@the-meridian/cli 1.1.0 → 1.3.0

package/dist/index.js

@@ -6,8 +6,8 @@ import { fileURLToPath } from "url";
 import { Command } from "commander";
 
 // src/commands/db.ts
-import { readFileSync as readFileSync7 } from "fs";
-import { join as join6 } from "path";
+import { readFileSync as readFileSync6 } from "fs";
+import { join as join5 } from "path";
 
 // src/version.ts
 import { createRequire } from "module";
@@ -67,6 +67,7 @@ var deviceInfoResponseSchema = z.object({
   created_at: z.string().optional()
 }).loose();
 var devDatabaseStatusSchema = z.union([z.enum(["provisioning", "ready", "error"]), z.string()]);
+var devDatabaseAccessSchema = z.union([z.enum(["gateway", "proxy"]), z.string()]);
 var devDatabaseSchema = z.object({
   id: idSchema,
   status: devDatabaseStatusSchema,
@@ -78,7 +79,21 @@ var devDatabaseSchema = z.object({
   region: z.string().nullish(),
   created_at: z.string().nullish(),
   /** Set by the API only while `status` is `error`; surfaced verbatim to the developer. */
-  error_message: z.string().nullish()
+  error_message: z.string().nullish(),
+  /**
+   * How the CLI reaches the database. The API always reports `gateway` (the
+   * Meridian database gateway with a per-developer certificate) since
+   * MER-823; the CLI no longer reads it.
+   */
+  access: devDatabaseAccessSchema.nullish()
+}).loose();
+var devDatabaseCertificateSchema = z.object({
+  certificate_pem: z.string(),
+  ca_pem: z.string(),
+  host: z.string(),
+  port: z.coerce.number(),
+  expires_at: z.string(),
+  fingerprint: z.string()
 }).loose();
 var devCredentialsSchema = z.object({
   host: z.string(),
@@ -96,11 +111,6 @@ var devCredentialsSchema = z.object({
   /** Echoed from the (nullable) dev-database column, so it can be null. */
   instance_connection_name: z.string().nullish()
 }).loose();
-var proxyTokenSchema = z.object({
-  access_token: z.string(),
-  expires_at: z.string().nullish(),
-  instance_connection_name: z.string().nullish()
-}).loose();
 var migrationRunInputSchema = z.object({
   command: z.string(),
   status: z.enum(["success", "failed", "rolled_back"]),
@@ -335,11 +345,16 @@ var ApiClient = class _ApiClient {
       `/app/cli/apps/${encodePathSegment(appId)}/dev-database/credentials`
     );
   }
-  async issueProxyToken(appId) {
+  /**
+   * Signs `publicKeyPem` (SPKI) as this developer's client certificate for the
+   * database gateway. Each call replaces the previous certificate server-side.
+   */
+  async issueDevDatabaseCertificate(appId, publicKeyPem) {
     return this.request(
-      proxyTokenSchema,
+      devDatabaseCertificateSchema,
       "POST",
-      `/app/cli/apps/${encodePathSegment(appId)}/dev-database/proxy-token`
+      `/app/cli/apps/${encodePathSegment(appId)}/dev-database/certificate`,
+      { body: { public_key: publicKeyPem } }
     );
   }
   async resetDevDatabase(appId) {
@@ -523,7 +538,9 @@ function extractErrorCode(body) {
 }
 var HINTS_BY_ERROR_CODE = {
   dev_database_limit_reached: "Your plan does not include a developer database for you on this app. Every collaborator gets their own out of the plan's allowance, so upgrading the organization's plan in the Meridian dashboard is what unlocks it.",
+  dev_databases_unavailable: "This Meridian environment does not offer developer databases. Run `meridian dev` against production (the default API URL) instead.",
   dev_database_over_storage_limit: "Run `meridian db reset` to drop and recreate the schema. Reset and delete stay available while you're over the limit.",
+  cli_upgrade_required: "Upgrade the Meridian CLI: npm i -g @the-meridian/cli",
   EXTERNAL_ACCESS_UNAVAILABLE: "External access is not switched on for this database yet, or the database is not ready. Check the database under Hosting in the Meridian dashboard.",
   FEATURE_NOT_ENTITLED: "Your organization's plan does not include managed developer databases; upgrade it in the Meridian dashboard."
 };
@@ -563,9 +580,6 @@ function meridianHome() {
 function globalConfigPath() {
   return join(meridianHome(), "config.json");
 }
-function proxyBinDir() {
-  return join(meridianHome(), "bin");
-}
 function projectStateDir(root) {
   return join(root, ".meridian");
 }
@@ -718,8 +732,8 @@ function connectionInfoFromCredentials(credentials, proxy) {
   };
 }
 var createSqlConnection = async (info, options) => {
-  const { createConnection: createConnection2 } = await import("mysql2/promise");
-  const connection = await createConnection2({
+  const { createConnection } = await import("mysql2/promise");
+  const connection = await createConnection({
     host: info.host,
     port: info.port,
     user: info.user,
@@ -803,7 +817,7 @@ function toDatabaseError(error2, info) {
   if (code === "ECONNREFUSED") {
     return build(
       `Could not reach ${target} (${code}).`,
-      "Nothing is listening on that port. `meridian dev` and `meridian migrate` start the Cloud SQL Auth Proxy for you; start it first if you are connecting by hand."
+      "Nothing is listening on that port. `meridian dev` and `meridian migrate` start the database connection for you; start one of them first if you are connecting by hand."
     );
   }
   if (code === "ETIMEDOUT" || code === "PROTOCOL_SEQUENCE_TIMEOUT") {
@@ -1742,14 +1756,770 @@ function redactDatabaseUrl(url) {
   return url.replace(/^(mysql:\/\/[^:@/]+):([^@]*)@/, "$1:****@");
 }
 
+// src/lib/gateway/certificate.ts
+import { generateKeyPair } from "crypto";
+import { createSecureContext } from "tls";
+import { promisify } from "util";
+var generateKeyPairAsync = promisify(generateKeyPair);
+function gatewayCertificateFromPem(material) {
+  return {
+    host: material.host,
+    port: material.port,
+    expiresAt: material.expiresAt,
+    fingerprint: material.fingerprint,
+    secureContext: createSecureContext({
+      key: material.keyPem,
+      cert: material.certificatePem,
+      ca: material.caPem,
+      minVersion: "TLSv1.2"
+    })
+  };
+}
+async function generateGatewayKeyPair() {
+  const { publicKey, privateKey } = await generateKeyPairAsync("ec", { namedCurve: "prime256v1" });
+  return {
+    publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+    privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }).toString()
+  };
+}
+async function issueGatewayCertificate(client, appId) {
+  const { publicKeyPem, privateKeyPem } = await generateGatewayKeyPair();
+  const issued = await client.issueDevDatabaseCertificate(appId, publicKeyPem);
+  return gatewayCertificateFromPem({
+    keyPem: privateKeyPem,
+    certificatePem: issued.certificate_pem,
+    caPem: issued.ca_pem,
+    host: issued.host,
+    port: issued.port,
+    expiresAt: issued.expires_at,
+    fingerprint: issued.fingerprint
+  });
+}
+var ASSUMED_LIFETIME_MS = 24 * 60 * 6e4;
+var DEFAULT_REFRESH_BEFORE_MS = 4 * 60 * 6e4;
+var MIN_REFRESH_DELAY_MS = 6e4;
+function certificateRefreshDelay(expiresAt, now, refreshBeforeMs = DEFAULT_REFRESH_BEFORE_MS) {
+  const parsed = Date.parse(expiresAt);
+  const expiry = Number.isNaN(parsed) ? now + ASSUMED_LIFETIME_MS : parsed;
+  return Math.max(MIN_REFRESH_DELAY_MS, expiry - refreshBeforeMs - now);
+}
+
+// src/lib/gateway/forwarder.ts
+import { connect as netConnect, createServer, isIP } from "net";
+import { connect as tlsConnect } from "tls";
+
+// src/lib/gateway/packets.ts
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+var CLIENT = {
+  LONG_PASSWORD: 1,
+  FOUND_ROWS: 2,
+  LONG_FLAG: 4,
+  CONNECT_WITH_DB: 8,
+  NO_SCHEMA: 16,
+  COMPRESS: 32,
+  ODBC: 64,
+  LOCAL_FILES: 128,
+  IGNORE_SPACE: 256,
+  PROTOCOL_41: 512,
+  INTERACTIVE: 1024,
+  SSL: 2048,
+  IGNORE_SIGPIPE: 4096,
+  TRANSACTIONS: 8192,
+  RESERVED: 16384,
+  SECURE_CONNECTION: 32768,
+  MULTI_STATEMENTS: 65536,
+  MULTI_RESULTS: 131072,
+  PS_MULTI_RESULTS: 262144,
+  PLUGIN_AUTH: 524288,
+  CONNECT_ATTRS: 1048576,
+  PLUGIN_AUTH_LENENC_CLIENT_DATA: 2097152,
+  CAN_HANDLE_EXPIRED_PASSWORDS: 4194304,
+  SESSION_TRACK: 8388608,
+  DEPRECATE_EOF: 16777216,
+  OPTIONAL_RESULTSET_METADATA: 33554432,
+  ZSTD_COMPRESSION: 67108864,
+  QUERY_ATTRIBUTES: 134217728
+};
+var GATEWAY_CAPABILITIES = CLIENT.LONG_PASSWORD | CLIENT.FOUND_ROWS | CLIENT.LONG_FLAG | CLIENT.CONNECT_WITH_DB | CLIENT.IGNORE_SPACE | CLIENT.PROTOCOL_41 | CLIENT.INTERACTIVE | CLIENT.SSL | CLIENT.IGNORE_SIGPIPE | CLIENT.TRANSACTIONS | CLIENT.RESERVED | CLIENT.SECURE_CONNECTION | CLIENT.MULTI_STATEMENTS | CLIENT.MULTI_RESULTS | CLIENT.PS_MULTI_RESULTS | CLIENT.PLUGIN_AUTH | CLIENT.CONNECT_ATTRS | CLIENT.PLUGIN_AUTH_LENENC_CLIENT_DATA | CLIENT.CAN_HANDLE_EXPIRED_PASSWORDS | CLIENT.SESSION_TRACK | CLIENT.DEPRECATE_EOF;
