@the-meridian/cli 1.0.3 → 1.1.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @the-meridian/cli
 
+## 1.1.0
+
+### Minor Changes
+
+- ef6a53f: Add `meridian db credential list` and `meridian db credential revoke <credential>` for the credentials a backend running outside Meridian uses to reach a hosted environment's MySQL database through the Meridian database gateway. `list` shows each credential's label, MySQL user, access mode, status, last connection and certificate expiry; `revoke` drops a credential after asking (or with `--yes`), so a leaked one can be cut off from a terminal. Both take `--env <name>`. Creating and rotating credentials stay in the dashboard.
+
+### Patch Changes
+
+- be18bb6: The per-developer MySQL database is now called a **developer database** in every message and command description, matching the **Developer databases** page in the dashboard. Nothing about how it works changes.
+
 ## 1.0.3
 
 ### Patch Changes

package/README.md

@@ -98,6 +98,17 @@ Runs `npx prisma db seed` with the proxy up and `DATABASE_URL` set. Extra args:
 
 Opens a SQL shell against the dev database: the real `mysql` client when it's on `PATH` (the password is passed via `MYSQL_PWD`, so it never appears in `ps`), otherwise a small built-in REPL over `mysql2`. `--repl` forces the built-in one, and `-e "SELECT 1"` runs a single statement and exits (`--json` formats the rows as JSON).
 
+### `meridian db credential`
+
+Lists and revokes credentials for reaching a hosted environment's MySQL database from a backend running outside Meridian, through the Meridian database gateway (mutual TLS plus a password). This acts on a hosted environment's database, not the developer database.
+
+```bash
+meridian db credential list --env production
+meridian db credential revoke aws-backend --env production --yes
+```
+
+Creating and rotating credentials happen in the dashboard (Hosting > Database > External access), behind a browser session: a CLI token cannot issue database access. Revoking needs the Credentials: Manage permission on the app.
+
 ### Global flags
 
 Accepted before or after the command name, so both `meridian --json whoami` and `meridian whoami --json` work.

package/dist/index.js

@@ -117,6 +117,51 @@ var migrationRunSchema = z.object({
   output_excerpt: z.string().nullish(),
   created_at: z.string().nullish()
 }).loose();
+function envelopeSchema(data) {
+  return z.object({ data }).loose();
+}
+var hostingAddonSchema = z.object({
+  uuid: z.string(),
+  type: z.string().nullish(),
+  name: z.string().nullish(),
+  status: z.string().nullish(),
+  database: z.object({
+    type: z.string().nullish(),
+    database: z.string().nullish()
+  }).loose().nullish()
+}).loose();
+var hostingEnvironmentSchema = z.object({
+  uuid: z.string(),
+  type: z.string().nullish(),
+  name: z.string().nullish(),
+  addons: z.array(hostingAddonSchema).nullish()
+}).loose();
+var externalCredentialSchema = z.object({
+  id: z.string(),
+  label: z.string(),
+  username: z.string(),
+  access_mode: z.string(),
+  max_connections: z.number().nullish(),
+  allowed_cidrs: z.array(z.string()).nullish(),
+  certificate_serial: z.string().nullish(),
+  certificate_expires_at: z.string().nullish(),
+  last_connected_at: z.string().nullish(),
+  last_connected_ip: z.string().nullish(),
+  locked_until: z.string().nullish(),
+  status: z.string(),
+  revoked_at: z.string().nullish(),
+  created_at: z.string().nullish()
+}).loose();
+var externalCredentialListMetaSchema = z.object({
+  available: z.boolean().nullish(),
+  host: z.string().nullish(),
+  port: z.coerce.number().nullish(),
+  max_credentials: z.number().nullish()
+}).loose();
+var externalCredentialListSchema = z.object({
+  data: z.array(externalCredentialSchema),
+  meta: externalCredentialListMetaSchema.nullish()
+}).loose();
 
 // src/lib/errors.ts
 var CliError = class extends Error {
@@ -313,6 +358,28 @@ var ApiClient = class _ApiClient {
       `/app/cli/apps/${encodePathSegment(appId)}/dev-database/migrations`
     );
   }
+  /** `GET /app/apps/{app}/environments`, each with its add-ons. Used to find an environment's database. */
+  async listEnvironments(appId) {
+    const body = await this.request(
+      envelopeSchema(z2.array(hostingEnvironmentSchema)),
+      "GET",
+      `/app/apps/${encodePathSegment(appId)}/environments`
+    );
+    return body.data;
+  }
+  /** `GET /app/addons/{addon}/database/external-credentials`: the credentials, plus whether external access is on. */
+  async listExternalCredentials(addonId) {
+    const body = await this.request(externalCredentialListSchema, "GET", externalCredentialsPath(addonId));
+    return { credentials: body.data, meta: body.meta ?? {} };
+  }
