@the-meridian/cli 1.1.0 → 1.2.0

package/dist/index.js

@@ -67,6 +67,7 @@ var deviceInfoResponseSchema = z.object({
   created_at: z.string().optional()
 }).loose();
 var devDatabaseStatusSchema = z.union([z.enum(["provisioning", "ready", "error"]), z.string()]);
+var devDatabaseAccessSchema = z.union([z.enum(["gateway", "proxy"]), z.string()]);
 var devDatabaseSchema = z.object({
   id: idSchema,
   status: devDatabaseStatusSchema,
@@ -78,7 +79,21 @@ var devDatabaseSchema = z.object({
   region: z.string().nullish(),
   created_at: z.string().nullish(),
   /** Set by the API only while `status` is `error`; surfaced verbatim to the developer. */
-  error_message: z.string().nullish()
+  error_message: z.string().nullish(),
+  /**
+   * How the CLI reaches the database: `gateway` (the Meridian database
+   * gateway with a per-developer certificate) or `proxy` (cloud-sql-proxy).
+   * Absent from an API older than the gateway, which means `proxy`.
+   */
+  access: devDatabaseAccessSchema.nullish()
+}).loose();
+var devDatabaseCertificateSchema = z.object({
+  certificate_pem: z.string(),
+  ca_pem: z.string(),
+  host: z.string(),
+  port: z.coerce.number(),
+  expires_at: z.string(),
+  fingerprint: z.string()
 }).loose();
 var devCredentialsSchema = z.object({
   host: z.string(),
@@ -342,6 +357,18 @@ var ApiClient = class _ApiClient {
       `/app/cli/apps/${encodePathSegment(appId)}/dev-database/proxy-token`
     );
   }
+  /**
+   * Signs `publicKeyPem` (SPKI) as this developer's client certificate for the
+   * database gateway. Each call replaces the previous certificate server-side.
+   */
+  async issueDevDatabaseCertificate(appId, publicKeyPem) {
+    return this.request(
+      devDatabaseCertificateSchema,
+      "POST",
+      `/app/cli/apps/${encodePathSegment(appId)}/dev-database/certificate`,
+      { body: { public_key: publicKeyPem } }
+    );
+  }
   async resetDevDatabase(appId) {
     return this.request(devDatabaseSchema, "POST", `/app/cli/apps/${encodePathSegment(appId)}/dev-database/reset`);
   }
@@ -523,7 +550,9 @@ function extractErrorCode(body) {
 }
 var HINTS_BY_ERROR_CODE = {
   dev_database_limit_reached: "Your plan does not include a developer database for you on this app. Every collaborator gets their own out of the plan's allowance, so upgrading the organization's plan in the Meridian dashboard is what unlocks it.",
+  dev_databases_unavailable: "This Meridian environment does not offer developer databases. Run `meridian dev` against production (the default API URL) instead.",
   dev_database_over_storage_limit: "Run `meridian db reset` to drop and recreate the schema. Reset and delete stay available while you're over the limit.",
+  cli_upgrade_required: "Upgrade the Meridian CLI: npm i -g @the-meridian/cli",
   EXTERNAL_ACCESS_UNAVAILABLE: "External access is not switched on for this database yet, or the database is not ready. Check the database under Hosting in the Meridian dashboard.",
   FEATURE_NOT_ENTITLED: "Your organization's plan does not include managed developer databases; upgrade it in the Meridian dashboard."
 };
@@ -1742,14 +1771,770 @@ function redactDatabaseUrl(url) {
   return url.replace(/^(mysql:\/\/[^:@/]+):([^@]*)@/, "$1:****@");
 }
 
+// src/lib/gateway/certificate.ts
+import { generateKeyPair } from "crypto";
+import { createSecureContext } from "tls";
+import { promisify } from "util";
+var generateKeyPairAsync = promisify(generateKeyPair);
+function gatewayCertificateFromPem(material) {
+  return {
+    host: material.host,
+    port: material.port,
+    expiresAt: material.expiresAt,
+    fingerprint: material.fingerprint,
+    secureContext: createSecureContext({
+      key: material.keyPem,
+      cert: material.certificatePem,
+      ca: material.caPem,
+      minVersion: "TLSv1.2"
+    })
+  };
+}
+async function generateGatewayKeyPair() {
+  const { publicKey, privateKey } = await generateKeyPairAsync("ec", { namedCurve: "prime256v1" });
+  return {
+    publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+    privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }).toString()
+  };
+}
+async function issueGatewayCertificate(client, appId) {
+  const { publicKeyPem, privateKeyPem } = await generateGatewayKeyPair();
+  const issued = await client.issueDevDatabaseCertificate(appId, publicKeyPem);
+  return gatewayCertificateFromPem({
+    keyPem: privateKeyPem,
+    certificatePem: issued.certificate_pem,
+    caPem: issued.ca_pem,
+    host: issued.host,
+    port: issued.port,
+    expiresAt: issued.expires_at,
+    fingerprint: issued.fingerprint
+  });
+}
+var ASSUMED_LIFETIME_MS = 24 * 60 * 6e4;
+var DEFAULT_REFRESH_BEFORE_MS = 4 * 60 * 6e4;
+var MIN_REFRESH_DELAY_MS = 6e4;
+function certificateRefreshDelay(expiresAt, now, refreshBeforeMs = DEFAULT_REFRESH_BEFORE_MS) {
+  const parsed = Date.parse(expiresAt);
+  const expiry = Number.isNaN(parsed) ? now + ASSUMED_LIFETIME_MS : parsed;
+  return Math.max(MIN_REFRESH_DELAY_MS, expiry - refreshBeforeMs - now);
+}
+
+// src/lib/gateway/forwarder.ts
+import { connect as netConnect, createServer, isIP } from "net";
