@the-meridian/cli 1.0.3 → 1.2.0

package/dist/index.js

@@ -67,6 +67,7 @@ var deviceInfoResponseSchema = z.object({
   created_at: z.string().optional()
 }).loose();
 var devDatabaseStatusSchema = z.union([z.enum(["provisioning", "ready", "error"]), z.string()]);
+var devDatabaseAccessSchema = z.union([z.enum(["gateway", "proxy"]), z.string()]);
 var devDatabaseSchema = z.object({
   id: idSchema,
   status: devDatabaseStatusSchema,
@@ -78,7 +79,21 @@ var devDatabaseSchema = z.object({
   region: z.string().nullish(),
   created_at: z.string().nullish(),
   /** Set by the API only while `status` is `error`; surfaced verbatim to the developer. */
-  error_message: z.string().nullish()
+  error_message: z.string().nullish(),
+  /**
+   * How the CLI reaches the database: `gateway` (the Meridian database
+   * gateway with a per-developer certificate) or `proxy` (cloud-sql-proxy).
+   * Absent from an API older than the gateway, which means `proxy`.
+   */
+  access: devDatabaseAccessSchema.nullish()
+}).loose();
+var devDatabaseCertificateSchema = z.object({
+  certificate_pem: z.string(),
+  ca_pem: z.string(),
+  host: z.string(),
+  port: z.coerce.number(),
+  expires_at: z.string(),
+  fingerprint: z.string()
 }).loose();
 var devCredentialsSchema = z.object({
   host: z.string(),
@@ -117,6 +132,51 @@ var migrationRunSchema = z.object({
   output_excerpt: z.string().nullish(),
   created_at: z.string().nullish()
 }).loose();
+function envelopeSchema(data) {
+  return z.object({ data }).loose();
+}
+var hostingAddonSchema = z.object({
+  uuid: z.string(),
+  type: z.string().nullish(),
+  name: z.string().nullish(),
+  status: z.string().nullish(),
+  database: z.object({
+    type: z.string().nullish(),
+    database: z.string().nullish()
+  }).loose().nullish()
+}).loose();
+var hostingEnvironmentSchema = z.object({
+  uuid: z.string(),
+  type: z.string().nullish(),
+  name: z.string().nullish(),
+  addons: z.array(hostingAddonSchema).nullish()
+}).loose();
+var externalCredentialSchema = z.object({
+  id: z.string(),
+  label: z.string(),
+  username: z.string(),
+  access_mode: z.string(),
+  max_connections: z.number().nullish(),
+  allowed_cidrs: z.array(z.string()).nullish(),
+  certificate_serial: z.string().nullish(),
+  certificate_expires_at: z.string().nullish(),
+  last_connected_at: z.string().nullish(),
+  last_connected_ip: z.string().nullish(),
+  locked_until: z.string().nullish(),
+  status: z.string(),
+  revoked_at: z.string().nullish(),
+  created_at: z.string().nullish()
+}).loose();
+var externalCredentialListMetaSchema = z.object({
+  available: z.boolean().nullish(),
+  host: z.string().nullish(),
+  port: z.coerce.number().nullish(),
+  max_credentials: z.number().nullish()
+}).loose();
+var externalCredentialListSchema = z.object({
+  data: z.array(externalCredentialSchema),
+  meta: externalCredentialListMetaSchema.nullish()
+}).loose();
 
 // src/lib/errors.ts
 var CliError = class extends Error {
@@ -297,6 +357,18 @@ var ApiClient = class _ApiClient {
       `/app/cli/apps/${encodePathSegment(appId)}/dev-database/proxy-token`
     );
   }
+  /**
+   * Signs `publicKeyPem` (SPKI) as this developer's client certificate for the
+   * database gateway. Each call replaces the previous certificate server-side.
+   */
+  async issueDevDatabaseCertificate(appId, publicKeyPem) {
+    return this.request(
+      devDatabaseCertificateSchema,
+      "POST",
+      `/app/cli/apps/${encodePathSegment(appId)}/dev-database/certificate`,
+      { body: { public_key: publicKeyPem } }
+    );
+  }
   async resetDevDatabase(appId) {
     return this.request(devDatabaseSchema, "POST", `/app/cli/apps/${encodePathSegment(appId)}/dev-database/reset`);
   }
@@ -313,6 +385,28 @@ var ApiClient = class _ApiClient {
       `/app/cli/apps/${encodePathSegment(appId)}/dev-database/migrations`
     );
   }
+  /** `GET /app/apps/{app}/environments`, each with its add-ons. Used to find an environment's database. */
+  async listEnvironments(appId) {
+    const body = await this.request(
+      envelopeSchema(z2.array(hostingEnvironmentSchema)),
+      "GET",
+      `/app/apps/${encodePathSegment(appId)}/environments`
+    );
+    return body.data;
+  }
+  /** `GET /app/addons/{addon}/database/external-credentials`: the credentials, plus whether external access is on. */
+  async listExternalCredentials(addonId) {
+    const body = await this.request(externalCredentialListSchema, "GET", externalCredentialsPath(addonId));
+    return { credentials: body.data, meta: body.meta ?? {} };
+  }
+  async revokeExternalCredential(addonId, credentialId) {
+    const body = await this.request(
+      envelopeSchema(externalCredentialSchema),
+      "DELETE",
+      `${externalCredentialsPath(addonId)}/${encodePathSegment(credentialId)}`
+    );
+    return body.data;
+  }
   #buildUrl(path, query) {
     const url = new URL(`${this.baseUrl}${path}`);
     if (query !== void 0) {
@@ -370,6 +464,9 @@ var ApiClient = class _ApiClient {
 function encodePathSegment(id) {
   return encodeURIComponent(String(id));
 }
+function externalCredentialsPath(addonId) {
+  return `/app/addons/${encodePathSegment(addonId)}/database/external-credentials`;
+}
 function parseJson(text, method, path) {
   try {
     return JSON.parse(text);
@@ -452,9 +549,12 @@ function extractErrorCode(body) {
   return record !== void 0 && typeof record.error === "string" ? record.error : void 0;
 }
 var HINTS_BY_ERROR_CODE = {
-  dev_database_limit_reached: "Your plan does not include a development database for you on this app. Every collaborator gets their own out of the plan's allowance, so upgrading the organization's plan in the Meridian dashboard is what unlocks it.",
+  dev_database_limit_reached: "Your plan does not include a developer database for you on this app. Every collaborator gets their own out of the plan's allowance, so upgrading the organization's plan in the Meridian dashboard is what unlocks it.",
+  dev_databases_unavailable: "This Meridian environment does not offer developer databases. Run `meridian dev` against production (the default API URL) instead.",
   dev_database_over_storage_limit: "Run `meridian db reset` to drop and recreate the schema. Reset and delete stay available while you're over the limit.",
-  FEATURE_NOT_ENTITLED: "Your organization's plan does not include managed development databases; upgrade it in the Meridian dashboard."
+  cli_upgrade_required: "Upgrade the Meridian CLI: npm i -g @the-meridian/cli",
+  EXTERNAL_ACCESS_UNAVAILABLE: "External access is not switched on for this database yet, or the database is not ready. Check the database under Hosting in the Meridian dashboard.",
+  FEATURE_NOT_ENTITLED: "Your organization's plan does not include managed developer databases; upgrade it in the Meridian dashboard."