+  async revokeExternalCredential(addonId, credentialId) {
+    const body = await this.request(
+      envelopeSchema(externalCredentialSchema),
+      "DELETE",
+      `${externalCredentialsPath(addonId)}/${encodePathSegment(credentialId)}`
+    );
+    return body.data;
+  }
   #buildUrl(path, query) {
     const url = new URL(`${this.baseUrl}${path}`);
     if (query !== void 0) {
@@ -370,6 +437,9 @@ var ApiClient = class _ApiClient {
 function encodePathSegment(id) {
   return encodeURIComponent(String(id));
 }
+function externalCredentialsPath(addonId) {
+  return `/app/addons/${encodePathSegment(addonId)}/database/external-credentials`;
+}
 function parseJson(text, method, path) {
   try {
     return JSON.parse(text);
@@ -452,9 +522,10 @@ function extractErrorCode(body) {
   return record !== void 0 && typeof record.error === "string" ? record.error : void 0;
 }
 var HINTS_BY_ERROR_CODE = {
-  dev_database_limit_reached: "Your plan does not include a development database for you on this app. Every collaborator gets their own out of the plan's allowance, so upgrading the organization's plan in the Meridian dashboard is what unlocks it.",
+  dev_database_limit_reached: "Your plan does not include a developer database for you on this app. Every collaborator gets their own out of the plan's allowance, so upgrading the organization's plan in the Meridian dashboard is what unlocks it.",
   dev_database_over_storage_limit: "Run `meridian db reset` to drop and recreate the schema. Reset and delete stay available while you're over the limit.",
-  FEATURE_NOT_ENTITLED: "Your organization's plan does not include managed development databases; upgrade it in the Meridian dashboard."
+  EXTERNAL_ACCESS_UNAVAILABLE: "External access is not switched on for this database yet, or the database is not ready. Check the database under Hosting in the Meridian dashboard.",
+  FEATURE_NOT_ENTITLED: "Your organization's plan does not include managed developer databases; upgrade it in the Meridian dashboard."
 };
 function hintForError(status, errorCode) {
   if (errorCode !== void 0) {
@@ -465,7 +536,7 @@ function hintForError(status, errorCode) {
   if (status === 403) return "You may not have access to this organization or app; check your Meridian membership.";
   if (status === 404) return "Run `meridian link` to select a valid organization and app.";
   if (status === 409) {
-    return "The development database is not ready yet. Wait for provisioning to finish, then try again. `meridian dev` polls for you.";
+    return "The developer database is not ready yet. Wait for provisioning to finish, then try again. `meridian dev` polls for you.";
   }
   if (status === 422) return "Check the request for validation errors and try again.";
   if (status === 429) return "You're being rate limited by the Meridian API; wait a moment and try again.";
@@ -1852,7 +1923,7 @@ function addShadowDatabaseUrl(root) {
 function wrongUrlError(datasource, url) {
   const problem = url.kind === "literal" ? `hardcodes \`url = "${url.value}"\`` : `reads \`env("${url.name}")\`, but Meridian sets \`${REQUIRED_URL_ENV}\``;
   return new CliError(
-    `\`${datasource.schemaPath}\` ${problem}, so this command would not touch the managed development database.`,
+    `\`${datasource.schemaPath}\` ${problem}, so this command would not touch the managed developer database.`,
     {
       hint: `Change the \`${datasource.name}\` datasource to \`url = env("${REQUIRED_URL_ENV}")\` with \`provider = "${REQUIRED_PROVIDER}"\`. Migrations generated against another database use dialect-specific SQL and have to be regenerated. ${BYPASS_HINT}`
     }
@@ -1860,7 +1931,7 @@ function wrongUrlError(datasource, url) {
 }
 function wrongProviderError(datasource, provider) {
   return new CliError(
-    `\`${datasource.schemaPath}\` sets \`provider = "${provider}"\`, but the managed development database is MySQL.`,
+    `\`${datasource.schemaPath}\` sets \`provider = "${provider}"\`, but the managed developer database is MySQL.`,
     {
       hint: `Change the \`${datasource.name}\` datasource to \`provider = "${REQUIRED_PROVIDER}"\` and regenerate any migrations generated for ${provider}, which use dialect-specific SQL. ${BYPASS_HINT}`
     }
@@ -2541,17 +2612,17 @@ var DEV_DATABASE_ID_ENV = "MERIDIAN_DEV_DATABASE_ID";
 function provisioningFailedError(devDatabase) {
   const reason = devDatabase.error_message;
   const detail2 = typeof reason === "string" && reason.trim() !== "" ? ` ${reason.trim()}` : "";
-  return new CliError(`Provisioning the development database failed.${detail2}`, {
+  return new CliError(`Provisioning the developer database failed.${detail2}`, {
     hint: "Check the Meridian dashboard for details, or contact support if this keeps happening."
