@the-meridian/cli 1.2.0 → 1.4.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @the-meridian/cli
 
+## 1.4.0
+
+### Minor Changes
+
+- 20c9059: New `meridian skills install`: writes the Meridian agent skill into the project for Claude Code (`.claude/skills/meridian`), Codex (`.agents/skills/meridian`) and Cursor (`.cursor/skills/meridian`), and adds the Meridian MCP server to each agent's project config, merging with what is there. `meridian login --json` now prints the device code and URL on stderr, so the login can be approved instead of waiting with nothing to show.
+
+### Patch Changes
+
+- 04cb7ba: The stored CLI token is only sent to the API that issued it. When `MERIDIAN_API_URL` or `--api-url` points somewhere else (for example after a shell sourced an app's `.env`), commands stop with an error instead of sending the token there, and `meridian login` signs in to that API afresh. `meridian login` now always records the API it signed in to.
+- 621147d: Raise the `zod` dependency floor to `^4.6.6`, the first release that fixes advisory GHSA-mrhx-c7xc-m3w5. No change to commands or output.
+
+## 1.3.0
+
+### Minor Changes
+
+- ea031dc: `meridian dev`, `migrate` and `db` connect only through the Meridian database gateway. The Cloud SQL Auth Proxy path is gone: the CLI no longer downloads `cloud-sql-proxy`, `~/.meridian/bin` is no longer used (you can delete it), and `MERIDIAN_PROXY_PATH`, `MERIDIAN_PROXY_VERSION` and `MERIDIAN_PROXY_SKIP_CHECKSUM` are no longer read.
+
 ## 1.2.0
 
 ### Minor Changes

package/README.md

@@ -2,7 +2,7 @@
 
 A managed remote MySQL development database for every developer on your team, with no local database setup.
 
-`meridian dev` provisions a private MySQL 8.4 database on Meridian's Cloud SQL instance, starts the Cloud SQL Auth Proxy on a local port, writes `DATABASE_URL` into your `.env`, and runs your app's dev server. Prisma, `mysql`, and anything else that reads `DATABASE_URL` then talk to `127.0.0.1` as if the database were local.
+`meridian dev` provisions a private MySQL 8.4 database on Meridian's Cloud SQL instance, opens a local connection to it through the Meridian database gateway, writes `DATABASE_URL` into your `.env`, and runs your app's dev server. Prisma, `mysql`, and anything else that reads `DATABASE_URL` then talk to `127.0.0.1` as if the database were local.
 
 ```bash
 npm install -g @the-meridian/cli
@@ -17,7 +17,7 @@ meridian dev            # every day
 - Node.js 20 or newer
 - A Meridian account with access to at least one organization and app
 
-You do **not** need Docker, a local MySQL server, `gcloud`, or the Cloud SQL Auth Proxy. The CLI downloads and manages the proxy for you.
+You do **not** need Docker, a local MySQL server, `gcloud`, or any proxy. The CLI connects to your database itself, with a certificate issued for you alone.
 
 ## How it works
 
@@ -26,14 +26,13 @@ meridian dev
   │
   ├─ POST /app/cli/apps/{app}/dev-database          ensure a database exists (polls until ready)
   ├─ POST …/dev-database/credentials                short-lived MySQL user + password
-  ├─ POST …/dev-database/proxy-token                short-lived GCP access token
-  ├─ download cloud-sql-proxy v2 → ~/.meridian/bin  cached, SHA-256 verified
-  ├─ spawn proxy on 127.0.0.1:<free port>           token passed in the environment, refreshed before it expires
+  ├─ POST …/dev-database/certificate                 24-hour client certificate for a key generated in memory
+  ├─ forwarder on 127.0.0.1:<free port>              TLS to the Meridian database gateway, certificate renewed before it expires
   ├─ patch DATABASE_URL into .env                   every other line preserved
   └─ run your dev command                           npm run dev by default
 ```
 
-Both child processes are shut down together: quitting your dev server stops the proxy, and Ctrl-C stops both.
+The connection and your dev server are shut down together: quitting your dev server closes the connection, and Ctrl-C stops both.
 
 ## Commands
 
@@ -49,6 +48,8 @@ Device-code login: prints a short user code, opens your browser to the verificat
 | `--no-browser` | Print the URL instead of opening a browser (also implied by `CI` or `MERIDIAN_NO_BROWSER`) |
 | `--hostname <name>` | Hostname reported to Meridian for this device |
 
+With `--json`, the code and URL still go to stderr, so the login can be approved while stdout carries only the JSON result.
+
 ### `meridian logout`
 
 Deletes the stored token. Leaves `.meridian/project.json` alone, and exits `0` when you were not logged in.
@@ -109,6 +110,17 @@ meridian db credential revoke aws-backend --env production --yes
 
 Creating and rotating credentials happen in the dashboard (Hosting > Database > External access), behind a browser session: a CLI token cannot issue database access. Revoking needs the Credentials: Manage permission on the app.
 