+var LOCAL_CAPABILITIES = GATEWAY_CAPABILITIES & ~CLIENT.SSL;
+var PLUGIN_NATIVE = "mysql_native_password";
+var PLUGIN_CACHING_SHA2 = "caching_sha2_password";
+var SCRAMBLE_LENGTH = 20;
+var DEFAULT_CHARSET = 255;
+var MAX_PAYLOAD = 16777215;
+var MAX_HANDSHAKE_PACKET = 64 * 1024;
+var AUTH_MORE_DATA = 1;
+var FAST_AUTH_SUCCESS = 3;
+var PERFORM_FULL_AUTH = 4;
+var SERVER_STATUS_AUTOCOMMIT = 2;
+function encodePacket(seq, payload) {
+  if (payload.length >= MAX_PAYLOAD) throw new Error(`refusing to write a ${payload.length} byte handshake packet`);
+  const header = Buffer.alloc(4);
+  header.writeUIntLE(payload.length, 0, 3);
+  header[3] = seq & 255;
+  return Buffer.concat([header, payload]);
+}
+var PacketReader = class {
+  #socket;
+  #maxPacket;
+  #buffer = Buffer.alloc(0);
+  #failure;
+  #waiter;
+  #onData = (chunk) => {
+    this.#buffer = this.#buffer.length === 0 ? chunk : Buffer.concat([this.#buffer, chunk]);
+    this.#settle();
+  };
+  #onClose = () => {
+    this.#fail(new Error("the connection closed during the MySQL handshake"));
+  };
+  #onError = (error2) => {
+    this.#fail(error2);
+  };
+  constructor(socket, maxPacket = MAX_HANDSHAKE_PACKET) {
+    this.#socket = socket;
+    this.#maxPacket = maxPacket;
+    socket.on("data", this.#onData);
+    socket.on("end", this.#onClose);
+    socket.on("close", this.#onClose);
+    socket.on("error", this.#onError);
+  }
+  read() {
+    return new Promise((resolve2, reject) => {
+      this.#waiter = { resolve: resolve2, reject };
+      this.#settle();
+    });
+  }
+  /** Stops reading. `pause` keeps later bytes in the socket for a pipe() to pick up. */
+  release(options) {
+    if (options.pause) this.#socket.pause();
+    this.#socket.off("data", this.#onData);
+    this.#socket.off("end", this.#onClose);
+    this.#socket.off("close", this.#onClose);
+    this.#socket.off("error", this.#onError);
+    const rest = this.#buffer;
+    this.#buffer = Buffer.alloc(0);
+    return rest;
+  }
+  #fail(error2) {
+    if (this.#failure === void 0) this.#failure = error2;
+    this.#settle();
+  }
+  #settle() {
+    const waiter = this.#waiter;
+    if (waiter === void 0) return;
+    if (this.#buffer.length >= 4) {
+      const length = this.#buffer.readUIntLE(0, 3);
+      if (length > this.#maxPacket) {
+        this.#waiter = void 0;
+        waiter.reject(new Error(`a ${length} byte packet during the MySQL handshake is too large`));
+        return;
+      }
+      if (this.#buffer.length >= 4 + length) {
+        const seq = this.#buffer[3] ?? 0;
+        const payload = Buffer.from(this.#buffer.subarray(4, 4 + length));
+        this.#buffer = this.#buffer.subarray(4 + length);
+        this.#waiter = void 0;
+        waiter.resolve({ seq, payload });
+        return;
+      }
+    }
+    if (this.#failure !== void 0) {
+      this.#waiter = void 0;
+      waiter.reject(this.#failure);
+    }
+  }
+};
+var Cursor = class {
+  constructor(buf) {
+    this.buf = buf;
+  }
+  buf;
+  pos = 0;
+  get remaining() {
+    return this.buf.length - this.pos;
+  }
+  bytes(n, what) {
+    if (n < 0 || this.remaining < n) throw new Error(`truncated packet reading ${what}`);
+    const out = this.buf.subarray(this.pos, this.pos + n);
+    this.pos += n;
+    return out;
+  }
+  u8(what) {
+    return this.bytes(1, what)[0] ?? 0;
+  }
+  u16(what) {
+    return this.bytes(2, what).readUInt16LE(0);
+  }
+  u32(what) {
+    return this.bytes(4, what).readUInt32LE(0);
+  }
+  nulString(what) {
+    const end = this.buf.indexOf(0, this.pos);
+    if (end < 0) throw new Error(`truncated packet reading ${what}`);
+    const out = this.buf.subarray(this.pos, end);
+    this.pos = end + 1;
+    return out;
+  }
+  /** Everything left, without a trailing NUL. */
+  restNul() {
+    let out = this.buf.subarray(this.pos);
+    this.pos = this.buf.length;
+    if (out.length > 0 && out[out.length - 1] === 0) out = out.subarray(0, out.length - 1);
+    return out;
+  }
+  lenencInt(what) {
+    const first = this.u8(what);
+    if (first < 251) return first;
+    if (first === 252) return this.u16(what);
+    if (first === 253) return this.bytes(3, what).readUIntLE(0, 3);
+    if (first === 254) {
+      const value = this.bytes(8, what).readBigUInt64LE(0);
+      if (value > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error(`${what} is too large`);
+      return Number(value);
+    }
+    throw new Error(`invalid length-encoded integer reading ${what}`);
+  }
+  lenencBytes(what) {
+    return this.bytes(this.lenencInt(what), what);
+  }
+};
+function lenencInt(n) {
+  if (n < 251) return Buffer.from([n]);
+  if (n <= 65535) {
+    const b2 = Buffer.alloc(3);
+    b2[0] = 252;
+    b2.writeUInt16LE(n, 1);
+    return b2;
+  }
+  if (n <= 16777215) {
+    const b2 = Buffer.alloc(4);
+    b2[0] = 253;
+    b2.writeUIntLE(n, 1, 3);
+    return b2;
+  }
+  const b = Buffer.alloc(9);
+  b[0] = 254;
+  b.writeBigUInt64LE(BigInt(n), 1);
+  return b;
+}
+function lenencBytes(value) {
+  return Buffer.concat([lenencInt(value.length), value]);
+}
+function u16(n) {
+  const b = Buffer.alloc(2);
+  b.writeUInt16LE(n & 65535, 0);
+  return b;
+}
+function u32(n) {
+  const b = Buffer.alloc(4);
+  b.writeUInt32LE(n >>> 0, 0);
+  return b;
+}
+var NUL = Buffer.from([0]);
+function encodeGreeting(g) {
+  if (g.scramble.length !== SCRAMBLE_LENGTH) throw new Error("the greeting scramble must be 20 bytes");
+  return Buffer.concat([
+    Buffer.from([10]),
+    Buffer.from(g.serverVersion, "utf8"),
+    NUL,
+    u32(g.connectionId),
+    g.scramble.subarray(0, 8),
+    NUL,
+    u16(g.capabilities),
+    Buffer.from([g.charset]),
+    u16(g.status),
+    u16(g.capabilities >>> 16),
+    Buffer.from([SCRAMBLE_LENGTH + 1]),
+    Buffer.alloc(10),
+    g.scramble.subarray(8),
+    NUL,
+    Buffer.from(g.authPlugin, "utf8"),
+    NUL
+  ]);
+}
+function localGreeting(connectionId, scramble, serverVersion) {
+  return {
+    serverVersion,
+    connectionId,
+    scramble,
+    capabilities: LOCAL_CAPABILITIES,
+    charset: DEFAULT_CHARSET,
+    status: SERVER_STATUS_AUTOCOMMIT,
+    authPlugin: PLUGIN_NATIVE
+  };
+}
+function parseGreeting(payload) {
+  if (payload[0] === 255) throw serverErrorFromPacket(payload);
+  const r = new Cursor(payload);
+  const version = r.u8("protocol version");
+  if (version !== 10) throw new Error(`unsupported handshake version ${version}`);
+  const serverVersion = r.nulString("server version").toString("utf8");
+  const connectionId = r.u32("connection id");
+  const part1 = Buffer.from(r.bytes(8, "scramble part 1"));
+  r.u8("filler");
+  let capabilities = r.u16("capabilities");
+  let charset = DEFAULT_CHARSET;
+  let status = 0;
+  let authPlugin = "";
+  let scramble = part1;
+  if (r.remaining > 0) {
+    charset = r.u8("charset");
+    status = r.u16("status");
+    capabilities = (capabilities | r.u16("capabilities upper") << 16) >>> 0;
+    const authLength = r.u8("auth data length");
+    r.bytes(10, "reserved");
+    if ((capabilities & CLIENT.SECURE_CONNECTION) !== 0) {
+      let part2 = r.bytes(Math.max(13, authLength - 8), "scramble part 2");
+      if (part2.length > 0 && part2[part2.length - 1] === 0) part2 = part2.subarray(0, part2.length - 1);
+      scramble = Buffer.concat([part1, part2]);
+    }
+    if ((capabilities & CLIENT.PLUGIN_AUTH) !== 0) authPlugin = r.restNul().toString("utf8");
+  }
+  if (scramble.length < SCRAMBLE_LENGTH) throw new Error(`the server scramble is ${scramble.length} bytes`);
+  return {
+    serverVersion,
+    connectionId,
+    scramble: scramble.subarray(0, SCRAMBLE_LENGTH),
+    capabilities,
+    charset,
+    status,
+    authPlugin: authPlugin === "" ? PLUGIN_NATIVE : authPlugin
+  };
+}
+function encodeSslRequest(capabilities, maxPacketSize, charset) {
+  return Buffer.concat([u32(capabilities | CLIENT.SSL), u32(maxPacketSize), Buffer.from([charset]), Buffer.alloc(23)]);
+}
+function parseHandshakeResponse(payload) {
+  const r = new Cursor(payload);
+  const capabilities = r.u32("capabilities");
+  if ((capabilities & CLIENT.PROTOCOL_41) === 0) throw new Error("the client does not speak protocol 4.1");
+  const maxPacketSize = r.u32("max packet size");
+  const charset = r.u8("charset");
+  r.bytes(23, "filler");
+  if (r.remaining === 0) {
+    return { capabilities, maxPacketSize, charset, username: "", authResponse: Buffer.alloc(0), database: "", authPlugin: "", attributes: [] };
+  }
+  const username = r.nulString("username").toString("utf8");
+  let authResponse;
