@the-meridian/cli 1.2.0 → 1.3.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @the-meridian/cli
 
+## 1.3.0
+
+### Minor Changes
+
+- ea031dc: `meridian dev`, `migrate` and `db` connect only through the Meridian database gateway. The Cloud SQL Auth Proxy path is gone: the CLI no longer downloads `cloud-sql-proxy`, `~/.meridian/bin` is no longer used (you can delete it), and `MERIDIAN_PROXY_PATH`, `MERIDIAN_PROXY_VERSION` and `MERIDIAN_PROXY_SKIP_CHECKSUM` are no longer read.
+
 ## 1.2.0
 
 ### Minor Changes

package/README.md

@@ -2,7 +2,7 @@
 
 A managed remote MySQL development database for every developer on your team, with no local database setup.
 
-`meridian dev` provisions a private MySQL 8.4 database on Meridian's Cloud SQL instance, starts the Cloud SQL Auth Proxy on a local port, writes `DATABASE_URL` into your `.env`, and runs your app's dev server. Prisma, `mysql`, and anything else that reads `DATABASE_URL` then talk to `127.0.0.1` as if the database were local.
+`meridian dev` provisions a private MySQL 8.4 database on Meridian's Cloud SQL instance, opens a local connection to it through the Meridian database gateway, writes `DATABASE_URL` into your `.env`, and runs your app's dev server. Prisma, `mysql`, and anything else that reads `DATABASE_URL` then talk to `127.0.0.1` as if the database were local.
 
 ```bash
 npm install -g @the-meridian/cli
@@ -17,7 +17,7 @@ meridian dev            # every day
 - Node.js 20 or newer
 - A Meridian account with access to at least one organization and app
 
-You do **not** need Docker, a local MySQL server, `gcloud`, or the Cloud SQL Auth Proxy. The CLI downloads and manages the proxy for you.
+You do **not** need Docker, a local MySQL server, `gcloud`, or any proxy. The CLI connects to your database itself, with a certificate issued for you alone.
 
 ## How it works
 
@@ -26,14 +26,13 @@ meridian dev
   │
   ├─ POST /app/cli/apps/{app}/dev-database          ensure a database exists (polls until ready)
   ├─ POST …/dev-database/credentials                short-lived MySQL user + password
-  ├─ POST …/dev-database/proxy-token                short-lived GCP access token
-  ├─ download cloud-sql-proxy v2 → ~/.meridian/bin  cached, SHA-256 verified
-  ├─ spawn proxy on 127.0.0.1:<free port>           token passed in the environment, refreshed before it expires
+  ├─ POST …/dev-database/certificate                 24-hour client certificate for a key generated in memory
+  ├─ forwarder on 127.0.0.1:<free port>              TLS to the Meridian database gateway, certificate renewed before it expires
   ├─ patch DATABASE_URL into .env                   every other line preserved
   └─ run your dev command                           npm run dev by default
 ```
 
-Both child processes are shut down together: quitting your dev server stops the proxy, and Ctrl-C stops both.
+The connection and your dev server are shut down together: quitting your dev server closes the connection, and Ctrl-C stops both.
 
 ## Commands
 
@@ -129,7 +128,6 @@ Accepted before or after the command name, so both `meridian --json whoami` and
 | Path | Contents |
 | --- | --- |
 | `~/.meridian/config.json` | `token`, `token_expires_at`, `user`, `api_base_url`. Mode `0600` |
-| `~/.meridian/bin/` | Cached, checksum-verified `cloud-sql-proxy` binaries |
 | `<project>/.meridian/project.json` | `org_id`, `app_id`, `app_name`, optional `dev_command` and `skip_datasource_check` |
 | `<project>/.meridian/snapshots/` | Pre-migration dumps, pruned to the newest few |
 | `<project>/.meridian/.gitignore` | Written for you, so snapshots and logs stay out of git |
@@ -196,9 +194,6 @@ Prompts are skipped automatically when stdin/stderr aren't TTYs, when `CI` is se
 | `MERIDIAN_NO_BROWSER` | Same as `login --no-browser` |
 | `MERIDIAN_DEV_ACTIVE` | Set to `1` in every process `meridian dev` starts. Read it to detect that your script is already inside a session; setting it yourself makes `meridian dev` refuse to start |
 | `MERIDIAN_DEV_DATABASE_ID` | Exported (alongside `DATABASE_URL`) into the children of `meridian dev`, `migrate` and `db …`, holding the id of the dev database that session provisioned. The Meridian SDK sends it as `devDatabaseId` on its identify call, so installs a locally-run app creates are billed to your dev database. Set by the CLI only. Never set it yourself |
-| `MERIDIAN_PROXY_PATH` | Use an existing proxy binary instead of downloading one |
-| `MERIDIAN_PROXY_VERSION` | Pin a different proxy version (checksum is fetched from that release) |
-| `MERIDIAN_PROXY_SKIP_CHECKSUM=1` | Allow install when no checksum is published. Use only if you trust the source |
 | `NO_COLOR` / `FORCE_COLOR` | Color detection |
 
