@butterbase/cli 0.2.2 → 0.3.3

package/README.md

@@ -139,6 +139,108 @@ butterbase storage upload ./image.png
 butterbase storage delete obj_abc123
 ```
 
+### AI
+
+```bash
+butterbase ai chat "Summarize this" --model openai/gpt-4o-mini
+butterbase ai chat "Explain RAG" --system "You're a concise teacher." --temperature 0.2
+butterbase ai embed "hello world" "another doc"
+butterbase ai models
+butterbase ai config get
+butterbase ai config set --default-model openai/gpt-4o-mini --max-tokens-per-request 4000
+butterbase ai config set --byok-key sk-or-...           # rotate BYOK key; "" to clear
+butterbase ai usage --start-date 2026-05-01 --end-date 2026-05-31
+```
+
+### OAuth (admin)
+
+```bash
+butterbase oauth configure google \
+  --client-id ... --client-secret ... \
+  --redirect-uri https://app.example/cb \
+  --scope openid --scope email
+butterbase oauth list
+butterbase oauth get google
+butterbase oauth update google --enabled false
+butterbase oauth delete google
+```
+
+### Audit logs
+
+```bash
+butterbase audit query --category auth --event-type login --limit 50
+butterbase audit query --from 2026-05-01 --to 2026-05-31 --action create --resource-type user
+butterbase audit query --actor-id user_123 --json
+```
+
+### App config (server-side)
+
+```bash
+butterbase apps config get
+butterbase apps config cors --allowed-origin https://app.example --allow-credentials true
+butterbase apps config jwt --access-token-ttl 15m --refresh-token-ttl-days 30
+butterbase apps config storage --public-read true --max-file-size-mb 25 --allowed-content-type image/png --allowed-content-type image/jpeg
+butterbase apps config access-mode authenticated
+butterbase apps config secure --table posts --table comments --user-column author_id --access-mode authenticated
+```
+
+### Regions + multi-region moves
+
+```bash
+butterbase regions list
+butterbase apps move app_abc us-west-2 --follow
+butterbase apps migrations active                 # current app
+butterbase apps migrations status app_abc m_xyz
+butterbase apps migrations abort app_abc m_xyz     # before cutover
+butterbase apps migrations reverse app_abc m_xyz   # after cutover
+butterbase apps replicas list
+butterbase apps replicas teardown m_xyz
+```
+
+### App-level billing (Stripe Connect)
+
+```bash
+butterbase app-billing plans list
+butterbase app-billing plans create --name pro --price-cents 1999 --interval month
+butterbase app-billing plans update plan_abc --price-cents 2499
+butterbase app-billing products list
+butterbase app-billing products create --name "Lifetime access" --price-cents 9900
+butterbase app-billing subscribe plan_abc
+butterbase app-billing subscription
+butterbase app-billing cancel
+butterbase app-billing purchase prod_xyz
+butterbase app-billing orders list
+butterbase app-billing orders get order_abc
+```
+
+### Scoped API keys + integrations
+
+```bash
+butterbase keys generate ci-key --scope schema:read --scope functions:invoke
+butterbase integrations configure github --scope repo --scope read:user
+butterbase integrations connect github --redirect-url https://app.example/cb --scope repo
+```
+
+### Functions deploy (full options)
+
+```bash
+butterbase functions deploy fn.ts \
+  --name my-fn \
+  --trigger cron --trigger-config '{"schedule":"*/5 * * * *"}' \
+  --env API_KEY=sk_... --env DEBUG=true \
+  --timeout-ms 9000 --memory-mb 256
+```
+
+### RLS
+
+```bash
+butterbase rls create --table posts --policy-name posts_own \
+  --command SELECT --using "author_id = auth.uid()" \
+  --role user --restrictive
+butterbase rls delete posts                 # delete all policies on table
+butterbase rls delete posts --policy posts_own
+```
+
 ## Global Options
 
 Most commands support the `--app` flag to specify an app ID:
@@ -284,6 +386,22 @@ butterbase integrations tools gmail --app app_abc123
 butterbase integrations execute GMAIL_SEND_EMAIL --data '{"to":"x@y.com","subject":"Hi","body":"Hello"}' --app app_abc123
 ```
 
+## Error output
+
+The CLI throws typed `ButterbaseError`s from `@butterbase/sdk`. The top-level
+handler renders the class name, message, and the structured fields the backend
+returned (`code`, `status`, `remediation`). Example for an unauthenticated call:
+
+```
+AuthError: Invalid API key
+  code:        AUTH_INVALID_API_KEY
+  status:      401
+  remediation: Rotate the key with `butterbase keys generate` and update ~/.butterbase/config.json.
