@dbx-tools/cli 0.9.58 → 0.9.60

package/lib/src/tunnel/proxy.js

@@ -0,0 +1,143 @@
+/**
+ * The reverse proxy that makes the wrapper path possible.
+ *
+ * The wrapper claims the PUBLIC port and the wrapped app runs as a child process
+ * on a private loopback port, so - unlike the in-process plugin - there is no
+ * middleware chain to insert the gate into. This proxy is that insertion point: it
+ * answers the login routes itself, applies the gate to everything else, and
+ * forwards what survives to the child.
+ *
+ * The gating DECISION is not reimplemented here. `@dbx-tools/tunnel`'s
+ * `gate.gateRequest` makes it - the same function the Express middleware calls -
+ * and this module only differs in how the outcome is written: a proxied request
+ * instead of `next()`, a `writeHead` instead of `res.json`. That is deliberate:
+ * two independent implementations of "which requests are gated and which headers
+ * are stripped" is the one way this package could become a security bug.
+ *
+ * @module
+ */
+import { createServer } from "node:http";
+import { log } from "@dbx-tools/shared-core";
+import { gate as tunnelGate, headers as tunnelHeaders, loginPage as tunnelLoginPage, } from "@dbx-tools/tunnel";
+import ProxyModule from "http-proxy-3";
+const logger = log.logger("tunnel:proxy");
+function sendJson(response, status, body, setCookie) {
+    response.writeHead(status, {
+        "content-type": "application/json",
+        ...(setCookie ? { "set-cookie": setCookie } : {}),
+    });
+    response.end(JSON.stringify(body));
+}
+/**
+ * Hand every Better Auth and compatibility route to the shared gate runtime.
+ */
+async function handleAuthRoute(request, response, path, gate, brandName) {
+    if (!tunnelGate.isAuthPath(path))
+        return false;
+    if (tunnelGate.wantsHostedLogin(request)) {
+        response.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+        response.end(tunnelLoginPage.loginPageHtml({
+            brandName,
+            returnTo: tunnelGate.loginReturnTo(request),
+        }));
+        return true;
+    }
+    const result = await gate.handler(tunnelGate.webRequest(request));
+    await tunnelGate.sendWebResponse(response, result);
+    return true;
+}
+/**
+ * Start the proxy and resolve once it is listening.
+ *
+ * `publicDomain` is intentionally NOT passed to `gateRequest`: on this path every
+ * request arrived on the public port, so it IS tunnel traffic by construction -
+ * whereas the in-process gate shares a port with the platform front door and has
+ * to tell them apart by `Host`. Passing the request's own host keeps the shared
+ * decision function's contract satisfied without weakening it.
+ */
+export async function startProxy(options) {
+    const proxy = ProxyModule.createProxyServer({
+        target: `http://127.0.0.1:${options.appPort}`,
+        ws: true,
+        xfwd: true,
+    });
+    const headerPolicy = tunnelHeaders.toHeaderPolicy(options.forwardHeaders);
+    const gate = options.gate;
+    const decide = (request) => gate
+        ? tunnelGate.gateRequest(request, {
+            gate,
+            publicDomain: (request.headers.host ?? "").split(":")[0] || "localhost",
+            headerPolicy,
+            gatePaths: options.gatePaths,
+        })
+        : Promise.resolve("pass");
+    const onRequest = (request, response) => {
+        void (async () => {
+            const path = (request.url ?? "/").split("?")[0] ?? "/";
+            const brandName = options.brandName ?? "this app";
+            if (gate && (await handleAuthRoute(request, response, path, gate, brandName)))
+                return;
+            if ((await decide(request)) === "deny") {
+                // A denied browser navigation gets the hosted login page; anything else
+                // (an XHR, a /ws upgrade probe, a non-HTML fetch) gets the 401 JSON.
+                if (gate && tunnelGate.wantsLoginPage(request)) {
+                    const html = tunnelLoginPage.loginPageHtml({
+                        brandName,
+                        returnTo: tunnelGate.requestReturnTo(request),
+                    });
+                    response.writeHead(401, { "content-type": "text/html; charset=utf-8" });
+                    response.end(html);
+                }
+                else {
+                    sendJson(response, 401, tunnelGate.unauthorizedBody(request));
+                }
+                return;
+            }
+            proxy.web(request, response);
+        })().catch((error) => {
+            logger.error("proxy request failed", { error });
+            if (!response.headersSent)
+                sendJson(response, 502, { error: "bad gateway" });
+            else
+                response.end();
+        });
+    };
+    // A websocket upgrade cannot be answered with a 401 body, so a denied one is
+    // destroyed - the client sees the handshake fail, which is what a browser's
+    // WebSocket error handler expects.
+    const onUpgrade = (request, socket, head) => {
+        const upgradeSocket = socket;
+        upgradeSocket.destroySoon ??= () => upgradeSocket.end();
+        const path = (request.url ?? "/").split("?", 1)[0] ?? "/";
+        if (tunnelGate.isAuthPath(path)) {
+            upgradeSocket.destroy();
+            return;
+        }
+        void decide(request)
+            .then((action) => {
+            if (action === "deny")
+                upgradeSocket.destroy();
+            else
+                proxy.ws(request, upgradeSocket, head);
+        })
+            .catch(() => upgradeSocket.destroy());
+    };
+    // One net.Server binds one address, so listen each host on its own server that
+    // shares the same handlers. Binding specific interface IPs (rather than the
+    // default 0.0.0.0) is what lets the gate front an overlay/LAN address while
+    // loopback reaches the upstream ungated.