+  if ((capabilities & CLIENT.PLUGIN_AUTH_LENENC_CLIENT_DATA) !== 0) authResponse = r.lenencBytes("auth response");
+  else if ((capabilities & CLIENT.SECURE_CONNECTION) !== 0) authResponse = r.bytes(r.u8("auth response length"), "auth response");
+  else authResponse = r.nulString("auth response");
+  let database = "";
+  if ((capabilities & CLIENT.CONNECT_WITH_DB) !== 0 && r.remaining > 0) database = r.nulString("database").toString("utf8");
+  let authPlugin = "";
+  if ((capabilities & CLIENT.PLUGIN_AUTH) !== 0 && r.remaining > 0) authPlugin = r.nulString("auth plugin").toString("utf8");
+  const attributes = [];
+  if ((capabilities & CLIENT.CONNECT_ATTRS) !== 0 && r.remaining > 0) {
+    const attrs = new Cursor(r.lenencBytes("attributes"));
+    while (attrs.remaining > 0) {
+      const key = attrs.lenencBytes("attribute key").toString("utf8");
+      const value = attrs.lenencBytes("attribute value").toString("utf8");
+      attributes.push([key, value]);
+    }
+  }
+  return {
+    capabilities,
+    maxPacketSize,
+    charset,
+    username,
+    authResponse: Buffer.from(authResponse),
+    database,
+    authPlugin,
+    attributes
+  };
+}
+function encodeHandshakeResponse(h) {
+  const parts = [u32(h.capabilities), u32(h.maxPacketSize), Buffer.from([h.charset]), Buffer.alloc(23)];
+  parts.push(Buffer.from(h.username, "utf8"), NUL);
+  if ((h.capabilities & CLIENT.PLUGIN_AUTH_LENENC_CLIENT_DATA) !== 0) parts.push(lenencBytes(h.authResponse));
+  else if ((h.capabilities & CLIENT.SECURE_CONNECTION) !== 0) parts.push(Buffer.from([h.authResponse.length]), h.authResponse);
+  else parts.push(h.authResponse, NUL);
+  if ((h.capabilities & CLIENT.CONNECT_WITH_DB) !== 0) parts.push(Buffer.from(h.database, "utf8"), NUL);
+  if ((h.capabilities & CLIENT.PLUGIN_AUTH) !== 0) parts.push(Buffer.from(h.authPlugin, "utf8"), NUL);
+  if ((h.capabilities & CLIENT.CONNECT_ATTRS) !== 0) {
+    const attrs = h.attributes.map(
+      ([key, value]) => Buffer.concat([lenencBytes(Buffer.from(key, "utf8")), lenencBytes(Buffer.from(value, "utf8"))])
+    );
+    parts.push(lenencBytes(Buffer.concat(attrs)));
+  }
+  return Buffer.concat(parts);
+}
+function encodeAuthSwitchRequest(plugin, scramble) {
+  return Buffer.concat([Buffer.from([254]), Buffer.from(plugin, "utf8"), NUL, scramble, NUL]);
+}
+function parseAuthSwitchRequest(payload) {
+  if (payload[0] !== 254) throw new Error("not an auth switch request");
+  const r = new Cursor(payload);
+  r.pos = 1;
+  const plugin = r.nulString("auth plugin").toString("utf8");
+  let scramble = Buffer.from(r.restNul());
+  if (scramble.length > SCRAMBLE_LENGTH) scramble = scramble.subarray(0, SCRAMBLE_LENGTH);
+  return { plugin, scramble };
+}
+var isOk = (payload) => payload[0] === 0;
+var isErr = (payload) => payload[0] === 255;
+var isAuthSwitch = (payload) => payload[0] === 254;
+var isAuthMoreData = (payload) => payload[0] === AUTH_MORE_DATA;
+function encodeErr(code, sqlState, message) {
+  const state2 = sqlState.length === 5 ? sqlState : "HY000";
+  return Buffer.concat([Buffer.from([255]), u16(code), Buffer.from(`#${state2}`, "latin1"), Buffer.from(message, "utf8")]);
+}
+var MysqlServerError = class extends Error {
+  constructor(code, sqlState, message) {
+    super(message);
+    this.code = code;
+    this.sqlState = sqlState;
+    this.name = "MysqlServerError";
+  }
+  code;
+  sqlState;
+};
+function serverErrorFromPacket(payload) {
+  if (payload.length < 3 || payload[0] !== 255) return new MysqlServerError(0, "HY000", "unknown error");
+  const code = payload.readUInt16LE(1);
+  let rest = payload.subarray(3);
+  let sqlState = "HY000";
+  if (rest.length >= 6 && rest[0] === 35) {
+    sqlState = rest.subarray(1, 6).toString("latin1");
+    rest = rest.subarray(6);
+  }
+  return new MysqlServerError(code, sqlState, rest.toString("utf8"));
+}
+function newScramble() {
+  const b = randomBytes(SCRAMBLE_LENGTH);
+  for (let i = 0; i < b.length; i++) {
+    let v = (b[i] ?? 0) & 127 | 1;
+    if (v === 36) v = 37;
+    b[i] = v;
+  }
+  return b;
+}
+function xor(a, b) {
+  const out = Buffer.alloc(a.length);
+  for (let i = 0; i < a.length; i++) out[i] = (a[i] ?? 0) ^ (b[i] ?? 0);
+  return out;
+}
+function scrambleNative(password, nonce) {
+  if (password === "") return Buffer.alloc(0);
+  const h1 = createHash("sha1").update(password, "utf8").digest();
+  const h2 = createHash("sha1").update(h1).digest();
+  const h3 = createHash("sha1").update(nonce).update(h2).digest();
+  return xor(h1, h3);
+}
+function scrambleCachingSha2(password, nonce) {
+  if (password === "") return Buffer.alloc(0);
+  const h1 = createHash("sha256").update(password, "utf8").digest();
+  const h2 = createHash("sha256").update(h1).digest();
+  const h3 = createHash("sha256").update(h2).update(nonce).digest();
+  return xor(h1, h3);
+}
+function scrambleFor(plugin, password, nonce) {
+  switch (plugin) {
+    case PLUGIN_NATIVE:
+      return scrambleNative(password, nonce);
+    case PLUGIN_CACHING_SHA2:
+      return scrambleCachingSha2(password, nonce);
+    default:
+      throw new Error(`unsupported auth plugin "${plugin}"`);
+  }
+}
+function scrambleMatches(received, expected) {
+  return received.length === expected.length && timingSafeEqual(received, expected);
+}
+
+// src/lib/gateway/forwarder.ts
+var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_HANDSHAKE_TIMEOUT_MS = 3e4;
+var REFRESH_RETRY_BACKOFFS_MS = [3e4, 6e4, 12e4, 3e5];
+var SERVER_VERSION = "8.0.40-meridian-forwarder";
+var CLOSE_GRACE_MS = 2e3;
+var ER_ACCESS_DENIED = 1045;
+var ER_HANDSHAKE = 1043;
+var CR_CONN_HOST_ERROR = 2003;
+var LocalRefusal = class extends Error {
+  constructor(code, sqlState, message) {
+    super(message);
+    this.code = code;
+    this.sqlState = sqlState;
+  }
+  code;
+  sqlState;
+};
+function accessDenied(username) {
+  return new LocalRefusal(ER_ACCESS_DENIED, "28000", `Access denied for user '${username}'@'localhost' (using password: YES)`);
+}
+function upstreamCapabilities(clientCapabilities, database) {
+  let caps = clientCapabilities & LOCAL_CAPABILITIES | CLIENT.SSL | CLIENT.PROTOCOL_41 | CLIENT.SECURE_CONNECTION | CLIENT.PLUGIN_AUTH | CLIENT.PLUGIN_AUTH_LENENC_CLIENT_DATA;
+  if (database !== "") caps |= CLIENT.CONNECT_WITH_DB;
+  return caps >>> 0;
+}
+function waitFor(socket, event) {
+  return new Promise((resolve2, reject) => {
+    const onError = (error2) => {
+      socket.off(event, onDone);
+      reject(error2);
+    };
+    const onDone = () => {
+      socket.off("error", onError);
+      resolve2();
+    };
+    socket.once(event, onDone);
+    socket.once("error", onError);
+  });
+}
+function splice(a, b) {
+  const closeOther = (other) => () => {
+    if (other.destroyed) return;
+    other.end();
+    setTimeout(() => other.destroy(), CLOSE_GRACE_MS).unref();
+  };
+  a.on("close", closeOther(b));
+  b.on("close", closeOther(a));
+  a.pipe(b);
+  b.pipe(a);
+}
+async function startGatewayForwarder(options) {
+  const host = options.host ?? DEFAULT_HOST;
+  const handshakeTimeoutMs = options.handshakeTimeoutMs ?? DEFAULT_HANDSHAKE_TIMEOUT_MS;
+  const refreshBeforeMs = options.refreshBeforeMs ?? DEFAULT_REFRESH_BEFORE_MS;
+  const now = options.now ?? Date.now;
+  const emit = (event) => {
+    try {
+      options.onEvent?.(event);
+    } catch {
+    }
+  };
+  let certificate = options.certificate;
+  let running = false;
+  let stopped = false;
+  let connectionId = 0;
+  let refreshTimer;
+  const sockets = /* @__PURE__ */ new Set();
+  const track = (socket) => {
+    sockets.add(socket);
+    socket.once("close", () => sockets.delete(socket));
+    socket.on("error", () => socket.destroy());
+  };
+  async function openUpstream(cert, client) {
+    const raw = netConnect({ host: cert.host, port: cert.port });
+    track(raw);
+    raw.setNoDelay(true);
+    await waitFor(raw, "connect");
+    const rawReader = new PacketReader(raw);
+    const greetingPacket = await rawReader.read();
+    const greeting = parseGreeting(greetingPacket.payload);
+    if ((greeting.capabilities & CLIENT.SSL) === 0) throw new Error("the gateway did not offer TLS");
+    const capabilities = upstreamCapabilities(client.capabilities, client.database);
+    let seq = greetingPacket.seq + 1;
+    raw.write(encodePacket(seq, encodeSslRequest(capabilities, client.maxPacketSize, client.charset)));
+    rawReader.release({ pause: false });
+    const socket = tlsConnect({
+      socket: raw,
+      secureContext: cert.secureContext,
+      host: cert.host,
+      // SNI carries host names only; an IP is still verified against the certificate.