+```
+
+The error codes come from `@butterbase/shared`'s `ErrorCodes` namespace — see
+the SDK README for the full list.
+
 ## License
 
 MIT

package/dist/bin/butterbase.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
+import { renderError } from '../src/lib/errors.js';
 import { initCommand } from '../src/commands/init.js';
 import { loginCommand, logoutCommand, configGetCommand, configSetCommand } from '../src/commands/config.js';
 import { appsListCommand, appsCreateCommand, appsUseCommand, appsDeleteCommand, appsPauseCommand, appsResumeCommand } from '../src/commands/apps.js';
@@ -24,6 +25,14 @@ import { rlsListCommand, rlsCreateCommand, rlsEnableCommand, rlsDeleteCommand }
 import { billingStatusCommand, billingPortalCommand, billingTopupCommand, billingCapGetCommand, billingCapRaiseCommand, billingPlansCommand, billingUsageCommand, } from '../src/commands/billing.js';
 import { ragCollectionsListCommand, ragCollectionsCreateCommand, ragCollectionsGetCommand, ragCollectionsDeleteCommand, ragIngestCommand, ragDocsListCommand, ragDocsDeleteCommand, ragQueryCommand, } from '../src/commands/rag.js';
 import { doDeployCommand, doListCommand, doGetCommand, doDeleteCommand, doUsageCommand, doEnvListCommand, doEnvSetCommand, doEnvUnsetCommand, } from '../src/commands/do.js';
+import { aiChatCommand, aiEmbedCommand, aiModelsCommand, aiConfigGetCommand, aiConfigSetCommand, aiUsageCommand, } from '../src/commands/ai.js';
+import { oauthConfigureCommand, oauthListCommand, oauthGetCommand, oauthUpdateCommand, oauthDeleteCommand, } from '../src/commands/oauth.js';
+import { auditQueryCommand } from '../src/commands/audit.js';
+import { appConfigGetCommand, appCorsCommand, appJwtCommand, appStorageCommand, appAccessModeCommand, appSecureCommand, } from '../src/commands/app-config.js';
+import { regionsListCommand } from '../src/commands/regions.js';
+import { moveCommand, migrationStatusCommand, migrationActiveCommand, migrationAbortCommand, migrationReverseCommand, replicasListCommand, replicaTeardownCommand, } from '../src/commands/move.js';
+import { plansListCommand, plansCreateCommand, plansUpdateCommand, productsListCommand, productsCreateCommand, productsUpdateCommand, subscribeCommand, subscriptionCommand, cancelCommand, purchaseCommand, ordersListCommand, ordersGetCommand, } from '../src/commands/app-billing.js';
+import { kvGetCommand, kvSetCommand, kvDelCommand, kvLsCommand, kvStatsCommand, kvFlushCommand, kvRulesCommand, kvExposeCommand, kvUnexposeCommand, kvApplyCommand, } from '../src/commands/kv.js';
 const program = new Command();
 program
     .name('butterbase')
@@ -80,6 +89,94 @@ apps
     .command('resume [app-id]')
     .description('Resume a paused app — restore data-plane traffic')
     .action(appsResumeCommand);
+const appsConfig = apps.command('config').description('Read or update the app\'s server-side config');
+appsConfig
+    .command('get')
+    .description('Show the app\'s full config')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => appConfigGetCommand(opts));
+appsConfig
+    .command('cors')
+    .description('Update CORS config')
+    .option('--app <appId>', 'Override current app')
+    .option('--allowed-origin <origin>', 'Allowed origin (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--allowed-method <method>', 'Allowed method (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--allowed-header <header>', 'Allowed header (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--allow-credentials <bool>', '(true|false)', (v) => v === 'true')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => appCorsCommand(opts));
+appsConfig
+    .command('jwt')
+    .description('Update JWT TTLs')
+    .option('--app <appId>', 'Override current app')
+    .option('--access-token-ttl <duration>', 'e.g. "15m", "1h"')
+    .option('--refresh-token-ttl-days <n>', 'Refresh token lifetime in days', parseInt)
+    .option('--json', 'Output raw JSON')
+    .action((opts) => appJwtCommand(opts));
+appsConfig
+    .command('storage')
+    .description('Update storage config')
