@the-meridian/cli 1.0.2 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @the-meridian/cli
 
+## 1.1.0
+
+### Minor Changes
+
+- ef6a53f: Add `meridian db credential list` and `meridian db credential revoke <credential>` for the credentials a backend running outside Meridian uses to reach a hosted environment's MySQL database through the Meridian database gateway. `list` shows each credential's label, MySQL user, access mode, status, last connection and certificate expiry; `revoke` drops a credential after asking (or with `--yes`), so a leaked one can be cut off from a terminal. Both take `--env <name>`. Creating and rotating credentials stay in the dashboard.
+
+### Patch Changes
+
+- be18bb6: The per-developer MySQL database is now called a **developer database** in every message and command description, matching the **Developer databases** page in the dashboard. Nothing about how it works changes.
+
+## 1.0.3
+
+### Patch Changes
+
+- faaf2bf: Clarify punctuation in the README.
+
 ## 1.0.2
 
 ### Patch Changes

package/README.md

@@ -17,7 +17,7 @@ meridian dev            # every day
 - Node.js 20 or newer
 - A Meridian account with access to at least one organization and app
 
-You do **not** need Docker, a local MySQL server, `gcloud`, or the Cloud SQL Auth Proxy — the CLI downloads and manages the proxy for you.
+You do **not** need Docker, a local MySQL server, `gcloud`, or the Cloud SQL Auth Proxy. The CLI downloads and manages the proxy for you.
 
 ## How it works
 
@@ -98,6 +98,17 @@ Runs `npx prisma db seed` with the proxy up and `DATABASE_URL` set. Extra args:
 
 Opens a SQL shell against the dev database: the real `mysql` client when it's on `PATH` (the password is passed via `MYSQL_PWD`, so it never appears in `ps`), otherwise a small built-in REPL over `mysql2`. `--repl` forces the built-in one, and `-e "SELECT 1"` runs a single statement and exits (`--json` formats the rows as JSON).
 
+### `meridian db credential`
+
+Lists and revokes credentials for reaching a hosted environment's MySQL database from a backend running outside Meridian, through the Meridian database gateway (mutual TLS plus a password). This acts on a hosted environment's database, not the developer database.
+
+```bash
+meridian db credential list --env production
+meridian db credential revoke aws-backend --env production --yes
+```
+
+Creating and rotating credentials happen in the dashboard (Hosting > Database > External access), behind a browser session: a CLI token cannot issue database access. Revoking needs the Credentials: Manage permission on the app.
+
 ### Global flags
 
