run402 1.38.0 → 1.40.0

package/lib/functions.mjs

@@ -1,6 +1,7 @@
 import { readFileSync } from "fs";
 import { findProject, API } from "./config.mjs";
-import { setupPaidFetch } from "./paid-fetch.mjs";
+import { getSdk } from "./sdk.mjs";
+import { reportSdkError } from "./sdk-errors.mjs";
 
 const HELP = `run402 functions — Manage serverless functions
 
@@ -128,7 +129,6 @@ Examples:
 };
 
 async function deploy(projectId, name, args) {
-  const p = findProject(projectId);
   const opts = { file: null, timeout: undefined, memory: undefined, deps: undefined, schedule: undefined };
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--file" && args[i + 1]) opts.file = args[++i];
@@ -139,47 +139,48 @@ async function deploy(projectId, name, args) {
   }
   if (!opts.file) { console.error(JSON.stringify({ status: "error", message: "Missing --file <file>" })); process.exit(1); }
   const code = readFileSync(opts.file, "utf-8");
-  const body = { name, code };
-  if (opts.timeout || opts.memory) body.config = {};
-  if (opts.timeout) body.config.timeout = opts.timeout;
-  if (opts.memory) body.config.memory = opts.memory;
-  if (opts.deps) body.deps = opts.deps;
-  if (opts.schedule !== undefined) body.schedule = opts.schedule === "" ? null : opts.schedule;
-
-  const fetchPaid = await setupPaidFetch();
-  const res = await fetchPaid(`${API}/projects/v1/admin/${projectId}/functions`, {
-    method: "POST",
-    headers: { "Authorization": `Bearer ${p.service_key}`, "Content-Type": "application/json" },
-    body: JSON.stringify(body),
-  });
-  const data = await res.json();
-  if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
-  console.log(JSON.stringify(data, null, 2));
+
+  const deployOpts = { name, code };
+  if (opts.timeout !== undefined || opts.memory !== undefined) {
+    deployOpts.config = {};
+    if (opts.timeout !== undefined) deployOpts.config.timeout = opts.timeout;
+    if (opts.memory !== undefined) deployOpts.config.memory = opts.memory;
+  }
+  if (opts.deps !== undefined) deployOpts.deps = opts.deps;
+  if (opts.schedule !== undefined) deployOpts.schedule = opts.schedule === "" ? null : opts.schedule;
+
+  try {
+    const data = await getSdk().functions.deploy(projectId, deployOpts);
+    console.log(JSON.stringify(data, null, 2));
+  } catch (err) {
+    reportSdkError(err);
+  }
 }
 
 async function invoke(projectId, name, args) {
-  const p = findProject(projectId);
   const opts = { method: "POST", body: undefined };
   for (let i = 0; i < args.length; i++) {
     if (args[i] === "--method" && args[i + 1]) opts.method = args[++i];
     if (args[i] === "--body" && args[i + 1]) opts.body = args[++i];
   }
-  const fetchOpts = {
-    method: opts.method,
-    headers: { "apikey": p.service_key },
-  };
-  if (opts.body && opts.method !== "GET" && opts.method !== "HEAD") {
-    fetchOpts.headers["Content-Type"] = "application/json";
-    fetchOpts.body = opts.body;
+  const invokeOpts = { method: opts.method };
+  if (opts.body !== undefined && opts.method !== "GET" && opts.method !== "HEAD") {
+    invokeOpts.body = opts.body;
+  }
+  try {
+    const result = await getSdk().functions.invoke(projectId, name, invokeOpts);
+    const body = result.body;
+    if (typeof body === "string") {
+      process.stdout.write(body + "\n");
+    } else {
+      console.log(JSON.stringify(body, null, 2));
+    }
+  } catch (err) {
+    reportSdkError(err);
   }
-  const res = await fetch(`${API}/functions/v1/${name}`, fetchOpts);
-  const text = await res.text();
-  if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, body: text })); process.exit(1); }
-  try { console.log(JSON.stringify(JSON.parse(text), null, 2)); } catch { process.stdout.write(text + "\n"); }
 }
 
 async function logs(projectId, name, args) {
-  const p = findProject(projectId);
   let tail = 50;
   let since = undefined;
   let follow = false;
@@ -189,21 +190,28 @@ async function logs(projectId, name, args) {
     if (args[i] === "--follow") follow = true;
   }
 