+    const hosts = options.bindHosts?.length ? options.bindHosts : ["0.0.0.0"];
+    await Promise.all(hosts.map((host) => new Promise((resolve) => {
+        const server = createServer(onRequest);
+        server.on("upgrade", onUpgrade);
+        server.listen(options.publicPort, host, () => {
+            logger.info("proxy listening", {
+                host,
+                publicPort: options.publicPort,
+                appPort: options.appPort,
+            });
+            resolve();
+        });
+    })));
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJveHkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvdHVubmVsL3Byb3h5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOzs7Ozs7Ozs7Ozs7Ozs7OztHQWlCRztBQUVILE9BQU8sRUFBRSxZQUFZLEVBQTZDLE1BQU0sV0FBVyxDQUFDO0FBRXBGLE9BQU8sRUFBRSxHQUFHLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUM3QyxPQUFPLEVBQ0wsSUFBSSxJQUFJLFVBQVUsRUFDbEIsT0FBTyxJQUFJLGFBQWEsRUFDeEIsU0FBUyxJQUFJLGVBQWUsR0FFN0IsTUFBTSxtQkFBbUIsQ0FBQztBQUMzQixPQUFPLFdBQVcsTUFBTSxjQUFjLENBQUM7QUFFdkMsTUFBTSxNQUFNLEdBQUcsR0FBRyxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsQ0FBQztBQTJCMUMsU0FBUyxRQUFRLENBQ2YsUUFBd0IsRUFDeEIsTUFBYyxFQUNkLElBQWEsRUFDYixTQUFrQjtJQUVsQixRQUFRLENBQUMsU0FBUyxDQUFDLE1BQU0sRUFBRTtRQUN6QixjQUFjLEVBQUUsa0JBQWtCO1FBQ2xDLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7S0FDbEQsQ0FBQyxDQUFDO0lBQ0gsUUFBUSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7QUFDckMsQ0FBQztBQUVEOztHQUVHO0FBQ0gsS0FBSyxVQUFVLGVBQWUsQ0FDNUIsT0FBd0IsRUFDeEIsUUFBd0IsRUFDeEIsSUFBWSxFQUNaLElBQWlCLEVBQ2pCLFNBQWlCO0lBRWpCLElBQUksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQztRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQy9DLElBQUksVUFBVSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDekMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxjQUFjLEVBQUUsMEJBQTBCLEVBQUUsQ0FBQyxDQUFDO1FBQ3hFLFFBQVEsQ0FBQyxHQUFHLENBQ1YsZUFBZSxDQUFDLGFBQWEsQ0FBQztZQUM1QixTQUFTO1lBQ1QsUUFBUSxFQUFFLFVBQVUsQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDO1NBQzVDLENBQUMsQ0FDSCxDQUFDO1FBQ0YsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztJQUNsRSxNQUFNLFVBQVUsQ0FBQyxlQUFlLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ25ELE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQztBQUVEOzs7Ozs7OztHQVFHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxVQUFVLENBQUMsT0FBcUI7SUFDcEQsTUFBTSxLQUFLLEdBQUcsV0FBVyxDQUFDLGlCQUFpQixDQUFDO1FBQzFDLE1BQU0sRUFBRSxvQkFBb0IsT0FBTyxDQUFDLE9BQU8sRUFBRTtRQUM3QyxFQUFFLEVBQUUsSUFBSTtRQUNSLElBQUksRUFBRSxJQUFJO0tBQ1gsQ0FBQyxDQUFDO0lBQ0gsTUFBTSxZQUFZLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDMUUsTUFBTSxJQUFJLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQztJQUUxQixNQUFNLE1BQU0sR0FBRyxDQUFDLE9BQXdCLEVBQWtDLEVBQUUsQ0FDMUUsSUFBSTtRQUNGLENBQUMsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRTtZQUM5QixJQUFJO1lBQ0osWUFBWSxFQUFFLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLElBQUksRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLFdBQVc7WUFDdkUsWUFBWTtZQUNaLFNBQVMsRUFBRSxPQUFPLENBQUMsU0FBUztTQUM3QixDQUFDO1FBQ0osQ0FBQyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQXdCLE1BQU0sQ0FBQyxDQUFDO0lBRXJELE1BQU0sU0FBUyxHQUFHLENBQUMsT0FBd0IsRUFBRSxRQUF3QixFQUFRLEVBQUU7UUFDN0UsS0FBSyxDQUFDLEtBQUssSUFBSSxFQUFFO1lBQ2YsTUFBTSxJQUFJLEdBQUcsQ0FBQyxPQUFPLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxHQUFHLENBQUM7WUFDdkQsTUFBTSxTQUFTLEdBQUcsT0FBTyxDQUFDLFNBQVMsSUFBSSxVQUFVLENBQUM7WUFDbEQsSUFBSSxJQUFJLElBQUksQ0FBQyxNQUFNLGVBQWUsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsU0FBUyxDQUFDLENBQUM7Z0JBQUUsT0FBTztZQUN0RixJQUFJLENBQUMsTUFBTSxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsS0FBSyxNQUFNLEVBQUUsQ0FBQztnQkFDdkMsd0VBQXdFO2dCQUN4RSxxRUFBcUU7Z0JBQ3JFLElBQUksSUFBSSxJQUFJLFVBQVUsQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztvQkFDL0MsTUFBTSxJQUFJLEdBQUcsZUFBZSxDQUFDLGFBQWEsQ0FBQzt3QkFDekMsU0FBUzt3QkFDVCxRQUFRLEVBQUUsVUFBVSxDQUFDLGVBQWUsQ0FBQyxPQUFPLENBQUM7cUJBQzlDLENBQUMsQ0FBQztvQkFDSCxRQUFRLENBQUMsU0FBUyxDQUFDLEdBQUcsRUFBRSxFQUFFLGNBQWMsRUFBRSwwQkFBMEIsRUFBRSxDQUFDLENBQUM7b0JBQ3hFLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUM7Z0JBQ3JCLENBQUM7cUJBQU0sQ0FBQztvQkFDTixRQUFRLENBQUMsUUFBUSxFQUFFLEdBQUcsRUFBRSxVQUFVLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztnQkFDaEUsQ0FBQztnQkFDRCxPQUFPO1lBQ1QsQ0FBQztZQUNELEtBQUssQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQy9CLENBQUMsQ0FBQyxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBYyxFQUFFLEVBQUU7WUFDNUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxzQkFBc0IsRUFBRSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7WUFDaEQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXO2dCQUFFLFFBQVEsQ0FBQyxRQUFRLEVBQUUsR0FBRyxFQUFFLEVBQUUsS0FBSyxFQUFFLGFBQWEsRUFBRSxDQUFDLENBQUM7O2dCQUN4RSxRQUFRLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDdEIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDLENBQUM7SUFFRiw2RUFBNkU7SUFDN0UsNEVBQTRFO0lBQzVFLG1DQUFtQztJQUNuQyxNQUFNLFNBQVMsR0FBRyxDQUFDLE9BQXdCLEVBQUUsTUFBYyxFQUFFLElBQVksRUFBUSxFQUFFO1FBQ2pGLE1BQU0sYUFBYSxHQUFHLE1BQXVCLENBQUM7UUFDOUMsYUFBYSxDQUFDLFdBQVcsS0FBSyxHQUFHLEVBQUUsQ0FBQyxhQUFhLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDeEQsTUFBTSxJQUFJLEdBQUcsQ0FBQyxPQUFPLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksR0FBRyxDQUFDO1FBQzFELElBQUksVUFBVSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ2hDLGFBQWEsQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN4QixPQUFPO1FBQ1QsQ0FBQztRQUNELEtBQUssTUFBTSxDQUFDLE9BQU8sQ0FBQzthQUNqQixJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRTtZQUNmLElBQUksTUFBTSxLQUFLLE1BQU07Z0JBQUUsYUFBYSxDQUFDLE9BQU8sRUFBRSxDQUFDOztnQkFDMUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsYUFBYSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzlDLENBQUMsQ0FBQzthQUNELEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxhQUFhLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztJQUMxQyxDQUFDLENBQUM7SUFFRiwrRUFBK0U7SUFDL0UsNEVBQTRFO0lBQzVFLDRFQUE0RTtJQUM1RSx5Q0FBeUM7SUFDekMsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLFNBQVMsRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDMUUsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUNmLEtBQUssQ0FBQyxHQUFHLENBQ1AsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUNQLElBQUksT0FBTyxDQUFPLENBQUMsT0FBTyxFQUFFLEVBQUU7UUFDNUIsTUFBTSxNQUFNLEdBQUcsWUFBWSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3ZDLE1BQU0sQ0FBQyxFQUFFLENBQUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQ2hDLE1BQU0sQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxJQUFJLEVBQUUsR0FBRyxFQUFFO1lBQzNDLE1BQU0sQ0FBQyxJQUFJLENBQUMsaUJBQWlCLEVBQUU7Z0JBQzdCLElBQUk7Z0JBQ0osVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFVO2dCQUM5QixPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU87YUFDekIsQ0FBQyxDQUFDO1lBQ0gsT0FBTyxFQUFFLENBQUM7UUFDWixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUMsQ0FBQyxDQUNMLENBQ0YsQ0FBQztBQUNKLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIFRoZSByZXZlcnNlIHByb3h5IHRoYXQgbWFrZXMgdGhlIHdyYXBwZXIgcGF0aCBwb3NzaWJsZS5cbiAqXG4gKiBUaGUgd3JhcHBlciBjbGFpbXMgdGhlIFBVQkxJQyBwb3J0IGFuZCB0aGUgd3JhcHBlZCBhcHAgcnVucyBhcyBhIGNoaWxkIHByb2Nlc3NcbiAqIG9uIGEgcHJpdmF0ZSBsb29wYmFjayBwb3J0LCBzbyAtIHVubGlrZSB0aGUgaW4tcHJvY2VzcyBwbHVnaW4gLSB0aGVyZSBpcyBub1xuICogbWlkZGxld2FyZSBjaGFpbiB0byBpbnNlcnQgdGhlIGdhdGUgaW50by4gVGhpcyBwcm94eSBpcyB0aGF0IGluc2VydGlvbiBwb2ludDogaXRcbiAqIGFuc3dlcnMgdGhlIGxvZ2luIHJvdXRlcyBpdHNlbGYsIGFwcGxpZXMgdGhlIGdhdGUgdG8gZXZlcnl0aGluZyBlbHNlLCBhbmRcbiAqIGZvcndhcmRzIHdoYXQgc3Vydml2ZXMgdG8gdGhlIGNoaWxkLlxuICpcbiAqIFRoZSBnYXRpbmcgREVDSVNJT04gaXMgbm90IHJlaW1wbGVtZW50ZWQgaGVyZS4gYEBkYngtdG9vbHMvdHVubmVsYCdzXG4gKiBgZ2F0ZS5nYXRlUmVxdWVzdGAgbWFrZXMgaXQgLSB0aGUgc2FtZSBmdW5jdGlvbiB0aGUgRXhwcmVzcyBtaWRkbGV3YXJlIGNhbGxzIC1cbiAqIGFuZCB0aGlzIG1vZHVsZSBvbmx5IGRpZmZlcnMgaW4gaG93IHRoZSBvdXRjb21lIGlzIHdyaXR0ZW46IGEgcHJveGllZCByZXF1ZXN0XG4gKiBpbnN0ZWFkIG9mIGBuZXh0KClgLCBhIGB3cml0ZUhlYWRgIGluc3RlYWQgb2YgYHJlcy5qc29uYC4gVGhhdCBpcyBkZWxpYmVyYXRlOlxuICogdHdvIGluZGVwZW5kZW50IGltcGxlbWVudGF0aW9ucyBvZiBcIndoaWNoIHJlcXVlc3RzIGFyZSBnYXRlZCBhbmQgd2hpY2ggaGVhZGVyc1xuICogYXJlIHN0cmlwcGVkXCIgaXMgdGhlIG9uZSB3YXkgdGhpcyBwYWNrYWdlIGNvdWxkIGJlY29tZSBhIHNlY3VyaXR5IGJ1Zy5cbiAqXG4gKiBAbW9kdWxlXG4gKi9cblxuaW1wb3J0IHsgY3JlYXRlU2VydmVyLCB0eXBlIEluY29taW5nTWVzc2FnZSwgdHlwZSBTZXJ2ZXJSZXNwb25zZSB9IGZyb20gXCJub2RlOmh0dHBcIjtcbmltcG9ydCB0eXBlIHsgU29ja2V0IH0gZnJvbSBcIm5vZGU6bmV0XCI7XG5pbXBvcnQgeyBsb2cgfSBmcm9tIFwiQGRieC10b29scy9zaGFyZWQtY29yZVwiO1xuaW1wb3J0IHtcbiAgZ2F0ZSBhcyB0dW5uZWxHYXRlLFxuICBoZWFkZXJzIGFzIHR1bm5lbEhlYWRlcnMsXG4gIGxvZ2luUGFnZSBhcyB0dW5uZWxMb2dpblBhZ2UsXG4gIHR5cGUgQXV0aEdhdGVBcGksXG59IGZyb20gXCJAZGJ4LXRvb2xzL3R1bm5lbFwiO1xuaW1wb3J0IFByb3h5TW9kdWxlIGZyb20gXCJodHRwLXByb3h5LTNcIjtcblxuY29uc3QgbG9nZ2VyID0gbG9nLmxvZ2dlcihcInR1bm5lbDpwcm94eVwiKTtcblxudHlwZSBVcGdyYWRlU29ja2V0ID0gU29ja2V0ICYgeyBkZXN0cm95U29vbj86ICgpID0+IHZvaWQgfTtcblxuLyoqIExpc3RlbmVyLCB1cHN0cmVhbSBhcHBsaWNhdGlvbiwgYW5kIG9wdGlvbmFsIGF1dGhlbnRpY2F0aW9uIHNldHRpbmdzIGZvciB0aGUgd3JhcHBlciBwcm94eS4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUHJveHlPcHRpb25zIHtcbiAgLyoqIFRoZSBwb3J0IHRoaXMgcHJveHkgbGlzdGVucyBvbiAtIHRoZSBwb3J0IHBvcnRyIGFuZCB0aGUgcGxhdGZvcm0gcm91dGUgdG8uICovXG4gIHB1YmxpY1BvcnQ6IG51bWJlcjtcbiAgLyoqIFRoZSBwcml2YXRlIGxvb3BiYWNrIHBvcnQgdGhlIHdyYXBwZWQgYXBwIGxpc3RlbnMgb24uICovXG4gIGFwcFBvcnQ6IG51bWJlcjtcbiAgLyoqIFRoZSBnYXRlIGhhbmRsZXJzLiBPbWl0dGVkIChhbiBgLS1pbnNlY3VyZWAgcnVuKSBmb3J3YXJkcyBldmVyeXRoaW5nLiAqL1xuICBnYXRlPzogQXV0aEdhdGVBcGk7XG4gIC8qKiBFeHRyYSBgeC1gIGhlYWRlcnMgdHVubmVsIHRyYWZmaWMgbWF5IGZvcndhcmQuICovXG4gIGZvcndhcmRIZWFkZXJzPzogcmVhZG9ubHkgc3RyaW5nW107XG4gIC8qKiBQYXRoIHByZWZpeGVzIHRvIGdhdGUgYmV5b25kIGAvYXBpL2AgKGUuZy4gYC93c2AgZm9yIGEgV2ViU29ja2V0IGFwcCkuICovXG4gIGdhdGVQYXRocz86IHJlYWRvbmx5IHN0cmluZ1tdO1xuICAvKiogQnJhbmQgbmFtZSBmb3IgdGhlIGhvc3RlZCBsb2dpbiBwYWdlIHNob3duIG9uIGEgZGVuaWVkIGJyb3dzZXIgbmF2aWdhdGlvbi4gKi9cbiAgYnJhbmROYW1lPzogc3RyaW5nO1xuICAvKipcbiAgICogQWRkcmVzc2VzIHRvIGxpc3RlbiBvbi4gRGVmYXVsdHMgdG8gYSBzaW5nbGUgYDAuMC4wLjBgIChldmVyeSBpbnRlcmZhY2UpLFxuICAgKiB0aGUgcG9ydHIvcGxhdGZvcm0gY2FzZS4gUGFzcyBzcGVjaWZpYyBpbnRlcmZhY2UgSVBzIHRvIGV4cG9zZSB0aGUgZ2F0ZSBvblxuICAgKiBvbmx5IHRob3NlIC0gZS5nLiBhbiBvdmVybGF5L0xBTiBhZGRyZXNzIHdoaWxlIGxvb3BiYWNrIHJlYWNoZXMgdGhlIHVwc3RyZWFtXG4gICAqIGRpcmVjdGx5IGFuZCB1bmdhdGVkLlxuICAgKi9cbiAgYmluZEhvc3RzPzogcmVhZG9ubHkgc3RyaW5nW107XG59XG5cbmZ1bmN0aW9uIHNlbmRKc29uKFxuICByZXNwb25zZTogU2VydmVyUmVzcG9uc2UsXG4gIHN0YXR1czogbnVtYmVyLFxuICBib2R5OiB1bmtub3duLFxuICBzZXRDb29raWU/OiBzdHJpbmcsXG4pOiB2b2lkIHtcbiAgcmVzcG9uc2Uud3JpdGVIZWFkKHN0YXR1cywge1xuICAgIFwiY29udGVudC10eXBlXCI6IFwiYXBwbGljYXRpb24vanNvblwiLFxuICAgIC4uLihzZXRDb29raWUgPyB7IFwic2V0LWNvb2tpZVwiOiBzZXRDb29raWUgfSA6IHt9KSxcbiAgfSk7XG4gIHJlc3BvbnNlLmVuZChKU09OLnN0cmluZ2lmeShib2R5KSk7XG59XG5cbi8qKlxuICogSGFuZCBldmVyeSBCZXR0ZXIgQXV0aCBhbmQgY29tcGF0aWJpbGl0eSByb3V0ZSB0byB0aGUgc2hhcmVkIGdhdGUgcnVudGltZS5cbiAqL1xuYXN5bmMgZnVuY3Rpb24gaGFuZGxlQXV0aFJvdXRlKFxuICByZXF1ZXN0OiBJbmNvbWluZ01lc3NhZ2UsXG4gIHJlc3BvbnNlOiBTZXJ2ZXJSZXNwb25zZSxcbiAgcGF0aDogc3RyaW5nLFxuICBnYXRlOiBBdXRoR2F0ZUFwaSxcbiAgYnJhbmROYW1lOiBzdHJpbmcsXG4pOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgaWYgKCF0dW5uZWxHYXRlLmlzQXV0aFBhdGgocGF0aCkpIHJldHVybiBmYWxzZTtcbiAgaWYgKHR1bm5lbEdhdGUud2FudHNIb3N0ZWRMb2dpbihyZXF1ZXN0KSkge1xuICAgIHJlc3BvbnNlLndyaXRlSGVhZCgyMDAsIHsgXCJjb250ZW50LXR5cGVcIjogXCJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLThcIiB9KTtcbiAgICByZXNwb25zZS5lbmQoXG4gICAgICB0dW5uZWxMb2dpblBhZ2UubG9naW5QYWdlSHRtbCh7XG4gICAgICAgIGJyYW5kTmFtZSxcbiAgICAgICAgcmV0dXJuVG86IHR1bm5lbEdhdGUubG9naW5SZXR1cm5UbyhyZXF1ZXN0KSxcbiAgICAgIH0pLFxuICAgICk7XG4gICAgcmV0dXJuIHRydWU7XG4gIH1cbiAgY29uc3QgcmVzdWx0ID0gYXdhaXQgZ2F0ZS5oYW5kbGVyKHR1bm5lbEdhdGUud2ViUmVxdWVzdChyZXF1ZXN0KSk7XG4gIGF3YWl0IHR1bm5lbEdhdGUuc2VuZFdlYlJlc3BvbnNlKHJlc3BvbnNlLCByZXN1bHQpO1xuICByZXR1cm4gdHJ1ZTtcbn1cblxuLyoqXG4gKiBTdGFydCB0aGUgcHJveHkgYW5kIHJlc29sdmUgb25jZSBpdCBpcyBsaXN0ZW5pbmcuXG4gKlxuICogYHB1YmxpY0RvbWFpbmAgaXMgaW50ZW50aW9uYWxseSBOT1QgcGFzc2VkIHRvIGBnYXRlUmVxdWVzdGA6IG9uIHRoaXMgcGF0aCBldmVyeVxuICogcmVxdWVzdCBhcnJpdmVkIG9uIHRoZSBwdWJsaWMgcG9ydCwgc28