 Read commands support `--json`. Errors are also JSON in that mode:
@@ -219,19 +214,15 @@ Read commands support `--json`. Errors are also JSON in that mode:
 
 **`The development database is not ready yet.`**: A credentials or reset call arrived before provisioning finished (HTTP 409). `meridian dev` polls for you, so this normally only appears when a command runs against a database that is still being created.
 
-**`Could not reach 127.0.0.1:<port>/<db> (ECONNREFUSED).`**: Nothing is listening. `meridian dev` and `meridian migrate` start the proxy themselves; if you're running Prisma directly, keep `meridian dev` running in another terminal.
+**`Could not reach 127.0.0.1:<port>/<db> (ECONNREFUSED).`**: Nothing is listening. `meridian dev` and `meridian migrate` open the connection themselves; if you're running Prisma directly, keep `meridian dev` running in another terminal.
 
-**`Timed out waiting for MySQL …`**: The proxy is up but can't reach Cloud SQL. Check whether a VPN, firewall, or corporate proxy blocks outbound connections, then retry with `--verbose` to see the proxy's own logs.
+**`Timed out waiting for MySQL …`**: The local forwarder is up but can't reach the Meridian database gateway (`db.the-meridian.app:3306`). Check whether a VPN, firewall, or corporate proxy blocks outbound connections on port 3306, then retry with `--verbose`.
 
 **`Another process is already listening on that port.`**: Pass `--port` to choose a different one.
 
-**Proxy download fails** (air-gapped network, blocked storage.googleapis.com): Install the [Cloud SQL Auth Proxy](https://github.com/GoogleCloudPlatform/cloud-sql-proxy) yourself and set `MERIDIAN_PROXY_PATH` to it.
-
-**Checksum verification failed**: A cached binary that no longer matches its published SHA-256 is deleted and downloaded again automatically. If a fresh download also fails verification the CLI refuses to install it, which usually means something on the network is rewriting the response. Don't reach for `MERIDIAN_PROXY_SKIP_CHECKSUM` in that situation.
-
 **A migration failed and left the schema half-applied**: `meridian migrate` restores the pre-migration snapshot automatically. To redo it by hand, use the newest file in `.meridian/snapshots/`, or run `meridian db reset` for a clean slate.
 
-**The rollback itself failed**: Treat the database as unsafe: the reset succeeded but the replay didn't finish, so the schema is partial. Start the proxy with `meridian dev` in another terminal and replay the snapshot by hand (`mysql … < .meridian/snapshots/<timestamp>.sql`, or `meridian db shell` and paste it), or take the clean slate with `meridian db reset --migrate`. The failing statement's index is in the error message.
+**The rollback itself failed**: Treat the database as unsafe: the reset succeeded but the replay didn't finish, so the schema is partial. Open the connection with `meridian dev` in another terminal and replay the snapshot by hand (`mysql … < .meridian/snapshots/<timestamp>.sql`, or `meridian db shell` and paste it), or take the clean slate with `meridian db reset --migrate`. The failing statement's index is in the error message.
 
 **`meridian dev` says it would call itself**: Your `npm run dev` script invokes `meridian dev`. Point `dev_command` in `.meridian/project.json` at the real dev server (for example `next dev`), or run `meridian dev -- next dev`.