-  // Parse since: accept ISO string or epoch ms
-  let sinceMs = undefined;
+  // Parse since: accept ISO string or epoch ms — keep CLI-side validation
+  // so a bad `--since` errors with a clear message rather than silently
+  // being dropped by the SDK.
+  let sinceIso = undefined;
   if (since !== undefined) {
     const parsed = Number(since);
-    sinceMs = Number.isNaN(parsed) ? new Date(since).getTime() : parsed;
-    if (Number.isNaN(sinceMs)) { console.error(JSON.stringify({ status: "error", message: `Invalid --since value: ${since}` })); process.exit(1); }
+    const ms = Number.isNaN(parsed) ? new Date(since).getTime() : parsed;
+    if (Number.isNaN(ms)) { console.error(JSON.stringify({ status: "error", message: `Invalid --since value: ${since}` })); process.exit(1); }
+    sinceIso = new Date(ms).toISOString();
   }
 
   const fetchLogs = async () => {
-    let url = `${API}/projects/v1/admin/${projectId}/functions/${encodeURIComponent(name)}/logs?tail=${tail}`;
-    if (sinceMs !== undefined) url += `&since=${sinceMs}`;
-    const res = await fetch(url, { headers: { "Authorization": `Bearer ${p.service_key}` } });
-    const data = await res.json();
-    if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
-    return data.logs || [];
+    try {
+      const data = await getSdk().functions.logs(projectId, name, {
+        tail,
+        since: sinceIso,
+      });
+      return data.logs || [];
+    } catch (err) {
+      reportSdkError(err);
+      return [];
+    }
   };
 
   if (!follow) {
@@ -212,17 +220,16 @@ async function logs(projectId, name, args) {
     return;
   }
 
-  // Follow mode: poll every 3s, print new entries
+  // Follow mode: poll every 3s, print new entries.
   let running = true;
   process.on("SIGINT", () => { running = false; });
 
-  // Initial fetch
   const initial = await fetchLogs();
   for (const entry of initial) {
     console.log(`[${entry.timestamp}] ${entry.message}`);
   }
   if (initial.length > 0) {
-    sinceMs = new Date(initial[initial.length - 1].timestamp).getTime() + 1;
+    sinceIso = new Date(new Date(initial[initial.length - 1].timestamp).getTime() + 1).toISOString();
   }
 
   while (running) {
@@ -233,13 +240,12 @@ async function logs(projectId, name, args) {
       console.log(`[${entry.timestamp}] ${entry.message}`);
     }
     if (entries.length > 0) {
-      sinceMs = new Date(entries[entries.length - 1].timestamp).getTime() + 1;
+      sinceIso = new Date(new Date(entries[entries.length - 1].timestamp).getTime() + 1).toISOString();
     }
   }
 }
 
 async function update(projectId, name, args) {
-  const p = findProject(projectId);
   let schedule = undefined;
   let scheduleRemove = false;
   let timeout = undefined;
@@ -250,52 +256,44 @@ async function update(projectId, name, args) {
     if (args[i] === "--timeout" && args[i + 1]) timeout = parseInt(args[++i]);
     if (args[i] === "--memory" && args[i + 1]) memory = parseInt(args[++i]);
   }
-  const body = {};
+
+  const updateOpts = {};
   if (scheduleRemove || schedule === "") {
-    body.schedule = null;
+    updateOpts.schedule = null;
   } else if (schedule !== undefined) {
-    body.schedule = schedule;
-  }
-  if (timeout !== undefined || memory !== undefined) {
-    body.config = {};
-    if (timeout !== undefined) body.config.timeout = timeout;
-    if (memory !== undefined) body.config.memory = memory;
+    updateOpts.schedule = schedule;
   }
-  if (Object.keys(body).length === 0) {
+  if (timeout !== undefined) updateOpts.timeout = timeout;
+  if (memory !== undefined) updateOpts.memory = memory;
+
+  if (Object.keys(updateOpts).length === 0) {
     console.error(JSON.stringify({ status: "error", message: "Provide at least one of: --schedule, --schedule-remove, --timeout, --memory" }));
     process.exit(1);
   }
-  const res = await fetch(`${API}/projects/v1/admin/${projectId}/functions/${encodeURIComponent(name)}`, {
-    method: "PATCH",
-    headers: { "Authorization": `Bearer ${p.service_key}`, "Content-Type": "application/json" },
-    body: JSON.stringify(body),
-  });
-  const data = await res.json();
-  if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
-  console.log(JSON.stringify(data, null, 2));
+
+  try {
+    const data = await getSdk().functions.update(projectId, name, updateOpts);
+    console.log(JSON.stringify(data, null, 2));
+  } catch (err) {
+    reportSdkError(err);
+  }
 }
 