   });
 }
 function provisioningTimeoutError() {
-  return new CliError("Timed out waiting for the development database to be provisioned.", {
+  return new CliError("Timed out waiting for the developer database to be provisioned.", {
     hint: "Try `meridian dev` again in a few minutes, and check the Meridian dashboard for its status."
   });
 }
 function provisioningNotFoundError() {
-  return new CliError("The Meridian API never finished creating the development database.", {
+  return new CliError("The Meridian API never finished creating the developer database.", {
     hint: "Try `meridian dev` again; if this keeps happening, contact Meridian support."
   });
 }
@@ -2563,7 +2634,7 @@ async function pollDevDatabase(client, appId, options, spinner2) {
   const start = now();
   const report = (status) => {
     const elapsedMs = now() - start;
-    spinner2.update(`Provisioning the development database... (${status}, ${Math.round(elapsedMs / 1e3)}s)`);
+    spinner2.update(`Provisioning the developer database... (${status}, ${Math.round(elapsedMs / 1e3)}s)`);
     options.onStatus?.(status, elapsedMs);
   };
   let current2 = await client.ensureDevDatabase(appId);
@@ -2590,9 +2661,9 @@ async function pollDevDatabase(client, appId, options, spinner2) {
 }
 async function ensureDevDatabaseReady(client, appId, options = {}) {
   return withSpinner(
-    "Provisioning the development database...",
+    "Provisioning the developer database...",
     (spinner2) => pollDevDatabase(client, appId, options, spinner2),
-    { success: (db) => `Development database "${db.database}" is ready.` }
+    { success: (db) => `Developer database "${db.database}" is ready.` }
   );
 }
 function toProxyToken(token) {
@@ -2787,6 +2858,232 @@ async function startDevSession(options = {}) {
   }
 }
 
+// src/lib/db/external-credential.ts
+function describeAccessMode(mode) {
+  if (mode === "read_only") return "read-only";
+  if (mode === "read_write") return "read-write";
+  return mode;
+}
+function resolveCredentialRef(credentials, ref) {
+  const wanted = ref.trim();
+  const byId = credentials.find((credential) => credential.id === wanted);
+  if (byId !== void 0) return byId;
+  const matchers = [
+    (credential) => credential.label === wanted,
+    (credential) => credential.label.toLowerCase() === wanted.toLowerCase()
+  ];
+  for (const matches of matchers) {
+    const found = credentials.filter(matches);
+    const live = found.filter((credential) => credential.status !== "revoked");
+    const pool = live.length > 0 ? live : found;
+    if (pool.length === 1 && pool[0] !== void 0) return pool[0];
+    if (pool.length > 1) {
+      throw new CliError(`More than one credential is labelled "${wanted}".`, {
+        hint: `Name it by id instead: ${pool.map((credential) => credential.id).join(", ")}.`
+      });
+    }
+  }
+  throw new CliError(`No credential matches "${wanted}".`, {
+    hint: "Run `meridian db credential list` to see each credential's label and id."