+      ...isIP(cert.host) === 0 ? { servername: cert.host } : {},
+      rejectUnauthorized: true
+    });
+    track(socket);
+    socket.setNoDelay(true);
+    await waitFor(socket, "secureConnect");
+    const reader = new PacketReader(socket);
+    let plugin = PLUGIN_CACHING_SHA2;
+    seq++;
+    socket.write(
+      encodePacket(
+        seq,
+        encodeHandshakeResponse({
+          capabilities,
+          maxPacketSize: client.maxPacketSize,
+          charset: client.charset,
+          username: options.username,
+          authResponse: scrambleCachingSha2(options.password, greeting.scramble),
+          database: client.database,
+          authPlugin: plugin,
+          attributes: client.attributes
+        })
+      )
+    );
+    for (let round = 0; round < 6; round++) {
+      const packet = await reader.read();
+      seq = packet.seq;
+      const payload = packet.payload;
+      if (isOk(payload)) return { socket, ok: payload, leftover: reader.release({ pause: true }) };
+      if (isErr(payload)) throw serverErrorFromPacket(payload);
+      if (isAuthSwitch(payload)) {
+        const request = parseAuthSwitchRequest(payload);
+        plugin = request.plugin;
+        seq++;
+        socket.write(encodePacket(seq, scrambleFor(plugin, options.password, request.scramble)));
+        continue;
+      }
+      if (isAuthMoreData(payload) && plugin === PLUGIN_CACHING_SHA2 && payload.length >= 2) {
+        if (payload[1] === FAST_AUTH_SUCCESS) continue;
+        if (payload[1] === PERFORM_FULL_AUTH) {
+          seq++;
+          socket.write(encodePacket(seq, Buffer.concat([Buffer.from(options.password, "utf8"), Buffer.from([0])])));
+          continue;
+        }
+      }
+      throw new Error(`unexpected packet 0x${(payload[0] ?? 0).toString(16)} from the gateway during authentication`);
+    }
+    throw new Error("the gateway's authentication did not finish");
+  }
+  async function authenticateLocal(local, reader) {
+    const scramble = newScramble();
+    connectionId = connectionId + 1 >>> 0;
+    local.write(encodePacket(0, encodeGreeting(localGreeting(connectionId, scramble, SERVER_VERSION))));
+    const first = await reader.read();
+    let seq = first.seq;
+    const client = parseHandshakeResponse(first.payload);
+    if (first.payload.length === 32) {
+      throw new LocalRefusal(ER_HANDSHAKE, "08S01", "The Meridian forwarder on this port does not use TLS; connect without it (the connection never leaves this machine).");
+    }
+    if ((client.capabilities & (CLIENT.COMPRESS | CLIENT.ZSTD_COMPRESSION)) !== 0) {
+      throw new LocalRefusal(ER_HANDSHAKE, "08S01", "Compression is not supported by the Meridian database gateway; turn it off in your client.");
+    }
+    if (client.username !== options.username) throw accessDenied(client.username);
+    let authResponse = client.authResponse;
+    let plugin = client.authPlugin;
+    if (plugin === "" && (client.capabilities & CLIENT.SECURE_CONNECTION) !== 0) plugin = PLUGIN_NATIVE;
+    if (plugin !== PLUGIN_NATIVE && plugin !== PLUGIN_CACHING_SHA2) {
+      seq++;
+      local.write(encodePacket(seq, encodeAuthSwitchRequest(PLUGIN_NATIVE, scramble)));
+      const answer = await reader.read();
+      seq = answer.seq;
+      authResponse = answer.payload;
+      plugin = PLUGIN_NATIVE;
+    }
+    const expected = plugin === PLUGIN_CACHING_SHA2 ? scrambleCachingSha2(options.password, scramble) : scrambleNative(options.password, scramble);
+    if (!scrambleMatches(authResponse, expected)) throw accessDenied(client.username);
+    if (plugin === PLUGIN_CACHING_SHA2) {
+      seq++;
+      local.write(encodePacket(seq, Buffer.from([AUTH_MORE_DATA, FAST_AUTH_SUCCESS])));
+    }
+    return { client, seq };
+  }
+  async function handleConnection(local) {
+    track(local);
+    local.setNoDelay(true);
+    const reader = new PacketReader(local);
+    let upstream;
+    const timer = setTimeout(() => {
+      emit({ type: "connection-error", message: "A local MySQL handshake timed out." });
+      local.destroy();
+      upstream?.destroy();
+    }, handshakeTimeoutMs);
+    timer.unref();
+    let seq = 0;
+    try {
+      const authenticated = await authenticateLocal(local, reader);
+      seq = authenticated.seq;
+      const cert = certificate;
+      let session;
+      try {
+        session = await openUpstream(cert, authenticated.client);
+      } catch (error2) {
+        if (error2 instanceof MysqlServerError) {
+          throw new LocalRefusal(error2.code, error2.sqlState, error2.message);
+        }
+        throw new LocalRefusal(
+          CR_CONN_HOST_ERROR,
+          "HY000",
+          `Cannot reach the Meridian database gateway at ${cert.host}:${cert.port}: ${describeError(error2)}`
+        );
+      }
+      upstream = session.socket;
+      clearTimeout(timer);
+      local.write(encodePacket(seq + 1, session.ok));
+      const pipelined = reader.release({ pause: true });
+      if (pipelined.length > 0) upstream.write(pipelined);
+      if (session.leftover.length > 0) local.write(session.leftover);
+      splice(local, upstream);
+    } catch (error2) {
+      clearTimeout(timer);
+      upstream?.destroy();
+      if (error2 instanceof LocalRefusal) {
+        if (error2.code !== ER_ACCESS_DENIED) emit({ type: "connection-error", message: error2.message });
+        if (!local.destroyed) local.end(encodePacket(seq + 1, encodeErr(error2.code, error2.sqlState, error2.message)));
+        return;
+      }
+      emit({ type: "connection-error", message: describeError(error2) });
+      local.destroy();
+    }
+  }
+  async function refresh() {
+    if (options.refreshCertificate === void 0) return;
+    const next = await options.refreshCertificate();
+    certificate = next;
+    emit({ type: "certificate-refreshed", expiresAt: next.expiresAt });
+  }
+  function scheduleRefresh(delayMs, attempt) {
+    if (options.refreshCertificate === void 0 || stopped) return;
+    refreshTimer = setTimeout(() => {
+      refresh().then(
+        () => scheduleRefresh(certificateRefreshDelay(certificate.expiresAt, now(), refreshBeforeMs), 0),
+        (error2) => {
+          const backoff = REFRESH_RETRY_BACKOFFS_MS[Math.min(attempt, REFRESH_RETRY_BACKOFFS_MS.length - 1)] ?? 3e5;
+          emit({
+            type: "error",
+            message: `Could not renew the database gateway certificate (${describeError(error2)}); retrying in ${Math.round(backoff / 1e3)}s.`
+          });
+          scheduleRefresh(backoff, attempt + 1);
+        }
+      );
+    }, delayMs);
+    refreshTimer.unref();
+  }
+  const server = createServer((local) => {
+    void handleConnection(local);
+  });
+  await new Promise((resolve2, reject) => {
+    server.once("error", (error2) => {
+      reject(
+        error2.code === "EADDRINUSE" ? new CliError(`Port ${options.port} is already in use.`, {
+          hint: "Pick a different port with --port, or free up that port and try again."
+        }) : error2
+      );
+    });
+    server.listen({ port: options.port, host, exclusive: true }, () => resolve2());
+  });
+  server.on("error", (error2) => emit({ type: "error", message: describeError(error2) }));
+  const address = server.address();
+  const port = typeof address === "object" && address !== null ? address.port : options.port;
+  running = true;
+  emit({ type: "ready", port });
+  scheduleRefresh(certificateRefreshDelay(certificate.expiresAt, now(), refreshBeforeMs), 0);
+  return {
+    host,
+    port,
+    get running() {
+      return running;
+    },
+    get certificate() {
+      return certificate;
+    },
+    refresh,
+    async stop() {
+      if (stopped) return;
+      stopped = true;
+      running = false;
+      if (refreshTimer !== void 0) clearTimeout(refreshTimer);
+      const closed = new Promise((resolve2) => server.close(() => resolve2()));
+      for (const socket of sockets) socket.destroy();
+      await closed;
+    }
+  };
+}
+
 // src/lib/port.ts
-import { createServer } from "net";
+import { createServer as createServer2 } from "net";
 var DEFAULT_START_PORT = 3307;
 var DEFAULT_ATTEMPTS = 20;
 var MAX_PORT = 65535;
 function isPortFree(port, host = "127.0.0.1") {
   return new Promise((resolve2) => {
-    const server = createServer();
+    const server = createServer2();
     server.once("error", () => {
       resolve2(false);
     });
@@ -1761,7 +2531,7 @@ function isPortFree(port, host = "127.0.0.1") {
 }
 function bindEphemeralPort(host) {
   return new Promise((resolve2) => {
-    const server = createServer();
+    const server = createServer2();
     server.once("error", () => resolve2(null));
     server.listen({ port: 0, host, exclusive: true }, () => {
       const address = server.address();
@@ -1784,7 +2554,7 @@ async function findFreePort(options = {}) {
   }
   const ephemeral = await bindEphemeralPort(host);
   if (ephemeral === null) {
-    throw new CliError("Could not find a free local port for the Cloud SQL Auth Proxy.", {
+    throw new CliError("Could not find a free local port for the database gateway forwarder.", {
       hint: "Close other applications using local ports and try again."