 Accepted before or after the command name, so both `meridian --json whoami` and `meridian whoami --json` work.
@@ -144,7 +155,7 @@ SHADOW_DATABASE_URL="mysql://devu_88_15:<password>@127.0.0.1:3307/devdb_88_u15_s
 ```
 
 - `SHADOW_DATABASE_URL` points at a second database provisioned for you, which `prisma migrate dev` needs (see below). It is reachable with the same credentials and is dropped when your dev database is.
-- Every other line — comments, ordering, blank lines, quoting style — is preserved; only these two are replaced.
+- Every other line (comments, ordering, blank lines, quoting style) is preserved; only these two are replaced.
 - The first time a file is modified, a one-time copy is saved as `.env.backup`, with the same permissions as the file it copies.
 - An existing file keeps its permissions; a file the CLI creates is `0600`, because the line it writes contains a live password.
 - The port changes between runs when the preferred port is busy, so re-running `meridian dev` rewrites the line.
@@ -167,13 +178,13 @@ datasource db {
 
 `meridian migrate` offers to add the `shadowDatabaseUrl` line for you the first time it finds it missing, and writes it in place. It asks rather than just doing it, because a schema is source you keep in git, unlike the generated `.env`. A datasource that already names some other variable is left alone.
 
-`shadowDatabaseUrl` is required because `prisma migrate dev` does not apply migrations directly: it replays your migration history into a throwaway shadow database and diffs that against your schema to detect drift. Prisma creates that database itself when it can, and your dev user cannot — it holds privileges on its own two databases and nothing else, so `CREATE DATABASE` is denied and Prisma reports `P3014`. Meridian provisions the shadow database per developer instead of granting the privilege, because Prisma names shadow databases with a fixed `prisma_migrate_shadow_db_*` prefix: a grant broad enough to cover that would be shared by every developer on the instance.
+`shadowDatabaseUrl` is required because `prisma migrate dev` does not apply migrations directly: it replays your migration history into a throwaway shadow database and diffs that against your schema to detect drift. Prisma creates that database itself when it can, and your dev user cannot: it holds privileges on its own two databases and nothing else, so `CREATE DATABASE` is denied and Prisma reports `P3014`. Meridian provisions the shadow database per developer instead of granting the privilege, because Prisma names shadow databases with a fixed `prisma_migrate_shadow_db_*` prefix: a grant broad enough to cover that would be shared by every developer on the instance.
 
 Only `meridian migrate` needs it. `dev`, `db seed` and `db shell` run fine without it.
 
 ## Non-interactive and CI use
 
-Prompts are skipped automatically when stdin/stderr aren't TTYs, when `CI` is set, or when `MERIDIAN_NON_INTERACTIVE` is set — in that mode a command that would have prompted fails with a message naming the flag or variable to set instead.
+Prompts are skipped automatically when stdin/stderr aren't TTYs, when `CI` is set, or when `MERIDIAN_NON_INTERACTIVE` is set. In that mode a command that would have prompted fails with a message naming the flag or variable to set instead.
 
 | Variable | Purpose |
 | --- | --- |
@@ -184,7 +195,7 @@ Prompts are skipped automatically when stdin/stderr aren't TTYs, when `CI` is se
 | `MERIDIAN_NON_INTERACTIVE` | Same as `--no-input` |
 | `MERIDIAN_NO_BROWSER` | Same as `login --no-browser` |
 | `MERIDIAN_DEV_ACTIVE` | Set to `1` in every process `meridian dev` starts. Read it to detect that your script is already inside a session; setting it yourself makes `meridian dev` refuse to start |
-| `MERIDIAN_DEV_DATABASE_ID` | Exported (alongside `DATABASE_URL`) into the children of `meridian dev`, `migrate` and `db …`, holding the id of the dev database that session provisioned. The Meridian SDK sends it as `devDatabaseId` on its identify call, so installs a locally-run app creates are billed to your dev database. Set by the CLI only — never set it yourself |
+| `MERIDIAN_DEV_DATABASE_ID` | Exported (alongside `DATABASE_URL`) into the children of `meridian dev`, `migrate` and `db …`, holding the id of the dev database that session provisioned. The Meridian SDK sends it as `devDatabaseId` on its identify call, so installs a locally-run app creates are billed to your dev database. Set by the CLI only. Never set it yourself |
 | `MERIDIAN_PROXY_PATH` | Use an existing proxy binary instead of downloading one |
 | `MERIDIAN_PROXY_VERSION` | Pin a different proxy version (checksum is fetched from that release) |