 };
 function hintForError(status, errorCode) {
   if (errorCode !== void 0) {
@@ -465,7 +565,7 @@ function hintForError(status, errorCode) {
   if (status === 403) return "You may not have access to this organization or app; check your Meridian membership.";
   if (status === 404) return "Run `meridian link` to select a valid organization and app.";
   if (status === 409) {
-    return "The development database is not ready yet. Wait for provisioning to finish, then try again. `meridian dev` polls for you.";
+    return "The developer database is not ready yet. Wait for provisioning to finish, then try again. `meridian dev` polls for you.";
   }
   if (status === 422) return "Check the request for validation errors and try again.";
   if (status === 429) return "You're being rate limited by the Meridian API; wait a moment and try again.";
@@ -1671,14 +1771,770 @@ function redactDatabaseUrl(url) {
   return url.replace(/^(mysql:\/\/[^:@/]+):([^@]*)@/, "$1:****@");
 }
 
+// src/lib/gateway/certificate.ts
+import { generateKeyPair } from "crypto";
+import { createSecureContext } from "tls";
+import { promisify } from "util";
+var generateKeyPairAsync = promisify(generateKeyPair);
+function gatewayCertificateFromPem(material) {
+  return {
+    host: material.host,
+    port: material.port,
+    expiresAt: material.expiresAt,
+    fingerprint: material.fingerprint,
+    secureContext: createSecureContext({
+      key: material.keyPem,
+      cert: material.certificatePem,
+      ca: material.caPem,
+      minVersion: "TLSv1.2"
+    })
+  };
+}
+async function generateGatewayKeyPair() {
+  const { publicKey, privateKey } = await generateKeyPairAsync("ec", { namedCurve: "prime256v1" });
+  return {
+    publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+    privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }).toString()
+  };
+}
+async function issueGatewayCertificate(client, appId) {
+  const { publicKeyPem, privateKeyPem } = await generateGatewayKeyPair();
+  const issued = await client.issueDevDatabaseCertificate(appId, publicKeyPem);
+  return gatewayCertificateFromPem({
+    keyPem: privateKeyPem,
+    certificatePem: issued.certificate_pem,
+    caPem: issued.ca_pem,
+    host: issued.host,
+    port: issued.port,
+    expiresAt: issued.expires_at,
+    fingerprint: issued.fingerprint
+  });
+}
+var ASSUMED_LIFETIME_MS = 24 * 60 * 6e4;
+var DEFAULT_REFRESH_BEFORE_MS = 4 * 60 * 6e4;
+var MIN_REFRESH_DELAY_MS = 6e4;
+function certificateRefreshDelay(expiresAt, now, refreshBeforeMs = DEFAULT_REFRESH_BEFORE_MS) {
+  const parsed = Date.parse(expiresAt);
+  const expiry = Number.isNaN(parsed) ? now + ASSUMED_LIFETIME_MS : parsed;
+  return Math.max(MIN_REFRESH_DELAY_MS, expiry - refreshBeforeMs - now);
+}
+
+// src/lib/gateway/forwarder.ts
+import { connect as netConnect, createServer, isIP } from "net";
+import { connect as tlsConnect } from "tls";
+
+// src/lib/gateway/packets.ts
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+var CLIENT = {
+  LONG_PASSWORD: 1,
+  FOUND_ROWS: 2,
+  LONG_FLAG: 4,
+  CONNECT_WITH_DB: 8,
+  NO_SCHEMA: 16,
+  COMPRESS: 32,
+  ODBC: 64,
+  LOCAL_FILES: 128,
+  IGNORE_SPACE: 256,
+  PROTOCOL_41: 512,
+  INTERACTIVE: 1024,
+  SSL: 2048,
+  IGNORE_SIGPIPE: 4096,
+  TRANSACTIONS: 8192,
+  RESERVED: 16384,
+  SECURE_CONNECTION: 32768,
+  MULTI_STATEMENTS: 65536,
+  MULTI_RESULTS: 131072,
+  PS_MULTI_RESULTS: 262144,
+  PLUGIN_AUTH: 524288,
+  CONNECT_ATTRS: 1048576,
+  PLUGIN_AUTH_LENENC_CLIENT_DATA: 2097152,
+  CAN_HANDLE_EXPIRED_PASSWORDS: 4194304,
+  SESSION_TRACK: 8388608,
+  DEPRECATE_EOF: 16777216,
+  OPTIONAL_RESULTSET_METADATA: 33554432,
+  ZSTD_COMPRESSION: 67108864,
+  QUERY_ATTRIBUTES: 134217728
+};
+var GATEWAY_CAPABILITIES = CLIENT.LONG_PASSWORD | CLIENT.FOUND_ROWS | CLIENT.LONG_FLAG | CLIENT.CONNECT_WITH_DB | CLIENT.IGNORE_SPACE | CLIENT.PROTOCOL_41 | CLIENT.INTERACTIVE | CLIENT.SSL | CLIENT.IGNORE_SIGPIPE | CLIENT.TRANSACTIONS | CLIENT.RESERVED | CLIENT.SECURE_CONNECTION | CLIENT.MULTI_STATEMENTS | CLIENT.MULTI_RESULTS | CLIENT.PS_MULTI_RESULTS | CLIENT.PLUGIN_AUTH | CLIENT.CONNECT_ATTRS | CLIENT.PLUGIN_AUTH_LENENC_CLIENT_DATA | CLIENT.CAN_HANDLE_EXPIRED_PASSWORDS | CLIENT.SESSION_TRACK | CLIENT.DEPRECATE_EOF;
+var LOCAL_CAPABILITIES = GATEWAY_CAPABILITIES & ~CLIENT.SSL;
+var PLUGIN_NATIVE = "mysql_native_password";
+var PLUGIN_CACHING_SHA2 = "caching_sha2_password";
+var SCRAMBLE_LENGTH = 20;
+var DEFAULT_CHARSET = 255;
+var MAX_PAYLOAD = 16777215;
+var MAX_HANDSHAKE_PACKET = 64 * 1024;
+var AUTH_MORE_DATA = 1;
+var FAST_AUTH_SUCCESS = 3;
+var PERFORM_FULL_AUTH = 4;
+var SERVER_STATUS_AUTOCOMMIT = 2;
+function encodePacket(seq, payload) {
+  if (payload.length >= MAX_PAYLOAD) throw new Error(`refusing to write a ${payload.length} byte handshake packet`);
+  const header = Buffer.alloc(4);
+  header.writeUIntLE(payload.length, 0, 3);
+  header[3] = seq & 255;
+  return Buffer.concat([header, payload]);
+}
+var PacketReader = class {
+  #socket;
+  #maxPacket;
+  #buffer = Buffer.alloc(0);
+  #failure;
+  #waiter;
+  #onData = (chunk) => {
+    this.#buffer = this.#buffer.length === 0 ? chunk : Buffer.concat([this.#buffer, chunk]);
+    this.#settle();
+  };
+  #onClose = () => {
+    this.#fail(new Error("the connection closed during the MySQL handshake"));
+  };
+  #onError = (error2) => {
+    this.#fail(error2);
+  };
+  constructor(socket, maxPacket = MAX_HANDSHAKE_PACKET) {
+    this.#socket = socket;
+    this.#maxPacket = maxPacket;
+    socket.on("data", this.#onData);
+    socket.on("end", this.#onClose);
+    socket.on("close", this.#onClose);
+    socket.on("error", this.#onError);
+  }
+  read() {
+    return new Promise((resolve2, reject) => {
+      this.#waiter = { resolve: resolve2, reject };
+      this.#settle();
+    });
+  }
+  /** Stops reading. `pause` keeps later bytes in the socket for a pipe() to pick up. */
+  release(options) {
+    if (options.pause) this.#socket.pause();
+    this.#socket.off("data", this.#onData);
+    this.#socket.off("end", this.#onClose);
+    this.#socket.off("close", this.#onClose);
+    this.#socket.off("error", this.#onError);
+    const rest = this.#buffer;
+    this.#buffer = Buffer.alloc(0);
+    return rest;
+  }
+  #fail(error2) {
+    if (this.#failure === void 0) this.#failure = error2;
+    this.#settle();
+  }
+  #settle() {
+    const waiter = this.#waiter;
+    if (waiter === void 0) return;
+    if (this.#buffer.length >= 4) {
+      const length = this.#buffer.readUIntLE(0, 3);
+      if (length > this.#maxPacket) {
+        this.#waiter = void 0;
+        waiter.reject(new Error(`a ${length} byte packet during the MySQL handshake is too large`));
+        return;
+      }
+      if (this.#buffer.length >= 4 + length) {
+        const seq = this.#buffer[3] ?? 0;
+        const payload = Buffer.from(this.#buffer.subarray(4, 4 + length));
+        this.#buffer = this.#buffer.subarray(4 + length);
+        this.#waiter = void 0;
+        waiter.resolve({ seq, payload });
+        return;
+      }
+    }
+    if (this.#failure !== void 0) {
+      this.#waiter = void 0;
+      waiter.reject(this.#failure);
+    }
+  }
+};
+var Cursor = class {
+  constructor(buf) {
+    this.buf = buf;
+  }
+  buf;
+  pos = 0;
+  get remaining() {
+    return this.buf.length - this.pos;
+  }
+  bytes(n, what) {
+    if (n < 0 || this.remaining < n) throw new Error(`truncated packet reading ${what}`);
+    const out = this.buf.subarray(this.pos, this.pos + n);
+    this.pos += n;
+    return out;
+  }
+  u8(what) {
+    return this.bytes(1, what)[0] ?? 0;
+  }
+  u16(what) {
+    return this.bytes(2, what).readUInt16LE(0);
+  }
+  u32(what) {
+    return this.bytes(4, what).readUInt32LE(0);
+  }
+  nulString(what) {
+    const end = this.buf.indexOf(0, this.pos);
+    if (end < 0) throw new Error(`truncated packet reading ${what}`);
+    const out = this.buf.subarray(this.pos, end);
+    this.pos = end + 1;
+    return out;
+  }
+  /** Everything left, without a trailing NUL. */
+  restNul() {
+    let out = this.buf.subarray(this.pos);
+    this.pos = this.buf.length;
+    if (out.length > 0 && out[out.length - 1] === 0) out = out.subarray(0, out.length - 1);
+    return out;
+  }
+  lenencInt(what) {
+    const first = this.u8(what);
+    if (first < 251) return first;
+    if (first === 252) return this.u16(what);
+    if (first === 253) return this.bytes(3, what).readUIntLE(0, 3);
+    if (first === 254) {
+      const value = this.bytes(8, what).readBigUInt64LE(0);
+      if (value > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error(`${what} is too large`);
+      return Number(value);
+    }
+    throw new Error(`invalid length-encoded integer reading ${what}`);
+  }
+  lenencBytes(what) {
+    return this.bytes(this.lenencInt(what), what);
+  }
+};
+function lenencInt(n) {
+  if (n < 251) return Buffer.from([n]);
+  if (n <= 65535) {
+    const b2 = Buffer.alloc(3);
+    b2[0] = 252;
+    b2.writeUInt16LE(n, 1);
+    return b2;
+  }
+  if (n <= 16777215) {
+    const b2 = Buffer.alloc(4);
+    b2[0] = 253;
+    b2.writeUIntLE(n, 1, 3);
+    return b2;
+  }
+  const b = Buffer.alloc(9);
+  b[0] = 254;
+  b.writeBigUInt64LE(BigInt(n), 1);
+  return b;
+}
+function lenencBytes(value) {
+  return Buffer.concat([lenencInt(value.length), value]);
+}
+function u16(n) {
+  const b = Buffer.alloc(2);
+  b.writeUInt16LE(n & 65535, 0);
+  return b;
+}
+function u32(n) {
+  const b = Buffer.alloc(4);