+### `meridian skills install`
+
+Installs the Meridian agent skill in the project, so Claude Code, Codex and Cursor know how to use Meridian: the CLI, the SDK, hosting and the Meridian MCP server. It writes the skill to `.claude/skills/meridian`, `.agents/skills/meridian` (Codex) and `.cursor/skills/meridian`, and adds the Meridian MCP server to `.mcp.json`, `.codex/config.toml` and `.cursor/mcp.json`. Existing config files are merged, never overwritten. Run it again after upgrading the CLI to update the skill.
+
+| Flag | Behavior |
+| --- | --- |
+| `--agent <agents>` | `claude`, `codex`, `cursor` (comma-separated) or `all`. Default: the agents the project already uses (`.claude/`, `CLAUDE.md`, `.codex/`, `.agents/`, `AGENTS.md`, `.cursor/`), or all three |
+| `--no-mcp` | Install the skill only |
+
+Replacing a skill folder that differs from this CLI's version asks first (`--yes` to approve).
+
 ### Global flags
 
 Accepted before or after the command name, so both `meridian --json whoami` and `meridian whoami --json` work.
@@ -129,7 +141,6 @@ Accepted before or after the command name, so both `meridian --json whoami` and
 | Path | Contents |
 | --- | --- |
 | `~/.meridian/config.json` | `token`, `token_expires_at`, `user`, `api_base_url`. Mode `0600` |
-| `~/.meridian/bin/` | Cached, checksum-verified `cloud-sql-proxy` binaries |
 | `<project>/.meridian/project.json` | `org_id`, `app_id`, `app_name`, optional `dev_command` and `skip_datasource_check` |
 | `<project>/.meridian/snapshots/` | Pre-migration dumps, pruned to the newest few |
 | `<project>/.meridian/.gitignore` | Written for you, so snapshots and logs stay out of git |
@@ -196,9 +207,6 @@ Prompts are skipped automatically when stdin/stderr aren't TTYs, when `CI` is se
 | `MERIDIAN_NO_BROWSER` | Same as `login --no-browser` |
 | `MERIDIAN_DEV_ACTIVE` | Set to `1` in every process `meridian dev` starts. Read it to detect that your script is already inside a session; setting it yourself makes `meridian dev` refuse to start |
 | `MERIDIAN_DEV_DATABASE_ID` | Exported (alongside `DATABASE_URL`) into the children of `meridian dev`, `migrate` and `db …`, holding the id of the dev database that session provisioned. The Meridian SDK sends it as `devDatabaseId` on its identify call, so installs a locally-run app creates are billed to your dev database. Set by the CLI only. Never set it yourself |
-| `MERIDIAN_PROXY_PATH` | Use an existing proxy binary instead of downloading one |
-| `MERIDIAN_PROXY_VERSION` | Pin a different proxy version (checksum is fetched from that release) |
-| `MERIDIAN_PROXY_SKIP_CHECKSUM=1` | Allow install when no checksum is published. Use only if you trust the source |
 | `NO_COLOR` / `FORCE_COLOR` | Color detection |
 
 Read commands support `--json`. Errors are also JSON in that mode:
@@ -219,19 +227,15 @@ Read commands support `--json`. Errors are also JSON in that mode:
 
 **`The development database is not ready yet.`**: A credentials or reset call arrived before provisioning finished (HTTP 409). `meridian dev` polls for you, so this normally only appears when a command runs against a database that is still being created.
 
-**`Could not reach 127.0.0.1:<port>/<db> (ECONNREFUSED).`**: Nothing is listening. `meridian dev` and `meridian migrate` start the proxy themselves; if you're running Prisma directly, keep `meridian dev` running in another terminal.
+**`Could not reach 127.0.0.1:<port>/<db> (ECONNREFUSED).`**: Nothing is listening. `meridian dev` and `meridian migrate` open the connection themselves; if you're running Prisma directly, keep `meridian dev` running in another terminal.
 
-**`Timed out waiting for MySQL …`**: The proxy is up but can't reach Cloud SQL. Check whether a VPN, firewall, or corporate proxy blocks outbound connections, then retry with `--verbose` to see the proxy's own logs.
+**`Timed out waiting for MySQL …`**: The local forwarder is up but can't reach the Meridian database gateway (`db.the-meridian.app:3306`). Check whether a VPN, firewall, or corporate proxy blocks outbound connections on port 3306, then retry with `--verbose`.
 
 **`Another process is already listening on that port.`**: Pass `--port` to choose a different one.
 
-**Proxy download fails** (air-gapped network, blocked storage.googleapis.com): Install the [Cloud SQL Auth Proxy](https://github.com/GoogleCloudPlatform/cloud-sql-proxy) yourself and set `MERIDIAN_PROXY_PATH` to it.
-
-**Checksum verification failed**: A cached binary that no longer matches its published SHA-256 is deleted and downloaded again automatically. If a fresh download also fails verification the CLI refuses to install it, which usually means something on the network is rewriting the response. Don't reach for `MERIDIAN_PROXY_SKIP_CHECKSUM` in that situation.
-
 **A migration failed and left the schema half-applied**: `meridian migrate` restores the pre-migration snapshot automatically. To redo it by hand, use the newest file in `.meridian/snapshots/`, or run `meridian db reset` for a clean slate.
 
-**The rollback itself failed**: Treat the database as unsafe: the reset succeeded but the replay didn't finish, so the schema is partial. Start the proxy with `meridian dev` in another terminal and replay the snapshot by hand (`mysql … < .meridian/snapshots/<timestamp>.sql`, or `meridian db shell` and paste it), or take the clean slate with `meridian db reset --migrate`. The failing statement's index is in the error message.
+**The rollback itself failed**: Treat the database as unsafe: the reset succeeded but the replay didn't finish, so the schema is partial. Open the connection with `meridian dev` in another terminal and replay the snapshot by hand (`mysql … < .meridian/snapshots/<timestamp>.sql`, or `meridian db shell` and paste it), or take the clean slate with `meridian db reset --migrate`. The failing statement's index is in the error message.
 
 **`meridian dev` says it would call itself**: Your `npm run dev` script invokes `meridian dev`. Point `dev_command` in `.meridian/project.json` at the real dev server (for example `next dev`), or run `meridian dev -- next dev`.