+import { connect as tlsConnect } from "tls";
+
+// src/lib/gateway/packets.ts
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+var CLIENT = {
+  LONG_PASSWORD: 1,
+  FOUND_ROWS: 2,
+  LONG_FLAG: 4,
+  CONNECT_WITH_DB: 8,
+  NO_SCHEMA: 16,
+  COMPRESS: 32,
+  ODBC: 64,
+  LOCAL_FILES: 128,
+  IGNORE_SPACE: 256,
+  PROTOCOL_41: 512,
+  INTERACTIVE: 1024,
+  SSL: 2048,
+  IGNORE_SIGPIPE: 4096,
+  TRANSACTIONS: 8192,
+  RESERVED: 16384,
+  SECURE_CONNECTION: 32768,
+  MULTI_STATEMENTS: 65536,
+  MULTI_RESULTS: 131072,
+  PS_MULTI_RESULTS: 262144,
+  PLUGIN_AUTH: 524288,
+  CONNECT_ATTRS: 1048576,
+  PLUGIN_AUTH_LENENC_CLIENT_DATA: 2097152,
+  CAN_HANDLE_EXPIRED_PASSWORDS: 4194304,
+  SESSION_TRACK: 8388608,
+  DEPRECATE_EOF: 16777216,
+  OPTIONAL_RESULTSET_METADATA: 33554432,
+  ZSTD_COMPRESSION: 67108864,
+  QUERY_ATTRIBUTES: 134217728
+};
+var GATEWAY_CAPABILITIES = CLIENT.LONG_PASSWORD | CLIENT.FOUND_ROWS | CLIENT.LONG_FLAG | CLIENT.CONNECT_WITH_DB | CLIENT.IGNORE_SPACE | CLIENT.PROTOCOL_41 | CLIENT.INTERACTIVE | CLIENT.SSL | CLIENT.IGNORE_SIGPIPE | CLIENT.TRANSACTIONS | CLIENT.RESERVED | CLIENT.SECURE_CONNECTION | CLIENT.MULTI_STATEMENTS | CLIENT.MULTI_RESULTS | CLIENT.PS_MULTI_RESULTS | CLIENT.PLUGIN_AUTH | CLIENT.CONNECT_ATTRS | CLIENT.PLUGIN_AUTH_LENENC_CLIENT_DATA | CLIENT.CAN_HANDLE_EXPIRED_PASSWORDS | CLIENT.SESSION_TRACK | CLIENT.DEPRECATE_EOF;
+var LOCAL_CAPABILITIES = GATEWAY_CAPABILITIES & ~CLIENT.SSL;
+var PLUGIN_NATIVE = "mysql_native_password";
+var PLUGIN_CACHING_SHA2 = "caching_sha2_password";
+var SCRAMBLE_LENGTH = 20;
+var DEFAULT_CHARSET = 255;
+var MAX_PAYLOAD = 16777215;
+var MAX_HANDSHAKE_PACKET = 64 * 1024;
+var AUTH_MORE_DATA = 1;
+var FAST_AUTH_SUCCESS = 3;
+var PERFORM_FULL_AUTH = 4;
+var SERVER_STATUS_AUTOCOMMIT = 2;
+function encodePacket(seq, payload) {
+  if (payload.length >= MAX_PAYLOAD) throw new Error(`refusing to write a ${payload.length} byte handshake packet`);
+  const header = Buffer.alloc(4);
+  header.writeUIntLE(payload.length, 0, 3);
+  header[3] = seq & 255;
+  return Buffer.concat([header, payload]);
+}
+var PacketReader = class {
+  #socket;
+  #maxPacket;
+  #buffer = Buffer.alloc(0);
+  #failure;
+  #waiter;
+  #onData = (chunk) => {
+    this.#buffer = this.#buffer.length === 0 ? chunk : Buffer.concat([this.#buffer, chunk]);
+    this.#settle();
+  };
+  #onClose = () => {
+    this.#fail(new Error("the connection closed during the MySQL handshake"));
+  };
+  #onError = (error2) => {
+    this.#fail(error2);
+  };
+  constructor(socket, maxPacket = MAX_HANDSHAKE_PACKET) {
+    this.#socket = socket;
+    this.#maxPacket = maxPacket;
+    socket.on("data", this.#onData);
+    socket.on("end", this.#onClose);
+    socket.on("close", this.#onClose);
+    socket.on("error", this.#onError);
+  }
+  read() {
+    return new Promise((resolve2, reject) => {
+      this.#waiter = { resolve: resolve2, reject };
+      this.#settle();
+    });
+  }
+  /** Stops reading. `pause` keeps later bytes in the socket for a pipe() to pick up. */
+  release(options) {
+    if (options.pause) this.#socket.pause();
+    this.#socket.off("data", this.#onData);
+    this.#socket.off("end", this.#onClose);
+    this.#socket.off("close", this.#onClose);
+    this.#socket.off("error", this.#onError);
+    const rest = this.#buffer;
+    this.#buffer = Buffer.alloc(0);
+    return rest;
+  }
+  #fail(error2) {
+    if (this.#failure === void 0) this.#failure = error2;
+    this.#settle();
+  }
+  #settle() {
+    const waiter = this.#waiter;
+    if (waiter === void 0) return;
+    if (this.#buffer.length >= 4) {
+      const length = this.#buffer.readUIntLE(0, 3);
+      if (length > this.#maxPacket) {
+        this.#waiter = void 0;
+        waiter.reject(new Error(`a ${length} byte packet during the MySQL handshake is too large`));
+        return;
+      }
+      if (this.#buffer.length >= 4 + length) {
+        const seq = this.#buffer[3] ?? 0;
+        const payload = Buffer.from(this.#buffer.subarray(4, 4 + length));
+        this.#buffer = this.#buffer.subarray(4 + length);
+        this.#waiter = void 0;
+        waiter.resolve({ seq, payload });
+        return;
+      }
+    }
+    if (this.#failure !== void 0) {
+      this.#waiter = void 0;
+      waiter.reject(this.#failure);
+    }
+  }
+};
+var Cursor = class {
+  constructor(buf) {
+    this.buf = buf;
+  }
+  buf;
+  pos = 0;
+  get remaining() {
+    return this.buf.length - this.pos;
+  }
+  bytes(n, what) {
+    if (n < 0 || this.remaining < n) throw new Error(`truncated packet reading ${what}`);
+    const out = this.buf.subarray(this.pos, this.pos + n);
+    this.pos += n;
+    return out;
+  }
+  u8(what) {
+    return this.bytes(1, what)[0] ?? 0;
+  }
+  u16(what) {
+    return this.bytes(2, what).readUInt16LE(0);
+  }
+  u32(what) {
+    return this.bytes(4, what).readUInt32LE(0);
+  }
+  nulString(what) {
+    const end = this.buf.indexOf(0, this.pos);
+    if (end < 0) throw new Error(`truncated packet reading ${what}`);
+    const out = this.buf.subarray(this.pos, end);
+    this.pos = end + 1;
+    return out;
+  }