     });
   }
@@ -1997,513 +2767,6 @@ function diagnoseMigrationFailure(root) {
   return offender === null ? null : foreignDialectExplanation(offender);
 }
 
-// src/lib/proxy/binary.ts
-import { createHash } from "crypto";
-import { chmodSync as chmodSync3, existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync6, renameSync as renameSync3, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
-import { join as join4 } from "path";
-var PROXY_VERSION = "2.24.1";
-var PROXY_CHECKSUMS = Object.freeze({
-  "cloud-sql-proxy.darwin.amd64": "67a38444d03fe77a8b11036f96fe5d2379640088bb6e338737fb48d97c58cf48",
-  "cloud-sql-proxy.darwin.arm64": "fd374545705f2aa687d8e525a2efcbb9d356cc8af60d4dfa1a330cb59a7f9450",
-  "cloud-sql-proxy.linux.386": "cf731f4becfb5a2de61f2998b2d660c5fb8f3067cbd3b86f5783ae9049c06f24",
-  "cloud-sql-proxy.linux.amd64": "fae2766aac9d614a2bdef2f2a7778f3d054f3acd5ff07a81a9e300bd471512eb",
-  "cloud-sql-proxy.linux.arm64": "da49fd73b0d33c0ab8e5dfc19dfb104cdd969ebd355eef8fd3b079c20a723c82",
-  "cloud-sql-proxy.x64.exe": "01ec54c69dbb8118c0b181c33ff1469a5cdb2dddb49eb86b0b173f6c55dea0bc",
-  "cloud-sql-proxy.x86.exe": "98c3b1897c80f2bc0b241b4452c18557a00cd86f89e4d7449c4ff1316e243c44"
-});
-var ASSET_NAME_BY_PLATFORM_ARCH = Object.freeze({
-  "darwin:arm64": "cloud-sql-proxy.darwin.arm64",
-  "darwin:x64": "cloud-sql-proxy.darwin.amd64",
-  "linux:x64": "cloud-sql-proxy.linux.amd64",
-  "linux:arm64": "cloud-sql-proxy.linux.arm64",
-  "linux:ia32": "cloud-sql-proxy.linux.386",
-  "win32:x64": "cloud-sql-proxy.x64.exe",
-  "win32:ia32": "cloud-sql-proxy.x86.exe"
-});
-function defaultVersion() {
-  const override = process.env.MERIDIAN_PROXY_VERSION;
-  if (override !== void 0 && override !== "") return override;
-  return PROXY_VERSION;
-}
-function resolveProxyAsset(options) {
-  const platform = options?.platform ?? process.platform;
-  const arch = options?.arch ?? process.arch;
-  const version = options?.version ?? defaultVersion();
-  const assetName = ASSET_NAME_BY_PLATFORM_ARCH[`${platform}:${arch}`];
-  if (assetName === void 0) {
-    throw new CliError(`The Cloud SQL Auth Proxy has no published build for ${platform}/${arch}.`, {
-      hint: "Set MERIDIAN_PROXY_PATH to the path of a proxy binary you install yourself."
-    });
-  }
-  const downloadUrl = `https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v${version}/${assetName}`;
-  const sha256Value = version === PROXY_VERSION ? PROXY_CHECKSUMS[assetName] : void 0;
-  const fileName = `cloud-sql-proxy-${version}-${platform}-${arch}${platform === "win32" ? ".exe" : ""}`;
-  return {
-    version,
-    assetName,
-    downloadUrl,
-    ...sha256Value !== void 0 ? { sha256: sha256Value } : {},
-    fileName
-  };
-}
-function sha256(data) {
-  return createHash("sha256").update(data).digest("hex");
-}
-var CHECKSUM_ROW_PATTERN = /\[([^\]]+)]\([^)]*\)\s*\|\s*([0-9a-fA-F]{64})/g;
-function parseChecksumTable(releaseBody) {
-  const table = {};
-  for (const match of releaseBody.matchAll(CHECKSUM_ROW_PATTERN)) {
-    const name = match[1];
-    const hash = match[2];
-    if (name !== void 0 && hash !== void 0) table[name] = hash.toLowerCase();
-  }
-  return table;
-}
-var RELEASE_API_URL = "https://api.github.com/repos/GoogleCloudPlatform/cloud-sql-proxy/releases/tags";
-var checksumCache = /* @__PURE__ */ new Map();
-async function resolveExpectedChecksum(asset, fetchImpl) {
-  if (asset.sha256 !== void 0) return asset.sha256;
-  const cacheKey = `${asset.version}:${asset.assetName}`;
-  const cached = checksumCache.get(cacheKey);
-  if (cached !== void 0) return cached;
-  const skipAllowed = process.env.MERIDIAN_PROXY_SKIP_CHECKSUM === "1";
-  const url = `${RELEASE_API_URL}/v${asset.version}`;
-  let response;
-  try {
-    response = await fetchImpl(url, { headers: { Accept: "application/vnd.github+json" } });
-  } catch (error2) {
-    if (skipAllowed) return void 0;
-    throw new CliError(`Could not reach ${url} to look up the checksum for cloud-sql-proxy v${asset.version}.`, {
-      hint: "Check your network connection, or set MERIDIAN_PROXY_SKIP_CHECKSUM=1 to install without verifying the checksum, at your own risk.",
-      cause: error2
-    });
-  }
-  if (!response.ok) {
-    if (skipAllowed) return void 0;
-    throw new CliError(
-      `Could not determine the sha256 checksum for cloud-sql-proxy v${asset.version} (GitHub release lookup for ${url} returned HTTP ${response.status}).`,
-      {
-        hint: "Set MERIDIAN_PROXY_SKIP_CHECKSUM=1 to install without verifying the checksum, at your own risk."
-      }
-    );
-  }
-  const rawBody = await response.text();
-  let releaseNotes = rawBody;
-  try {
-    const parsed = JSON.parse(rawBody);
-    if (typeof parsed === "object" && parsed !== null && "body" in parsed && typeof parsed.body === "string") {
-      releaseNotes = parsed.body;
-    }
-  } catch {
-  }
-  const checksum = parseChecksumTable(releaseNotes)[asset.assetName];
-  if (checksum !== void 0) {
-    checksumCache.set(cacheKey, checksum);
-    return checksum;
-  }
-  if (skipAllowed) return void 0;
-  throw new CliError(
-    `Could not find a published sha256 checksum for ${asset.assetName} in the cloud-sql-proxy v${asset.version} release notes.`,
-    { hint: "Set MERIDIAN_PROXY_SKIP_CHECKSUM=1 to install without verifying the checksum, at your own risk." }
-  );
-}
-function parseContentLength(header) {
-  if (header === null) return void 0;
-  const value = Number(header);
-  return Number.isFinite(value) ? value : void 0;
-}
-async function readResponseBody(response, onProgress) {
-  const total = parseContentLength(response.headers.get("content-length"));
-  if (response.body === null) {
-    const buffer = Buffer.from(await response.arrayBuffer());
-    onProgress?.(buffer.byteLength, total);
-    return buffer;
-  }
-  const reader = response.body.getReader();
-  const chunks = [];
-  let received = 0;
-  for (; ; ) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    if (value !== void 0) {
-      chunks.push(value);
-      received += value.byteLength;
-      onProgress?.(received, total);
-    }
-  }
-  return Buffer.concat(chunks);
-}
-async function ensureProxyBinary(options = {}) {
-  const overridePath = process.env.MERIDIAN_PROXY_PATH;
-  if (overridePath !== void 0 && overridePath !== "") {
-    if (!existsSync4(overridePath)) {
-      throw new CliError(`MERIDIAN_PROXY_PATH is set to ${overridePath}, but that file does not exist.`, {
-        hint: "Fix or unset MERIDIAN_PROXY_PATH."
-      });
-    }
-    return overridePath;
-  }
-  const asset = resolveProxyAsset(options.version !== void 0 ? { version: options.version } : {});
-  const dir = options.dir ?? proxyBinDir();
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const targetPath = join4(dir, asset.fileName);
-  mkdirSync4(dir, { recursive: true });
-  if (!options.force && existsSync4(targetPath)) {
-    const cached = readFileSync6(targetPath);
-    const expected2 = await resolveExpectedChecksum(asset, fetchImpl);
-    if (expected2 === void 0 || sha256(cached) === expected2) return targetPath;
-    rmSync2(targetPath, { force: true });
-  }
-  const response = await fetchImpl(asset.downloadUrl);
-  if (!response.ok) {
-    throw new CliError(
-      `Failed to download the Cloud SQL Auth Proxy v${asset.version} from ${asset.downloadUrl} (HTTP ${response.status}).`,
-      {
-        hint: "Check your network connection (and any corporate proxy settings), or set MERIDIAN_PROXY_PATH to a proxy binary you install yourself."
-      }
-    );
-  }
-  const buffer = await readResponseBody(response, options.onProgress);
-  const expected = await resolveExpectedChecksum(asset, fetchImpl);
-  const actual = sha256(buffer);
-  if (expected !== void 0 && actual !== expected) {
-    throw new CliError(
-      `Checksum mismatch for ${asset.assetName}: expected ${expected.slice(0, 12)}..., got ${actual.slice(0, 12)}....`,
-      {
-        hint: "This can happen after a corrupted download or an untrusted network. Try again; if it persists, report this."
