(name) {
+  const iso = name.replace(/\.sql$/, "").replace(/T(\d\d)-(\d\d)-(\d\d)-(\d\d\d)Z$/, "T$1:$2:$3.$4Z");
+  return new Date(iso);
+}
+async function listSnapshots(dir) {
+  let entries;
+  try {
+    entries = await readdir(dir);
+  } catch (error2) {
+    if (isEnoent5(error2)) return [];
+    throw error2;
+  }
+  const names = entries.filter((name) => name.endsWith(".sql")).sort().reverse();
+  const results = [];
+  for (const name of names) {
+    const path = join8(dir, name);
+    const { size } = await stat(path);
+    results.push({ path, name, bytes: size, createdAt: parseSnapshotDate(name) });
+  }
+  return results;
+}
+async function pruneSnapshots(dir, keep) {
+  const snapshots = await listSnapshots(dir);
+  const toDelete = snapshots.slice(Math.max(keep, 0));
+  for (const snapshot of toDelete) {
+    await rm(snapshot.path, { force: true });
+  }
+  return toDelete.map((snapshot) => snapshot.path);
+}
+
+// src/commands/migrate.ts
+var DEFAULT_KEEP_SNAPSHOTS = 5;
+var MAX_OUTPUT_EXCERPT = 4e3;
+function defaultDeps4() {
+  return {
+    startDevSession,
+    createSnapshot,
+    restoreSnapshot,
+    pruneSnapshots,
+    runNpx,
+    createApiClient,
+    requireProject: () => requireProject(workingDirectory()),
+    assertShadowDatasource,
+    assertMigrationDialect,
+    missingShadowDatabaseUrl,
+    addShadowDatabaseUrl,
+    diagnoseMigrationFailure,
+    now: () => /* @__PURE__ */ new Date()
+  };
+}
+function resolveDeps2(overrides) {
+  return { ...defaultDeps4(), ...overrides };
+}
+function formatSize(bytes) {
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+}
+function excerptOf(output) {
+  return output.length > MAX_OUTPUT_EXCERPT ? output.slice(-MAX_OUTPUT_EXCERPT) : output;
+}
+function shouldInheritStdio(json) {
+  return !json && isInteractive();
+}
+async function reportMigrationSafely(client, appId, input2) {
+  try {
+    await client.reportMigration(appId, input2);
+  } catch {
+    warn("Could not report this migration run to Meridian.");
+  }
+}
+async function runMigration(session, deps, ctx) {
+  const { json, keepSnapshots, commandArgs, commandString, options } = ctx;
+  const client = deps.createApiClient();
+  const appId = session.project.config.app_id;
+  const dir = snapshotsDir(session.project.root);
+  let snapshot;
+  if (options.skipSnapshot !== true) {
+    snapshot = await withSpinner(
+      "Snapshotting the development database...",
+      () => deps.createSnapshot(session.connection, { dir, now: deps.now }),
+      {
+        success: (result) => result.path === null ? "Development database is empty \u2014 nothing to snapshot." : `Snapshot saved to ${style.path(result.path)} (${formatSize(result.bytes)}).`
+      }
+    );
+  }
+  const inherit = shouldInheritStdio(json);
+  const startedAt = deps.now().toISOString();
+  const runResult = await deps.runNpx(commandArgs, { cwd: session.project.root, env: session.env, inherit });
+  const finishedAt = deps.now().toISOString();
+  let status;
+  let rolledBack = false;
+  let exitCode;
+  if (runResult.code === 0) {
+    success("Migration applied.");
+    status = "success";
+    exitCode = 0;
+    if (snapshot !== void 0) await deps.pruneSnapshots(dir, keepSnapshots);
+  } else {
+    exitCode = runResult.code !== 0 ? runResult.code : 1;
+    status = "failed";
+    if (snapshot === void 0) {
+      warn(`\`${commandString}\` failed (exit code ${runResult.code}).`);
+      hint("No snapshot was taken (--skip-snapshot), so there is nothing to roll back.");
+    } else if (options.noRollback === true) {
+      warn(`\`${commandString}\` failed (exit code ${runResult.code}); the database was left as-is (--no-rollback).`);
+      if (snapshot.path === null) {
+        hint("The database was empty before the migration; `meridian db reset` returns it to that state.");
+      } else {
+        detail(`Pre-migration snapshot: ${snapshot.path}`);
+        hint(`Replay it by hand once the proxy is up (\`meridian dev\`): \`mysql < ${snapshot.path}\`.`);
+      }
+    } else {
+      const snapshotPath = snapshot.path;
+      warn(
+        `\`${commandString}\` failed (exit code ${runResult.code}); ` + (snapshotPath === null ? "rolling the development database back to its pre-migration (empty) state..." : "rolling back the development database to the pre-migration snapshot...")