+  /** Everything left, without a trailing NUL. */
+  restNul() {
+    let out = this.buf.subarray(this.pos);
+    this.pos = this.buf.length;
+    if (out.length > 0 && out[out.length - 1] === 0) out = out.subarray(0, out.length - 1);
+    return out;
+  }
+  lenencInt(what) {
+    const first = this.u8(what);
+    if (first < 251) return first;
+    if (first === 252) return this.u16(what);
+    if (first === 253) return this.bytes(3, what).readUIntLE(0, 3);
+    if (first === 254) {
+      const value = this.bytes(8, what).readBigUInt64LE(0);
+      if (value > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error(`${what} is too large`);
+      return Number(value);
+    }
+    throw new Error(`invalid length-encoded integer reading ${what}`);
+  }
+  lenencBytes(what) {
+    return this.bytes(this.lenencInt(what), what);
+  }
+};
+function lenencInt(n) {
+  if (n < 251) return Buffer.from([n]);
+  if (n <= 65535) {
+    const b2 = Buffer.alloc(3);
+    b2[0] = 252;
+    b2.writeUInt16LE(n, 1);
+    return b2;
+  }
+  if (n <= 16777215) {
+    const b2 = Buffer.alloc(4);
+    b2[0] = 253;
+    b2.writeUIntLE(n, 1, 3);
+    return b2;
+  }
+  const b = Buffer.alloc(9);
+  b[0] = 254;
+  b.writeBigUInt64LE(BigInt(n), 1);
+  return b;
+}
+function lenencBytes(value) {
+  return Buffer.concat([lenencInt(value.length), value]);
+}
+function u16(n) {
+  const b = Buffer.alloc(2);
+  b.writeUInt16LE(n & 65535, 0);
+  return b;
+}
+function u32(n) {
+  const b = Buffer.alloc(4);
+  b.writeUInt32LE(n >>> 0, 0);
+  return b;
+}
+var NUL = Buffer.from([0]);
+function encodeGreeting(g) {
+  if (g.scramble.length !== SCRAMBLE_LENGTH) throw new Error("the greeting scramble must be 20 bytes");
+  return Buffer.concat([
+    Buffer.from([10]),
+    Buffer.from(g.serverVersion, "utf8"),
+    NUL,
+    u32(g.connectionId),
+    g.scramble.subarray(0, 8),
+    NUL,
+    u16(g.capabilities),
+    Buffer.from([g.charset]),
+    u16(g.status),
+    u16(g.capabilities >>> 16),
+    Buffer.from([SCRAMBLE_LENGTH + 1]),
+    Buffer.alloc(10),
+    g.scramble.subarray(8),
+    NUL,
+    Buffer.from(g.authPlugin, "utf8"),
+    NUL
+  ]);
+}
+function localGreeting(connectionId, scramble, serverVersion) {
+  return {
+    serverVersion,
+    connectionId,
+    scramble,
+    capabilities: LOCAL_CAPABILITIES,
+    charset: DEFAULT_CHARSET,
+    status: SERVER_STATUS_AUTOCOMMIT,
+    authPlugin: PLUGIN_NATIVE
+  };
+}
+function parseGreeting(payload) {
+  if (payload[0] === 255) throw serverErrorFromPacket(payload);
+  const r = new Cursor(payload);
+  const version = r.u8("protocol version");
+  if (version !== 10) throw new Error(`unsupported handshake version ${version}`);
+  const serverVersion = r.nulString("server version").toString("utf8");
+  const connectionId = r.u32("connection id");
+  const part1 = Buffer.from(r.bytes(8, "scramble part 1"));
+  r.u8("filler");
+  let capabilities = r.u16("capabilities");
+  let charset = DEFAULT_CHARSET;
+  let status = 0;
+  let authPlugin = "";
+  let scramble = part1;
+  if (r.remaining > 0) {
+    charset = r.u8("charset");
+    status = r.u16("status");
+    capabilities = (capabilities | r.u16("capabilities upper") << 16) >>> 0;
+    const authLength = r.u8("auth data length");
+    r.bytes(10, "reserved");
+    if ((capabilities & CLIENT.SECURE_CONNECTION) !== 0) {
+      let part2 = r.bytes(Math.max(13, authLength - 8), "scramble part 2");
+      if (part2.length > 0 && part2[part2.length - 1] === 0) part2 = part2.subarray(0, part2.length - 1);
+      scramble = Buffer.concat([part1, part2]);
+    }
+    if ((capabilities & CLIENT.PLUGIN_AUTH) !== 0) authPlugin = r.restNul().toString("utf8");
+  }
+  if (scramble.length < SCRAMBLE_LENGTH) throw new Error(`the server scramble is ${scramble.length} bytes`);
+  return {
+    serverVersion,
+    connectionId,
+    scramble: scramble.subarray(0, SCRAMBLE_LENGTH),
+    capabilities,
+    charset,
+    status,
+    authPlugin: authPlugin === "" ? PLUGIN_NATIVE : authPlugin
+  };
+}
+function encodeSslRequest(capabilities, maxPacketSize, charset) {
+  return Buffer.concat([u32(capabilities | CLIENT.SSL), u32(maxPacketSize), Buffer.from([charset]), Buffer.alloc(23)]);
+}
+function parseHandshakeResponse(payload) {
+  const r = new Cursor(payload);
+  const capabilities = r.u32("capabilities");
+  if ((capabilities & CLIENT.PROTOCOL_41) === 0) throw new Error("the client does not speak protocol 4.1");
+  const maxPacketSize = r.u32("max packet size");
+  const charset = r.u8("charset");
+  r.bytes(23, "filler");
+  if (r.remaining === 0) {
+    return { capabilities, maxPacketSize, charset, username: "", authResponse: Buffer.alloc(0), database: "", authPlugin: "", attributes: [] };
+  }
+  const username = r.nulString("username").toString("utf8");
+  let authResponse;
+  if ((capabilities & CLIENT.PLUGIN_AUTH_LENENC_CLIENT_DATA) !== 0) authResponse = r.lenencBytes("auth response");
+  else if ((capabilities & CLIENT.SECURE_CONNECTION) !== 0) authResponse = r.bytes(r.u8("auth response length"), "auth response");
+  else authResponse = r.nulString("auth response");