-      }
-    );
-  }
-  const tmpPath = join4(dir, `.${asset.fileName}.${process.pid}.tmp`);
-  writeFileSync5(tmpPath, buffer);
-  chmodSync3(tmpPath, 493);
-  renameSync3(tmpPath, targetPath);
-  return targetPath;
-}
-
-// src/lib/proxy/proxy.ts
-import { spawn } from "child_process";
-import { createConnection } from "net";
-var PROBE_INTERVAL_MS = 150;
-var KILL_GRACE_MS = 2e3;
-var CRASH_BACKOFFS_MS = [200, 1e3, 3e3];
-var MAX_CRASH_RESTARTS = CRASH_BACKOFFS_MS.length;
-var REFRESH_RETRY_BACKOFFS_MS = [3e4, 6e4, 12e4];
-var MIN_REFRESH_DELAY_MS = 6e4;
-var LOG_RING_SIZE = 20;
-var STDERR_TAIL_LINES = 10;
-function buildProxyArgs(input2) {
-  return ["--address", input2.host, "--port", String(input2.port), input2.instanceConnectionName];
-}
-function buildProxyEnv(accessToken, base = process.env) {
-  return { ...base, CSQL_PROXY_TOKEN: accessToken };
-}
-function defaultProbe(host, port) {
-  return new Promise((resolve2) => {
-    const socket = createConnection({ host, port });
-    const finish = (ok) => {
-      socket.removeAllListeners();
-      socket.destroy();
-      resolve2(ok);
-    };
-    socket.once("connect", () => finish(true));
-    socket.once("error", () => finish(false));
-    socket.setTimeout(1e3, () => finish(false));
-  });
-}
-function computeRefreshDelayMs(token, refreshSkewMs, assumedLifetimeMs) {
-  let expiresAtMs;
-  if (token.expires_at !== void 0) {
-    const parsed = new Date(token.expires_at).getTime();
-    if (!Number.isNaN(parsed)) expiresAtMs = parsed;
-  }
-  const effectiveExpiryMs = expiresAtMs ?? Date.now() + assumedLifetimeMs;
-  return Math.max(effectiveExpiryMs - Date.now() - refreshSkewMs, MIN_REFRESH_DELAY_MS);
-}
-function buildStartupFailureError(code, signal, lastLines) {
-  const tail = lastLines.slice(-STDERR_TAIL_LINES).join("\n");
-  const lower = tail.toLowerCase();
-  let hint2 = "Run `meridian dev` again; if this keeps happening, check the instance connection name and your network.";
-  if (lower.includes("iam") || lower.includes("permission") || lower.includes("forbidden")) {
-    hint2 = "The Meridian API's service account may be missing roles/cloudsql.client on the dev Cloud SQL instance. Contact Meridian support.";
-  } else if (lower.includes("invalid token") || lower.includes("401") || lower.includes("unauthorized")) {
-    hint2 = "The access token appears to have expired. Retry `meridian dev` to mint a fresh one.";
-  } else if (lower.includes("address already in use")) {
-    hint2 = "Another process is already listening on that port. Free it up, or retry with a different port.";
-  }
-  const summary = `The Cloud SQL Auth Proxy exited before it was ready (code ${code ?? "null"}, signal ${signal ?? "null"}).`;
-  return new CliError(tail === "" ? summary : `${summary}
-${tail}`, { hint: hint2 });
-}
-function waitForReady(child, probeImpl, host, port, timeoutMs, setTimeoutImpl, getLastLines) {
-  return new Promise((resolve2, reject) => {
-    let settled = false;
-    let pollTimer;
-    let timeoutTimer;
-    const cleanup = () => {
-      if (pollTimer !== void 0) clearTimeout(pollTimer);
-      if (timeoutTimer !== void 0) clearTimeout(timeoutTimer);
-      child.off("exit", onExit);
-    };
-    function onExit(code, signal) {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      reject(buildStartupFailureError(code, signal, getLastLines()));
-    }
-    function poll() {
-      if (settled) return;
-      probeImpl(host, port).then((ok) => {
-        if (settled) return;
-        if (ok) {
-          settled = true;
-          cleanup();
-          resolve2();
-        } else {
-          pollTimer = setTimeoutImpl(poll, PROBE_INTERVAL_MS);
-        }
-      }).catch(() => {
-        if (!settled) pollTimer = setTimeoutImpl(poll, PROBE_INTERVAL_MS);
-      });
-    }
-    child.on("exit", onExit);
-    timeoutTimer = setTimeoutImpl(() => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      reject(
-        new CliError(`Timed out after ${timeoutMs}ms waiting for the Cloud SQL Auth Proxy to accept connections.`, {
-          hint: "The instance may be slow to reach, or readyTimeoutMs may need to be raised."
-        })
-      );
-    }, timeoutMs);
-    poll();
-  });
-}
-async function startProxy(options) {
-  const host = options.host ?? "127.0.0.1";
-  const spawnImpl = options.spawnImpl ?? spawn;
-  const probeImpl = options.probeImpl ?? defaultProbe;
-  const setTimeoutImpl = options.setTimeoutImpl ?? setTimeout;
-  const refreshSkewMs = options.refreshSkewMs ?? 5 * 6e4;
-  const assumedLifetimeMs = options.assumedLifetimeMs ?? 55 * 6e4;
-  const readyTimeoutMs = options.readyTimeoutMs ?? 3e4;
-  const emit = (event) => options.onEvent?.(event);
-  let stopped = false;
-  let running = false;
-  let expectingExit = false;
-  let currentToken = options.token;
-  let child;
-  let refreshTimer;
-  let crashTimer;
-  let refreshBackoffIndex = 0;
-  let crashRestartsRemaining = MAX_CRASH_RESTARTS;
-  let attemptCounter = 0;
-  let cleanupFns = [];
-  const knownTokens = /* @__PURE__ */ new Set();
-  const logRing = [];
-  function trackToken(token) {
-    if (token.access_token !== "") knownTokens.add(token.access_token);
-  }
-  function redact(text) {
-    let result = text;
-    for (const token of knownTokens) result = result.split(token).join("<redacted>");
-    return result;
-  }
-  function pushLog(line) {
-    const safeLine = redact(line);
-    logRing.push(safeLine);
-    if (logRing.length > LOG_RING_SIZE) logRing.shift();
-    emit({ type: "log", line: safeLine });
-  }
-  function wireOutput(c) {
-    for (const stream of [c.stdout, c.stderr]) {
-      if (stream === null) continue;
-      let buffer = "";
-      const onData = (chunk) => {
-        buffer += chunk.toString();
-        const lines = buffer.split("\n");
-        buffer = lines.pop() ?? "";
-        for (const line of lines) pushLog(line);
-      };
-      stream.on("data", onData);
-      cleanupFns.push(() => stream.off("data", onData));
-    }
-  }
-  function wireExit(c) {
-    c.once("exit", (code, signal) => {
-      if (child !== c) return;
-      const wasRunning = running;
-      const wasExpected = expectingExit;
-      running = false;
-      expectingExit = false;
-      emit({ type: "exit", code, signal });
-      if (stopped || wasExpected || !wasRunning) return;
-      void handleCrash();
-    });
-  }
-  async function spawnChild() {
-    attemptCounter += 1;
-    emit({ type: "starting", attempt: attemptCounter });
-    const args = buildProxyArgs({
-      instanceConnectionName: options.instanceConnectionName,
-      host,
-      port: options.port
-    });
-    const c = spawnImpl(options.binaryPath, args, {
-      stdio: ["ignore", "pipe", "pipe"],
-      env: buildProxyEnv(currentToken.access_token, options.env)
-    });
-    child = c;
-    wireOutput(c);
-    wireExit(c);
-    try {
-      await waitForReady(c, probeImpl, host, options.port, readyTimeoutMs, setTimeoutImpl, () => logRing.slice());
-    } catch (error2) {
-      expectingExit = true;
-      await killChild(c);
-      if (child === c) child = void 0;
-      throw error2;
-    }
-    emit({ type: "ready", port: options.port });
-  }
-  function killChild(c) {
-    if (c.exitCode !== null || c.signalCode !== null) return Promise.resolve();
-    return new Promise((resolve2) => {
-      let settled = false;
-      let killTimer;
-      const onExit = () => {
-        if (settled) return;
-        settled = true;
-        if (killTimer !== void 0) clearTimeout(killTimer);
-        resolve2();
-      };
-      c.once("exit", onExit);
-      c.kill("SIGTERM");
-      killTimer = setTimeoutImpl(() => {
-        if (!settled) c.kill("SIGKILL");
-      }, KILL_GRACE_MS);
-    });
-  }
-  function scheduleRefresh(token) {
-    if (stopped || options.refreshToken === void 0) return;
-    if (refreshTimer !== void 0) clearTimeout(refreshTimer);
-    const delayMs = computeRefreshDelayMs(token, refreshSkewMs, assumedLifetimeMs);
-    refreshTimer = setTimeoutImpl(() => {
-      refreshTimer = void 0;
-      void handleRefreshFire();
-    }, delayMs);
-  }
-  function scheduleRefreshRetry() {
-    if (stopped) return;
-    const delayMs = REFRESH_RETRY_BACKOFFS_MS[Math.min(refreshBackoffIndex, REFRESH_RETRY_BACKOFFS_MS.length - 1)] ?? 12e4;
-    refreshBackoffIndex += 1;
-    if (refreshTimer !== void 0) clearTimeout(refreshTimer);
-    refreshTimer = setTimeoutImpl(() => {
-      refreshTimer = void 0;
-      void handleRefreshFire();
-    }, delayMs);
-  }
-  async function handleRefreshFire() {
-    if (stopped || options.refreshToken === void 0) return;
-    let newToken;
-    try {
-      newToken = await options.refreshToken();
-    } catch (error2) {
-      emit({ type: "error", message: redact(`Token refresh failed: ${describeError(error2)}`) });