+  });
+}
+function isMysqlDatabase(addon) {
+  if (addon.type !== "database") return false;
+  const type = addon.database?.type;
+  return type === void 0 || type === null || type === "mysql";
+}
+function databaseTargets(environments) {
+  const targets = [];
+  for (const environment of environments) {
+    const addon = (environment.addons ?? []).find(isMysqlDatabase);
+    if (addon !== void 0) targets.push({ environment, addon });
+  }
+  return targets;
+}
+function environmentLabel(environment) {
+  return environment.name ?? environment.type ?? environment.uuid;
+}
+function matchEnvironment(targets, wanted) {
+  const target = wanted.trim().toLowerCase();
+  return targets.find(
+    ({ environment }) => [environment.name, environment.type, environment.uuid].some(
+      (value) => typeof value === "string" && value.toLowerCase() === target
+    )
+  );
+}
+function formatTimestamp(value, dateOnly = false) {
+  if (value === null || value === void 0 || value === "") return "-";
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return value;
+  const iso = date.toISOString();
+  return dateOnly ? iso.slice(0, 10) : `${iso.slice(0, 16).replace("T", " ")} UTC`;
+}
+function formatCredentialTable(credentials) {
+  const rows = [
+    ["LABEL", "USERNAME", "MODE", "STATUS", "LAST CONNECTED", "CERT EXPIRES", "ID"],
+    ...credentials.map((credential) => [
+      credential.label,
+      credential.username,
+      describeAccessMode(credential.access_mode),
+      credential.status,
+      credential.last_connected_at === null || credential.last_connected_at === void 0 ? "never" : formatTimestamp(credential.last_connected_at),
+      formatTimestamp(credential.certificate_expires_at, true),
+      credential.id
+    ])
+  ];
+  const widths = rows[0]?.map((_, column) => Math.max(...rows.map((row) => (row[column] ?? "").length))) ?? [];
+  return rows.map(
+    (row) => row.map((cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths[column] ?? 0)).join("  ").trimEnd()
+  );
+}
+
+// src/commands/db-credential.ts
+function defaultDeps() {
+  return { createApiClient, requireProject };
+}
+var MANAGE_HINT = "Revoking an external credential needs the Credentials: Manage permission on this app. Ask an organization owner or admin to grant it, or to revoke it for you.";
+var CLI_SCOPE_HINT = "This Meridian API does not accept CLI tokens for external credentials yet. Manage them under Hosting > Database > External access in the dashboard.";
+var DASHBOARD_HINT = "Create and rotate credentials in the dashboard: Hosting > Database > External access. The key is generated in your browser there.";
+async function withAccessHints(fn, needsManage) {
+  try {
+    return await fn();
+  } catch (err) {
+    if (isApiError(err) && err.status === 403) {
+      const scope = err.message.includes("/app/cli/");
+      if (scope || needsManage) {
+        throw new ApiError(err.message, {
+          status: err.status,
+          body: err.body,
+          ...err.errorCode !== void 0 ? { errorCode: err.errorCode } : {},
+          hint: scope ? CLI_SCOPE_HINT : MANAGE_HINT,
+          cause: err
+        });
+      }
+    }
+    throw err;
+  }
+}
+async function resolveTarget(client, appId, env, deps) {
+  const environments = await withAccessHints(() => client.listEnvironments(appId), false);
+  const targets = databaseTargets(environments);
+  if (targets.length === 0) {
+    throw new CliError("None of this app's environments has a hosted MySQL database.", {
+      hint: "Add a database to an environment under Hosting in the Meridian dashboard first."