+    .option('--app <appId>', 'Override current app')
+    .option('--public-read <bool>', 'Public-read default (true|false)', (v) => v === 'true')
+    .option('--max-file-size-mb <n>', 'Per-file size cap in MB', parseInt)
+    .option('--allowed-content-type <ct>', 'Allowed content-type (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--json', 'Output raw JSON')
+    .action((opts) => appStorageCommand(opts));
+appsConfig
+    .command('access-mode <mode>')
+    .description('Set access mode: public | authenticated')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((mode, opts) => appAccessModeCommand(mode, opts));
+appsConfig
+    .command('secure')
+    .description('Enable RLS + access-mode in one shot')
+    .option('--app <appId>', 'Override current app')
+    .option('--table <name>', 'Table to secure (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--user-column <col>', 'User-id column name (default: user_id)')
+    .option('--access-mode <mode>', 'public | authenticated')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => appSecureCommand(opts));
+apps
+    .command('move <appId> <destRegion>')
+    .description('Migrate an app to another region')
+    .option('--follow', 'Poll status until terminal')
+    .option('--json', 'Output raw JSON')
+    .action((appId, destRegion, opts) => moveCommand(appId, destRegion, opts));
+const appsMigrations = apps.command('migrations').description('Read or control in-flight migrations');
+appsMigrations
+    .command('status <appId> <migrationId>')
+    .description('Get status of a specific migration')
+    .option('--json', 'Output raw JSON')
+    .action((appId, migrationId, opts) => migrationStatusCommand(appId, migrationId, opts));
+appsMigrations
+    .command('active [appId]')
+    .description('Show the currently-active migration for an app')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((appId, opts) => migrationActiveCommand(appId, opts));
+appsMigrations
+    .command('abort <appId> <migrationId>')
+    .description('Cancel a migration that has not yet reached cutover')
+    .option('--json', 'Output raw JSON')
+    .action((appId, migrationId, opts) => migrationAbortCommand(appId, migrationId, opts));
+appsMigrations
+    .command('reverse <appId> <migrationId>')
+    .description('Roll a completed migration back to source')
+    .option('--json', 'Output raw JSON')
+    .action((appId, migrationId, opts) => migrationReverseCommand(appId, migrationId, opts));
+const appsReplicas = apps.command('replicas').description('Manage retained source replicas after a move');
+appsReplicas
+    .command('list')
+    .description('List active retained source replicas')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => replicasListCommand(opts));
+appsReplicas
+    .command('teardown <migrationId>')
+    .description('Decommission a retained source replica')
+    .option('--json', 'Output raw JSON')
+    .action((migrationId, opts) => replicaTeardownCommand(migrationId, opts));
 // Schema
 const schema = program.command('schema').description('Manage database schema');
 schema
@@ -107,8 +204,12 @@ functions
     .description('Deploy a function')
     .option('--app <app-id>', 'App ID (uses current app if not specified)')
     .option('--name <name>', 'Function name (defaults to filename)')
-    .option('--trigger <type>', 'Trigger type (http, cron)', 'http')
+    .option('--trigger <type>', 'Trigger type (http, cron, s3_upload, webhook, websocket)', 'http')
+    .option('--trigger-config <json>', 'Trigger config as JSON (e.g. \'{"schedule":"*/5 * * * *"}\')')
     .option('--description <desc>', 'Function description')
+    .option('--env <kv>', 'Env var as KEY=value (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--timeout-ms <n>', 'Per-invocation timeout (ms)', parseInt)
+    .option('--memory-mb <n>', 'Memory limit (MB)', parseInt)
     .action(functionsDeployCommand);
 functions
     .command('logs <function-name>')
@@ -287,6 +388,7 @@ const keys = program.command('keys').description('Manage API keys');
 keys
     .command('generate [name]')