gaXQgSVMgdHVubmVsIHRyYWZmaWMgYnkgY29uc3RydWN0aW9uIC1cbiAqIHdoZXJlYXMgdGhlIGluLXByb2Nlc3MgZ2F0ZSBzaGFyZXMgYSBwb3J0IHdpdGggdGhlIHBsYXRmb3JtIGZyb250IGRvb3IgYW5kIGhhc1xuICogdG8gdGVsbCB0aGVtIGFwYXJ0IGJ5IGBIb3N0YC4gUGFzc2luZyB0aGUgcmVxdWVzdCdzIG93biBob3N0IGtlZXBzIHRoZSBzaGFyZWRcbiAqIGRlY2lzaW9uIGZ1bmN0aW9uJ3MgY29udHJhY3Qgc2F0aXNmaWVkIHdpdGhvdXQgd2Vha2VuaW5nIGl0LlxuICovXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gc3RhcnRQcm94eShvcHRpb25zOiBQcm94eU9wdGlvbnMpOiBQcm9taXNlPHZvaWQ+IHtcbiAgY29uc3QgcHJveHkgPSBQcm94eU1vZHVsZS5jcmVhdGVQcm94eVNlcnZlcih7XG4gICAgdGFyZ2V0OiBgaHR0cDovLzEyNy4wLjAuMToke29wdGlvbnMuYXBwUG9ydH1gLFxuICAgIHdzOiB0cnVlLFxuICAgIHhmd2Q6IHRydWUsXG4gIH0pO1xuICBjb25zdCBoZWFkZXJQb2xpY3kgPSB0dW5uZWxIZWFkZXJzLnRvSGVhZGVyUG9saWN5KG9wdGlvbnMuZm9yd2FyZEhlYWRlcnMpO1xuICBjb25zdCBnYXRlID0gb3B0aW9ucy5nYXRlO1xuXG4gIGNvbnN0IGRlY2lkZSA9IChyZXF1ZXN0OiBJbmNvbWluZ01lc3NhZ2UpOiBQcm9taXNlPHR1bm5lbEdhdGUuR2F0ZUFjdGlvbj4gPT5cbiAgICBnYXRlXG4gICAgICA/IHR1bm5lbEdhdGUuZ2F0ZVJlcXVlc3QocmVxdWVzdCwge1xuICAgICAgICAgIGdhdGUsXG4gICAgICAgICAgcHVibGljRG9tYWluOiAocmVxdWVzdC5oZWFkZXJzLmhvc3QgPz8gXCJcIikuc3BsaXQoXCI6XCIpWzBdIHx8IFwibG9jYWxob3N0XCIsXG4gICAgICAgICAgaGVhZGVyUG9saWN5LFxuICAgICAgICAgIGdhdGVQYXRoczogb3B0aW9ucy5nYXRlUGF0aHMsXG4gICAgICAgIH0pXG4gICAgICA6IFByb21pc2UucmVzb2x2ZTx0dW5uZWxHYXRlLkdhdGVBY3Rpb24+KFwicGFzc1wiKTtcblxuICBjb25zdCBvblJlcXVlc3QgPSAocmVxdWVzdDogSW5jb21pbmdNZXNzYWdlLCByZXNwb25zZTogU2VydmVyUmVzcG9uc2UpOiB2b2lkID0+IHtcbiAgICB2b2lkIChhc3luYyAoKSA9PiB7XG4gICAgICBjb25zdCBwYXRoID0gKHJlcXVlc3QudXJsID8/IFwiL1wiKS5zcGxpdChcIj9cIilbMF0gPz8gXCIvXCI7XG4gICAgICBjb25zdCBicmFuZE5hbWUgPSBvcHRpb25zLmJyYW5kTmFtZSA/PyBcInRoaXMgYXBwXCI7XG4gICAgICBpZiAoZ2F0ZSAmJiAoYXdhaXQgaGFuZGxlQXV0aFJvdXRlKHJlcXVlc3QsIHJlc3BvbnNlLCBwYXRoLCBnYXRlLCBicmFuZE5hbWUpKSkgcmV0dXJuO1xuICAgICAgaWYgKChhd2FpdCBkZWNpZGUocmVxdWVzdCkpID09PSBcImRlbnlcIikge1xuICAgICAgICAvLyBBIGRlbmllZCBicm93c2VyIG5hdmlnYXRpb24gZ2V0cyB0aGUgaG9zdGVkIGxvZ2luIHBhZ2U7IGFueXRoaW5nIGVsc2VcbiAgICAgICAgLy8gKGFuIFhIUiwgYSAvd3MgdXBncmFkZSBwcm9iZSwgYSBub24tSFRNTCBmZXRjaCkgZ2V0cyB0aGUgNDAxIEpTT04uXG4gICAgICAgIGlmIChnYXRlICYmIHR1bm5lbEdhdGUud2FudHNMb2dpblBhZ2UocmVxdWVzdCkpIHtcbiAgICAgICAgICBjb25zdCBodG1sID0gdHVubmVsTG9naW5QYWdlLmxvZ2luUGFnZUh0bWwoe1xuICAgICAgICAgICAgYnJhbmROYW1lLFxuICAgICAgICAgICAgcmV0dXJuVG86IHR1bm5lbEdhdGUucmVxdWVzdFJldHVyblRvKHJlcXVlc3QpLFxuICAgICAgICAgIH0pO1xuICAgICAgICAgIHJlc3BvbnNlLndyaXRlSGVhZCg0MDEsIHsgXCJjb250ZW50LXR5cGVcIjogXCJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLThcIiB9KTtcbiAgICAgICAgICByZXNwb25zZS5lbmQoaHRtbCk7XG4gICAgICAgIH0gZWxzZSB7XG4gICAgICAgICAgc2VuZEpzb24ocmVzcG9uc2UsIDQwMSwgdHVubmVsR2F0ZS51bmF1dGhvcml6ZWRCb2R5KHJlcXVlc3QpKTtcbiAgICAgICAgfVxuICAgICAgICByZXR1cm47XG4gICAgICB9XG4gICAgICBwcm94eS53ZWIocmVxdWVzdCwgcmVzcG9uc2UpO1xuICAgIH0pKCkuY2F0Y2goKGVycm9yOiB1bmtub3duKSA9PiB7XG4gICAgICBsb2dnZXIuZXJyb3IoXCJwcm94eSByZXF1ZXN0IGZhaWxlZFwiLCB7IGVycm9yIH0pO1xuICAgICAgaWYgKCFyZXNwb25zZS5oZWFkZXJzU2VudCkgc2VuZEpzb24ocmVzcG9uc2UsIDUwMiwgeyBlcnJvcjogXCJiYWQgZ2F0ZXdheVwiIH0pO1xuICAgICAgZWxzZSByZXNwb25zZS5lbmQoKTtcbiAgICB9KTtcbiAgfTtcblxuICAvLyBBIHdlYnNvY2tldCB1cGdyYWRlIGNhbm5vdCBiZSBhbnN3ZXJlZCB3aXRoIGEgNDAxIGJvZHksIHNvIGEgZGVuaWVkIG9uZSBpc1xuICAvLyBkZXN0cm95ZWQgLSB0aGUgY2xpZW50IHNlZXMgdGhlIGhhbmRzaGFrZSBmYWlsLCB3aGljaCBpcyB3aGF0IGEgYnJvd3NlcidzXG4gIC8vIFdlYlNvY2tldCBlcnJvciBoYW5kbGVyIGV4cGVjdHMuXG4gIGNvbnN0IG9uVXBncmFkZSA9IChyZXF1ZXN0OiBJbmNvbWluZ01lc3NhZ2UsIHNvY2tldDogU29ja2V0LCBoZWFkOiBCdWZmZXIpOiB2b2lkID0+IHtcbiAgICBjb25zdCB1cGdyYWRlU29ja2V0ID0gc29ja2V0IGFzIFVwZ3JhZGVTb2NrZXQ7XG4gICAgdXBncmFkZVNvY2tldC5kZXN0cm95U29vbiA/Pz0gKCkgPT4gdXBncmFkZVNvY2tldC5lbmQoKTtcbiAgICBjb25zdCBwYXRoID0gKHJlcXVlc3QudXJsID8/IFwiL1wiKS5zcGxpdChcIj9cIiwgMSlbMF0gPz8gXCIvXCI7XG4gICAgaWYgKHR1bm5lbEdhdGUuaXNBdXRoUGF0aChwYXRoKSkge1xuICAgICAgdXBncmFkZVNvY2tldC5kZXN0cm95KCk7XG4gICAgICByZXR1cm47XG4gICAgfVxuICAgIHZvaWQgZGVjaWRlKHJlcXVlc3QpXG4gICAgICAudGhlbigoYWN0aW9uKSA9PiB7XG4gICAgICAgIGlmIChhY3Rpb24gPT09IFwiZGVueVwiKSB1cGdyYWRlU29ja2V0LmRlc3Ryb3koKTtcbiAgICAgICAgZWxzZSBwcm94eS53cyhyZXF1ZXN0LCB1cGdyYWRlU29ja2V0