+  b.writeUInt32LE(n >>> 0, 0);
+  return b;
+}
+var NUL = Buffer.from([0]);
+function encodeGreeting(g) {
+  if (g.scramble.length !== SCRAMBLE_LENGTH) throw new Error("the greeting scramble must be 20 bytes");
+  return Buffer.concat([
+    Buffer.from([10]),
+    Buffer.from(g.serverVersion, "utf8"),
+    NUL,
+    u32(g.connectionId),
+    g.scramble.subarray(0, 8),
+    NUL,
+    u16(g.capabilities),
+    Buffer.from([g.charset]),
+    u16(g.status),
+    u16(g.capabilities >>> 16),
+    Buffer.from([SCRAMBLE_LENGTH + 1]),
+    Buffer.alloc(10),
+    g.scramble.subarray(8),
+    NUL,
+    Buffer.from(g.authPlugin, "utf8"),
+    NUL
+  ]);
+}
+function localGreeting(connectionId, scramble, serverVersion) {
+  return {
+    serverVersion,
+    connectionId,
+    scramble,
+    capabilities: LOCAL_CAPABILITIES,
+    charset: DEFAULT_CHARSET,
+    status: SERVER_STATUS_AUTOCOMMIT,
+    authPlugin: PLUGIN_NATIVE
+  };
+}
+function parseGreeting(payload) {
+  if (payload[0] === 255) throw serverErrorFromPacket(payload);
+  const r = new Cursor(payload);
+  const version = r.u8("protocol version");
+  if (version !== 10) throw new Error(`unsupported handshake version ${version}`);
+  const serverVersion = r.nulString("server version").toString("utf8");
+  const connectionId = r.u32("connection id");
+  const part1 = Buffer.from(r.bytes(8, "scramble part 1"));
+  r.u8("filler");
+  let capabilities = r.u16("capabilities");
+  let charset = DEFAULT_CHARSET;
+  let status = 0;
+  let authPlugin = "";
+  let scramble = part1;
+  if (r.remaining > 0) {
+    charset = r.u8("charset");
+    status = r.u16("status");
+    capabilities = (capabilities | r.u16("capabilities upper") << 16) >>> 0;
+    const authLength = r.u8("auth data length");
+    r.bytes(10, "reserved");
+    if ((capabilities & CLIENT.SECURE_CONNECTION) !== 0) {
+      let part2 = r.bytes(Math.max(13, authLength - 8), "scramble part 2");
+      if (part2.length > 0 && part2[part2.length - 1] === 0) part2 = part2.subarray(0, part2.length - 1);
+      scramble = Buffer.concat([part1, part2]);
+    }
+    if ((capabilities & CLIENT.PLUGIN_AUTH) !== 0) authPlugin = r.restNul().toString("utf8");
+  }
+  if (scramble.length < SCRAMBLE_LENGTH) throw new Error(`the server scramble is ${scramble.length} bytes`);
+  return {
+    serverVersion,
+    connectionId,
+    scramble: scramble.subarray(0, SCRAMBLE_LENGTH),
+    capabilities,
+    charset,
+    status,
+    authPlugin: authPlugin === "" ? PLUGIN_NATIVE : authPlugin
+  };
+}
+function encodeSslRequest(capabilities, maxPacketSize, charset) {
+  return Buffer.concat([u32(capabilities | CLIENT.SSL), u32(maxPacketSize), Buffer.from([charset]), Buffer.alloc(23)]);
+}
+function parseHandshakeResponse(payload) {
+  const r = new Cursor(payload);
+  const capabilities = r.u32("capabilities");
+  if ((capabilities & CLIENT.PROTOCOL_41) === 0) throw new Error("the client does not speak protocol 4.1");
+  const maxPacketSize = r.u32("max packet size");
+  const charset = r.u8("charset");
+  r.bytes(23, "filler");
+  if (r.remaining === 0) {
+    return { capabilities, maxPacketSize, charset, username: "", authResponse: Buffer.alloc(0), database: "", authPlugin: "", attributes: [] };
+  }
+  const username = r.nulString("username").toString("utf8");
+  let authResponse;
+  if ((capabilities & CLIENT.PLUGIN_AUTH_LENENC_CLIENT_DATA) !== 0) authResponse = r.lenencBytes("auth response");
+  else if ((capabilities & CLIENT.SECURE_CONNECTION) !== 0) authResponse = r.bytes(r.u8("auth response length"), "auth response");
+  else authResponse = r.nulString("auth response");
+  let database = "";
+  if ((capabilities & CLIENT.CONNECT_WITH_DB) !== 0 && r.remaining > 0) database = r.nulString("database").toString("utf8");
+  let authPlugin = "";
+  if ((capabilities & CLIENT.PLUGIN_AUTH) !== 0 && r.remaining > 0) authPlugin = r.nulString("auth plugin").toString("utf8");
+  const attributes = [];
+  if ((capabilities & CLIENT.CONNECT_ATTRS) !== 0 && r.remaining > 0) {
+    const attrs = new Cursor(r.lenencBytes("attributes"));
+    while (attrs.remaining > 0) {
+      const key = attrs.lenencBytes("attribute key").toString("utf8");
+      const value = attrs.lenencBytes("attribute value").toString("utf8");
+      attributes.push([key, value]);
+    }
+  }
+  return {
+    capabilities,
+    maxPacketSize,
+    charset,
+    username,
+    authResponse: Buffer.from(authResponse),
+    database,
+    authPlugin,
+    attributes
+  };
+}
+function encodeHandshakeResponse(h) {
+  const parts = [u32(h.capabilities), u32(h.maxPacketSize), Buffer.from([h.charset]), Buffer.alloc(23)];
+  parts.push(Buffer.from(h.username, "utf8"), NUL);
+  if ((h.capabilities & CLIENT.PLUGIN_AUTH_LENENC_CLIENT_DATA) !== 0) parts.push(lenencBytes(h.authResponse));
+  else if ((h.capabilities & CLIENT.SECURE_CONNECTION) !== 0) parts.push(Buffer.from([h.authResponse.length]), h.authResponse);
+  else parts.push(h.authResponse, NUL);
+  if ((h.capabilities & CLIENT.CONNECT_WITH_DB) !== 0) parts.push(Buffer.from(h.database, "utf8"), NUL);
+  if ((h.capabilities & CLIENT.PLUGIN_AUTH) !== 0) parts.push(Buffer.from(h.authPlugin, "utf8"), NUL);
+  if ((h.capabilities & CLIENT.CONNECT_ATTRS) !== 0) {
+    const attrs = h.attributes.map(
+      ([key, value]) => Buffer.concat([lenencBytes(Buffer.from(key, "utf8")), lenencBytes(Buffer.from(value, "utf8"))])
+    );
+    parts.push(lenencBytes(Buffer.concat(attrs)));
+  }
+  return Buffer.concat(parts);
+}
+function encodeAuthSwitchRequest(plugin, scramble) {
+  return Buffer.concat([Buffer.from([254]), Buffer.from(plugin, "utf8"), NUL, scramble, NUL]);
+}
+function parseAuthSwitchRequest(payload) {
+  if (payload[0] !== 254) throw new Error("not an auth switch request");
+  const r = new Cursor(payload);
+  r.pos = 1;
+  const plugin = r.nulString("auth plugin").toString("utf8");
+  let scramble = Buffer.from(r.restNul());
+  if (scramble.length > SCRAMBLE_LENGTH) scramble = scramble.subarray(0, SCRAMBLE_LENGTH);
+  return { plugin, scramble };
+}
+var isOk = (payload) => payload[0] === 0;
+var isErr = (payload) => payload[0] === 255;
+var isAuthSwitch = (payload) => payload[0] === 254;
+var isAuthMoreData = (payload) => payload[0] === AUTH_MORE_DATA;
+function encodeErr(code, sqlState, message) {
+  const state2 = sqlState.length === 5 ? sqlState : "HY000";
+  return Buffer.concat([Buffer.from([255]), u16(code), Buffer.from(`#${state2}`, "latin1"), Buffer.from(message, "utf8")]);
+}
+var MysqlServerError = class extends Error {
+  constructor(code, sqlState, message) {
+    super(message);
+    this.code = code;
+    this.sqlState = sqlState;
+    this.name = "MysqlServerError";
+  }
+  code;
+  sqlState;
+};
+function serverErrorFromPacket(payload) {
+  if (payload.length < 3 || payload[0] !== 255) return new MysqlServerError(0, "HY000", "unknown error");
+  const code = payload.readUInt16LE(1);
+  let rest = payload.subarray(3);
+  let sqlState = "HY000";
+  if (rest.length >= 6 && rest[0] === 35) {
+    sqlState = rest.subarray(1, 6).toString("latin1");
+    rest = rest.subarray(6);
+  }
+  return new MysqlServerError(code, sqlState, rest.toString("utf8"));
+}
+function newScramble() {
+  const b = randomBytes(SCRAMBLE_LENGTH);
+  for (let i = 0; i < b.length; i++) {
+    let v = (b[i] ?? 0) & 127 | 1;
+    if (v === 36) v = 37;
+    b[i] = v;
+  }
+  return b;
+}
+function xor(a, b) {
+  const out = Buffer.alloc(a.length);
+  for (let i = 0; i < a.length; i++) out[i] = (a[i] ?? 0) ^ (b[i] ?? 0);
+  return out;
+}
+function scrambleNative(password, nonce) {
+  if (password === "") return Buffer.alloc(0);
+  const h1 = createHash("sha1").update(password, "utf8").digest();
+  const h2 = createHash("sha1").update(h1).digest();
+  const h3 = createHash("sha1").update(nonce).update(h2).digest();
+  return xor(h1, h3);
+}
+function scrambleCachingSha2(password, nonce) {
+  if (password === "") return Buffer.alloc(0);
+  const h1 = createHash("sha256").update(password, "utf8").digest();
+  const h2 = createHash("sha256").update(h1).digest();
+  const h3 = createHash("sha256").update(h2).update(nonce).digest();
+  return xor(h1, h3);
+}
+function scrambleFor(plugin, password, nonce) {
+  switch (plugin) {
+    case PLUGIN_NATIVE:
+      return scrambleNative(password, nonce);
+    case PLUGIN_CACHING_SHA2:
+      return scrambleCachingSha2(password, nonce);
+    default:
+      throw new Error(`unsupported auth plugin "${plugin}"`);
+  }
+}
+function scrambleMatches(received, expected) {
+  return received.length === expected.length && timingSafeEqual(received, expected);
+}
+
+// src/lib/gateway/forwarder.ts
+var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_HANDSHAKE_TIMEOUT_MS = 3e4;
+var REFRESH_RETRY_BACKOFFS_MS = [3e4, 6e4, 12e4, 3e5];
+var SERVER_VERSION = "8.0.40-meridian-forwarder";
+var CLOSE_GRACE_MS = 2e3;
+var ER_ACCESS_DENIED = 1045;
+var ER_HANDSHAKE = 1043;
+var CR_CONN_HOST_ERROR = 2003;
+var LocalRefusal = class extends Error {
+  constructor(code, sqlState, message) {
+    super(message);
+    this.code = code;
+    this.sqlState = sqlState;
+  }
+  code;
+  sqlState;
+};
+function accessDenied(username) {
+  return new LocalRefusal(ER_ACCESS_DENIED, "28000", `Access denied for user '${username}'@'localhost' (using password: YES)`);
+}
+function upstreamCapabilities(clientCapabilities, database) {
+  let caps = clientCapabilities & LOCAL_CAPABILITIES | CLIENT.SSL | CLIENT.PROTOCOL_41 | CLIENT.SECURE_CONNECTION | CLIENT.PLUGIN_AUTH | CLIENT.PLUGIN_AUTH_LENENC_CLIENT_DATA;