     .description('Generate a new API key')
+    .option('--scope <scope>', 'Add a scope (repeatable)', (v, prev) => prev.concat(v), [])
     .option('--json', 'Output as JSON')
     .action(keysGenerateCommand);
 keys
@@ -322,6 +424,7 @@ integrations
     .description('Enable a toolkit for the app')
     .option('--app <app-id>', 'App ID')
     .option('--display-name <name>', 'Human-readable display name')
+    .option('--scope <scope>', 'Add a scope (repeatable)', (v, prev) => prev.concat(v), [])
     .action(integrationsConfigureCommand);
 integrations
     .command('disable <toolkit>')
@@ -334,6 +437,7 @@ integrations
     .option('--app <app-id>', 'App ID')
     .option('--redirect-url <url>', 'URL to redirect after OAuth')
     .option('--user-id <uuid>', 'User ID (for API key auth)')
+    .option('--scope <scope>', 'Add a scope (repeatable)', (v, prev) => prev.concat(v), [])
     .action(integrationsConnectCommand);
 integrations
     .command('connections')
@@ -474,6 +578,7 @@ rls
     .option('--using <expr>', 'USING expression')
     .option('--with-check <expr>', 'WITH CHECK expression')
     .option('--restrictive', 'Create as RESTRICTIVE policy')
+    .option('--role <role>', 'Restrict to a Postgres role (anon | user)')
     .option('--json', 'Output as JSON')
     .action(rlsCreateCommand);
 rls
@@ -591,6 +696,267 @@ rag
     .option('--model <model>', 'LLM model to use for synthesis')
     .option('--json', 'Output as JSON')
     .action(ragQueryCommand);
+// AI Gateway
+const ai = program.command('ai').description('Use the app\'s AI gateway (chat, embeddings, models, BYOK, usage)');
+ai
+    .command('chat <prompt>')
+    .description('Send a single-turn chat completion')
+    .option('--app <appId>', 'Override current app')
+    .option('--model <model>', 'Model id (default: app default)')
+    .option('--temperature <n>', 'Sampling temperature', parseFloat)
+    .option('--max-tokens <n>', 'Max output tokens', parseInt)
+    .option('--system <message>', 'Prepend a system message')
+    .option('--json', 'Output raw JSON')
+    .action((prompt, opts) => aiChatCommand(prompt, opts));
+ai
+    .command('embed <input...>')
+    .description('Embed text(s) into vectors')
+    .option('--app <appId>', 'Override current app')
+    .option('--model <model>', 'Embedding model')
+    .option('--json', 'Output raw JSON')
+    .action((input, opts) => aiEmbedCommand(input, opts));
+ai
+    .command('models')
+    .description('List available AI models')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => aiModelsCommand(opts));
+const aiConfig = ai.command('config').description('Read or update AI config');
+aiConfig
+    .command('get')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => aiConfigGetCommand(opts));
+aiConfig
+    .command('set')
+    .option('--app <appId>', 'Override current app')
+    .option('--default-model <model>')
+    .option('--allowed-models <models...>')
+    .option('--max-tokens-per-request <n>', 'Cap on tokens per request', parseInt)
+    .option('--byok-key <key>', 'Set or clear BYOK key (empty string clears)')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => aiConfigSetCommand(opts));
+ai
+    .command('usage')
+    .description('AI token + cost usage over a window')
+    .option('--app <appId>', 'Override current app')
+    .option('--start-date <date>', 'ISO date')
+    .option('--end-date <date>', 'ISO date')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => aiUsageCommand({
+    app: opts.app, startDate: opts.startDate, endDate: opts.endDate, json: opts.json,
+}));
+// OAuth
+const oauth = program.command('oauth').description('Manage OAuth providers for end-user auth');
+oauth
+    .command('configure <provider>')
+    .description('Configure an OAuth provider (e.g. google, github, apple)')
+    .requiredOption('--client-id <id>')
+    .requiredOption('--client-secret <secret>')
+    .option('--app <appId>', 'Override current app')
+    .option('--redirect-uri <uri>', 'Add a redirect URI (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--scope <scope>', 'Add a scope (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--authorization-url <url>')