+  let database = "";
+  if ((capabilities & CLIENT.CONNECT_WITH_DB) !== 0 && r.remaining > 0) database = r.nulString("database").toString("utf8");
+  let authPlugin = "";
+  if ((capabilities & CLIENT.PLUGIN_AUTH) !== 0 && r.remaining > 0) authPlugin = r.nulString("auth plugin").toString("utf8");
+  const attributes = [];
+  if ((capabilities & CLIENT.CONNECT_ATTRS) !== 0 && r.remaining > 0) {
+    const attrs = new Cursor(r.lenencBytes("attributes"));
+    while (attrs.remaining > 0) {
+      const key = attrs.lenencBytes("attribute key").toString("utf8");
+      const value = attrs.lenencBytes("attribute value").toString("utf8");
+      attributes.push([key, value]);
+    }
+  }
+  return {
+    capabilities,
+    maxPacketSize,
+    charset,
+    username,
+    authResponse: Buffer.from(authResponse),
+    database,
+    authPlugin,
+    attributes
+  };
+}
+function encodeHandshakeResponse(h) {
+  const parts = [u32(h.capabilities), u32(h.maxPacketSize), Buffer.from([h.charset]), Buffer.alloc(23)];
+  parts.push(Buffer.from(h.username, "utf8"), NUL);
+  if ((h.capabilities & CLIENT.PLUGIN_AUTH_LENENC_CLIENT_DATA) !== 0) parts.push(lenencBytes(h.authResponse));
+  else if ((h.capabilities & CLIENT.SECURE_CONNECTION) !== 0) parts.push(Buffer.from([h.authResponse.length]), h.authResponse);
+  else parts.push(h.authResponse, NUL);
+  if ((h.capabilities & CLIENT.CONNECT_WITH_DB) !== 0) parts.push(Buffer.from(h.database, "utf8"), NUL);
+  if ((h.capabilities & CLIENT.PLUGIN_AUTH) !== 0) parts.push(Buffer.from(h.authPlugin, "utf8"), NUL);
+  if ((h.capabilities & CLIENT.CONNECT_ATTRS) !== 0) {
+    const attrs = h.attributes.map(
+      ([key, value]) => Buffer.concat([lenencBytes(Buffer.from(key, "utf8")), lenencBytes(Buffer.from(value, "utf8"))])
+    );
+    parts.push(lenencBytes(Buffer.concat(attrs)));
+  }
+  return Buffer.concat(parts);
+}
+function encodeAuthSwitchRequest(plugin, scramble) {
+  return Buffer.concat([Buffer.from([254]), Buffer.from(plugin, "utf8"), NUL, scramble, NUL]);
+}
+function parseAuthSwitchRequest(payload) {
+  if (payload[0] !== 254) throw new Error("not an auth switch request");
+  const r = new Cursor(payload);
+  r.pos = 1;
+  const plugin = r.nulString("auth plugin").toString("utf8");
+  let scramble = Buffer.from(r.restNul());
+  if (scramble.length > SCRAMBLE_LENGTH) scramble = scramble.subarray(0, SCRAMBLE_LENGTH);
+  return { plugin, scramble };
+}
+var isOk = (payload) => payload[0] === 0;
+var isErr = (payload) => payload[0] === 255;
+var isAuthSwitch = (payload) => payload[0] === 254;
+var isAuthMoreData = (payload) => payload[0] === AUTH_MORE_DATA;
+function encodeErr(code, sqlState, message) {
+  const state2 = sqlState.length === 5 ? sqlState : "HY000";
+  return Buffer.concat([Buffer.from([255]), u16(code), Buffer.from(`#${state2}`, "latin1"), Buffer.from(message, "utf8")]);
+}
+var MysqlServerError = class extends Error {
+  constructor(code, sqlState, message) {
+    super(message);
+    this.code = code;
+    this.sqlState = sqlState;
+    this.name = "MysqlServerError";
+  }
+  code;
+  sqlState;
+};
+function serverErrorFromPacket(payload) {
+  if (payload.length < 3 || payload[0] !== 255) return new MysqlServerError(0, "HY000", "unknown error");
+  const code = payload.readUInt16LE(1);
+  let rest = payload.subarray(3);
+  let sqlState = "HY000";
+  if (rest.length >= 6 && rest[0] === 35) {
+    sqlState = rest.subarray(1, 6).toString("latin1");
+    rest = rest.subarray(6);
+  }
+  return new MysqlServerError(code, sqlState, rest.toString("utf8"));
+}
+function newScramble() {
+  const b = randomBytes(SCRAMBLE_LENGTH);
+  for (let i = 0; i < b.length; i++) {
+    let v = (b[i] ?? 0) & 127 | 1;
+    if (v === 36) v = 37;
+    b[i] = v;
+  }
+  return b;
+}
+function xor(a, b) {
+  const out = Buffer.alloc(a.length);
+  for (let i = 0; i < a.length; i++) out[i] = (a[i] ?? 0) ^ (b[i] ?? 0);
+  return out;
+}
+function scrambleNative(password, nonce) {
+  if (password === "") return Buffer.alloc(0);
+  const h1 = createHash("sha1").update(password, "utf8").digest();
+  const h2 = createHash("sha1").update(h1).digest();
+  const h3 = createHash("sha1").update(nonce).update(h2).digest();
+  return xor(h1, h3);
+}
+function scrambleCachingSha2(password, nonce) {
+  if (password === "") return Buffer.alloc(0);
+  const h1 = createHash("sha256").update(password, "utf8").digest();
+  const h2 = createHash("sha256").update(h1).digest();
+  const h3 = createHash("sha256").update(h2).update(nonce).digest();
+  return xor(h1, h3);
+}
+function scrambleFor(plugin, password, nonce) {
+  switch (plugin) {
+    case PLUGIN_NATIVE:
+      return scrambleNative(password, nonce);
+    case PLUGIN_CACHING_SHA2:
+      return scrambleCachingSha2(password, nonce);
+    default:
+      throw new Error(`unsupported auth plugin "${plugin}"`);
+  }
+}
+function scrambleMatches(received, expected) {
+  return received.length === expected.length && timingSafeEqual(received, expected);
+}
+
+// src/lib/gateway/forwarder.ts
+var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_HANDSHAKE_TIMEOUT_MS = 3e4;