+      );
+      try {
+        await client.resetDevDatabase(appId);
+        if (snapshotPath === null) {
+          success("Development database rolled back to its pre-migration (empty) state.");
+        } else {
+          await withSpinner(
+            "Restoring the pre-migration snapshot...",
+            (spinner2) => deps.restoreSnapshot(session.connection, snapshotPath, {
+              onProgress: (executed, total) => spinner2.update(`Restoring the pre-migration snapshot... (${executed}/${total} statements)`)
+            }),
+            { success: (result) => `Restored the pre-migration snapshot (${result.statements} statements).` }
+          );
+        }
+        status = "rolled_back";
+        rolledBack = true;
+      } catch {
+        error("Automatic rollback failed. The development database may be in a partial state \u2014 treat it as unsafe.");
+        if (snapshotPath === null) {
+          hint("Recover by hand with `meridian db reset` \u2014 the database was empty before this migration.");
+        } else {
+          detail(`Pre-migration snapshot: ${snapshotPath}`);
+          hint(
+            `Recover by hand: start the proxy with \`meridian dev\`, then run \`mysql < ${snapshotPath}\` to replay the snapshot, or \`meridian db reset\` to start over from an empty schema.`
+          );
+        }
+      }
+    }
+    const diagnosis = deps.diagnoseMigrationFailure(session.project.root);
+    if (diagnosis !== null) hint(diagnosis);
+  }
+  const excerpt = excerptOf(runResult.output);
+  await reportMigrationSafely(client, appId, {
+    command: commandString,
+    status,
+    started_at: startedAt,
+    finished_at: finishedAt,
+    ...excerpt !== "" ? { output_excerpt: excerpt } : {}
+  });
+  if (json) {
+    const payload = {
+      status,
+      command: commandString,
+      started_at: startedAt,
+      finished_at: finishedAt,
+      exit_code: exitCode,
+      snapshot: snapshot !== void 0 ? { path: snapshot.path, bytes: snapshot.bytes } : null,
+      rolled_back: rolledBack,
+      database: session.connection.database,
+      app_id: appId
+    };
+    printJson(payload);
+  }
+  return exitCode;
+}
+async function ensureShadowDatasource(root, deps) {
+  const schemaPath = deps.missingShadowDatabaseUrl(root);
+  if (schemaPath !== null && (isAssumeYes() || isInteractive())) {
+    const approved = await confirmAction({
+      message: `\`prisma migrate dev\` needs a shadow database. Add \`shadowDatabaseUrl\` to ${schemaPath}?`,
+      default: true
+    });
+    if (approved) {
+      deps.addShadowDatabaseUrl(root);
+      success(`Added \`shadowDatabaseUrl = env("SHADOW_DATABASE_URL")\` to ${style.path(schemaPath)}.`);
+    }
+  }
+  deps.assertShadowDatasource(root);
+}
+async function runMigrate(options = {}) {
+  const deps = resolveDeps2(options.deps);
+  const json = isJsonOutput();
+  const keepSnapshots = options.keepSnapshots ?? DEFAULT_KEEP_SNAPSHOTS;
+  const commandArgs = ["prisma", "migrate", "dev", ...options.prismaArgs ?? []];
+  const commandString = ["npx", ...commandArgs].join(" ");
+  const project = deps.requireProject();
+  if (project.config.skip_datasource_check !== true) await ensureShadowDatasource(project.root, deps);
+  if (options.allowForeignMigrations !== true) deps.assertMigrationDialect(project.root);
+  const sessionOptions = {
+    ...options.port !== void 0 ? { port: options.port } : {},
+    ...options.envFile !== void 0 ? { envFile: options.envFile } : {},
+    project
+  };
+  const session = await deps.startDevSession(sessionOptions);
+  try {
+    return await runMigration(session, deps, { json, keepSnapshots, commandArgs, commandString, options });
+  } finally {
+    await session.stop();
+  }
+}
+function registerMigrateCommand(program) {
+  program.command("migrate").description(
+    "Snapshot the development database, run `prisma migrate dev`, and roll back to the snapshot automatically if the migration fails."