+  if (database !== "") caps |= CLIENT.CONNECT_WITH_DB;
+  return caps >>> 0;
+}
+function waitFor(socket, event) {
+  return new Promise((resolve2, reject) => {
+    const onError = (error2) => {
+      socket.off(event, onDone);
+      reject(error2);
+    };
+    const onDone = () => {
+      socket.off("error", onError);
+      resolve2();
+    };
+    socket.once(event, onDone);
+    socket.once("error", onError);
+  });
+}
+function splice(a, b) {
+  const closeOther = (other) => () => {
+    if (other.destroyed) return;
+    other.end();
+    setTimeout(() => other.destroy(), CLOSE_GRACE_MS).unref();
+  };
+  a.on("close", closeOther(b));
+  b.on("close", closeOther(a));
+  a.pipe(b);
+  b.pipe(a);
+}
+async function startGatewayForwarder(options) {
+  const host = options.host ?? DEFAULT_HOST;
+  const handshakeTimeoutMs = options.handshakeTimeoutMs ?? DEFAULT_HANDSHAKE_TIMEOUT_MS;
+  const refreshBeforeMs = options.refreshBeforeMs ?? DEFAULT_REFRESH_BEFORE_MS;
+  const now = options.now ?? Date.now;
+  const emit = (event) => {
+    try {
+      options.onEvent?.(event);
+    } catch {
+    }
+  };
+  let certificate = options.certificate;
+  let running = false;
+  let stopped = false;
+  let connectionId = 0;
+  let refreshTimer;
+  const sockets = /* @__PURE__ */ new Set();
+  const track = (socket) => {
+    sockets.add(socket);
+    socket.once("close", () => sockets.delete(socket));
+    socket.on("error", () => socket.destroy());
+  };
+  async function openUpstream(cert, client) {
+    const raw = netConnect({ host: cert.host, port: cert.port });
+    track(raw);
+    raw.setNoDelay(true);
+    await waitFor(raw, "connect");
+    const rawReader = new PacketReader(raw);
+    const greetingPacket = await rawReader.read();
+    const greeting = parseGreeting(greetingPacket.payload);
+    if ((greeting.capabilities & CLIENT.SSL) === 0) throw new Error("the gateway did not offer TLS");
+    const capabilities = upstreamCapabilities(client.capabilities, client.database);
+    let seq = greetingPacket.seq + 1;
+    raw.write(encodePacket(seq, encodeSslRequest(capabilities, client.maxPacketSize, client.charset)));
+    rawReader.release({ pause: false });
+    const socket = tlsConnect({
+      socket: raw,
+      secureContext: cert.secureContext,
+      host: cert.host,
+      // SNI carries host names only; an IP is still verified against the certificate.
+      ...isIP(cert.host) === 0 ? { servername: cert.host } : {},
+      rejectUnauthorized: true
+    });
+    track(socket);
+    socket.setNoDelay(true);
+    await waitFor(socket, "secureConnect");
+    const reader = new PacketReader(socket);
+    let plugin = PLUGIN_CACHING_SHA2;
+    seq++;
+    socket.write(
+      encodePacket(
+        seq,
+        encodeHandshakeResponse({
+          capabilities,
+          maxPacketSize: client.maxPacketSize,
+          charset: client.charset,
+          username: options.username,
+          authResponse: scrambleCachingSha2(options.password, greeting.scramble),
+          database: client.database,
+          authPlugin: plugin,
+          attributes: client.attributes
+        })
+      )
+    );
+    for (let round = 0; round < 6; round++) {
+      const packet = await reader.read();
+      seq = packet.seq;
+      const payload = packet.payload;
+      if (isOk(payload)) return { socket, ok: payload, leftover: reader.release({ pause: true }) };
+      if (isErr(payload)) throw serverErrorFromPacket(payload);
+      if (isAuthSwitch(payload)) {
+        const request = parseAuthSwitchRequest(payload);
+        plugin = request.plugin;
+        seq++;
+        socket.write(encodePacket(seq, scrambleFor(plugin, options.password, request.scramble)));
+        continue;
+      }
+      if (isAuthMoreData(payload) && plugin === PLUGIN_CACHING_SHA2 && payload.length >= 2) {
+        if (payload[1] === FAST_AUTH_SUCCESS) continue;
+        if (payload[1] === PERFORM_FULL_AUTH) {
+          seq++;
+          socket.write(encodePacket(seq, Buffer.concat([Buffer.from(options.password, "utf8"), Buffer.from([0])])));
+          continue;
+        }
+      }
+      throw new Error(`unexpected packet 0x${(payload[0] ?? 0).toString(16)} from the gateway during authentication`);
+    }
+    throw new Error("the gateway's authentication did not finish");
+  }
+  async function authenticateLocal(local, reader) {
+    const scramble = newScramble();
+    connectionId = connectionId + 1 >>> 0;
+    local.write(encodePacket(0, encodeGreeting(localGreeting(connectionId, scramble, SERVER_VERSION))));
+    const first = await reader.read();
+    let seq = first.seq;
+    const client = parseHandshakeResponse(first.payload);
+    if (first.payload.length === 32) {
+      throw new LocalRefusal(ER_HANDSHAKE, "08S01", "The Meridian forwarder on this port does not use TLS; connect without it (the connection never leaves this machine).");
+    }
+    if ((client.capabilities & (CLIENT.COMPRESS | CLIENT.ZSTD_COMPRESSION)) !== 0) {
+      throw new LocalRefusal(ER_HANDSHAKE, "08S01", "Compression is not supported by the Meridian database gateway; turn it off in your client.");
+    }
+    if (client.username !== options.username) throw accessDenied(client.username);
+    let authResponse = client.authResponse;
+    let plugin = client.authPlugin;
+    if (plugin === "" && (client.capabilities & CLIENT.SECURE_CONNECTION) !== 0) plugin = PLUGIN_NATIVE;
+    if (plugin !== PLUGIN_NATIVE && plugin !== PLUGIN_CACHING_SHA2) {
+      seq++;
+      local.write(encodePacket(seq, encodeAuthSwitchRequest(PLUGIN_NATIVE, scramble)));
+      const answer = await reader.read();
+      seq = answer.seq;
+      authResponse = answer.payload;
+      plugin = PLUGIN_NATIVE;
+    }
+    const expected = plugin === PLUGIN_CACHING_SHA2 ? scrambleCachingSha2(options.password, scramble) : scrambleNative(options.password, scramble);
+    if (!scrambleMatches(authResponse, expected)) throw accessDenied(client.username);
+    if (plugin === PLUGIN_CACHING_SHA2) {
+      seq++;
+      local.write(encodePacket(seq, Buffer.from([AUTH_MORE_DATA, FAST_AUTH_SUCCESS])));
+    }
+    return { client, seq };
+  }
+  async function handleConnection(local) {
+    track(local);
+    local.setNoDelay(true);
+    const reader = new PacketReader(local);
+    let upstream;
+    const timer = setTimeout(() => {
+      emit({ type: "connection-error", message: "A local MySQL handshake timed out." });
+      local.destroy();
+      upstream?.destroy();
+    }, handshakeTimeoutMs);
+    timer.unref();
+    let seq = 0;
+    try {
+      const authenticated = await authenticateLocal(local, reader);
+      seq = authenticated.seq;
+      const cert = certificate;
+      let session;
+      try {
+        session = await openUpstream(cert, authenticated.client);
+      } catch (error2) {
+        if (error2 instanceof MysqlServerError) {
+          throw new LocalRefusal(error2.code, error2.sqlState, error2.message);
+        }
+        throw new LocalRefusal(
+          CR_CONN_HOST_ERROR,
+          "HY000",
+          `Cannot reach the Meridian database gateway at ${cert.host}:${cert.port}: ${describeError(error2)}`
+        );
+      }
+      upstream = session.socket;
+      clearTimeout(timer);
+      local.write(encodePacket(seq + 1, session.ok));
+      const pipelined = reader.release({ pause: true });
+      if (pipelined.length > 0) upstream.write(pipelined);
+      if (session.leftover.length > 0) local.write(session.leftover);
+      splice(local, upstream);
+    } catch (error2) {
+      clearTimeout(timer);
+      upstream?.destroy();
+      if (error2 instanceof LocalRefusal) {
+        if (error2.code !== ER_ACCESS_DENIED) emit({ type: "connection-error", message: error2.message });
+        if (!local.destroyed) local.end(encodePacket(seq + 1, encodeErr(error2.code, error2.sqlState, error2.message)));
+        return;
+      }
+      emit({ type: "connection-error", message: describeError(error2) });
+      local.destroy();
+    }
+  }
+  async function refresh() {
+    if (options.refreshCertificate === void 0) return;
+    const next = await options.refreshCertificate();
+    certificate = next;
+    emit({ type: "certificate-refreshed", expiresAt: next.expiresAt });
+  }
+  function scheduleRefresh(delayMs, attempt) {
+    if (options.refreshCertificate === void 0 || stopped) return;
+    refreshTimer = setTimeout(() => {
+      refresh().then(
+        () => scheduleRefresh(certificateRefreshDelay(certificate.expiresAt, now(), refreshBeforeMs), 0),
+        (error2) => {
+          const backoff = REFRESH_RETRY_BACKOFFS_MS[Math.min(attempt, REFRESH_RETRY_BACKOFFS_MS.length - 1)] ?? 3e5;
+          emit({
+            type: "error",
+            message: `Could not renew the database gateway certificate (${describeError(error2)}); retrying in ${Math.round(backoff / 1e3)}s.`
+          });
+          scheduleRefresh(backoff, attempt + 1);
+        }
+      );
+    }, delayMs);
+    refreshTimer.unref();
+  }
+  const server = createServer((local) => {
+    void handleConnection(local);
+  });
+  await new Promise((resolve2, reject) => {
+    server.once("error", (error2) => {
+      reject(
+        error2.code === "EADDRINUSE" ? new CliError(`Port ${options.port} is already in use.`, {
+          hint: "Pick a different port with --port, or free up that port and try again."