+var REFRESH_RETRY_BACKOFFS_MS = [3e4, 6e4, 12e4, 3e5];
+var SERVER_VERSION = "8.0.40-meridian-forwarder";
+var CLOSE_GRACE_MS = 2e3;
+var ER_ACCESS_DENIED = 1045;
+var ER_HANDSHAKE = 1043;
+var CR_CONN_HOST_ERROR = 2003;
+var LocalRefusal = class extends Error {
+  constructor(code, sqlState, message) {
+    super(message);
+    this.code = code;
+    this.sqlState = sqlState;
+  }
+  code;
+  sqlState;
+};
+function accessDenied(username) {
+  return new LocalRefusal(ER_ACCESS_DENIED, "28000", `Access denied for user '${username}'@'localhost' (using password: YES)`);
+}
+function upstreamCapabilities(clientCapabilities, database) {
+  let caps = clientCapabilities & LOCAL_CAPABILITIES | CLIENT.SSL | CLIENT.PROTOCOL_41 | CLIENT.SECURE_CONNECTION | CLIENT.PLUGIN_AUTH | CLIENT.PLUGIN_AUTH_LENENC_CLIENT_DATA;
+  if (database !== "") caps |= CLIENT.CONNECT_WITH_DB;
+  return caps >>> 0;
+}
+function waitFor(socket, event) {
+  return new Promise((resolve2, reject) => {
+    const onError = (error2) => {
+      socket.off(event, onDone);
+      reject(error2);
+    };
+    const onDone = () => {
+      socket.off("error", onError);
+      resolve2();
+    };
+    socket.once(event, onDone);
+    socket.once("error", onError);
+  });
+}
+function splice(a, b) {
+  const closeOther = (other) => () => {
+    if (other.destroyed) return;
+    other.end();
+    setTimeout(() => other.destroy(), CLOSE_GRACE_MS).unref();
+  };
+  a.on("close", closeOther(b));
+  b.on("close", closeOther(a));
+  a.pipe(b);
+  b.pipe(a);
+}
+async function startGatewayForwarder(options) {
+  const host = options.host ?? DEFAULT_HOST;
+  const handshakeTimeoutMs = options.handshakeTimeoutMs ?? DEFAULT_HANDSHAKE_TIMEOUT_MS;
+  const refreshBeforeMs = options.refreshBeforeMs ?? DEFAULT_REFRESH_BEFORE_MS;
+  const now = options.now ?? Date.now;
+  const emit = (event) => {
+    try {
+      options.onEvent?.(event);
+    } catch {
+    }
+  };
+  let certificate = options.certificate;
+  let running = false;
+  let stopped = false;
+  let connectionId = 0;
+  let refreshTimer;
+  const sockets = /* @__PURE__ */ new Set();
+  const track = (socket) => {
+    sockets.add(socket);
+    socket.once("close", () => sockets.delete(socket));
+    socket.on("error", () => socket.destroy());
+  };
+  async function openUpstream(cert, client) {
+    const raw = netConnect({ host: cert.host, port: cert.port });
+    track(raw);
+    raw.setNoDelay(true);
+    await waitFor(raw, "connect");
+    const rawReader = new PacketReader(raw);
+    const greetingPacket = await rawReader.read();
+    const greeting = parseGreeting(greetingPacket.payload);
+    if ((greeting.capabilities & CLIENT.SSL) === 0) throw new Error("the gateway did not offer TLS");
+    const capabilities = upstreamCapabilities(client.capabilities, client.database);
+    let seq = greetingPacket.seq + 1;
+    raw.write(encodePacket(seq, encodeSslRequest(capabilities, client.maxPacketSize, client.charset)));
+    rawReader.release({ pause: false });
+    const socket = tlsConnect({
+      socket: raw,
+      secureContext: cert.secureContext,
+      host: cert.host,
+      // SNI carries host names only; an IP is still verified against the certificate.
+      ...isIP(cert.host) === 0 ? { servername: cert.host } : {},
+      rejectUnauthorized: true
+    });
+    track(socket);
+    socket.setNoDelay(true);
+    await waitFor(socket, "secureConnect");
+    const reader = new PacketReader(socket);
+    let plugin = PLUGIN_CACHING_SHA2;
+    seq++;
+    socket.write(
+      encodePacket(
+        seq,
+        encodeHandshakeResponse({
+          capabilities,
+          maxPacketSize: client.maxPacketSize,
+          charset: client.charset,
+          username: options.username,
+          authResponse: scrambleCachingSha2(options.password, greeting.scramble),
+          database: client.database,
+          authPlugin: plugin,
+          attributes: client.attributes
+        })
+      )
+    );
+    for (let round = 0; round < 6; round++) {
+      const packet = await reader.read();
+      seq = packet.seq;
+      const payload = packet.payload;
+      if (isOk(payload)) return { socket, ok: payload, leftover: reader.release({ pause: true }) };
+      if (isErr(payload)) throw serverErrorFromPacket(payload);
+      if (isAuthSwitch(payload)) {
+        const request = parseAuthSwitchRequest(payload);
+        plugin = request.plugin;
+        seq++;
+        socket.write(encodePacket(seq, scrambleFor(plugin, options.password, request.scramble)));
+        continue;
+      }
+      if (isAuthMoreData(payload) && plugin === PLUGIN_CACHING_SHA2 && payload.length >= 2) {
+        if (payload[1] === FAST_AUTH_SUCCESS) continue;
+        if (payload[1] === PERFORM_FULL_AUTH) {
+          seq++;
+          socket.write(encodePacket(seq, Buffer.concat([Buffer.from(options.password, "utf8"), Buffer.from([0])])));
+          continue;
+        }
+      }
+      throw new Error(`unexpected packet 0x${(payload[0] ?? 0).toString(16)} from the gateway during authentication`);
+    }