 async function list(projectId) {
-  const p = findProject(projectId);
-  const res = await fetch(`${API}/projects/v1/admin/${projectId}/functions`, {
-    headers: { "Authorization": `Bearer ${p.service_key}` },
-  });
-  const data = await res.json();
-  if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
-  console.log(JSON.stringify(data, null, 2));
+  try {
+    const data = await getSdk().functions.list(projectId);
+    console.log(JSON.stringify(data, null, 2));
+  } catch (err) {
+    reportSdkError(err);
+  }
 }
 
 async function deleteFunction(projectId, name) {
-  const p = findProject(projectId);
-  const res = await fetch(`${API}/projects/v1/admin/${projectId}/functions/${encodeURIComponent(name)}`, {
-    method: "DELETE",
-    headers: { "Authorization": `Bearer ${p.service_key}` },
-  });
-  if (res.status === 204 || res.ok) {
+  try {
+    await getSdk().functions.delete(projectId, name);
     console.log(JSON.stringify({ status: "ok", message: `Function '${name}' deleted.` }));
-  } else {
-    const data = await res.json().catch(() => ({}));
-    console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1);
+  } catch (err) {
+    reportSdkError(err);
   }
 }
 

package/lib/image.mjs

@@ -1,6 +1,6 @@
 import { writeFileSync } from "fs";
-import { API, ALLOWANCE_FILE } from "./config.mjs";
-import { setupPaidFetch } from "./paid-fetch.mjs";
+import { getSdk } from "./sdk.mjs";
+import { reportSdkError } from "./sdk-errors.mjs";
 
 const HELP = `run402 image — Generate AI images via x402 micropayments
 
@@ -51,17 +51,16 @@ export async function run(sub, args) {
 
   if (!opts.prompt) { console.error(JSON.stringify({ status: "error", message: "Prompt required. Usage: run402 image generate \"your prompt\"" })); process.exit(1); }
 
-  const fetchPaid = await setupPaidFetch();
-
-  const res = await fetchPaid(`${API}/generate-image/v1`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ prompt: opts.prompt, aspect: opts.aspect }) });
-  const data = await res.json();
-  if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
-
-  if (opts.output) {
-    const buf = Buffer.from(data.image, "base64");
-    writeFileSync(opts.output, buf);
-    console.log(JSON.stringify({ status: "ok", file: opts.output, size: buf.length, aspect: data.aspect }));
-  } else {
-    console.log(JSON.stringify({ status: "ok", aspect: data.aspect, content_type: data.content_type, image: data.image }));
+  try {
+    const data = await getSdk().ai.generateImage({ prompt: opts.prompt, aspect: opts.aspect });
+    if (opts.output) {
+      const buf = Buffer.from(data.image, "base64");
+      writeFileSync(opts.output, buf);
+      console.log(JSON.stringify({ status: "ok", file: opts.output, size: buf.length, aspect: data.aspect }));
+    } else {
+      console.log(JSON.stringify({ status: "ok", aspect: data.aspect, content_type: data.content_type, image: data.image }));
+    }
+  } catch (err) {
+    reportSdkError(err);
   }
 }

package/lib/message.mjs

@@ -1,4 +1,6 @@
-import { API, allowanceAuthHeaders } from "./config.mjs";
+import { allowanceAuthHeaders } from "./config.mjs";
+import { getSdk } from "./sdk.mjs";
+import { reportSdkError } from "./sdk-errors.mjs";
 
 const HELP = `run402 message — Send messages to Run402 developers
 
@@ -15,16 +17,15 @@ Examples:
 
 async function send(text) {
   if (!text) { console.error(JSON.stringify({ status: "error", message: "Missing message text" })); process.exit(1); }
-  const authHeaders = allowanceAuthHeaders("/message/v1");
+  // Preserve the aggressive early exit when no allowance is configured.
+  allowanceAuthHeaders("/message/v1");
 