+    });
+  }
+  if (env !== void 0) {
+    const match = matchEnvironment(targets, env);
+    if (match === void 0) {
+      throw new CliError(`No environment named "${env}" has a hosted MySQL database.`, {
+        hint: `Environments with one: ${targets.map(({ environment }) => environmentLabel(environment)).join(", ")}.`
+      });
+    }
+    return match;
+  }
+  const index = await selectOne({
+    message: "Which environment's database?",
+    choices: targets.map((target, position) => ({
+      value: String(position),
+      name: environmentLabel(target.environment),
+      ...target.addon.database?.database ? { description: target.addon.database.database } : {}
+    })),
+    flag: "--env",
+    ...deps.selectImpl !== void 0 ? { promptImpl: deps.selectImpl } : {}
+  });
+  const chosen = targets[Number(index)];
+  if (chosen === void 0) throw new CliError("Nothing to choose from.");
+  return chosen;
+}
+async function openContext(env, deps) {
+  const project = deps.requireProject(workingDirectory());
+  const client = deps.createApiClient({});
+  const target = await resolveTarget(client, project.config.app_id, env, deps);
+  return { client, target };
+}
+async function runDbCredentialList(options = {}) {
+  const deps = { ...defaultDeps(), ...options.deps };
+  const { client, target } = await openContext(options.env, deps);
+  const { credentials, meta } = await withAccessHints(() => client.listExternalCredentials(target.addon.uuid), false);
+  const envName = environmentLabel(target.environment);
+  if (isJsonOutput()) {
+    printJson({
+      environment: envName,
+      addon_id: target.addon.uuid,
+      available: meta.available ?? null,
+      host: meta.host ?? null,
+      port: meta.port ?? null,
+      credentials
+    });
+    return 0;
+  }
+  if (meta.available === false) {
+    warn(`External access is not available for the ${envName} database yet.`);
+  }
+  if (credentials.length === 0) {
+    log(`No external credentials for the ${envName} database.`);
+    hint(DASHBOARD_HINT);
+    return 0;
+  }
+  log(`External credentials for the ${style.bold(envName)} database${meta.host ? ` (${meta.host}:${meta.port ?? 3306})` : ""}:`);
+  log();
+  for (const line of formatCredentialTable(credentials)) log(`  ${line}`);
+  return 0;
+}
+async function runDbCredentialRevoke(options) {
+  const deps = { ...defaultDeps(), ...options.deps };
+  const { client, target } = await openContext(options.env, deps);
+  const { credentials } = await withAccessHints(() => client.listExternalCredentials(target.addon.uuid), false);
+  const credential = resolveCredentialRef(credentials, options.credential);
+  const envName = environmentLabel(target.environment);
+  if (credential.status === "revoked") {
+    log(`Credential "${credential.label}" is already revoked.`);
+    if (isJsonOutput()) printJson({ revoked: true, already_revoked: true, credential });
+    return 0;
+  }
+  const confirmed = await confirmAction({
+    message: `Revoke "${credential.label}" (${credential.username}) on the ${envName} database? Anything using it loses access within 30 seconds.`,
+    default: false,
+    assumeYes: isAssumeYes(),
+    ...deps.confirmImpl !== void 0 ? { promptImpl: deps.confirmImpl } : {}
+  });
+  if (!confirmed) {
+    log("Aborted.");
+    if (isJsonOutput()) printJson({ revoked: false, aborted: true, credential });
+    return 0;
+  }
+  const revoked = await withAccessHints(
+    () => withSpinner(
+      `Revoking credential "${credential.label}"...`,
+      () => client.revokeExternalCredential(target.addon.uuid, credential.id)
+    ),
+    true
+  );
+  if (isJsonOutput()) printJson({ revoked: true, already_revoked: false, credential: revoked });
+  else success(`Revoked "${credential.label}". Its MySQL user is gone and open connections close within 30 seconds.`);
+  return 0;
+}
+async function runAndSetExitCode(fn) {
+  const code = await fn();
+  if (code !== 0) process.exitCode = code;
+}
+function registerDbCredentialCommand(db) {
+  const credential = db.command("credential").description(
+    "List and revoke credentials for reaching a hosted environment's database from outside Meridian. Create and rotate them in the dashboard."
+  );
+  credential.action(() => {
+    credential.outputHelp();
+  });
+  const envOption = ["--env <name>", "the environment whose database to use (name or type, e.g. production)"];
+  credential.command("list").description("List the database's external credentials.").option(...envOption).action(async (opts) => {
+    await runAndSetExitCode(() => runDbCredentialList({ ...opts.env !== void 0 ? { env: opts.env } : {} }));
+  });
+  credential.command("revoke").description("Revoke a credential: its MySQL user is dropped and open connections close within 30 seconds.").argument("<credential>", "the credential's id or label").option(...envOption).action(async (ref, opts) => {
+    await runAndSetExitCode(
+      () => runDbCredentialRevoke({ credential: ref, ...opts.env !== void 0 ? { env: opts.env } : {} })
+    );
+  });
+}
+
 // src/commands/db-shell-repl.ts
 import { accessSync, constants as fsConstants } from "fs";
 import { delimiter as delimiter2, join as join5 } from "path";
@@ -3059,7 +3356,7 @@ async function runDbSeed(options = {}) {
       inherit: true
     });
     if (result.code === 0) {
-      success("Seeded the development database.");
+      success("Seeded the developer database.");
     } else {
       error(`\`npx prisma db seed\` exited with code ${result.code}.`);
       hint("Make sure `prisma.seed` (or your Prisma 6 seed config) is set in package.json.");
@@ -3107,17 +3404,19 @@ async function runDbShell(options = {}) {
     if (session !== void 0) await session.stop();
   }
 }
-async function runAndSetExitCode(fn) {
+async function runAndSetExitCode2(fn) {
   const code = await fn();
   if (code !== 0) process.exitCode = code;
 }
 function registerDbCommand(program) {
-  const db = program.command("db").description("Manage the Meridian-managed MySQL development database: reset, seed, or open a SQL shell.");
+  const db = program.command("db").description(
+    "Manage the Meridian-managed MySQL developer database (reset, seed, or open a SQL shell), and external credentials for hosted databases."