+        }) : error2
+      );
+    });
+    server.listen({ port: options.port, host, exclusive: true }, () => resolve2());
+  });
+  server.on("error", (error2) => emit({ type: "error", message: describeError(error2) }));
+  const address = server.address();
+  const port = typeof address === "object" && address !== null ? address.port : options.port;
+  running = true;
+  emit({ type: "ready", port });
+  scheduleRefresh(certificateRefreshDelay(certificate.expiresAt, now(), refreshBeforeMs), 0);
+  return {
+    host,
+    port,
+    get running() {
+      return running;
+    },
+    get certificate() {
+      return certificate;
+    },
+    refresh,
+    async stop() {
+      if (stopped) return;
+      stopped = true;
+      running = false;
+      if (refreshTimer !== void 0) clearTimeout(refreshTimer);
+      const closed = new Promise((resolve2) => server.close(() => resolve2()));
+      for (const socket of sockets) socket.destroy();
+      await closed;
+    }
+  };
+}
+
 // src/lib/port.ts
-import { createServer } from "net";
+import { createServer as createServer2 } from "net";
 var DEFAULT_START_PORT = 3307;
 var DEFAULT_ATTEMPTS = 20;
 var MAX_PORT = 65535;
 function isPortFree(port, host = "127.0.0.1") {
   return new Promise((resolve2) => {
-    const server = createServer();
+    const server = createServer2();
     server.once("error", () => {
       resolve2(false);
     });
@@ -1690,7 +2546,7 @@ function isPortFree(port, host = "127.0.0.1") {
 }
 function bindEphemeralPort(host) {
   return new Promise((resolve2) => {
-    const server = createServer();
+    const server = createServer2();
     server.once("error", () => resolve2(null));
     server.listen({ port: 0, host, exclusive: true }, () => {
       const address = server.address();
@@ -1852,7 +2708,7 @@ function addShadowDatabaseUrl(root) {
 function wrongUrlError(datasource, url) {
   const problem = url.kind === "literal" ? `hardcodes \`url = "${url.value}"\`` : `reads \`env("${url.name}")\`, but Meridian sets \`${REQUIRED_URL_ENV}\``;
   return new CliError(
-    `\`${datasource.schemaPath}\` ${problem}, so this command would not touch the managed development database.`,
+    `\`${datasource.schemaPath}\` ${problem}, so this command would not touch the managed developer database.`,
     {
       hint: `Change the \`${datasource.name}\` datasource to \`url = env("${REQUIRED_URL_ENV}")\` with \`provider = "${REQUIRED_PROVIDER}"\`. Migrations generated against another database use dialect-specific SQL and have to be regenerated. ${BYPASS_HINT}`
     }
@@ -1860,7 +2716,7 @@ function wrongUrlError(datasource, url) {
 }
 function wrongProviderError(datasource, provider) {
   return new CliError(
-    `\`${datasource.schemaPath}\` sets \`provider = "${provider}"\`, but the managed development database is MySQL.`,
+    `\`${datasource.schemaPath}\` sets \`provider = "${provider}"\`, but the managed developer database is MySQL.`,
     {
       hint: `Change the \`${datasource.name}\` datasource to \`provider = "${REQUIRED_PROVIDER}"\` and regenerate any migrations generated for ${provider}, which use dialect-specific SQL. ${BYPASS_HINT}`
     }
@@ -1927,7 +2783,7 @@ function diagnoseMigrationFailure(root) {
 }
 
 // src/lib/proxy/binary.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { chmodSync as chmodSync3, existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync6, renameSync as renameSync3, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
 import { join as join4 } from "path";
 var PROXY_VERSION = "2.24.1";
@@ -1976,7 +2832,7 @@ function resolveProxyAsset(options) {
   };
 }
 function sha256(data) {
-  return createHash("sha256").update(data).digest("hex");
+  return createHash2("sha256").update(data).digest("hex");
 }
 var CHECKSUM_ROW_PATTERN = /\[([^\]]+)]\([^)]*\)\s*\|\s*([0-9a-fA-F]{64})/g;
 function parseChecksumTable(releaseBody) {
@@ -2117,8 +2973,8 @@ var PROBE_INTERVAL_MS = 150;
 var KILL_GRACE_MS = 2e3;
 var CRASH_BACKOFFS_MS = [200, 1e3, 3e3];
 var MAX_CRASH_RESTARTS = CRASH_BACKOFFS_MS.length;
-var REFRESH_RETRY_BACKOFFS_MS = [3e4, 6e4, 12e4];
-var MIN_REFRESH_DELAY_MS = 6e4;
+var REFRESH_RETRY_BACKOFFS_MS2 = [3e4, 6e4, 12e4];
+var MIN_REFRESH_DELAY_MS2 = 6e4;
 var LOG_RING_SIZE = 20;
 var STDERR_TAIL_LINES = 10;
 function buildProxyArgs(input2) {
@@ -2147,7 +3003,7 @@ function computeRefreshDelayMs(token, refreshSkewMs, assumedLifetimeMs) {
     if (!Number.isNaN(parsed)) expiresAtMs = parsed;
   }
   const effectiveExpiryMs = expiresAtMs ?? Date.now() + assumedLifetimeMs;
-  return Math.max(effectiveExpiryMs - Date.now() - refreshSkewMs, MIN_REFRESH_DELAY_MS);
+  return Math.max(effectiveExpiryMs - Date.now() - refreshSkewMs, MIN_REFRESH_DELAY_MS2);
 }
 function buildStartupFailureError(code, signal, lastLines) {
   const tail = lastLines.slice(-STDERR_TAIL_LINES).join("\n");
@@ -2325,7 +3181,7 @@ async function startProxy(options) {
   }
   function scheduleRefreshRetry() {
     if (stopped) return;
-    const delayMs = REFRESH_RETRY_BACKOFFS_MS[Math.min(refreshBackoffIndex, REFRESH_RETRY_BACKOFFS_MS.length - 1)] ?? 12e4;
+    const delayMs = REFRESH_RETRY_BACKOFFS_MS2[Math.min(refreshBackoffIndex, REFRESH_RETRY_BACKOFFS_MS2.length - 1)] ?? 12e4;
     refreshBackoffIndex += 1;
     if (refreshTimer !== void 0) clearTimeout(refreshTimer);
     refreshTimer = setTimeoutImpl(() => {
@@ -2525,6 +3381,8 @@ function resolveDeps(overrides) {
   return {
     ensureProxyBinary,
     startProxy,
+    issueGatewayCertificate,
+    startGatewayForwarder,
     findFreePort,
     patchEnvFile,
     waitForDatabase,
@@ -2541,17 +3399,17 @@ var DEV_DATABASE_ID_ENV = "MERIDIAN_DEV_DATABASE_ID";
 function provisioningFailedError(devDatabase) {
   const reason = devDatabase.error_message;
   const detail2 = typeof reason === "string" && reason.trim() !== "" ? ` ${reason.trim()}` : "";
-  return new CliError(`Provisioning the development database failed.${detail2}`, {
+  return new CliError(`Provisioning the developer database failed.${detail2}`, {
     hint: "Check the Meridian dashboard for details, or contact support if this keeps happening."
   });
 }
 function provisioningTimeoutError() {
-  return new CliError("Timed out waiting for the development database to be provisioned.", {
+  return new CliError("Timed out waiting for the developer database to be provisioned.", {
     hint: "Try `meridian dev` again in a few minutes, and check the Meridian dashboard for its status."
   });
 }
 function provisioningNotFoundError() {
-  return new CliError("The Meridian API never finished creating the development database.", {
+  return new CliError("The Meridian API never finished creating the developer database.", {
     hint: "Try `meridian dev` again; if this keeps happening, contact Meridian support."
   });
 }
@@ -2563,7 +3421,7 @@ async function pollDevDatabase(client, appId, options, spinner2) {
   const start = now();
   const report = (status) => {
     const elapsedMs = now() - start;
-    spinner2.update(`Provisioning the development database... (${status}, ${Math.round(elapsedMs / 1e3)}s)`);
+    spinner2.update(`Provisioning the developer database... (${status}, ${Math.round(elapsedMs / 1e3)}s)`);
     options.onStatus?.(status, elapsedMs);
   };
   let current2 = await client.ensureDevDatabase(appId);
@@ -2590,9 +3448,9 @@ async function pollDevDatabase(client, appId, options, spinner2) {
 }
 async function ensureDevDatabaseReady(client, appId, options = {}) {
   return withSpinner(
-    "Provisioning the development database...",
+    "Provisioning the developer database...",
     (spinner2) => pollDevDatabase(client, appId, options, spinner2),
-    { success: (db) => `Development database "${db.database}" is ready.` }
+    { success: (db) => `Developer database "${db.database}" is ready.` }
   );
 }
 function toProxyToken(token) {
@@ -2651,6 +3509,97 @@ function handleProxyEvent(event) {
       return;
   }
 }
+async function pickLocalPort(options, deps) {
+  const findPortOptions = { start: DEFAULT_PORT_START };
+  if (options.port !== void 0) findPortOptions.preferred = options.port;
+  const port = await deps.findFreePort(findPortOptions);
+  if (options.port !== void 0 && port !== options.port) {
+    throw new CliError(`Port ${options.port} is already in use.`, {
+      hint: "Pick a different port with --port, or free up that port and try again."