LCBoZWFkKTtcbiAgICAgIH0pXG4gICAgICAuY2F0Y2goKCkgPT4gdXBncmFkZVNvY2tldC5kZXN0cm95KCkpO1xuICB9O1xuXG4gIC8vIE9uZSBuZXQuU2VydmVyIGJpbmRzIG9uZSBhZGRyZXNzLCBzbyBsaXN0ZW4gZWFjaCBob3N0IG9uIGl0cyBvd24gc2VydmVyIHRoYXRcbiAgLy8gc2hhcmVzIHRoZSBzYW1lIGhhbmRsZXJzLiBCaW5kaW5nIHNwZWNpZmljIGludGVyZmFjZSBJUHMgKHJhdGhlciB0aGFuIHRoZVxuICAvLyBkZWZhdWx0IDAuMC4wLjApIGlzIHdoYXQgbGV0cyB0aGUgZ2F0ZSBmcm9udCBhbiBvdmVybGF5L0xBTiBhZGRyZXNzIHdoaWxlXG4gIC8vIGxvb3BiYWNrIHJlYWNoZXMgdGhlIHVwc3RyZWFtIHVuZ2F0ZWQuXG4gIGNvbnN0IGhvc3RzID0gb3B0aW9ucy5iaW5kSG9zdHM/Lmxlbmd0aCA/IG9wdGlvbnMuYmluZEhvc3RzIDogW1wiMC4wLjAuMFwiXTtcbiAgYXdhaXQgUHJvbWlzZS5hbGwoXG4gICAgaG9zdHMubWFwKFxuICAgICAgKGhvc3QpID0+XG4gICAgICAgIG5ldyBQcm9taXNlPHZvaWQ+KChyZXNvbHZlKSA9PiB7XG4gICAgICAgICAgY29uc3Qgc2VydmVyID0gY3JlYXRlU2VydmVyKG9uUmVxdWVzdCk7XG4gICAgICAgICAgc2VydmVyLm9uKFwidXBncmFkZVwiLCBvblVwZ3JhZGUpO1xuICAgICAgICAgIHNlcnZlci5saXN0ZW4ob3B0aW9ucy5wdWJsaWNQb3J0LCBob3N0LCAoKSA9PiB7XG4gICAgICAgICAgICBsb2dnZXIuaW5mbyhcInByb3h5IGxpc3RlbmluZ1wiLCB7XG4gICAgICAgICAgICAgIGhvc3QsXG4gICAgICAgICAgICAgIHB1YmxpY1BvcnQ6IG9wdGlvbnMucHVibGljUG9ydCxcbiAgICAgICAgICAgICAgYXBwUG9ydDogb3B0aW9ucy5hcHBQb3J0LFxuICAgICAgICAgICAgfSk7XG4gICAgICAgICAgICByZXNvbHZlKCk7XG4gICAgICAgICAgfSk7XG4gICAgICAgIH0pLFxuICAgICksXG4gICk7XG59XG4iXX0=

package/lib/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../src/bootstrap.ts","../src/bun.ts","../src/cli.ts","../src/root.ts","../index.ts","../bin/dbx-tools.ts"],"version":"5.9.3"}
+{"root":["../src/bootstrap.ts","../src/bun.ts","../src/cli.ts","../src/root.ts","../src/appkit/cli.ts","../src/appkit/env-export.ts","../src/auth/cli.ts","../src/auth/options.ts","../src/graphiti/cli.ts","../src/graphiti/options.ts","../src/lakebase-proxy/cancellation.ts","../src/lakebase-proxy/cli.ts","../src/lakebase-proxy/options.ts","../src/lakebase-proxy/protocol.ts","../src/lakebase-proxy/proxy.ts","../src/model-gateway/cli.ts","../src/model-gateway/server.ts","../src/tunnel/app.ts","../src/tunnel/cli.ts","../src/tunnel/options.ts","../src/tunnel/proxy.ts","../index.ts","../bin/dbx-graphiti.ts","../bin/dbx-lakebase-proxy.ts","../bin/dbx-model-gateway.ts","../bin/dbx-tools.ts"],"version":"5.9.3"}

package/package.json

@@ -8,6 +8,9 @@
   },
   "bin": {
     "dbx": "./lib/bin/dbx-tools.js",
+    "dbx-graphiti": "./lib/bin/dbx-graphiti.js",
+    "dbx-lakebase-proxy": "./lib/bin/dbx-lakebase-proxy.js",
+    "dbx-model-gateway": "./lib/bin/dbx-model-gateway.js",
     "dbx-tools": "./lib/bin/dbx-tools.js"
   },
   "scripts": {
@@ -24,19 +27,32 @@
   },
   "devDependencies": {
     "@types/node": "^24.6.0",
+    "@types/pg": "^8",
     "typescript": "^5.9.3"
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/cli-appkit-env": "^0.9.58",
-    "@dbx-tools/cli-auth": "^0.9.58",
-    "@dbx-tools/cli-graphiti": "^0.9.58",
-    "@dbx-tools/cli-lakebase-proxy": "^0.9.58",
-    "@dbx-tools/cli-model-gateway": "^0.9.58",
-    "@dbx-tools/cli-tunnel": "^0.9.58",
-    "@dbx-tools/core": "^0.9.58",
-    "@dbx-tools/shared-core": "^0.9.58",
+    "@databricks/appkit": "0.81.0",
+    "@dbx-tools/appkit": "^0.9.60",
+    "@dbx-tools/appkit-model-gateway": "^0.9.60",
+    "@dbx-tools/auth": "^0.9.60",
+    "@dbx-tools/auth-gate": "^0.9.60",
+    "@dbx-tools/cli-args": "^0.9.60",
+    "@dbx-tools/cli-service": "^0.9.60",
+    "@dbx-tools/core": "^0.9.60",
+    "@dbx-tools/databricks": "^0.9.60",
+    "@dbx-tools/email": "^0.9.60",
+    "@dbx-tools/graphiti": "^0.9.60",
+    "@dbx-tools/lakebase": "^0.9.60",
+    "@dbx-tools/postgres": "^0.9.60",
+    "@dbx-tools/shared-auth": "^0.9.60",
+    "@dbx-tools/shared-core": "^0.9.60",
+    "@dbx-tools/shared-email": "^0.9.60",
+    "@dbx-tools/shared-model-gateway": "^0.9.60",
+    "@dbx-tools/tunnel": "^0.9.60",
     "commander": "^15.0.0",
+    "http-proxy-3": "^1.23.1",
+    "pg": "^8.22.0",
     "zod": "4.3.6"
   },
   "main": "./lib/index.js",
@@ -47,6 +63,9 @@
     "types": "./lib/index.d.ts",
     "bin": {
       "dbx": "./lib/bin/dbx-tools.js",
+      "dbx-graphiti": "./lib/bin/dbx-graphiti.js",