+  ).option("--skip-snapshot", "run without a pre-migration snapshot (no rollback is possible)").option(
+    "--allow-foreign-migrations",
+    "run even when prisma/migrations was generated for SQLite or Postgres and cannot apply to MySQL"
+  ).option("--no-rollback", "keep a snapshot but do not automatically restore it after a failed migration").option("--keep-snapshots <n>", "number of recent snapshots to keep after a successful migration", "5").option("--port <port>", "preferred local port for the Cloud SQL Auth Proxy").option("--env-file <file>", "path (relative to the project root) of the .env file to patch with DATABASE_URL").argument("[prismaArgs...]", "extra arguments forwarded to `prisma migrate dev` verbatim, after --").passThroughOptions().action(async (prismaArgs, opts) => {
+    const keepSnapshots = parseIntegerOption(opts.keepSnapshots, "--keep-snapshots", { min: 0 });
+    const port = parsePortOption(opts.port);
+    const exitCode = await runMigrate({
+      prismaArgs,
+      ...opts.skipSnapshot === true ? { skipSnapshot: true } : {},
+      ...opts.allowForeignMigrations === true ? { allowForeignMigrations: true } : {},
+      ...opts.rollback === false ? { noRollback: true } : {},
+      ...keepSnapshots !== void 0 ? { keepSnapshots } : {},
+      ...port !== void 0 ? { port } : {},
+      ...opts.envFile !== void 0 ? { envFile: opts.envFile } : {}
+    });
+    process.exitCode = exitCode;
+  });
+}
+
+// src/commands/unlink.ts
+async function runUnlink(options = {}) {
+  const deps = { ...options.deps };
+  const json = isJsonOutput();
+  const root = workingDirectory();
+  const project = readProject(root);
+  if (project === null) {
+    if (json) printJson({ unlinked: false, root });
+    else log("This directory is not linked to a Meridian app.");
+    return;
+  }
+  const appLabel2 = project.config.app_name ?? String(project.config.app_id);
+  const proceed = await confirmAction({
+    message: `Unlink ${project.root} from ${appLabel2}?`,
+    ...deps.confirmImpl !== void 0 ? { promptImpl: deps.confirmImpl } : {}
+  });
+  if (!proceed) throw new CliError("Aborted.");
+  removeProject(project.root);
+  if (json) {
+    printJson({ unlinked: true, root: project.root });
+    return;
+  }
+  success(`Unlinked ${project.root} from ${appLabel2}.`);
+  hint("Snapshots in `.meridian/snapshots/` were left alone.");
+}
+function registerUnlinkCommand(program) {
+  program.command("unlink").description("Remove this project's link to a Meridian organization and app.").action(async () => {
+    await runUnlink();
+  });
+}
+
+// src/commands/whoami.ts
+var SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1e3;
+function defaultDeps5() {
+  return { createClient: createApiClient };
+}
+function toConfigUser2(user) {
+  return { id: user.id, name: user.name, email: user.email };
+}
+function describeExpiry(tokenExpiresAt) {
+  if (tokenExpiresAt === void 0) return void 0;
+  const expiry = new Date(tokenExpiresAt).getTime();
+  if (Number.isNaN(expiry)) return void 0;
+  const remainingMs = expiry - Date.now();
