tidb_migration_credentials library

Classes

TidbCloudSqlUserApi: Administrative API transport. It never exposes an API key to the child argv.
TidbMigrationCredentials: The SQL identity used only by local migration and runtime-user provisioning.

loadTidbCredentialState() → Future<Map<String, dynamic>>: Reads the local state without printing credential values.
resolveTidbMigrationCredentials({required String environment, required String cluster, required String host, required String database, required String node, required Map<String, dynamic> legacySecrets, required String publicKey, required String privateKey, String authMode = "api_key", String oauthProfile = "default", bool allowProvision = true, TidbCloudSqlUserApi? api, TidbSqlProbe? probe, Future<void> save(Map<String, dynamic>)?}) → Future<TidbMigrationCredentials>: Resolve legacy credentials first, then provision a dedicated user once. Existing users with the intended name are never adopted without a saved pending credential that proves this process created them.
saveTidbCredentialState(Map<String, dynamic> state) → Future<void>: Writes before provisioning, so a failed final save cannot lose the password.
verifyTidbMigrationSqlUser(String host, String database, String username, String password, String node) → Future<void>: Checks the actual SQL identity and administrative role over HTTPS SQL.

TidbSqlProbe = Future<void> Function(String host, String database, String username, String password, String node): Injectable SQL identity and privilege probe.