-  const res = await fetch(`${API}/message/v1`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", ...authHeaders },
-    body: JSON.stringify({ message: text }),
-  });
-  const data = await res.json();
-  if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
-  console.log(JSON.stringify(data, null, 2));
+  try {
+    await getSdk().admin.sendMessage(text);
+    console.log(JSON.stringify({ status: "ok", message: "Message sent to Run402 developers." }));
+  } catch (err) {
+    reportSdkError(err);
+  }
 }
 
 export async function run(sub, args) {

package/lib/projects.mjs

@@ -1,5 +1,7 @@
 import { readFileSync } from "fs";
-import { findProject, loadKeyStore, saveProject, removeProject, API, allowanceAuthHeaders, setActiveProjectId, getActiveProjectId, resolveProjectId } from "./config.mjs";
+import { findProject, loadKeyStore, API, allowanceAuthHeaders, resolveProjectId } from "./config.mjs";
+import { getSdk } from "./sdk.mjs";
+import { reportSdkError } from "./sdk-errors.mjs";
 
 const HELP = `run402 projects — Manage your deployed Run402 projects
 
@@ -17,7 +19,10 @@ Subcommands:
   rest  [id] <table> [params]             Query a table via the REST API (PostgREST)
   usage [id]                              Show compute/storage usage for a project
   schema [id]                             Inspect the database schema
-  rls   [id] <template> <tables_json>     Apply Row-Level Security policies
+  rls   [id] <template> <tables_json>     ⚠ DEPRECATED (sunset 2026-05-23) - use 'apply-expose' instead
+  apply-expose [id] <manifest_json>       Apply a declarative authorization manifest (supersedes 'rls')
+  apply-expose [id] --file <path>         Apply a manifest from a JSON file
+  get-expose   [id]                       Get the current authorization manifest
   delete [id]                             Immediately and irreversibly delete a project (cascade purge) and remove from local state
   pin   [id]                              Pin a project (prevents expiry/GC)
   promote-user [id] <email>               Promote a user to project_admin role
@@ -37,6 +42,8 @@ Examples:
   run402 projects usage abc123
   run402 projects schema abc123
   run402 projects rls abc123 public_read_authenticated_write '[{"table":"posts"}]'
+  run402 projects apply-expose abc123 --file manifest.json
+  run402 projects get-expose abc123
   run402 projects keys abc123
   run402 projects delete abc123
 
@@ -52,6 +59,14 @@ Notes:
       public_read_authenticated_write   anyone reads; any authenticated user writes any row
       public_read_write_UNRESTRICTED    fully open (anon_key writes); use 'run402 deploy' with a manifest
                                         that includes "i_understand_this_is_unrestricted": true
+  - 'rls' is deprecated (sunset 2026-05-23) — migrate to 'apply-expose'.
+    The expose manifest declares the full authorization surface (tables, views,
+    RPCs) in one convergent call. Tables not listed with expose:true are dark
+    by default. Sample manifest:
+      {"version":"1",
+       "tables":[{"name":"posts","expose":true,"policy":"user_owns_rows","owner_column":"user_id","force_owner_on_insert":true}],
+       "views":[],
+       "rpcs":[]}
 `;
 
 const SUB_HELP = {
@@ -97,10 +112,12 @@ Examples:
 };
 
 async function quote() {
-  const res = await fetch(`${API}/tiers/v1`);
-  const data = await res.json();
-  if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
-  console.log(JSON.stringify(data, null, 2));
+  try {
+    const data = await getSdk().projects.getQuote();
+    console.log(JSON.stringify(data, null, 2));
+  } catch (err) {
+    reportSdkError(err);
+  }
 }
 