+      "dbx-lakebase-proxy": "./lib/bin/dbx-lakebase-proxy.js",
+      "dbx-model-gateway": "./lib/bin/dbx-model-gateway.js",
       "dbx-tools": "./lib/bin/dbx-tools.js"
     },
     "exports": {
@@ -70,10 +89,58 @@
         "types": "./lib/src/root.d.ts",
         "default": "./lib/src/root.js"
       },
+      "./appkit": {
+        "types": "./lib/src/appkit/cli.d.ts",
+        "default": "./lib/src/appkit/cli.js"
+      },
+      "./appkit/env-export": {
+        "types": "./lib/src/appkit/env-export.d.ts",
+        "default": "./lib/src/appkit/env-export.js"
+      },
+      "./auth": {
+        "types": "./lib/src/auth/cli.d.ts",
+        "default": "./lib/src/auth/cli.js"
+      },
+      "./auth/options": {
+        "types": "./lib/src/auth/options.d.ts",
+        "default": "./lib/src/auth/options.js"
+      },
+      "./graphiti": {
+        "types": "./lib/src/graphiti/cli.d.ts",
+        "default": "./lib/src/graphiti/cli.js"
+      },
+      "./graphiti/options": {
+        "types": "./lib/src/graphiti/options.d.ts",
+        "default": "./lib/src/graphiti/options.js"
+      },
+      "./lakebase-proxy": {
+        "types": "./lib/src/lakebase-proxy/cli.d.ts",
+        "default": "./lib/src/lakebase-proxy/cli.js"
+      },
+      "./lakebase-proxy/options": {
+        "types": "./lib/src/lakebase-proxy/options.d.ts",
+        "default": "./lib/src/lakebase-proxy/options.js"
+      },
+      "./model-gateway": {
+        "types": "./lib/src/model-gateway/cli.d.ts",
+        "default": "./lib/src/model-gateway/cli.js"
+      },
+      "./model-gateway/server": {
+        "types": "./lib/src/model-gateway/server.d.ts",
+        "default": "./lib/src/model-gateway/server.js"
+      },
+      "./tunnel": {
+        "types": "./lib/src/tunnel/cli.d.ts",
+        "default": "./lib/src/tunnel/cli.js"
+      },
+      "./tunnel/options": {
+        "types": "./lib/src/tunnel/options.d.ts",
+        "default": "./lib/src/tunnel/options.js"
+      },
       "./package.json": "./package.json"
     }
   },
-  "version": "0.9.58",
+  "version": "0.9.60",
   "types": "./lib/index.d.ts",
   "dbxToolsConfig": {
     "tags": [
@@ -102,6 +169,54 @@
       "types": "./lib/src/root.d.ts",
       "default": "./lib/src/root.js"
     },
+    "./appkit": {
+      "types": "./lib/src/appkit/cli.d.ts",
+      "default": "./lib/src/appkit/cli.js"
+    },
+    "./appkit/env-export": {
+      "types": "./lib/src/appkit/env-export.d.ts",
+      "default": "./lib/src/appkit/env-export.js"
+    },
+    "./auth": {
+      "types": "./lib/src/auth/cli.d.ts",
+      "default": "./lib/src/auth/cli.js"
+    },
+    "./auth/options": {
+      "types": "./lib/src/auth/options.d.ts",
+      "default": "./lib/src/auth/options.js"
+    },
+    "./graphiti": {
+      "types": "./lib/src/graphiti/cli.d.ts",
+      "default": "./lib/src/graphiti/cli.js"
+    },
+    "./graphiti/options": {
+      "types": "./lib/src/graphiti/options.d.ts",
+      "default": "./lib/src/graphiti/options.js"
+    },
+    "./lakebase-proxy": {
+      "types": "./lib/src/lakebase-proxy/cli.d.ts",
+      "default": "./lib/src/lakebase-proxy/cli.js"
+    },
+    "./lakebase-proxy/options": {
+      "types": "./lib/src/lakebase-proxy/options.d.ts",
+      "default": "./lib/src/lakebase-proxy/options.js"
+    },
+    "./model-gateway": {
+      "types": "./lib/src/model-gateway/cli.d.ts",
+      "default": "./lib/src/model-gateway/cli.js"
+    },
+    "./model-gateway/server": {
+      "types": "./lib/src/model-gateway/server.d.ts",
+      "default": "./lib/src/model-gateway/server.js"
+    },
+    "./tunnel": {
+      "types": "./lib/src/tunnel/cli.d.ts",
+      "default": "./lib/src/tunnel/cli.js"
+    },
+    "./tunnel/options": {
+      "types": "./lib/src/tunnel/options.d.ts",
+      "default": "./lib/src/tunnel/options.js"
+    },
     "./package.json": "./package.json"
   },
   "files": [

package/src/appkit/cli.ts

@@ -0,0 +1,72 @@
+/**
+ * `dbx appkit` commander program.