+    .option('--token-url <url>')
+    .option('--userinfo-url <url>')
+    .option('--json', 'Output raw JSON')
+    .action((provider, opts) => oauthConfigureCommand(provider, opts));
+oauth
+    .command('list')
+    .description('List configured OAuth providers')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => oauthListCommand(opts));
+oauth
+    .command('get <provider>')
+    .description('Show config for a provider')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((provider, opts) => oauthGetCommand(provider, opts));
+oauth
+    .command('update <provider>')
+    .description('Update provider config (any field optional)')
+    .option('--app <appId>', 'Override current app')
+    .option('--client-id <id>')
+    .option('--client-secret <secret>')
+    .option('--redirect-uri <uri>', 'Replace redirect URIs', (v, prev) => prev.concat(v), [])
+    .option('--scope <scope>', 'Replace scopes', (v, prev) => prev.concat(v), [])
+    .option('--enabled <bool>', 'Enable/disable (true|false)', (v) => v === 'true')
+    .option('--json', 'Output raw JSON')
+    .action((provider, opts) => oauthUpdateCommand(provider, opts));
+oauth
+    .command('delete <provider>')
+    .description('Delete an OAuth provider configuration')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((provider, opts) => oauthDeleteCommand(provider, opts));
+// Audit
+const audit = program.command('audit').description('Query the app\'s audit log');
+audit
+    .command('query')
+    .description('Query audit log entries with optional filters')
+    .option('--app <appId>', 'Override current app')
+    .option('--category <c>')
+    .option('--event-type <e>')
+    .option('--action <a>')
+    .option('--resource-type <t>')
+    .option('--resource-id <id>')
+    .option('--actor-id <id>')
+    .option('--from <iso>', 'Start of window (ISO date)')
+    .option('--to <iso>', 'End of window (ISO date)')
+    .option('--limit <n>', 'Max rows', parseInt)
+    .option('--offset <n>', 'Pagination offset', parseInt)
+    .option('--json', 'Output raw JSON')
+    .action((opts) => auditQueryCommand(opts));
+// Regions
+const regions = program.command('regions').description('Multi-region operations');
+regions
+    .command('list')
+    .description('List supported regions')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => regionsListCommand(opts));
+// App Billing (Stripe Connect — plans/products/subscriptions/orders)
+const appBilling = program.command('app-billing').description('Manage app-level Stripe Connect billing (plans/products/subscriptions/orders)');
+const abPlans = appBilling.command('plans').description('Subscription plans');
+abPlans
+    .command('list')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => plansListCommand(opts));
+abPlans
+    .command('create')
+    .requiredOption('--name <name>')
+    .requiredOption('--price-cents <n>', 'Price in cents', parseInt)
+    .requiredOption('--interval <month|year>')
+    .option('--description <desc>')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => plansCreateCommand(opts));
+abPlans
+    .command('update <planId>')
+    .option('--name <name>')
+    .option('--price-cents <n>', 'Price in cents', parseInt)
+    .option('--description <desc>')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((planId, opts) => plansUpdateCommand(planId, opts));
+const abProducts = appBilling.command('products').description('One-time products');
+abProducts
+    .command('list')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => productsListCommand(opts));
+abProducts
+    .command('create')
+    .requiredOption('--name <name>')
+    .requiredOption('--price-cents <n>', 'Price in cents', parseInt)
+    .option('--description <desc>')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => productsCreateCommand(opts));
+abProducts
+    .command('update <productId>')
+    .option('--name <name>')
+    .option('--price-cents <n>', 'Price in cents', parseInt)