 async function provision(args) {
@@ -109,60 +126,64 @@ async function provision(args) {
     if (args[i] === "--tier" && args[i + 1]) opts.tier = args[++i];
     if (args[i] === "--name" && args[i + 1]) opts.name = args[++i];
   }
-  const authHeaders = allowanceAuthHeaders("/projects/v1");
-  const body = { tier: opts.tier };
-  if (opts.name) body.name = opts.name;
-  const res = await fetch(`${API}/projects/v1`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", ...authHeaders },
-    body: JSON.stringify(body),
-  });
-  // Content-type aware parsing: gateways (ALB, CloudFront, etc.) return HTML on
-  // 502/504/etc., which would otherwise crash res.json() with SyntaxError (GH-84).
-  const contentType = res.headers.get("content-type") || "";
-  let data = null;
-  let parseError = null;
-  let bodyText = null;
-  if (contentType.includes("application/json")) {
-    try {
-      data = await res.json();
-    } catch (e) {
-      parseError = e;
-      try { bodyText = await res.text(); } catch { bodyText = ""; }
-    }
-  } else {
-    try { bodyText = await res.text(); } catch { bodyText = ""; }
+  // Preserve the aggressive early exit when no allowance is configured —
+  // gives the user a more specific prompt than the SDK's 401/402 path.
+  allowanceAuthHeaders("/projects/v1");
+
+  try {
+    const data = await getSdk().projects.provision({ tier: opts.tier, name: opts.name });
+    console.log(JSON.stringify(data, null, 2));
+  } catch (err) {
+    reportSdkError(err);
   }
-  if (!res.ok || parseError || data === null) {
-    const err = { status: "error", http: res.status, content_type: contentType || null };
-    if (data && typeof data === "object") {
-      Object.assign(err, data);
-    } else {
-      const preview = typeof bodyText === "string" ? bodyText.slice(0, 500) : "";
-      err.body_preview = preview;
-      if (parseError) err.parse_error = "response body was not valid JSON";
-    }
-    console.error(JSON.stringify(err));
+}
+
+async function rls(projectId, template, tablesJson) {
+  let tables;
+  try {
+    tables = JSON.parse(tablesJson);
+  } catch {
+    console.error(JSON.stringify({ status: "error", message: "Invalid JSON for tables argument" }));
     process.exit(1);
   }
-  // Save project credentials locally and set as active
-  if (data.project_id) {
-    saveProject(data.project_id, {
-      anon_key: data.anon_key, service_key: data.service_key,
-      deployed_at: new Date().toISOString(),
-    });
-    setActiveProjectId(data.project_id);
+  try {
+    const data = await getSdk().projects.setupRls(projectId, { template, tables });
+    console.log(JSON.stringify(data, null, 2));
+  } catch (err) {
+    reportSdkError(err);
   }
-  console.log(JSON.stringify(data, null, 2));
 }
 
-async function rls(projectId, template, tablesJson) {
+async function applyExpose(projectId, args = []) {
   const p = findProject(projectId);
-  const tables = JSON.parse(tablesJson);
-  const res = await fetch(`${API}/projects/v1/admin/${projectId}/rls`, {
+  let file = null;
+  let inline = null;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === "--file" && args[i + 1]) { file = args[++i]; }
+    else if (!inline && !args[i].startsWith("--")) { inline = args[i]; }
+  }
+  const raw = file ? readFileSync(file, "utf-8") : inline;
+  if (!raw) {
+    console.error(JSON.stringify({ status: "error", message: "Missing manifest. Provide inline JSON or use --file <path>" }));
+    process.exit(1);
+  }
+  let manifest;
+  try { manifest = JSON.parse(raw); }
+  catch { console.error(JSON.stringify({ status: "error", message: "Invalid JSON for manifest" })); process.exit(1); }
+  const res = await fetch(`${API}/projects/v1/admin/${projectId}/expose`, {
     method: "POST",
     headers: { "Authorization": `Bearer ${p.service_key}`, "Content-Type": "application/json" },
-    body: JSON.stringify({ template, tables }),
+    body: JSON.stringify(manifest),
+  });
+  const data = await res.json();
+  if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
+  console.log(JSON.stringify(data, null, 2));
+}
+
+async function getExpose(projectId) {
+  const p = findProject(projectId);
+  const res = await fetch(`${API}/projects/v1/admin/${projectId}/expose`, {
+    headers: { "Authorization": `Bearer ${p.service_key}` },
   });
   const data = await res.json();
   if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
@@ -178,20 +199,28 @@ async function list() {
 }
 
 async function info(projectId) {
-  const p = findProject(projectId);
-  console.log(JSON.stringify({
-    project_id: projectId,
-    rest_url: `${API}/rest/v1`,
-    anon_key: p.anon_key,
-    service_key: p.service_key,
-    site_url: p.site_url || null,
-    deployed_at: p.deployed_at || null,
-  }, null, 2));
+  try {
+    const data = await getSdk().projects.info(projectId);
+    console.log(JSON.stringify({
+      project_id: projectId,
+      rest_url: `${API}/rest/v1`,
+      anon_key: data.anon_key,
+      service_key: data.service_key,
+      site_url: data.site_url || null,
+      deployed_at: data.deployed_at || null,
+    }, null, 2));
+  } catch (err) {
+    reportSdkError(err);
+  }
 }
 
 async function keys(projectId) {
-  const p = findProject(projectId);
-  console.log(JSON.stringify({ project_id: projectId, anon_key: p.anon_key, service_key: p.service_key }, null, 2));
+  try {
+    const data = await getSdk().projects.keys(projectId);
+    console.log(JSON.stringify({ project_id: projectId, anon_key: data.anon_key, service_key: data.service_key }, null, 2));
+  } catch (err) {
+    reportSdkError(err);
+  }
 }
 