 | `MERIDIAN_PROXY_SKIP_CHECKSUM=1` | Allow install when no checksum is published. Use only if you trust the source |
@@ -198,39 +209,39 @@ Read commands support `--json`. Errors are also JSON in that mode:
 
 ## Troubleshooting
 
-**`You are not logged in to Meridian.`** — Run `meridian login`.
+**`You are not logged in to Meridian.`**: Run `meridian login`.
 
-**`This project is not linked to a Meridian app.`** — Run `meridian link` in the project root. The CLI looks for `.meridian/project.json` in the current directory and its parents.
+**`This project is not linked to a Meridian app.`**: Run `meridian link` in the project root. The CLI looks for `.meridian/project.json` in the current directory and its parents.
 
-**`Your Meridian CLI token is no longer valid (401).`** — The token was revoked or expired. Run `meridian login` again.
+**`Your Meridian CLI token is no longer valid (401).`**: The token was revoked or expired. Run `meridian login` again.
 
-**`Provisioning the development database failed.`** — Provisioning ended in an error state on Meridian's side; the reason the API reports is appended to the message. Check the dashboard for the full history, then re-run `meridian dev` to retry.
+**`Provisioning the development database failed.`**: Provisioning ended in an error state on Meridian's side; the reason the API reports is appended to the message. Check the dashboard for the full history, then re-run `meridian dev` to retry.
 
-**`The development database is not ready yet.`** — A credentials or reset call arrived before provisioning finished (HTTP 409). `meridian dev` polls for you, so this normally only appears when a command runs against a database that is still being created.
+**`The development database is not ready yet.`**: A credentials or reset call arrived before provisioning finished (HTTP 409). `meridian dev` polls for you, so this normally only appears when a command runs against a database that is still being created.
 
-**`Could not reach 127.0.0.1:<port>/<db> (ECONNREFUSED).`** — Nothing is listening. `meridian dev` and `meridian migrate` start the proxy themselves; if you're running Prisma directly, keep `meridian dev` running in another terminal.
+**`Could not reach 127.0.0.1:<port>/<db> (ECONNREFUSED).`**: Nothing is listening. `meridian dev` and `meridian migrate` start the proxy themselves; if you're running Prisma directly, keep `meridian dev` running in another terminal.
 
-**`Timed out waiting for MySQL …`** — The proxy is up but can't reach Cloud SQL. Check whether a VPN, firewall, or corporate proxy blocks outbound connections, then retry with `--verbose` to see the proxy's own logs.
+**`Timed out waiting for MySQL …`**: The proxy is up but can't reach Cloud SQL. Check whether a VPN, firewall, or corporate proxy blocks outbound connections, then retry with `--verbose` to see the proxy's own logs.
 
-**`Another process is already listening on that port.`** — Pass `--port` to choose a different one.
+**`Another process is already listening on that port.`**: Pass `--port` to choose a different one.
 
-**Proxy download fails** (air-gapped network, blocked storage.googleapis.com) — Install the [Cloud SQL Auth Proxy](https://github.com/GoogleCloudPlatform/cloud-sql-proxy) yourself and set `MERIDIAN_PROXY_PATH` to it.
+**Proxy download fails** (air-gapped network, blocked storage.googleapis.com): Install the [Cloud SQL Auth Proxy](https://github.com/GoogleCloudPlatform/cloud-sql-proxy) yourself and set `MERIDIAN_PROXY_PATH` to it.
 
-**Checksum verification failed** — A cached binary that no longer matches its published SHA-256 is deleted and downloaded again automatically. If a fresh download also fails verification the CLI refuses to install it, which usually means something on the network is rewriting the response. Don't reach for `MERIDIAN_PROXY_SKIP_CHECKSUM` in that situation.
+**Checksum verification failed**: A cached binary that no longer matches its published SHA-256 is deleted and downloaded again automatically. If a fresh download also fails verification the CLI refuses to install it, which usually means something on the network is rewriting the response. Don't reach for `MERIDIAN_PROXY_SKIP_CHECKSUM` in that situation.
 
-**A migration failed and left the schema half-applied** — `meridian migrate` restores the pre-migration snapshot automatically. To redo it by hand, use the newest file in `.meridian/snapshots/`, or run `meridian db reset` for a clean slate.
+**A migration failed and left the schema half-applied**: `meridian migrate` restores the pre-migration snapshot automatically. To redo it by hand, use the newest file in `.meridian/snapshots/`, or run `meridian db reset` for a clean slate.
 