+    });
+  }
+  return port;
+}
+async function startProxyEndpoint(client, appId, devDatabase, credentials, options, deps) {
+  const proxyToken = await withSpinner(
+    "Requesting a Cloud SQL Auth Proxy token...",
+    () => client.issueProxyToken(appId),
+    { success: "Issued a Cloud SQL Auth Proxy token." }
+  );
+  const binaryPath = await withSpinner(
+    "Preparing the Cloud SQL Auth Proxy...",
+    (spinner2) => {
+      const ensureOptions = {
+        onProgress: (received, total) => {
+          spinner2.update(
+            total !== void 0 ? `Downloading the Cloud SQL Auth Proxy... (${formatMb(received)}/${formatMb(total)} MB)` : `Downloading the Cloud SQL Auth Proxy... (${formatMb(received)} MB)`
+          );
+        }
+      };
+      return deps.ensureProxyBinary(ensureOptions);
+    },
+    { success: "Cloud SQL Auth Proxy is ready." }
+  );
+  const port = await pickLocalPort(options, deps);
+  const instanceConnectionName = firstNonEmpty(
+    credentials.instance_connection_name,
+    proxyToken.instance_connection_name,
+    devDatabase.instance_connection_name
+  );
+  if (instanceConnectionName === void 0) {
+    throw new CliError("The Meridian API did not return a Cloud SQL instance connection name.", {
+      hint: "Try again, or contact Meridian support if this persists."
+    });
+  }
+  return withSpinner(
+    `Starting the Cloud SQL Auth Proxy on 127.0.0.1:${port}...`,
+    () => deps.startProxy({
+      binaryPath,
+      instanceConnectionName,
+      token: toProxyToken(proxyToken),
+      port,
+      ...options.refreshToken !== false ? { refreshToken: async () => toProxyToken(await client.issueProxyToken(appId)) } : {},
+      onEvent: handleProxyEvent
+    }),
+    { success: `Cloud SQL Auth Proxy listening on 127.0.0.1:${port}.` }
+  );
+}
+function handleForwarderEvent(event) {
+  switch (event.type) {
+    case "ready":
+      debug(`Database gateway forwarder listening on port ${event.port}.`);
+      return;
+    case "connection-error":
+      debug(`Database gateway connection failed: ${event.message}`);
+      return;
+    case "certificate-refreshed":
+      step(`Renewed the database gateway certificate (expires ${event.expiresAt}).`);
+      return;
+    case "error":
+      warn(`Database gateway: ${event.message} Restart \`meridian dev\` if the database becomes unreachable.`);
+      return;
+  }
+}
+async function startGatewayEndpoint(client, appId, credentials, options, deps) {
+  const certificate = await withSpinner(
+    "Requesting a database gateway certificate...",
+    () => deps.issueGatewayCertificate(client, appId),
+    { success: (cert) => `Issued a database gateway certificate (expires ${cert.expiresAt}).` }
+  );
+  const port = await pickLocalPort(options, deps);
+  return withSpinner(
+    `Starting the database gateway forwarder on 127.0.0.1:${port}...`,
+    () => deps.startGatewayForwarder({
+      port,
+      username: credentials.username,
+      password: credentials.password,
+      certificate,
+      ...options.refreshToken !== false ? { refreshCertificate: () => deps.issueGatewayCertificate(client, appId) } : {},
+      onEvent: handleForwarderEvent
+    }),
+    { success: `Database gateway forwarder listening on 127.0.0.1:${port} (${certificate.host}).` }
+  );
+}
 async function startDevSession(options = {}) {
   const deps = resolveDeps(options.deps);
   let proxy;
@@ -2667,55 +3616,8 @@ async function startDevSession(options = {}) {
         success: (creds) => `Fetched credentials for database "${creds.database}"${typeof creds.expires_at === "string" ? ` (expire ${creds.expires_at})` : ""}.`
       }
     );
-    const proxyToken = await withSpinner(
-      "Requesting a Cloud SQL Auth Proxy token...",
-      () => client.issueProxyToken(appId),
-      { success: "Issued a Cloud SQL Auth Proxy token." }
-    );
-    const binaryPath = await withSpinner(
-      "Preparing the Cloud SQL Auth Proxy...",
-      (spinner2) => {
-        const ensureOptions = {
-          onProgress: (received, total) => {
-            spinner2.update(
-              total !== void 0 ? `Downloading the Cloud SQL Auth Proxy... (${formatMb(received)}/${formatMb(total)} MB)` : `Downloading the Cloud SQL Auth Proxy... (${formatMb(received)} MB)`
-            );
-          }
-        };
-        return deps.ensureProxyBinary(ensureOptions);
-      },
-      { success: "Cloud SQL Auth Proxy is ready." }
-    );
-    const findPortOptions = { start: DEFAULT_PORT_START };
-    if (options.port !== void 0) findPortOptions.preferred = options.port;
-    const port = await deps.findFreePort(findPortOptions);
-    if (options.port !== void 0 && port !== options.port) {
-      throw new CliError(`Port ${options.port} is already in use.`, {
-        hint: "Pick a different port with --port, or free up that port and try again."
-      });
-    }
-    const instanceConnectionName = firstNonEmpty(
-      credentials.instance_connection_name,
-      proxyToken.instance_connection_name,
-      devDatabase.instance_connection_name
-    );
-    if (instanceConnectionName === void 0) {
-      throw new CliError("The Meridian API did not return a Cloud SQL instance connection name.", {
-        hint: "Try again, or contact Meridian support if this persists."
-      });
-    }
-    proxy = await withSpinner(
-      `Starting the Cloud SQL Auth Proxy on 127.0.0.1:${port}...`,
-      () => deps.startProxy({
-        binaryPath,
-        instanceConnectionName,
-        token: toProxyToken(proxyToken),
-        port,
-        ...options.refreshToken !== false ? { refreshToken: async () => toProxyToken(await client.issueProxyToken(appId)) } : {},
-        onEvent: handleProxyEvent
-      }),
-      { success: `Cloud SQL Auth Proxy listening on 127.0.0.1:${port}.` }
-    );
+    const access = devDatabase.access === "gateway" ? "gateway" : "proxy";
+    proxy = access === "gateway" ? await startGatewayEndpoint(client, appId, credentials, options, deps) : await startProxyEndpoint(client, appId, devDatabase, credentials, options, deps);
     const connection = connectionInfoFromCredentials(credentials, { host: proxy.host, port: proxy.port });
     if (options.waitForDb !== false) {
       await withSpinner(
@@ -2767,6 +3669,7 @@ async function startDevSession(options = {}) {
       connection,
       databaseUrl,
       ...shadowDatabaseUrl !== void 0 ? { shadowDatabaseUrl } : {},
+      access,
       proxy,
       env: {
         ...process.env,
@@ -2787,6 +3690,232 @@ async function startDevSession(options = {}) {
   }
 }
 
+// src/lib/db/external-credential.ts
+function describeAccessMode(mode) {
+  if (mode === "read_only") return "read-only";
+  if (mode === "read_write") return "read-write";
+  return mode;
+}
+function resolveCredentialRef(credentials, ref) {
+  const wanted = ref.trim();
+  const byId = credentials.find((credential) => credential.id === wanted);
+  if (byId !== void 0) return byId;
+  const matchers = [
+    (credential) => credential.label === wanted,
+    (credential) => credential.label.toLowerCase() === wanted.toLowerCase()
+  ];
+  for (const matches of matchers) {
+    const found = credentials.filter(matches);
+    const live = found.filter((credential) => credential.status !== "revoked");
+    const pool = live.length > 0 ? live : found;
+    if (pool.length === 1 && pool[0] !== void 0) return pool[0];
+    if (pool.length > 1) {
+      throw new CliError(`More than one credential is labelled "${wanted}".`, {
+        hint: `Name it by id instead: ${pool.map((credential) => credential.id).join(", ")}.`
+      });
+    }
+  }
+  throw new CliError(`No credential matches "${wanted}".`, {
+    hint: "Run `meridian db credential list` to see each credential's label and id."
+  });
+}
+function isMysqlDatabase(addon) {
+  if (addon.type !== "database") return false;
+  const type = addon.database?.type;
+  return type === void 0 || type === null || type === "mysql";
+}
+function databaseTargets(environments) {
+  const targets = [];
+  for (const environment of environments) {
+    const addon = (environment.addons ?? []).find(isMysqlDatabase);
+    if (addon !== void 0) targets.push({ environment, addon });
+  }
+  return targets;
+}
+function environmentLabel(environment) {
+  return environment.name ?? environment.type ?? environment.uuid;
+}
+function matchEnvironment(targets, wanted) {
+  const target = wanted.trim().toLowerCase();
+  return targets.find(
+    ({ environment }) => [environment.name, environment.type, environment.uuid].some(
+      (value) => typeof value === "string" && value.toLowerCase() === target
+    )
+  );
+}
+function formatTimestamp(value, dateOnly = false) {
+  if (value === null || value === void 0 || value === "") return "-";
+  const date = new Date(value);
+  if (Number.isNaN(date.getTime())) return value;
+  const iso = date.toISOString();
+  return dateOnly ? iso.slice(0, 10) : `${iso.slice(0, 16).replace("T", " ")} UTC`;
+}
+function formatCredentialTable(credentials) {
+  const rows = [
+    ["LABEL", "USERNAME", "MODE", "STATUS", "LAST CONNECTED", "CERT EXPIRES", "ID"],
+    ...credentials.map((credential) => [
+      credential.label,
+      credential.username,
+      describeAccessMode(credential.access_mode),
+      credential.status,
+      credential.last_connected_at === null || credential.last_connected_at === void 0 ? "never" : formatTimestamp(credential.last_connected_at),
+      formatTimestamp(credential.certificate_expires_at, true),
+      credential.id
+    ])
+  ];
+  const widths = rows[0]?.map((_, column) => Math.max(...rows.map((row) => (row[column] ?? "").length))) ?? [];
+  return rows.map(
+    (row) => row.map((cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths[column] ?? 0)).join("  ").trimEnd()
+  );
+}
+
+// src/commands/db-credential.ts
+function defaultDeps() {
+  return { createApiClient, requireProject };
+}
+var MANAGE_HINT = "Revoking an external credential needs the Credentials: Manage permission on this app. Ask an organization owner or admin to grant it, or to revoke it for you.";
+var CLI_SCOPE_HINT = "This Meridian API does not accept CLI tokens for external credentials yet. Manage them under Hosting > Database > External access in the dashboard.";
+var DASHBOARD_HINT = "Create and rotate credentials in the dashboard: Hosting > Database > External access. The key is generated in your browser there.";
+async function withAccessHints(fn, needsManage) {
+  try {
+    return await fn();
+  } catch (err) {
+    if (isApiError(err) && err.status === 403) {
+      const scope = err.message.includes("/app/cli/");
+      if (scope || needsManage) {
+        throw new ApiError(err.message, {
+          status: err.status,
+          body: err.body,
+          ...err.errorCode !== void 0 ? { errorCode: err.errorCode } : {},
+          hint: scope ? CLI_SCOPE_HINT : MANAGE_HINT,
+          cause: err
+        });
+      }
+    }
+    throw err;
+  }
+}
+async function resolveTarget(client, appId, env, deps) {
+  const environments = await withAccessHints(() => client.listEnvironments(appId), false);
+  const targets = databaseTargets(environments);
+  if (targets.length === 0) {
+    throw new CliError("None of this app's environments has a hosted MySQL database.", {
+      hint: "Add a database to an environment under Hosting in the Meridian dashboard first."