+  if (remainingMs < 0) return "Your Meridian CLI token has expired.";
+  if (remainingMs < SEVEN_DAYS_MS) return "Your Meridian CLI token expires soon.";
+  return void 0;
+}
+function printHuman(result, project) {
+  if (result.user !== null) {
+    success(`Logged in as ${result.user.name} <${result.user.email}>`);
+  } else {
+    log("Logged in (cached user details unavailable offline).");
+  }
+  keyValues([
+    ["User ID", result.user !== null ? String(result.user.id) : "unknown"],
+    ["API URL", result.apiBaseUrl],
+    ["Token expires", result.tokenExpiresAt ?? "never"]
+  ]);
+  const expiryWarning = describeExpiry(result.tokenExpiresAt);
+  if (expiryWarning !== void 0) warn(expiryWarning);
+  log();
+  if (result.offline) {
+    hint("Organization list requires network access; omitted in --offline mode.");
+  } else if (result.orgs.length > 0) {
+    step("Organizations");
+    keyValues(result.orgs.map((org) => [org.name, org.slug]));
+  } else {
+    log("No organizations.");
+  }
+  log();
+  if (project !== null) {
+    step("Linked project");
+    keyValues([
+      ["App", project.config.app_name ?? String(project.config.app_id)],
+      ["Org", String(project.config.org_id)],
+      ["Root", project.root]
+    ]);
+  } else {
+    hint("Run `meridian link` to connect this directory to a Meridian app.");
+  }
+}
+function printJsonResult(result, project) {
+  printJson({
+    user: result.user,
+    api_base_url: result.apiBaseUrl,
+    token_expires_at: result.tokenExpiresAt,
+    orgs: result.orgs,
+    project: project === null ? null : {
+      root: project.root,
+      org_id: project.config.org_id,
+      app_id: project.config.app_id,
+      ...project.config.app_name !== void 0 ? { app_name: project.config.app_name } : {}
+    }
+  });
+}
+async function runWhoami(options = {}) {
+  const deps = { ...defaultDeps5(), ...options.deps };
+  const json = isJsonOutput();
+  const auth = getAuth();
+  if (auth === null) throw notLoggedInError();
+  let result;
+  if (options.offline === true) {
+    result = {
+      user: auth.user ?? null,
+      apiBaseUrl: resolveApiBaseUrl(getGlobalOptions().apiUrl),
+      tokenExpiresAt: auth.tokenExpiresAt,
+      orgs: [],
+      offline: true
+    };
+  } else {
+    const client = deps.createClient({ token: auth.token, requireAuth: false });
+    try {
+      const me = await client.getMe();
+      result = {
+        user: toConfigUser2(me.user),
+        apiBaseUrl: client.baseUrl,
+        tokenExpiresAt: auth.tokenExpiresAt,
+        orgs: me.orgs,
+        offline: false
+      };
+    } catch (error2) {
+      if (isApiError(error2) && error2.status === 401) throw sessionExpiredError(error2);
+      throw error2;
+    }
+  }
+  const project = readProject(workingDirectory());
+  if (json) printJsonResult(result, project);
+  else printHuman(result, project);
+}
+function registerWhoamiCommand(program) {
+  program.command("whoami").description(
+    "Show the logged-in Meridian user, org memberships, and any linked project.\nUse --offline to skip the API call and report only what is cached locally."