 async function sqlCmd(projectId, args = []) {
@@ -229,38 +258,41 @@ async function rest(projectId, table, queryParams) {
 }
 
 async function usage(projectId) {
-  const p = findProject(projectId);
-  const res = await fetch(`${API}/projects/v1/admin/${projectId}/usage`, { headers: { "Authorization": `Bearer ${p.service_key}` } });
-  const data = await res.json();
-  if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
-  console.log(JSON.stringify(data, null, 2));
+  try {
+    const data = await getSdk().projects.getUsage(projectId);
+    console.log(JSON.stringify(data, null, 2));
+  } catch (err) {
+    reportSdkError(err);
+  }
 }
 
 async function schema(projectId) {
-  const p = findProject(projectId);
-  const res = await fetch(`${API}/projects/v1/admin/${projectId}/schema`, { headers: { "Authorization": `Bearer ${p.service_key}` } });
-  const data = await res.json();
-  if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
-  console.log(JSON.stringify(data, null, 2));
+  try {
+    const data = await getSdk().projects.getSchema(projectId);
+    console.log(JSON.stringify(data, null, 2));
+  } catch (err) {
+    reportSdkError(err);
+  }
 }
 
 async function use(projectId) {
   if (!projectId) { console.error("Usage: run402 projects use <project_id>"); process.exit(1); }
-  findProject(projectId); // verify it exists
-  setActiveProjectId(projectId);
-  console.log(JSON.stringify({ status: "ok", active_project_id: projectId }));
+  try {
+    await getSdk().projects.use(projectId);
+    console.log(JSON.stringify({ status: "ok", active_project_id: projectId }));
+  } catch (err) {
+    reportSdkError(err);
+  }
 }
 
 async function pin(projectId) {
   if (!projectId) { console.error(JSON.stringify({ status: "error", message: "Usage: run402 projects pin <project_id>" })); process.exit(1); }
-  const p = findProject(projectId);
-  const res = await fetch(`${API}/projects/v1/admin/${projectId}/pin`, {
-    method: "POST",
-    headers: { "Authorization": `Bearer ${p.service_key}` },
-  });
-  const data = await res.json();
-  if (!res.ok) { console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1); }
-  console.log(JSON.stringify(data, null, 2));
+  try {
+    const data = await getSdk().projects.pin(projectId);
+    console.log(JSON.stringify(data, null, 2));
+  } catch (err) {
+    reportSdkError(err);
+  }
 }
 
 async function promoteUser(projectId, email) {
@@ -290,14 +322,11 @@ async function demoteUser(projectId, email) {
 }
 
 async function deleteProject(projectId) {
-  const p = findProject(projectId);
-  const res = await fetch(`${API}/projects/v1/${projectId}`, { method: "DELETE", headers: { "Authorization": `Bearer ${p.service_key}` } });
-  if (res.status === 204 || res.ok) {
-    removeProject(projectId);
+  try {
+    await getSdk().projects.delete(projectId);
     console.log(JSON.stringify({ status: "ok", message: `Project ${projectId} deleted.` }));
-  } else {
-    const data = await res.json().catch(() => ({}));
-    console.error(JSON.stringify({ status: "error", http: res.status, ...data })); process.exit(1);
+  } catch (err) {
+    reportSdkError(err);
   }
 }
 
@@ -335,6 +364,8 @@ export async function run(sub, args) {
     case "usage":     { const { projectId } = resolvePositionalProject(args); await usage(projectId); break; }
     case "schema":    { const { projectId } = resolvePositionalProject(args); await schema(projectId); break; }
     case "rls":       { const { projectId, rest } = resolvePositionalProject(args); await rls(projectId, rest[0], rest[1]); break; }
+    case "apply-expose": { const { projectId, rest } = resolvePositionalProject(args); await applyExpose(projectId, rest); break; }
+    case "get-expose":   { const { projectId } = resolvePositionalProject(args); await getExpose(projectId); break; }
     case "delete":    { const { projectId } = resolvePositionalProject(args); await deleteProject(projectId); break; }
     case "pin":       { const { projectId } = resolvePositionalProject(args); await pin(projectId); break; }
     case "promote-user": { const { projectId, rest } = resolvePositionalProject(args); await promoteUser(projectId, rest[0]); break; }