+    throw new Error("the gateway's authentication did not finish");
+  }
+  async function authenticateLocal(local, reader) {
+    const scramble = newScramble();
+    connectionId = connectionId + 1 >>> 0;
+    local.write(encodePacket(0, encodeGreeting(localGreeting(connectionId, scramble, SERVER_VERSION))));
+    const first = await reader.read();
+    let seq = first.seq;
+    const client = parseHandshakeResponse(first.payload);
+    if (first.payload.length === 32) {
+      throw new LocalRefusal(ER_HANDSHAKE, "08S01", "The Meridian forwarder on this port does not use TLS; connect without it (the connection never leaves this machine).");
+    }
+    if ((client.capabilities & (CLIENT.COMPRESS | CLIENT.ZSTD_COMPRESSION)) !== 0) {
+      throw new LocalRefusal(ER_HANDSHAKE, "08S01", "Compression is not supported by the Meridian database gateway; turn it off in your client.");
+    }
+    if (client.username !== options.username) throw accessDenied(client.username);
+    let authResponse = client.authResponse;
+    let plugin = client.authPlugin;
+    if (plugin === "" && (client.capabilities & CLIENT.SECURE_CONNECTION) !== 0) plugin = PLUGIN_NATIVE;
+    if (plugin !== PLUGIN_NATIVE && plugin !== PLUGIN_CACHING_SHA2) {
+      seq++;
+      local.write(encodePacket(seq, encodeAuthSwitchRequest(PLUGIN_NATIVE, scramble)));
+      const answer = await reader.read();
+      seq = answer.seq;
+      authResponse = answer.payload;
+      plugin = PLUGIN_NATIVE;
+    }
+    const expected = plugin === PLUGIN_CACHING_SHA2 ? scrambleCachingSha2(options.password, scramble) : scrambleNative(options.password, scramble);
+    if (!scrambleMatches(authResponse, expected)) throw accessDenied(client.username);
+    if (plugin === PLUGIN_CACHING_SHA2) {
+      seq++;
+      local.write(encodePacket(seq, Buffer.from([AUTH_MORE_DATA, FAST_AUTH_SUCCESS])));
+    }
+    return { client, seq };
+  }
+  async function handleConnection(local) {
+    track(local);
+    local.setNoDelay(true);
+    const reader = new PacketReader(local);
+    let upstream;
+    const timer = setTimeout(() => {
+      emit({ type: "connection-error", message: "A local MySQL handshake timed out." });
+      local.destroy();
+      upstream?.destroy();
+    }, handshakeTimeoutMs);
+    timer.unref();
+    let seq = 0;
+    try {
+      const authenticated = await authenticateLocal(local, reader);
+      seq = authenticated.seq;
+      const cert = certificate;
+      let session;
+      try {
+        session = await openUpstream(cert, authenticated.client);
+      } catch (error2) {
+        if (error2 instanceof MysqlServerError) {
+          throw new LocalRefusal(error2.code, error2.sqlState, error2.message);
+        }
+        throw new LocalRefusal(
+          CR_CONN_HOST_ERROR,
+          "HY000",
+          `Cannot reach the Meridian database gateway at ${cert.host}:${cert.port}: ${describeError(error2)}`
+        );
+      }
+      upstream = session.socket;
+      clearTimeout(timer);
+      local.write(encodePacket(seq + 1, session.ok));
+      const pipelined = reader.release({ pause: true });
+      if (pipelined.length > 0) upstream.write(pipelined);
+      if (session.leftover.length > 0) local.write(session.leftover);
+      splice(local, upstream);
+    } catch (error2) {
+      clearTimeout(timer);
+      upstream?.destroy();
+      if (error2 instanceof LocalRefusal) {
+        if (error2.code !== ER_ACCESS_DENIED) emit({ type: "connection-error", message: error2.message });
+        if (!local.destroyed) local.end(encodePacket(seq + 1, encodeErr(error2.code, error2.sqlState, error2.message)));
+        return;
+      }
+      emit({ type: "connection-error", message: describeError(error2) });
+      local.destroy();
+    }
+  }
+  async function refresh() {
+    if (options.refreshCertificate === void 0) return;
+    const next = await options.refreshCertificate();
+    certificate = next;
+    emit({ type: "certificate-refreshed", expiresAt: next.expiresAt });
+  }
+  function scheduleRefresh(delayMs, attempt) {
+    if (options.refreshCertificate === void 0 || stopped) return;
+    refreshTimer = setTimeout(() => {
+      refresh().then(
+        () => scheduleRefresh(certificateRefreshDelay(certificate.expiresAt, now(), refreshBeforeMs), 0),
+        (error2) => {
+          const backoff = REFRESH_RETRY_BACKOFFS_MS[Math.min(attempt, REFRESH_RETRY_BACKOFFS_MS.length - 1)] ?? 3e5;
+          emit({
+            type: "error",
+            message: `Could not renew the database gateway certificate (${describeError(error2)}); retrying in ${Math.round(backoff / 1e3)}s.`
+          });
+          scheduleRefresh(backoff, attempt + 1);
+        }
+      );
+    }, delayMs);
+    refreshTimer.unref();
+  }
+  const server = createServer((local) => {
+    void handleConnection(local);
+  });
+  await new Promise((resolve2, reject) => {
+    server.once("error", (error2) => {
+      reject(
+        error2.code === "EADDRINUSE" ? new CliError(`Port ${options.port} is already in use.`, {
+          hint: "Pick a different port with --port, or free up that port and try again."