+  );
   db.action(() => {
     db.outputHelp();
   });
-  db.command("reset").description("Drop and recreate every table in the development database (keeps the MySQL user).").option("--migrate", "run `npx prisma migrate deploy` afterwards, without asking").option("--seed", "run `npx prisma db seed` afterwards, without asking").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to update (defaults to .env)").action(async (opts) => {
-    await runAndSetExitCode(
+  db.command("reset").description("Drop and recreate every table in the developer database (keeps the MySQL user).").option("--migrate", "run `npx prisma migrate deploy` afterwards, without asking").option("--seed", "run `npx prisma db seed` afterwards, without asking").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to update (defaults to .env)").action(async (opts) => {
+    await runAndSetExitCode2(
       () => runDbReset({
         ...opts.migrate === true ? { migrate: true } : {},
         ...opts.seed === true ? { seed: true } : {},
@@ -3127,7 +3426,7 @@ function registerDbCommand(program) {
     );
   });
   db.command("seed").description("Run `npx prisma db seed` with the Cloud SQL Auth Proxy up and DATABASE_URL set.").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to update (defaults to .env)").passThroughOptions().argument("[args...]", "extra arguments forwarded to `npx prisma db seed` (put them after `--`)").action(async (args, opts) => {
-    await runAndSetExitCode(
+    await runAndSetExitCode2(
       () => runDbSeed({
         ...opts.port !== void 0 ? { port: opts.port } : {},
         ...opts.envFile !== void 0 ? { envFile: opts.envFile } : {},
@@ -3135,8 +3434,8 @@ function registerDbCommand(program) {
       })
     );
   });
-  db.command("shell").description("Open a SQL shell against the development database (the `mysql` client if available, otherwise a built-in REPL).").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to read/patch (defaults to .env)").option("--repl", "force the built-in SQL REPL even when `mysql` is on PATH").option("-e, --execute <sql>", "run one SQL statement and exit").option("--no-env", "do not patch DATABASE_URL into the project's .env file").action(async (opts) => {
-    await runAndSetExitCode(
+  db.command("shell").description("Open a SQL shell against the developer database (the `mysql` client if available, otherwise a built-in REPL).").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to read/patch (defaults to .env)").option("--repl", "force the built-in SQL REPL even when `mysql` is on PATH").option("-e, --execute <sql>", "run one SQL statement and exit").option("--no-env", "do not patch DATABASE_URL into the project's .env file").action(async (opts) => {
+    await runAndSetExitCode2(
       () => runDbShell({
         ...opts.port !== void 0 ? { port: opts.port } : {},
         ...opts.envFile !== void 0 ? { envFile: opts.envFile } : {},
@@ -3146,10 +3445,11 @@ function registerDbCommand(program) {
       })
     );
   });
+  registerDbCredentialCommand(db);
 }
 
 // src/commands/dev.ts
-function defaultDeps() {
+function defaultDeps2() {
   return { startDevSession, startProcess, readPackageScript, requireProject };
 }
 var RECURSION_HINT = "Set `dev_command` in `.meridian/project.json` to the underlying command (e.g. `next dev`), or run `meridian dev -- next dev` to bypass the script entirely.";
@@ -3228,7 +3528,7 @@ function buildDevJsonPayload(session) {
   };
 }
 async function runDev(options = {}) {
-  const deps = { ...defaultDeps(), ...options.deps };
+  const deps = { ...defaultDeps2(), ...options.deps };
   if (isInsideDevSession()) throw nestedSessionError();
   const project = deps.requireProject(workingDirectory());
   const resolved = resolveDevCommand(deps, project, options.command);
@@ -3272,7 +3572,7 @@ async function runDev(options = {}) {
   }
 }
 function registerDevCommand(program) {