+  ).option("--offline", "skip the API call; report only what is stored locally").action(async (opts) => {
+    await runWhoami({ ...opts.offline === true ? { offline: true } : {} });
+  });
+}
+
+// src/lib/global-flags.ts
+import { Option } from "commander";
+var HELP_GROUP = "Global Options:";
+function globalOptions() {
+  return [
+    new Option("--api-url <url>", "Meridian API base URL (overrides MERIDIAN_API_URL and the stored config)"),
+    new Option("--json", "print machine-readable JSON on stdout").default(false),
+    new Option("-q, --quiet", "only print warnings and errors").default(false),
+    new Option("--verbose", "print debug output, including stack traces").default(false),
+    new Option("--no-color", "disable ANSI colors"),
+    new Option("-y, --yes", "assume yes for every confirmation prompt").default(false),
+    new Option("--no-input", "never prompt; fail instead (for CI)"),
+    new Option("--cwd <dir>", "run as if started in this directory")
+  ];
+}
+function addGlobalFlags(command) {
+  for (const option of globalOptions()) {
+    command.addOption(option.helpGroup(HELP_GROUP));
+  }
+  return command;
+}
+function addGlobalFlagsToSubcommands(parent) {
+  for (const child of parent.commands) {
+    if (child.commands.length > 0) addGlobalFlagsToSubcommands(child);
+    else addGlobalFlags(child);
+  }
+}
+function commandChain(command) {
+  const chain = [];
+  let node = command;
+  while (node !== null) {
+    chain.push(node);
+    node = node.parent;
+  }
+  return chain;
+}
+function explicit(chain, key) {
+  for (const command of chain) {
+    if (command.getOptionValueSource(key) === "cli") return command.getOptionValue(key);
+  }
+  return void 0;
+}
+function resolveGlobalFlags(actionCommand) {
+  const chain = commandChain(actionCommand);
+  const apiUrl = explicit(chain, "apiUrl");
+  const color = explicit(chain, "color");
+  const input2 = explicit(chain, "input");
+  const cwd = explicit(chain, "cwd");
+  return {
+    ...apiUrl !== void 0 ? { apiUrl } : {},
+    json: explicit(chain, "json") === true,
+    quiet: explicit(chain, "quiet") === true,
+    verbose: explicit(chain, "verbose") === true,
+    // `--no-color`/`--no-input` are only meaningful when asked for explicitly;
+    // otherwise output and prompts auto-detect the terminal.
+    ...color !== void 0 ? { color } : {},
+    yes: explicit(chain, "yes") === true,
+    ...input2 !== void 0 ? { interactive: input2 } : {},
+    ...cwd !== void 0 ? { cwd } : {}
+  };
+}
+
+// src/index.ts
+function buildProgram() {
+  const program = new Command();
+  program.name("meridian").description(
+    "Managed remote development databases for Meridian apps.\n\nRun `meridian login` once, `meridian link` per project, then `meridian dev`."
+  ).version(VERSION, "-V, --version").enablePositionalOptions().showHelpAfterError("(run `meridian --help` for usage)");
+  addGlobalFlags(program);
+  program.hook("preAction", (_thisCommand, actionCommand) => {
+    const flags = resolveGlobalFlags(actionCommand);
+    setGlobalOptions(flags);
+    configureOutput({
+      json: flags.json === true,
+      quiet: flags.quiet === true,
+      verbose: flags.verbose === true,
+      ...flags.color !== void 0 ? { color: flags.color } : {}
+    });
+    configurePrompts({
+      // Only set when the flag is actually present: `--yes` has no negated
+      // form, so passing `false` here would just be "flag absent" — and it
+      // would override the MERIDIAN_YES fallback isAssumeYes() falls back to.
+      ...flags.yes === true ? { assumeYes: true } : {},
+      ...flags.interactive !== void 0 ? { interactive: flags.interactive } : {}
+    });
+  });
+  registerLoginCommand(program);
+  registerLogoutCommand(program);
+  registerWhoamiCommand(program);
+  registerLinkCommand(program);
+  registerUnlinkCommand(program);
+  registerDevCommand(program);
+  registerMigrateCommand(program);
+  registerDbCommand(program);
+  addGlobalFlagsToSubcommands(program);
+  return program;
+}
+async function run(argv = process.argv) {
+  try {
+    await buildProgram().parseAsync(argv);
+    return process.exitCode === void 0 ? 0 : Number(process.exitCode);
+  } catch (error2) {
+    return reportError(error2);
+  }
+}
+function isMainModule() {
+  const entry = process.argv[1];
+  if (entry === void 0) return false;
+  try {
+    return realpathSync(entry) === realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+}
+if (isMainModule()) {
+  const code = await run(process.argv);
+  if (code !== 0) process.exitCode = code;
+}
+export {
+  buildProgram,
+  run
+};
+//# sourceMappingURL=index.js.map