+        }) : error2
+      );
+    });
+    server.listen({ port: options.port, host, exclusive: true }, () => resolve2());
+  });
+  server.on("error", (error2) => emit({ type: "error", message: describeError(error2) }));
+  const address = server.address();
+  const port = typeof address === "object" && address !== null ? address.port : options.port;
+  running = true;
+  emit({ type: "ready", port });
+  scheduleRefresh(certificateRefreshDelay(certificate.expiresAt, now(), refreshBeforeMs), 0);
+  return {
+    host,
+    port,
+    get running() {
+      return running;
+    },
+    get certificate() {
+      return certificate;
+    },
+    refresh,
+    async stop() {
+      if (stopped) return;
+      stopped = true;
+      running = false;
+      if (refreshTimer !== void 0) clearTimeout(refreshTimer);
+      const closed = new Promise((resolve2) => server.close(() => resolve2()));
+      for (const socket of sockets) socket.destroy();
+      await closed;
+    }
+  };
+}
+
 // src/lib/port.ts
-import { createServer } from "net";
+import { createServer as createServer2 } from "net";
 var DEFAULT_START_PORT = 3307;
 var DEFAULT_ATTEMPTS = 20;
 var MAX_PORT = 65535;
 function isPortFree(port, host = "127.0.0.1") {
   return new Promise((resolve2) => {
-    const server = createServer();
+    const server = createServer2();
     server.once("error", () => {
       resolve2(false);
     });
@@ -1761,7 +2546,7 @@ function isPortFree(port, host = "127.0.0.1") {
 }
 function bindEphemeralPort(host) {
   return new Promise((resolve2) => {
-    const server = createServer();
+    const server = createServer2();
     server.once("error", () => resolve2(null));
     server.listen({ port: 0, host, exclusive: true }, () => {
       const address = server.address();
@@ -1998,7 +2783,7 @@ function diagnoseMigrationFailure(root) {
 }
 
 // src/lib/proxy/binary.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { chmodSync as chmodSync3, existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync6, renameSync as renameSync3, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
 import { join as join4 } from "path";
 var PROXY_VERSION = "2.24.1";
@@ -2047,7 +2832,7 @@ function resolveProxyAsset(options) {
   };
 }
 function sha256(data) {
-  return createHash("sha256").update(data).digest("hex");
+  return createHash2("sha256").update(data).digest("hex");
 }
 var CHECKSUM_ROW_PATTERN = /\[([^\]]+)]\([^)]*\)\s*\|\s*([0-9a-fA-F]{64})/g;
 function parseChecksumTable(releaseBody) {
@@ -2188,8 +2973,8 @@ var PROBE_INTERVAL_MS = 150;
 var KILL_GRACE_MS = 2e3;
 var CRASH_BACKOFFS_MS = [200, 1e3, 3e3];
 var MAX_CRASH_RESTARTS = CRASH_BACKOFFS_MS.length;
-var REFRESH_RETRY_BACKOFFS_MS = [3e4, 6e4, 12e4];
-var MIN_REFRESH_DELAY_MS = 6e4;
+var REFRESH_RETRY_BACKOFFS_MS2 = [3e4, 6e4, 12e4];
+var MIN_REFRESH_DELAY_MS2 = 6e4;
 var LOG_RING_SIZE = 20;
 var STDERR_TAIL_LINES = 10;
 function buildProxyArgs(input2) {
@@ -2218,7 +3003,7 @@ function computeRefreshDelayMs(token, refreshSkewMs, assumedLifetimeMs) {
     if (!Number.isNaN(parsed)) expiresAtMs = parsed;
   }
   const effectiveExpiryMs = expiresAtMs ?? Date.now() + assumedLifetimeMs;
-  return Math.max(effectiveExpiryMs - Date.now() - refreshSkewMs, MIN_REFRESH_DELAY_MS);
+  return Math.max(effectiveExpiryMs - Date.now() - refreshSkewMs, MIN_REFRESH_DELAY_MS2);
 }
 function buildStartupFailureError(code, signal, lastLines) {
   const tail = lastLines.slice(-STDERR_TAIL_LINES).join("\n");
@@ -2396,7 +3181,7 @@ async function startProxy(options) {
   }
   function scheduleRefreshRetry() {
     if (stopped) return;
-    const delayMs = REFRESH_RETRY_BACKOFFS_MS[Math.min(refreshBackoffIndex, REFRESH_RETRY_BACKOFFS_MS.length - 1)] ?? 12e4;
+    const delayMs = REFRESH_RETRY_BACKOFFS_MS2[Math.min(refreshBackoffIndex, REFRESH_RETRY_BACKOFFS_MS2.length - 1)] ?? 12e4;
     refreshBackoffIndex += 1;
     if (refreshTimer !== void 0) clearTimeout(refreshTimer);
     refreshTimer = setTimeoutImpl(() => {
@@ -2596,6 +3381,8 @@ function resolveDeps(overrides) {
   return {
     ensureProxyBinary,
     startProxy,
+    issueGatewayCertificate,
+    startGatewayForwarder,
     findFreePort,
     patchEnvFile,
     waitForDatabase,
@@ -2722,6 +3509,97 @@ function handleProxyEvent(event) {
       return;
   }
 }
+async function pickLocalPort(options, deps) {
+  const findPortOptions = { start: DEFAULT_PORT_START };
+  if (options.port !== void 0) findPortOptions.preferred = options.port;
+  const port = await deps.findFreePort(findPortOptions);
+  if (options.port !== void 0 && port !== options.port) {
+    throw new CliError(`Port ${options.port} is already in use.`, {
+      hint: "Pick a different port with --port, or free up that port and try again."
+    });
+  }
+  return port;
+}
+async function startProxyEndpoint(client, appId, devDatabase, credentials, options, deps) {
+  const proxyToken = await withSpinner(
+    "Requesting a Cloud SQL Auth Proxy token...",
+    () => client.issueProxyToken(appId),
+    { success: "Issued a Cloud SQL Auth Proxy token." }
+  );
+  const binaryPath = await withSpinner(
+    "Preparing the Cloud SQL Auth Proxy...",
+    (spinner2) => {
+      const ensureOptions = {
+        onProgress: (received, total) => {
+          spinner2.update(
+            total !== void 0 ? `Downloading the Cloud SQL Auth Proxy... (${formatMb(received)}/${formatMb(total)} MB)` : `Downloading the Cloud SQL Auth Proxy... (${formatMb(received)} MB)`
+          );
+        }
+      };
+      return deps.ensureProxyBinary(ensureOptions);
+    },
+    { success: "Cloud SQL Auth Proxy is ready." }
+  );
+  const port = await pickLocalPort(options, deps);
+  const instanceConnectionName = firstNonEmpty(
+    credentials.instance_connection_name,
+    proxyToken.instance_connection_name,
+    devDatabase.instance_connection_name
+  );
+  if (instanceConnectionName === void 0) {
+    throw new CliError("The Meridian API did not return a Cloud SQL instance connection name.", {
+      hint: "Try again, or contact Meridian support if this persists."