+ *
+ * `env` runs AppKit auto-config and prints the env vars it added or changed as
+ * eval-able `export` / `set` lines (or JSON) - e.g. `eval "$(dbx appkit env)"`
+ * to load a resolved Lakebase connection into your shell.
+ *
+ * This package ships no bin of its own: {@link buildProgram} is mounted as the
+ * `appkit` subcommand of the single `dbx` CLI (`@dbx-tools/cli`), which imports
+ * this module lazily so `dbx dev` never pays for the AppKit load.
+ *
+ * @module
+ */
+
+import { appkit } from "@dbx-tools/appkit";
+import { addArgs, parseArgs } from "@dbx-tools/cli-args";
+import { log } from "@dbx-tools/shared-core";
+import { Command, CommanderError } from "commander";
+
+import {
+  diffEnv,
+  EnvCommandOptionsSchema,
+  formatEnvExport,
+  snapshotEnv,
+  type EnvCommandOptions,
+} from "./env-export.ts";
+
+const logger = log.logger("appkit-env");
+
+/** Run auto-config and write the resulting env delta to stdout. */
+async function writeEnvExport(opts: EnvCommandOptions): Promise<void> {
+  if (opts.quiet) {
+    process.env.LOG_LEVEL = "error";
+  }
+
+  logger.debug("Snapshotting env vars");
+  const before = snapshotEnv();
+  await appkit.autoConfigure({ autoConfigure: "env" });
+  const changes = diffEnv(before, snapshotEnv());
+
+  process.stdout.write(formatEnvExport(changes, opts.format));
+}
+
+/**
+ * Build the `env` command on its own, so a host CLI can mount it under a
+ * different parent than {@link buildProgram}'s.
+ */
+export function buildEnvCommand(name = "env"): Command {
+  const command = addArgs(
+    new Command(name).description("Run AppKit auto-config and print new/changed env vars."),
+    EnvCommandOptionsSchema,
+  );
+  return command.action(async () => {
+    await writeEnvExport(parseArgs(command, EnvCommandOptionsSchema));
+  });
+}
+
+/** Build the `dbx appkit` commander program (no side effects until parsed). */
+export function buildProgram(name = "dbx appkit"): Command {
+  return new Command()
+    .name(name)
+    .description("AppKit helpers: resolve the environment an AppKit app would start with.")
+    .addCommand(buildEnvCommand())
+    .showHelpAfterError();
+}
+
+/** Parse `argv` and run the matching command. Throws {@link CommanderError} on flag errors. */
+export async function runCli(argv: string[]): Promise<void> {
+  await buildProgram().parseAsync(argv);
+}
+
+export { CommanderError };

package/src/appkit/env-export.ts

@@ -0,0 +1,124 @@
+/**
+ * Snapshot `process.env`, diff after auto-config, and format deltas as
+ * eval-able shell `export` / Windows `set` lines or JSON.
+ *
+ * @module
+ */
+
+import { z } from "zod";
+
+export const EnvExportFormatSchema = z
+  .preprocess(
+    (value) => {
+      if (typeof value !== "string") return value;
+      const normalized = value.trim().toLowerCase();
+      if (["export", "shell", "nix", "bash"].includes(normalized)) return "export";
+      if (["windows", "win", "cmd"].includes(normalized)) return "windows";
+      return normalized;
+    },
+    z.enum(["export", "windows", "json"]),
+  )
+  .describe("Environment export output format.");
+
+export type EnvExportFormat = z.output<typeof EnvExportFormatSchema>;
+
+/** Shallow copy of the current process environment. */
+export function snapshotEnv(env: NodeJS.ProcessEnv = process.env): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value !== undefined) {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+
+/**
+ * Keys whose values were added, changed, or cleared between snapshots. A key
+ * that went from a non-blank value to blank/removed is emitted with an empty
+ * value so it can be unset. Keys that were already blank/absent and stayed that
+ * way are omitted.
+ */
+export function diffEnv(
+  before: Record<string, string>,
+  after: Record<string, string>,
+): Record<string, string> {
+  const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
+  const out: Record<string, string> = {};
+  for (const key of [...keys].sort()) {
+    // Treat a removed key as blank so a non-blank -> blank/removed transition is a delta.
+    const prev = before[key] ?? "";
+    const next = after[key] ?? "";
+    if (next !== prev) {
+      out[key] = next;
+    }
+  }
+  return out;
+}
+
+/** Select Windows `set` output on Windows and POSIX `export` output elsewhere. */
+export function defaultEnvExportFormat(
+  platform: NodeJS.Platform = process.platform,
+): EnvExportFormat {
+  return platform === "win32" ? "windows" : "export";
+}
+
+export const EnvCommandOptionsSchema = z
+  .object({
+    format: EnvExportFormatSchema.default(defaultEnvExportFormat()).describe(
+      "Output format: export, windows, or json.",
+    ),
+    quiet: z.boolean().default(false).describe("Suppress auto-config log output."),
+  })
+  .strict()
+  .describe("Options for exporting the AppKit auto-config environment.");
+
+export type EnvCommandOptions = z.output<typeof EnvCommandOptionsSchema>;
+
+function escapeExportValue(value: string): string {
+  return value
+    .replace(/\\/g, "\\\\")
+    .replace(/"/g, '\\"')
+    .replace(/\$/g, "\\$")
+    .replace(/`/g, "\\`");
+}
+
+function escapeWindowsSetValue(value: string): string {
+  if (/[\s"&|<>^]/.test(value)) {
+    return `"${value.replace(/"/g, '""')}"`;
+  }
+  return value;
+}
+
+/**
+ * Format env entries for the requested output style. An empty map prints
+ * nothing (no trailing newline).
+ */
+export function formatEnvExport(env: Record<string, string>, format: EnvExportFormat): string {
+  const entries = Object.entries(env).sort(([a], [b]) => a.localeCompare(b));
+  if (entries.length === 0) {
+    return "";
+  }
+
+  switch (format) {
+    case "json":
+      return `${JSON.stringify(Object.fromEntries(entries), null, 2)}\n`;
+    case "windows":
+      return (
+        entries.map(([key, value]) => `set ${key}=${escapeWindowsSetValue(value)}`).join("\n") +
+        "\n"
+      );
+    case "export":
+      return (
+        entries.map(([key, value]) => `export ${key}="${escapeExportValue(value)}"`).join("\n") +
+        "\n"
+      );
+    default:
+      throw new Error(`Unknown env export format: ${format satisfies never}`);
+  }
+}
+
+/** Normalize CLI format aliases to a supported export format. */
+export function parseEnvExportFormat(value: string): EnvExportFormat {
+  return EnvExportFormatSchema.parse(value);
+}