+    });
+  }
+  if (env !== void 0) {
+    const match = matchEnvironment(targets, env);
+    if (match === void 0) {
+      throw new CliError(`No environment named "${env}" has a hosted MySQL database.`, {
+        hint: `Environments with one: ${targets.map(({ environment }) => environmentLabel(environment)).join(", ")}.`
+      });
+    }
+    return match;
+  }
+  const index = await selectOne({
+    message: "Which environment's database?",
+    choices: targets.map((target, position) => ({
+      value: String(position),
+      name: environmentLabel(target.environment),
+      ...target.addon.database?.database ? { description: target.addon.database.database } : {}
+    })),
+    flag: "--env",
+    ...deps.selectImpl !== void 0 ? { promptImpl: deps.selectImpl } : {}
+  });
+  const chosen = targets[Number(index)];
+  if (chosen === void 0) throw new CliError("Nothing to choose from.");
+  return chosen;
+}
+async function openContext(env, deps) {
+  const project = deps.requireProject(workingDirectory());
+  const client = deps.createApiClient({});
+  const target = await resolveTarget(client, project.config.app_id, env, deps);
+  return { client, target };
+}
+async function runDbCredentialList(options = {}) {
+  const deps = { ...defaultDeps(), ...options.deps };
+  const { client, target } = await openContext(options.env, deps);
+  const { credentials, meta } = await withAccessHints(() => client.listExternalCredentials(target.addon.uuid), false);
+  const envName = environmentLabel(target.environment);
+  if (isJsonOutput()) {
+    printJson({
+      environment: envName,
+      addon_id: target.addon.uuid,
+      available: meta.available ?? null,
+      host: meta.host ?? null,
+      port: meta.port ?? null,
+      credentials
+    });
+    return 0;
+  }
+  if (meta.available === false) {
+    warn(`External access is not available for the ${envName} database yet.`);
+  }
+  if (credentials.length === 0) {
+    log(`No external credentials for the ${envName} database.`);
+    hint(DASHBOARD_HINT);
+    return 0;
+  }
+  log(`External credentials for the ${style.bold(envName)} database${meta.host ? ` (${meta.host}:${meta.port ?? 3306})` : ""}:`);
+  log();
+  for (const line of formatCredentialTable(credentials)) log(`  ${line}`);
+  return 0;
+}
+async function runDbCredentialRevoke(options) {
+  const deps = { ...defaultDeps(), ...options.deps };
+  const { client, target } = await openContext(options.env, deps);
+  const { credentials } = await withAccessHints(() => client.listExternalCredentials(target.addon.uuid), false);
+  const credential = resolveCredentialRef(credentials, options.credential);
+  const envName = environmentLabel(target.environment);
+  if (credential.status === "revoked") {
+    log(`Credential "${credential.label}" is already revoked.`);
+    if (isJsonOutput()) printJson({ revoked: true, already_revoked: true, credential });
+    return 0;
+  }
+  const confirmed = await confirmAction({
+    message: `Revoke "${credential.label}" (${credential.username}) on the ${envName} database? Anything using it loses access within 30 seconds.`,
+    default: false,
+    assumeYes: isAssumeYes(),
+    ...deps.confirmImpl !== void 0 ? { promptImpl: deps.confirmImpl } : {}
+  });
+  if (!confirmed) {
+    log("Aborted.");
+    if (isJsonOutput()) printJson({ revoked: false, aborted: true, credential });
+    return 0;
+  }
+  const revoked = await withAccessHints(
+    () => withSpinner(
+      `Revoking credential "${credential.label}"...`,
+      () => client.revokeExternalCredential(target.addon.uuid, credential.id)
+    ),
+    true
+  );
+  if (isJsonOutput()) printJson({ revoked: true, already_revoked: false, credential: revoked });
+  else success(`Revoked "${credential.label}". Its MySQL user is gone and open connections close within 30 seconds.`);
+  return 0;
+}
+async function runAndSetExitCode(fn) {
+  const code = await fn();
+  if (code !== 0) process.exitCode = code;
+}
+function registerDbCredentialCommand(db) {
+  const credential = db.command("credential").description(
+    "List and revoke credentials for reaching a hosted environment's database from outside Meridian. Create and rotate them in the dashboard."
+  );
+  credential.action(() => {
+    credential.outputHelp();
+  });
+  const envOption = ["--env <name>", "the environment whose database to use (name or type, e.g. production)"];
+  credential.command("list").description("List the database's external credentials.").option(...envOption).action(async (opts) => {
+    await runAndSetExitCode(() => runDbCredentialList({ ...opts.env !== void 0 ? { env: opts.env } : {} }));
+  });
+  credential.command("revoke").description("Revoke a credential: its MySQL user is dropped and open connections close within 30 seconds.").argument("<credential>", "the credential's id or label").option(...envOption).action(async (ref, opts) => {
+    await runAndSetExitCode(
+      () => runDbCredentialRevoke({ credential: ref, ...opts.env !== void 0 ? { env: opts.env } : {} })
+    );
+  });
+}
+
 // src/commands/db-shell-repl.ts
 import { accessSync, constants as fsConstants } from "fs";
 import { delimiter as delimiter2, join as join5 } from "path";
@@ -3059,7 +4188,7 @@ async function runDbSeed(options = {}) {
       inherit: true
     });
     if (result.code === 0) {
-      success("Seeded the development database.");
+      success("Seeded the developer database.");
     } else {
       error(`\`npx prisma db seed\` exited with code ${result.code}.`);
       hint("Make sure `prisma.seed` (or your Prisma 6 seed config) is set in package.json.");
@@ -3107,17 +4236,19 @@ async function runDbShell(options = {}) {
     if (session !== void 0) await session.stop();
   }
 }
-async function runAndSetExitCode(fn) {
+async function runAndSetExitCode2(fn) {
   const code = await fn();
   if (code !== 0) process.exitCode = code;
 }
 function registerDbCommand(program) {
-  const db = program.command("db").description("Manage the Meridian-managed MySQL development database: reset, seed, or open a SQL shell.");
+  const db = program.command("db").description(
+    "Manage the Meridian-managed MySQL developer database (reset, seed, or open a SQL shell), and external credentials for hosted databases."