+    });
+  }
+  return withSpinner(
+    `Starting the Cloud SQL Auth Proxy on 127.0.0.1:${port}...`,
+    () => deps.startProxy({
+      binaryPath,
+      instanceConnectionName,
+      token: toProxyToken(proxyToken),
+      port,
+      ...options.refreshToken !== false ? { refreshToken: async () => toProxyToken(await client.issueProxyToken(appId)) } : {},
+      onEvent: handleProxyEvent
+    }),
+    { success: `Cloud SQL Auth Proxy listening on 127.0.0.1:${port}.` }
+  );
+}
+function handleForwarderEvent(event) {
+  switch (event.type) {
+    case "ready":
+      debug(`Database gateway forwarder listening on port ${event.port}.`);
+      return;
+    case "connection-error":
+      debug(`Database gateway connection failed: ${event.message}`);
+      return;
+    case "certificate-refreshed":
+      step(`Renewed the database gateway certificate (expires ${event.expiresAt}).`);
+      return;
+    case "error":
+      warn(`Database gateway: ${event.message} Restart \`meridian dev\` if the database becomes unreachable.`);
+      return;
+  }
+}
+async function startGatewayEndpoint(client, appId, credentials, options, deps) {
+  const certificate = await withSpinner(
+    "Requesting a database gateway certificate...",
+    () => deps.issueGatewayCertificate(client, appId),
+    { success: (cert) => `Issued a database gateway certificate (expires ${cert.expiresAt}).` }
+  );
+  const port = await pickLocalPort(options, deps);
+  return withSpinner(
+    `Starting the database gateway forwarder on 127.0.0.1:${port}...`,
+    () => deps.startGatewayForwarder({
+      port,
+      username: credentials.username,
+      password: credentials.password,
+      certificate,
+      ...options.refreshToken !== false ? { refreshCertificate: () => deps.issueGatewayCertificate(client, appId) } : {},
+      onEvent: handleForwarderEvent
+    }),
+    { success: `Database gateway forwarder listening on 127.0.0.1:${port} (${certificate.host}).` }
+  );
+}
 async function startDevSession(options = {}) {
   const deps = resolveDeps(options.deps);
   let proxy;
@@ -2738,55 +3616,8 @@ async function startDevSession(options = {}) {
         success: (creds) => `Fetched credentials for database "${creds.database}"${typeof creds.expires_at === "string" ? ` (expire ${creds.expires_at})` : ""}.`
       }
     );
-    const proxyToken = await withSpinner(
-      "Requesting a Cloud SQL Auth Proxy token...",
-      () => client.issueProxyToken(appId),
-      { success: "Issued a Cloud SQL Auth Proxy token." }
-    );
-    const binaryPath = await withSpinner(
-      "Preparing the Cloud SQL Auth Proxy...",
-      (spinner2) => {
-        const ensureOptions = {
-          onProgress: (received, total) => {
-            spinner2.update(
-              total !== void 0 ? `Downloading the Cloud SQL Auth Proxy... (${formatMb(received)}/${formatMb(total)} MB)` : `Downloading the Cloud SQL Auth Proxy... (${formatMb(received)} MB)`
-            );
-          }
-        };
-        return deps.ensureProxyBinary(ensureOptions);
-      },
-      { success: "Cloud SQL Auth Proxy is ready." }
-    );
-    const findPortOptions = { start: DEFAULT_PORT_START };
-    if (options.port !== void 0) findPortOptions.preferred = options.port;
-    const port = await deps.findFreePort(findPortOptions);
-    if (options.port !== void 0 && port !== options.port) {
-      throw new CliError(`Port ${options.port} is already in use.`, {
-        hint: "Pick a different port with --port, or free up that port and try again."
-      });
-    }
-    const instanceConnectionName = firstNonEmpty(
-      credentials.instance_connection_name,
-      proxyToken.instance_connection_name,
-      devDatabase.instance_connection_name
-    );
-    if (instanceConnectionName === void 0) {
-      throw new CliError("The Meridian API did not return a Cloud SQL instance connection name.", {
-        hint: "Try again, or contact Meridian support if this persists."
-      });
-    }
-    proxy = await withSpinner(
-      `Starting the Cloud SQL Auth Proxy on 127.0.0.1:${port}...`,
-      () => deps.startProxy({
-        binaryPath,
-        instanceConnectionName,
-        token: toProxyToken(proxyToken),
-        port,
-        ...options.refreshToken !== false ? { refreshToken: async () => toProxyToken(await client.issueProxyToken(appId)) } : {},
-        onEvent: handleProxyEvent
-      }),
-      { success: `Cloud SQL Auth Proxy listening on 127.0.0.1:${port}.` }
-    );
+    const access = devDatabase.access === "gateway" ? "gateway" : "proxy";
+    proxy = access === "gateway" ? await startGatewayEndpoint(client, appId, credentials, options, deps) : await startProxyEndpoint(client, appId, devDatabase, credentials, options, deps);
     const connection = connectionInfoFromCredentials(credentials, { host: proxy.host, port: proxy.port });
     if (options.waitForDb !== false) {
       await withSpinner(
@@ -2838,6 +3669,7 @@ async function startDevSession(options = {}) {
       connection,
       databaseUrl,
       ...shadowDatabaseUrl !== void 0 ? { shadowDatabaseUrl } : {},
+      access,
       proxy,
       env: {
         ...process.env,
@@ -3506,7 +4338,7 @@ function printDevSummary(session, noEnv) {
   const entries = [
     ["App", appLabel(session.project)],
     ["Database", session.devDatabase.database],
-    ["Proxy", `127.0.0.1:${session.proxy.port}`],
+    [session.access === "gateway" ? "Gateway" : "Proxy", `127.0.0.1:${session.proxy.port}`],
     ["Env file", envEntry],
     ["DATABASE_URL", redactDatabaseUrl(session.databaseUrl)]
   ];
@@ -3521,6 +4353,7 @@ function buildDevJsonPayload(session) {
   return {
     app: appLabel(session.project),
     database: session.devDatabase.database,
+    access: session.access,
     proxy: { host: session.proxy.host, port: session.proxy.port },
     database_url: redactDatabaseUrl(session.databaseUrl),
     env_file: session.envPatch?.path ?? null,