-      scheduleRefreshRetry();
-      return;
-    }
-    if (stopped) return;
-    trackToken(newToken);
-    currentToken = newToken;
-    expectingExit = true;
-    emit({ type: "restarting", reason: "token-refresh" });
-    try {
-      const previous = child;
-      if (previous !== void 0) await killChild(previous);
-      await spawnChild();
-    } catch (error2) {
-      emit({ type: "error", message: redact(`Restart after token refresh failed: ${describeError(error2)}`) });
-      scheduleRefreshRetry();
-      return;
-    }
-    running = true;
-    refreshBackoffIndex = 0;
-    emit({ type: "token-refreshed", ...newToken.expires_at !== void 0 ? { expiresAt: newToken.expires_at } : {} });
-    scheduleRefresh(newToken);
-  }
-  async function handleCrash() {
-    if (stopped) return;
-    if (crashRestartsRemaining <= 0) {
-      const tail = logRing.slice(-STDERR_TAIL_LINES).join("\n");
-      emit({
-        type: "error",
-        message: `The Cloud SQL Auth Proxy crashed repeatedly and could not be restarted.${tail === "" ? "" : `
-${tail}`}`
-      });
-      return;
-    }
-    const attemptIndex = MAX_CRASH_RESTARTS - crashRestartsRemaining;
-    const delayMs = CRASH_BACKOFFS_MS[attemptIndex] ?? (CRASH_BACKOFFS_MS[CRASH_BACKOFFS_MS.length - 1] ?? 3e3);
-    crashRestartsRemaining -= 1;
-    emit({ type: "restarting", reason: "crash" });
-    crashTimer = setTimeoutImpl(() => {
-      crashTimer = void 0;
-      if (stopped) return;
-      spawnChild().then(() => {
-        running = true;
-      }).catch((error2) => {
-        emit({ type: "error", message: redact(describeError(error2)) });
-        void handleCrash();
-      });
-    }, delayMs);
-  }
-  async function refresh() {
-    if (stopped) return;
-    if (options.refreshToken === void 0) {
-      throw new CliError("Cannot refresh the Cloud SQL Auth Proxy token: no refreshToken() was configured.");
-    }
-    if (refreshTimer !== void 0) {
-      clearTimeout(refreshTimer);
-      refreshTimer = void 0;
-    }
-    refreshBackoffIndex = 0;
-    await handleRefreshFire();
-  }
-  async function stop() {
-    if (stopped) return;
-    stopped = true;
-    if (refreshTimer !== void 0) clearTimeout(refreshTimer);
-    refreshTimer = void 0;
-    if (crashTimer !== void 0) clearTimeout(crashTimer);
-    crashTimer = void 0;
-    for (const cleanup of cleanupFns) cleanup();
-    cleanupFns = [];
-    const current2 = child;
-    if (current2 !== void 0) {
-      expectingExit = true;
-      await killChild(current2);
-    }
-    running = false;
-    child = void 0;
-  }
-  trackToken(currentToken);
-  await spawnChild();
-  running = true;
-  scheduleRefresh(currentToken);
-  return {
-    host,
-    port: options.port,
-    instanceConnectionName: options.instanceConnectionName,
-    get running() {
-      return running;
-    },
-    refresh,
-    stop
-  };
-}
-
 // src/lib/signals.ts
 var SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
 var SIGNAL_EXIT_CODES = {
@@ -2594,8 +2857,8 @@ function defaultSleep(ms) {
 }
 function resolveDeps(overrides) {
   return {
-    ensureProxyBinary,
-    startProxy,
+    issueGatewayCertificate,
+    startGatewayForwarder,
     findFreePort,
     patchEnvFile,
     waitForDatabase,
@@ -2666,15 +2929,6 @@ async function ensureDevDatabaseReady(client, appId, options = {}) {
     { success: (db) => `Developer database "${db.database}" is ready.` }
   );
 }
-function toProxyToken(token) {
-  return {
-    access_token: token.access_token,
-    ...typeof token.expires_at === "string" ? { expires_at: token.expires_at } : {}
-  };
-}
-function formatMb(bytes) {
-  return (bytes / (1024 * 1024)).toFixed(1);
-}
 function firstNonEmpty(...values) {
   for (const value of values) {
     if (typeof value === "string" && value.trim() !== "") return value;
@@ -2696,32 +2950,53 @@ function logEnvPatch(result, databaseUrl, wroteShadow) {
   }
   if (result.backedUp) detail(`Backed up the previous file to ${result.path}.backup`);
 }
-function handleProxyEvent(event) {
+async function pickLocalPort(options, deps) {
+  const findPortOptions = { start: DEFAULT_PORT_START };
+  if (options.port !== void 0) findPortOptions.preferred = options.port;
+  const port = await deps.findFreePort(findPortOptions);
+  if (options.port !== void 0 && port !== options.port) {
+    throw new CliError(`Port ${options.port} is already in use.`, {
+      hint: "Pick a different port with --port, or free up that port and try again."
+    });
+  }
+  return port;
+}
+function handleForwarderEvent(event) {
   switch (event.type) {
-    case "starting":
-      debug(`Starting the Cloud SQL Auth Proxy (attempt ${event.attempt}).`);
-      return;
     case "ready":
-      debug(`Cloud SQL Auth Proxy listening on port ${event.port}.`);
+      debug(`Database gateway forwarder listening on port ${event.port}.`);
       return;
-    case "log":
-      debug(event.line);
+    case "connection-error":
+      debug(`Database gateway connection failed: ${event.message}`);
       return;
-    case "token-refreshed":
-      step("Refreshed the Cloud SQL Auth Proxy token.");
-      return;
-    case "restarting":
-      if (event.reason === "crash") warn("The Cloud SQL Auth Proxy crashed; restarting it.");
-      else debug("Restarting the Cloud SQL Auth Proxy with a refreshed token...");
-      return;
-    case "exit":
-      debug(`Cloud SQL Auth Proxy exited (code ${event.code ?? "null"}, signal ${event.signal ?? "null"}).`);
+    case "certificate-refreshed":
+      step(`Renewed the database gateway certificate (expires ${event.expiresAt}).`);
       return;
     case "error":
-      warn(`Cloud SQL Auth Proxy error: ${event.message} Restart \`meridian dev\` if the database becomes unreachable.`);
+      warn(`Database gateway: ${event.message} Restart \`meridian dev\` if the database becomes unreachable.`);
       return;
   }
 }
+async function startGatewayEndpoint(client, appId, credentials, options, deps) {
+  const certificate = await withSpinner(
+    "Requesting a database gateway certificate...",
+    () => deps.issueGatewayCertificate(client, appId),
+    { success: (cert) => `Issued a database gateway certificate (expires ${cert.expiresAt}).` }
+  );
+  const port = await pickLocalPort(options, deps);
+  return withSpinner(
+    `Starting the database gateway forwarder on 127.0.0.1:${port}...`,
+    () => deps.startGatewayForwarder({
+      port,
+      username: credentials.username,
+      password: credentials.password,
+      certificate,
+      ...options.refreshToken !== false ? { refreshCertificate: () => deps.issueGatewayCertificate(client, appId) } : {},
+      onEvent: handleForwarderEvent
+    }),
+    { success: `Database gateway forwarder listening on 127.0.0.1:${port} (${certificate.host}).` }
+  );
+}
 async function startDevSession(options = {}) {
   const deps = resolveDeps(options.deps);
   let proxy;
@@ -2738,55 +3013,8 @@ async function startDevSession(options = {}) {
         success: (creds) => `Fetched credentials for database "${creds.database}"${typeof creds.expires_at === "string" ? ` (expire ${creds.expires_at})` : ""}.`
       }
     );
-    const proxyToken = await withSpinner(
-      "Requesting a Cloud SQL Auth Proxy token...",
-      () => client.issueProxyToken(appId),
-      { success: "Issued a Cloud SQL Auth Proxy token." }
-    );
-    const binaryPath = await withSpinner(
-      "Preparing the Cloud SQL Auth Proxy...",
-      (spinner2) => {
-        const ensureOptions = {
-          onProgress: (received, total) => {
-            spinner2.update(
-              total !== void 0 ? `Downloading the Cloud SQL Auth Proxy... (${formatMb(received)}/${formatMb(total)} MB)` : `Downloading the Cloud SQL Auth Proxy... (${formatMb(received)} MB)`
-            );
-          }
-        };
-        return deps.ensureProxyBinary(ensureOptions);
-      },
-      { success: "Cloud SQL Auth Proxy is ready." }
-    );
-    const findPortOptions = { start: DEFAULT_PORT_START };
-    if (options.port !== void 0) findPortOptions.preferred = options.port;
-    const port = await deps.findFreePort(findPortOptions);
-    if (options.port !== void 0 && port !== options.port) {
-      throw new CliError(`Port ${options.port} is already in use.`, {
-        hint: "Pick a different port with --port, or free up that port and try again."
-      });
-    }
-    const instanceConnectionName = firstNonEmpty(
-      credentials.instance_connection_name,
-      proxyToken.instance_connection_name,
-      devDatabase.instance_connection_name
-    );
-    if (instanceConnectionName === void 0) {
-      throw new CliError("The Meridian API did not return a Cloud SQL instance connection name.", {
-        hint: "Try again, or contact Meridian support if this persists."