-  program.command("dev").description("Run the managed dev database proxy and your app's dev server together.").option("--port <port>", "preferred local port for the Cloud SQL Auth Proxy").option("--env-file <file>", "the .env file to patch, relative to the project root (default .env)").option("--no-env", "don't touch any .env file; just print the DATABASE_URL for manual use").argument("[command...]", "run this instead of the app's dev script, e.g. `meridian dev -- next dev`").passThroughOptions().action(async (command, opts) => {
+  program.command("dev").description("Run the managed developer database proxy and your app's dev server together.").option("--port <port>", "preferred local port for the Cloud SQL Auth Proxy").option("--env-file <file>", "the .env file to patch, relative to the project root (default .env)").option("--no-env", "don't touch any .env file; just print the DATABASE_URL for manual use").argument("[command...]", "run this instead of the app's dev script, e.g. `meridian dev -- next dev`").passThroughOptions().action(async (command, opts) => {
     const port = parsePortOption(opts.port);
     const code = await runDev({
       ...command.length > 0 ? { command } : {},
@@ -3287,7 +3587,7 @@ function registerDevCommand(program) {
 // src/commands/link.ts
 import { existsSync as existsSync5 } from "fs";
 import { join as join7 } from "path";
-function defaultDeps2() {
+function defaultDeps3() {
   return { createClient: createApiClient };
 }
 function formatOrg(org) {
@@ -3302,7 +3602,7 @@ function resolveChoiceAnswer(choices, raw, keysOf) {
   return match !== void 0 ? match.name : raw;
 }
 async function runLink(options = {}) {
-  const deps = { ...defaultDeps2(), ...options.deps };
+  const deps = { ...defaultDeps3(), ...options.deps };
   const json = isJsonOutput();
   const root = resolveProjectRoot(workingDirectory()) ?? workingDirectory();
   if (!existsSync5(join7(root, "package.json"))) {
@@ -3498,7 +3798,7 @@ async function defaultOpenUrl(url) {
   const { default: open } = await import("open");
   await open(url);
 }
-function defaultDeps3() {
+function defaultDeps4() {
   return { createClient: createApiClient, runDeviceFlow, openUrl: defaultOpenUrl };
 }
 function shouldOpenBrowser(noBrowser) {
@@ -3519,7 +3819,7 @@ function hintUnlessLinked(json) {
   hint("Run `meridian link` to connect this project to a Meridian app.");
 }
 async function runLogin(options = {}) {
-  const deps = { ...defaultDeps3(), ...options.deps };
+  const deps = { ...defaultDeps4(), ...options.deps };
   const json = isJsonOutput();
   if (options.force !== true) {
     const auth = getAuth();
@@ -3656,7 +3956,7 @@ async function createSnapshot(info, options) {
       }
     });
   } catch (error2) {
-    throw new CliError(`Could not snapshot the development database: ${describeError(error2)}`, {
+    throw new CliError(`Could not snapshot the developer database: ${describeError(error2)}`, {
       hint: SKIP_SNAPSHOT_HINT,
       cause: error2
     });
@@ -3665,13 +3965,13 @@ async function createSnapshot(info, options) {
   try {
     bytes = (await stat(path)).size;
   } catch (error2) {
-    throw new CliError("Could not snapshot the development database: the dump did not produce a file.", {
+    throw new CliError("Could not snapshot the developer database: the dump did not produce a file.", {
       hint: SKIP_SNAPSHOT_HINT,
       cause: error2
     });
   }
   if (bytes === 0) {
-    throw new CliError("Could not snapshot the development database: the dump produced an empty file.", {
+    throw new CliError("Could not snapshot the developer database: the dump produced an empty file.", {
       hint: SKIP_SNAPSHOT_HINT
     });
   }
@@ -3862,7 +4162,7 @@ async function pruneSnapshots(dir, keep) {
 // src/commands/migrate.ts
 var DEFAULT_KEEP_SNAPSHOTS = 5;
 var MAX_OUTPUT_EXCERPT = 4e3;
-function defaultDeps4() {
+function defaultDeps5() {
   return {
     startDevSession,
     createSnapshot,
@@ -3880,7 +4180,7 @@ function defaultDeps4() {
   };
 }
 function resolveDeps2(overrides) {
-  return { ...defaultDeps4(), ...overrides };
+  return { ...defaultDeps5(), ...overrides };
 }
 function formatSize(bytes) {
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
@@ -3907,10 +4207,10 @@ async function runMigration(session, deps, ctx) {
   let snapshot;
   if (options.skipSnapshot !== true) {