+    .option('--description <desc>')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((productId, opts) => productsUpdateCommand(productId, opts));
+appBilling
+    .command('subscribe <planId>')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((planId, opts) => subscribeCommand(planId, opts));
+appBilling
+    .command('subscription')
+    .description('Show the current subscription')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => subscriptionCommand(opts));
+appBilling
+    .command('cancel')
+    .description('Cancel the current subscription')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => cancelCommand(opts));
+appBilling
+    .command('purchase <productId>')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((productId, opts) => purchaseCommand(productId, opts));
+const abOrders = appBilling.command('orders').description('Order history');
+abOrders
+    .command('list')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => ordersListCommand(opts));
+abOrders
+    .command('get <orderId>')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((orderId, opts) => ordersGetCommand(orderId, opts));
+// KV
+const kv = program.command('kv').description('Manage app KV store');
+kv.command('get <key>')
+    .description('Get a value by key')
+    .option('--app <id>', 'App ID (uses current app if not specified)')
+    .option('--raw', 'Return raw value without JSON decoding')
+    .action(kvGetCommand);
+kv.command('set <key> <value>')
+    .description('Set a value')
+    .option('--app <id>', 'App ID (uses current app if not specified)')
+    .option('--ttl <ttl>', 'TTL: 30d, 1h, 60s, "null"/"forever" for no expiry')
+    .option('--ephemeral', 'Mark as ephemeral (not persisted)')
+    .action(kvSetCommand);
+kv.command('del <key>')
+    .description('Delete a key')
+    .option('--app <id>', 'App ID (uses current app if not specified)')
+    .action(kvDelCommand);
+kv.command('ls')
+    .description('List / scan keys')
+    .option('--app <id>', 'App ID (uses current app if not specified)')
+    .option('--prefix <p>', 'Key prefix filter')
+    .option('--limit <n>', 'Maximum keys to return (default 100)')
+    .action(kvLsCommand);
+kv.command('stats')
+    .description('Show KV store statistics')
+    .option('--app <id>', 'App ID (uses current app if not specified)')
+    .action(kvStatsCommand);
+kv.command('flush')
+    .description('Flush all keys (requires --confirm)')
+    .option('--app <id>', 'App ID (uses current app if not specified)')
+    .option('--confirm', 'Required: confirm destructive flush')
+    .option('--include-config', 'Also flush expose rules')
+    .action(kvFlushCommand);
+kv.command('rules')
+    .description('List expose rules')
+    .option('--app <id>', 'App ID (uses current app if not specified)')
+    .action(kvRulesCommand);
+kv.command('expose <pattern>')
+    .description('Create or update an expose rule')
+    .option('--app <id>', 'App ID (uses current app if not specified)')
+    .requiredOption('--read <role>', 'Read role (public|authed|owner|deny)')
+    .requiredOption('--write <role>', 'Write role (public|authed|owner|deny)')
+    .action(kvExposeCommand);
+kv.command('unexpose <pattern>')
+    .description('Remove an expose rule')
+    .option('--app <id>', 'App ID (uses current app if not specified)')
+    .action(kvUnexposeCommand);
+kv.command('apply <file>')
+    .description('Apply KV expose rules from a config file (kv.config.ts)')
+    .option('--app <id>', 'App ID (uses current app if not specified)')
+    .option('--dry-run', 'Preview changes without applying')
+    .option('--yes', 'Skip confirmation prompt')
+    .action((file, opts) => kvApplyCommand({ app: opts.app, file, dryRun: opts.dryRun, yes: opts.yes }));
+// Top-level error handlers for unhandled exceptions / rejections
+process.on('uncaughtException', (err) => {
+    console.error(renderError(err));
+    process.exit(1);
+});
+process.on('unhandledRejection', (err) => {
+    console.error(renderError(err));
+    process.exit(1);
+});
 // Parse arguments
 program.parse();
 //# sourceMappingURL=butterbase.js.map