-      });
-    }
-    proxy = await withSpinner(
-      `Starting the Cloud SQL Auth Proxy on 127.0.0.1:${port}...`,
-      () => deps.startProxy({
-        binaryPath,
-        instanceConnectionName,
-        token: toProxyToken(proxyToken),
-        port,
-        ...options.refreshToken !== false ? { refreshToken: async () => toProxyToken(await client.issueProxyToken(appId)) } : {},
-        onEvent: handleProxyEvent
-      }),
-      { success: `Cloud SQL Auth Proxy listening on 127.0.0.1:${port}.` }
-    );
+    const access = "gateway";
+    proxy = await startGatewayEndpoint(client, appId, credentials, options, deps);
     const connection = connectionInfoFromCredentials(credentials, { host: proxy.host, port: proxy.port });
     if (options.waitForDb !== false) {
       await withSpinner(
@@ -2838,6 +3066,7 @@ async function startDevSession(options = {}) {
       connection,
       databaseUrl,
       ...shadowDatabaseUrl !== void 0 ? { shadowDatabaseUrl } : {},
+      access,
       proxy,
       env: {
         ...process.env,
@@ -3086,7 +3315,7 @@ function registerDbCredentialCommand(db) {
 
 // src/commands/db-shell-repl.ts
 import { accessSync, constants as fsConstants } from "fs";
-import { delimiter as delimiter2, join as join5 } from "path";
+import { delimiter as delimiter2, join as join4 } from "path";
 import { createInterface } from "readline";
 function candidateNames(name) {
   if (process.platform !== "win32") return [name];
@@ -3101,7 +3330,7 @@ function findExecutable(name) {
   const candidates = candidateNames(name);
   for (const dir of dirs) {
     for (const candidate of candidates) {
-      const fullPath = join5(dir, candidate);
+      const fullPath = join4(dir, candidate);
       try {
         accessSync(fullPath, fsConstants.X_OK);
         return fullPath;
@@ -3236,7 +3465,7 @@ function defaultDbDeps() {
 function hasSeedConfigured(root) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync7(join6(root, "package.json"), "utf8"));
+    parsed = JSON.parse(readFileSync6(join5(root, "package.json"), "utf8"));
   } catch {
     return false;
   }
@@ -3415,7 +3644,7 @@ function registerDbCommand(program) {
   db.action(() => {
     db.outputHelp();
   });
-  db.command("reset").description("Drop and recreate every table in the developer database (keeps the MySQL user).").option("--migrate", "run `npx prisma migrate deploy` afterwards, without asking").option("--seed", "run `npx prisma db seed` afterwards, without asking").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to update (defaults to .env)").action(async (opts) => {
+  db.command("reset").description("Drop and recreate every table in the developer database (keeps the MySQL user).").option("--migrate", "run `npx prisma migrate deploy` afterwards, without asking").option("--seed", "run `npx prisma db seed` afterwards, without asking").option("--port <port>", "local port for the database gateway forwarder", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to update (defaults to .env)").action(async (opts) => {
     await runAndSetExitCode2(
       () => runDbReset({
         ...opts.migrate === true ? { migrate: true } : {},
@@ -3425,7 +3654,7 @@ function registerDbCommand(program) {
       })
     );
   });
-  db.command("seed").description("Run `npx prisma db seed` with the Cloud SQL Auth Proxy up and DATABASE_URL set.").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to update (defaults to .env)").passThroughOptions().argument("[args...]", "extra arguments forwarded to `npx prisma db seed` (put them after `--`)").action(async (args, opts) => {
+  db.command("seed").description("Run `npx prisma db seed` with the database connection up and DATABASE_URL set.").option("--port <port>", "local port for the database gateway forwarder", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to update (defaults to .env)").passThroughOptions().argument("[args...]", "extra arguments forwarded to `npx prisma db seed` (put them after `--`)").action(async (args, opts) => {
     await runAndSetExitCode2(
       () => runDbSeed({
         ...opts.port !== void 0 ? { port: opts.port } : {},
@@ -3434,7 +3663,7 @@ function registerDbCommand(program) {
       })
     );
   });
-  db.command("shell").description("Open a SQL shell against the developer database (the `mysql` client if available, otherwise a built-in REPL).").option("--port <port>", "local port for the Cloud SQL Auth Proxy", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to read/patch (defaults to .env)").option("--repl", "force the built-in SQL REPL even when `mysql` is on PATH").option("-e, --execute <sql>", "run one SQL statement and exit").option("--no-env", "do not patch DATABASE_URL into the project's .env file").action(async (opts) => {
+  db.command("shell").description("Open a SQL shell against the developer database (the `mysql` client if available, otherwise a built-in REPL).").option("--port <port>", "local port for the database gateway forwarder", (value) => parsePortOption(value)).option("--env-file <file>", "project .env file to read/patch (defaults to .env)").option("--repl", "force the built-in SQL REPL even when `mysql` is on PATH").option("-e, --execute <sql>", "run one SQL statement and exit").option("--no-env", "do not patch DATABASE_URL into the project's .env file").action(async (opts) => {
     await runAndSetExitCode2(
       () => runDbShell({
         ...opts.port !== void 0 ? { port: opts.port } : {},
@@ -3506,7 +3735,7 @@ function printDevSummary(session, noEnv) {
   const entries = [
     ["App", appLabel(session.project)],
     ["Database", session.devDatabase.database],
-    ["Proxy", `127.0.0.1:${session.proxy.port}`],
+    [session.access === "gateway" ? "Gateway" : "Proxy", `127.0.0.1:${session.proxy.port}`],
     ["Env file", envEntry],
     ["DATABASE_URL", redactDatabaseUrl(session.databaseUrl)]
   ];
@@ -3521,6 +3750,7 @@ function buildDevJsonPayload(session) {
   return {
     app: appLabel(session.project),
     database: session.devDatabase.database,
+    access: session.access,
     proxy: { host: session.proxy.host, port: session.proxy.port },
     database_url: redactDatabaseUrl(session.databaseUrl),
     env_file: session.envPatch?.path ?? null,
@@ -3572,7 +3802,7 @@ async function runDev(options = {}) {
   }
 }
 function registerDevCommand(program) {
-  program.command("dev").description("Run the managed developer database proxy and your app's dev server together.").option("--port <port>", "preferred local port for the Cloud SQL Auth Proxy").option("--env-file <file>", "the .env file to patch, relative to the project root (default .env)").option("--no-env", "don't touch any .env file; just print the DATABASE_URL for manual use").argument("[command...]", "run this instead of the app's dev script, e.g. `meridian dev -- next dev`").passThroughOptions().action(async (command, opts) => {
+  program.command("dev").description("Run the managed developer database proxy and your app's dev server together.").option("--port <port>", "preferred local port for the database gateway forwarder").option("--env-file <file>", "the .env file to patch, relative to the project root (default .env)").option("--no-env", "don't touch any .env file; just print the DATABASE_URL for manual use").argument("[command...]", "run this instead of the app's dev script, e.g. `meridian dev -- next dev`").passThroughOptions().action(async (command, opts) => {
     const port = parsePortOption(opts.port);
     const code = await runDev({
       ...command.length > 0 ? { command } : {},
@@ -3585,8 +3815,8 @@ function registerDevCommand(program) {
 }
 
 // src/commands/link.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { join as join6 } from "path";
 function defaultDeps3() {
   return { createClient: createApiClient };
 }
@@ -3605,7 +3835,7 @@ async function runLink(options = {}) {
   const deps = { ...defaultDeps3(), ...options.deps };
   const json = isJsonOutput();
   const root = resolveProjectRoot(workingDirectory()) ?? workingDirectory();
-  if (!existsSync5(join7(root, "package.json"))) {
+  if (!existsSync4(join6(root, "package.json"))) {
     log(`No package.json found in ${style.path(root)}.`);
     const proceed = await confirmAction({
       message: "Link this directory to a Meridian app anyway?",
@@ -3919,7 +4149,7 @@ function registerLogoutCommand(program) {
 
 // src/lib/db/snapshot.ts
 import { mkdir, readFile, readdir, rm, stat } from "fs/promises";
-import { join as join8 } from "path";
+import { join as join7 } from "path";
 function snapshotFileName(date = /* @__PURE__ */ new Date()) {
   return `${date.toISOString().replace(/[:.]/g, "-")}.sql`;
 }
@@ -3938,7 +4168,7 @@ async function createSnapshot(info, options) {
   }
   const dump = options.dumpImpl ?? await loadMysqldump();
   await mkdir(options.dir, { recursive: true });
-  const path = join8(options.dir, snapshotFileName(createdAt));
+  const path = join7(options.dir, snapshotFileName(createdAt));
   try {
     await dump({
       connection: {
@@ -4144,7 +4374,7 @@ async function listSnapshots(dir) {
   const names = entries.filter((name) => name.endsWith(".sql")).sort().reverse();
   const results = [];
   for (const name of names) {
-    const path = join8(dir, name);
+    const path = join7(dir, name);
     const { size } = await stat(path);
     results.push({ path, name, bytes: size, createdAt: parseSnapshotDate(name) });
   }
@@ -4340,7 +4570,7 @@ function registerMigrateCommand(program) {
   ).option("--skip-snapshot", "run without a pre-migration snapshot (no rollback is possible)").option(
     "--allow-foreign-migrations",
     "run even when prisma/migrations was generated for SQLite or Postgres and cannot apply to MySQL"
-  ).option("--no-rollback", "keep a snapshot but do not automatically restore it after a failed migration").option("--keep-snapshots <n>", "number of recent snapshots to keep after a successful migration", "5").option("--port <port>", "preferred local port for the Cloud SQL Auth Proxy").option("--env-file <file>", "path (relative to the project root) of the .env file to patch with DATABASE_URL").argument("[prismaArgs...]", "extra arguments forwarded to `prisma migrate dev` verbatim, after --").passThroughOptions().action(async (prismaArgs, opts) => {
+  ).option("--no-rollback", "keep a snapshot but do not automatically restore it after a failed migration").option("--keep-snapshots <n>", "number of recent snapshots to keep after a successful migration", "5").option("--port <port>", "preferred local port for the database gateway forwarder").option("--env-file <file>", "path (relative to the project root) of the .env file to patch with DATABASE_URL").argument("[prismaArgs...]", "extra arguments forwarded to `prisma migrate dev` verbatim, after --").passThroughOptions().action(async (prismaArgs, opts) => {
     const keepSnapshots = parseIntegerOption(opts.keepSnapshots, "--keep-snapshots", { min: 0 });
     const port = parsePortOption(opts.port);
     const exitCode = await runMigrate({