     snapshot = await withSpinner(
-      "Snapshotting the development database...",
+      "Snapshotting the developer database...",
       () => deps.createSnapshot(session.connection, { dir, now: deps.now }),
       {
-        success: (result) => result.path === null ? "Development database is empty. Nothing to snapshot." : `Snapshot saved to ${style.path(result.path)} (${formatSize(result.bytes)}).`
+        success: (result) => result.path === null ? "Developer database is empty. Nothing to snapshot." : `Snapshot saved to ${style.path(result.path)} (${formatSize(result.bytes)}).`
       }
     );
   }
@@ -3943,12 +4243,12 @@ async function runMigration(session, deps, ctx) {
     } else {
       const snapshotPath = snapshot.path;
       warn(
-        `\`${commandString}\` failed (exit code ${runResult.code}); ` + (snapshotPath === null ? "rolling the development database back to its pre-migration (empty) state..." : "rolling back the development database to the pre-migration snapshot...")
+        `\`${commandString}\` failed (exit code ${runResult.code}); ` + (snapshotPath === null ? "rolling the developer database back to its pre-migration (empty) state..." : "rolling back the developer database to the pre-migration snapshot...")
       );
       try {
         await client.resetDevDatabase(appId);
         if (snapshotPath === null) {
-          success("Development database rolled back to its pre-migration (empty) state.");
+          success("Developer database rolled back to its pre-migration (empty) state.");
         } else {
           await withSpinner(
             "Restoring the pre-migration snapshot...",
@@ -3961,7 +4261,7 @@ async function runMigration(session, deps, ctx) {
         status = "rolled_back";
         rolledBack = true;
       } catch {
-        error("Automatic rollback failed. The development database may be in a partial state. Treat it as unsafe.");
+        error("Automatic rollback failed. The developer database may be in a partial state. Treat it as unsafe.");
         if (snapshotPath === null) {
           hint("Recover by hand with `meridian db reset`. The database was empty before this migration.");
         } else {
@@ -4036,7 +4336,7 @@ async function runMigrate(options = {}) {
 }
 function registerMigrateCommand(program) {
   program.command("migrate").description(
-    "Snapshot the development database, run `prisma migrate dev`, and roll back to the snapshot automatically if the migration fails."
+    "Snapshot the developer database, run `prisma migrate dev`, and roll back to the snapshot automatically if the migration fails."
   ).option("--skip-snapshot", "run without a pre-migration snapshot (no rollback is possible)").option(
     "--allow-foreign-migrations",
     "run even when prisma/migrations was generated for SQLite or Postgres and cannot apply to MySQL"
@@ -4089,7 +4389,7 @@ function registerUnlinkCommand(program) {
 
 // src/commands/whoami.ts
 var SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1e3;
-function defaultDeps5() {
+function defaultDeps6() {
   return { createClient: createApiClient };
 }
 function toConfigUser2(user) {
@@ -4153,7 +4453,7 @@ function printJsonResult(result, project) {
   });
 }
 async function runWhoami(options = {}) {
-  const deps = { ...defaultDeps5(), ...options.deps };
+  const deps = { ...defaultDeps6(), ...options.deps };
   const json = isJsonOutput();
   const auth = getAuth();
   if (auth === null) throw notLoggedInError();
@@ -4260,7 +4560,7 @@ function resolveGlobalFlags(actionCommand) {
 function buildProgram() {
   const program = new Command();
   program.name("meridian").description(
-    "Managed remote development databases for Meridian apps.\n\nRun `meridian login` once, `meridian link` per project, then `meridian dev`."
+    "Managed remote developer databases for Meridian apps.\n\nRun `meridian login` once, `meridian link` per project, then `meridian dev`."
   ).version(VERSION, "-V, --version").enablePositionalOptions().showHelpAfterError("(run `meridian --help` for usage)");
   addGlobalFlags(program);
   program.hook("preAction", (_thisCommand, actionCommand) => {