-**The rollback itself failed** — Treat the database as unsafe: the reset succeeded but the replay didn't finish, so the schema is partial. Start the proxy with `meridian dev` in another terminal and replay the snapshot by hand (`mysql … < .meridian/snapshots/<timestamp>.sql`, or `meridian db shell` and paste it), or take the clean slate with `meridian db reset --migrate`. The failing statement's index is in the error message.
+**The rollback itself failed**: Treat the database as unsafe: the reset succeeded but the replay didn't finish, so the schema is partial. Start the proxy with `meridian dev` in another terminal and replay the snapshot by hand (`mysql … < .meridian/snapshots/<timestamp>.sql`, or `meridian db shell` and paste it), or take the clean slate with `meridian db reset --migrate`. The failing statement's index is in the error message.
 
-**`meridian dev` says it would call itself** — Your `npm run dev` script invokes `meridian dev`. Point `dev_command` in `.meridian/project.json` at the real dev server (for example `next dev`), or run `meridian dev -- next dev`.
+**`meridian dev` says it would call itself**: Your `npm run dev` script invokes `meridian dev`. Point `dev_command` in `.meridian/project.json` at the real dev server (for example `next dev`), or run `meridian dev -- next dev`.
 
-**"…would not touch the managed development database"** — Your Prisma datasource does not read `DATABASE_URL`, so Prisma would ignore the database the CLI just connected you to and use whatever the schema hardcodes (typically `file:dev.sqlite`). Set `provider = "mysql"` and `url = env("DATABASE_URL")`, and regenerate any migrations created for the old database — their SQL is dialect-specific and MySQL will reject it. Projects that deliberately manage their datasource some other way can set `"skip_datasource_check": true` in `.meridian/project.json`.
+**"…would not touch the managed development database"**: Your Prisma datasource does not read `DATABASE_URL`, so Prisma would ignore the database the CLI just connected you to and use whatever the schema hardcodes (typically `file:dev.sqlite`). Set `provider = "mysql"` and `url = env("DATABASE_URL")`, and regenerate any migrations created for the old database, because their SQL is dialect-specific and MySQL will reject it. Projects that deliberately manage their datasource some other way can set `"skip_datasource_check": true` in `.meridian/project.json`.
 
-**"written for a different database engine"** — `migrate` screens `prisma/migrations` before it provisions anything, because a history generated for another engine cannot apply to MySQL. SQLite and Postgres quote identifiers as `"Session"`, which MySQL reads as a string literal, and SQLite's `TEXT` primary keys are invalid as MySQL keys. Migration SQL is dialect-specific, so the history has to be regenerated: if it has only ever run locally, delete `prisma/migrations` and re-run. This is the normal state of a Shopify app template, which ships SQLite migrations. `--allow-foreign-migrations` waives the check.
+**"written for a different database engine"**: `migrate` screens `prisma/migrations` before it provisions anything, because a history generated for another engine cannot apply to MySQL. SQLite and Postgres quote identifiers as `"Session"`, which MySQL reads as a string literal, and SQLite's `TEXT` primary keys are invalid as MySQL keys. Migration SQL is dialect-specific, so the history has to be regenerated: if it has only ever run locally, delete `prisma/migrations` and re-run. This is the normal state of a Shopify app template, which ships SQLite migrations. `--allow-foreign-migrations` waives the check.
 
 If an earlier attempt already failed against the database, run `meridian db reset` before retrying. Prisma records the failure in `_prisma_migrations`, and once the history is deleted that row names a migration that no longer exists on disk, which Prisma reports as drift and refuses to work past.
 
-**"declares no `shadowDatabaseUrl`"**, or Prisma's **`P3014`** — `prisma migrate dev` needs a shadow database and your dev user cannot create one. Meridian provisions it and exports `SHADOW_DATABASE_URL`; add `shadowDatabaseUrl = env("SHADOW_DATABASE_URL")` to your datasource. If you hit `P3014` despite having that line, your dev database predates shadow databases — `meridian db reset` re-provisions it.
+**"declares no `shadowDatabaseUrl`"**, or Prisma's **`P3014`**: `prisma migrate dev` needs a shadow database and your dev user cannot create one. Meridian provisions it and exports `SHADOW_DATABASE_URL`; add `shadowDatabaseUrl = env("SHADOW_DATABASE_URL")` to your datasource. If you hit `P3014` despite having that line, your dev database predates shadow databases. `meridian db reset` re-provisions it.
 
 ## Development