+  );
   db.action(() => {
     db.outputHelp();
   });
-  db.command("reset").description("Drop and recreate every table in the development database (keeps the MySQL user).").option("--migrate", "run `npx prisma migrate deploy` afterwards, without asking").option("--seed", "run `npx prisma db seed` afterwards, without asking").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to update (defaults to .env)").action(async (opts) => {
-    await runAndSetExitCode(
+  db.command("reset").description("Drop and recreate every table in the developer database (keeps the MySQL user).").option("--migrate", "run `npx prisma migrate deploy` afterwards, without asking").option("--seed", "run `npx prisma db seed` afterwards, without asking").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to update (defaults to .env)").action(async (opts) => {
+    await runAndSetExitCode2(
       () => runDbReset({
         ...opts.migrate === true ? { migrate: true } : {},
         ...opts.seed === true ? { seed: true } : {},
@@ -3127,7 +4258,7 @@ function registerDbCommand(program) {
     );
   });
   db.command("seed").description("Run `npx prisma db seed` with the Cloud SQL Auth Proxy up and DATABASE_URL set.").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to update (defaults to .env)").passThroughOptions().argument("[args...]", "extra arguments forwarded to `npx prisma db seed` (put them after `--`)").action(async (args, opts) => {
-    await runAndSetExitCode(
+    await runAndSetExitCode2(
       () => runDbSeed({
         ...opts.port !== void 0 ? { port: opts.port } : {},
         ...opts.envFile !== void 0 ? { envFile: opts.envFile } : {},
@@ -3135,8 +4266,8 @@ function registerDbCommand(program) {
       })
     );
   });
-  db.command("shell").description("Open a SQL shell against the development database (the `mysql` client if available, otherwise a built-in REPL).").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to read/patch (defaults to .env)").option("--repl", "force the built-in SQL REPL even when `mysql` is on PATH").option("-e, --execute <sql>", "run one SQL statement and exit").option("--no-env", "do not patch DATABASE_URL into the project's .env file").action(async (opts) => {
-    await runAndSetExitCode(
+  db.command("shell").description("Open a SQL shell against the developer database (the `mysql` client if available, otherwise a built-in REPL).").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to read/patch (defaults to .env)").option("--repl", "force the built-in SQL REPL even when `mysql` is on PATH").option("-e, --execute <sql>", "run one SQL statement and exit").option("--no-env", "do not patch DATABASE_URL into the project's .env file").action(async (opts) => {
+    await runAndSetExitCode2(
       () => runDbShell({
         ...opts.port !== void 0 ? { port: opts.port } : {},
         ...opts.envFile !== void 0 ? { envFile: opts.envFile } : {},
@@ -3146,10 +4277,11 @@ function registerDbCommand(program) {
       })
     );
   });
+  registerDbCredentialCommand(db);
 }
 
 // src/commands/dev.ts
-function defaultDeps() {
+function defaultDeps2() {
   return { startDevSession, startProcess, readPackageScript, requireProject };
 }
 var RECURSION_HINT = "Set `dev_command` in `.meridian/project.json` to the underlying command (e.g. `next dev`), or run `meridian dev -- next dev` to bypass the script entirely.";
@@ -3206,7 +4338,7 @@ function printDevSummary(session, noEnv) {
   const entries = [
     ["App", appLabel(session.project)],
     ["Database", session.devDatabase.database],
-    ["Proxy", `127.0.0.1:${session.proxy.port}`],
+    [session.access === "gateway" ? "Gateway" : "Proxy", `127.0.0.1:${session.proxy.port}`],
     ["Env file", envEntry],
     ["DATABASE_URL", redactDatabaseUrl(session.databaseUrl)]
   ];
@@ -3221,6 +4353,7 @@ function buildDevJsonPayload(session) {
   return {
     app: appLabel(session.project),
     database: session.devDatabase.database,
+    access: session.access,
     proxy: { host: session.proxy.host, port: session.proxy.port },
     database_url: redactDatabaseUrl(session.databaseUrl),
     env_file: session.envPatch?.path ?? null,
@@ -3228,7 +4361,7 @@ function buildDevJsonPayload(session) {
   };
 }
 async function runDev(options = {}) {
-  const deps = { ...defaultDeps(), ...options.deps };
+  const deps = { ...defaultDeps2(), ...options.deps };
   if (isInsideDevSession()) throw nestedSessionError();
   const project = deps.requireProject(workingDirectory());
   const resolved = resolveDevCommand(deps, project, options.command);
@@ -3272,7 +4405,7 @@ async function runDev(options = {}) {
   }
 }
 function registerDevCommand(program) {
-  program.command("dev").description("Run the managed dev database proxy and your app's dev server together.").option("--port <port>", "preferred local port for the Cloud SQL Auth Proxy").option("--env-file <file>", "the .env file to patch, relative to the project root (default .env)").option("--no-env", "don't touch any .env file; just print the DATABASE_URL for manual use").argument("[command...]", "run this instead of the app's dev script, e.g. `meridian dev -- next dev`").passThroughOptions().action(async (command, opts) => {
+  program.command("dev").description("Run the managed developer database proxy and your app's dev server together.").option("--port <port>", "preferred local port for the Cloud SQL Auth Proxy").option("--env-file <file>", "the .env file to patch, relative to the project root (default .env)").option("--no-env", "don't touch any .env file; just print the DATABASE_URL for manual use").argument("[command...]", "run this instead of the app's dev script, e.g. `meridian dev -- next dev`").passThroughOptions().action(async (command, opts) => {
     const port = parsePortOption(opts.port);
     const code = await runDev({
       ...command.length > 0 ? { command } : {},
@@ -3287,7 +4420,7 @@ function registerDevCommand(program) {
 // src/commands/link.ts
 import { existsSync as existsSync5 } from "fs";
 import { join as join7 } from "path";
-function defaultDeps2() {
+function defaultDeps3() {
   return { createClient: createApiClient };
 }
 function formatOrg(org) {
@@ -3302,7 +4435,7 @@ function resolveChoiceAnswer(choices, raw, keysOf) {
   return match !== void 0 ? match.name : raw;
 }
 async function runLink(options = {}) {
-  const deps = { ...defaultDeps2(), ...options.deps };
+  const deps = { ...defaultDeps3(), ...options.deps };
   const json = isJsonOutput();
   const root = resolveProjectRoot(workingDirectory()) ?? workingDirectory();
   if (!existsSync5(join7(root, "package.json"))) {
@@ -3498,7 +4631,7 @@ async function defaultOpenUrl(url) {
   const { default: open } = await import("open");
   await open(url);
 }
-function defaultDeps3() {
+function defaultDeps4() {
   return { createClient: createApiClient, runDeviceFlow, openUrl: defaultOpenUrl };
 }
 function shouldOpenBrowser(noBrowser) {
@@ -3519,7 +4652,7 @@ function hintUnlessLinked(json) {
   hint("Run `meridian link` to connect this project to a Meridian app.");
 }
 async function runLogin(options = {}) {
-  const deps = { ...defaultDeps3(), ...options.deps };
+  const deps = { ...defaultDeps4(), ...options.deps };
   const json = isJsonOutput();
   if (options.force !== true) {
     const auth = getAuth();
@@ -3656,7 +4789,7 @@ async function createSnapshot(info, options) {
       }
     });
   } catch (error2) {
-    throw new CliError(`Could not snapshot the development database: ${describeError(error2)}`, {
+    throw new CliError(`Could not snapshot the developer database: ${describeError(error2)}`, {
       hint: SKIP_SNAPSHOT_HINT,
       cause: error2
     });
@@ -3665,13 +4798,13 @@ async function createSnapshot(info, options) {
   try {
     bytes = (await stat(path)).size;
   } catch (error2) {
-    throw new CliError("Could not snapshot the development database: the dump did not produce a file.", {
+    throw new CliError("Could not snapshot the developer database: the dump did not produce a file.", {
       hint: SKIP_SNAPSHOT_HINT,
       cause: error2
     });
   }
   if (bytes === 0) {
-    throw new CliError("Could not snapshot the development database: the dump produced an empty file.", {
+    throw new CliError("Could not snapshot the developer database: the dump produced an empty file.", {
       hint: SKIP_SNAPSHOT_HINT
     });
   }
@@ -3862,7 +4995,7 @@ async function pruneSnapshots(dir, keep) {
 // src/commands/migrate.ts
 var DEFAULT_KEEP_SNAPSHOTS = 5;
 var MAX_OUTPUT_EXCERPT = 4e3;
-function defaultDeps4() {
+function defaultDeps5() {
   return {
     startDevSession,
     createSnapshot,
@@ -3880,7 +5013,7 @@ function defaultDeps4() {
   };
 }
 function resolveDeps2(overrides) {
-  return { ...defaultDeps4(), ...overrides };
+  return { ...defaultDeps5(), ...overrides };
 }
 function formatSize(bytes) {
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
@@ -3907,10 +5040,10 @@ async function runMigration(session, deps, ctx) {
   let snapshot;
   if (options.skipSnapshot !== true) {
     snapshot = await withSpinner(
-      "Snapshotting the development database...",
+      "Snapshotting the developer database...",
       () => deps.createSnapshot(session.connection, { dir, now: deps.now }),
       {
-        success: (result) => result.path === null ? "Development database is empty. Nothing to snapshot." : `Snapshot saved to ${style.path(result.path)} (${formatSize(result.bytes)}).`
+        success: (result) => result.path === null ? "Developer database is empty. Nothing to snapshot." : `Snapshot saved to ${style.path(result.path)} (${formatSize(result.bytes)}).`
       }
     );
   }
@@ -3943,12 +5076,12 @@ async function runMigration(session, deps, ctx) {
     } else {
       const snapshotPath = snapshot.path;
       warn(
-        `\`${commandString}\` failed (exit code ${runResult.code}); ` + (snapshotPath === null ? "rolling the development database back to its pre-migration (empty) state..." : "rolling back the development database to the pre-migration snapshot...")
+        `\`${commandString}\` failed (exit code ${runResult.code}); ` + (snapshotPath === null ? "rolling the developer database back to its pre-migration (empty) state..." : "rolling back the developer database to the pre-migration snapshot...")
       );
       try {
         await client.resetDevDatabase(appId);
         if (snapshotPath === null) {
-          success("Development database rolled back to its pre-migration (empty) state.");
+          success("Developer database rolled back to its pre-migration (empty) state.");
         } else {
           await withSpinner(
             "Restoring the pre-migration snapshot...",
@@ -3961,7 +5094,7 @@ async function runMigration(session, deps, ctx) {
         status = "rolled_back";
         rolledBack = true;
       } catch {
-        error("Automatic rollback failed. The development database may be in a partial state. Treat it as unsafe.");
+        error("Automatic rollback failed. The developer database may be in a partial state. Treat it as unsafe.");
         if (snapshotPath === null) {
           hint("Recover by hand with `meridian db reset`. The database was empty before this migration.");
         } else {
@@ -4036,7 +5169,7 @@ async function runMigrate(options = {}) {
 }
 function registerMigrateCommand(program) {
   program.command("migrate").description(
-    "Snapshot the development database, run `prisma migrate dev`, and roll back to the snapshot automatically if the migration fails."
+    "Snapshot the developer database, run `prisma migrate dev`, and roll back to the snapshot automatically if the migration fails."
   ).option("--skip-snapshot", "run without a pre-migration snapshot (no rollback is possible)").option(
     "--allow-foreign-migrations",
     "run even when prisma/migrations was generated for SQLite or Postgres and cannot apply to MySQL"
@@ -4089,7 +5222,7 @@ function registerUnlinkCommand(program) {
 
 // src/commands/whoami.ts
 var SEVEN_DAYS_MS = 7 * 24 * 60 * 60 * 1e3;
-function defaultDeps5() {
+function defaultDeps6() {
   return { createClient: createApiClient };
 }
 function toConfigUser2(user) {
@@ -4153,7 +5286,7 @@ function printJsonResult(result, project) {
   });
 }
 async function runWhoami(options = {}) {
-  const deps = { ...defaultDeps5(), ...options.deps };
+  const deps = { ...defaultDeps6(), ...options.deps };
   const json = isJsonOutput();
   const auth = getAuth();
   if (auth === null) throw notLoggedInError();
@@ -4260,7 +5393,7 @@ function resolveGlobalFlags(actionCommand) {
 function buildProgram() {
   const program = new Command();
   program.name("meridian").description(
-    "Managed remote development databases for Meridian apps.\n\nRun `meridian login` once, `meridian link` per project, then `meridian dev`."
+    "Managed remote developer databases for Meridian apps.\n\nRun `meridian login` once, `meridian link` per project, then `meridian dev`."
   ).version(VERSION, "-V, --version").enablePositionalOptions().showHelpAfterError("(run `meridian --help` for usage)");
   addGlobalFlags(program);
   program.hook("preAction", (_thisCommand, actionCommand) => {