@butterbase/cli 0.2.1 → 0.3.2

package/README.md

@@ -139,6 +139,108 @@ butterbase storage upload ./image.png
 butterbase storage delete obj_abc123
 ```
 
+### AI
+
+```bash
+butterbase ai chat "Summarize this" --model openai/gpt-4o-mini
+butterbase ai chat "Explain RAG" --system "You're a concise teacher." --temperature 0.2
+butterbase ai embed "hello world" "another doc"
+butterbase ai models
+butterbase ai config get
+butterbase ai config set --default-model openai/gpt-4o-mini --max-tokens-per-request 4000
+butterbase ai config set --byok-key sk-or-...           # rotate BYOK key; "" to clear
+butterbase ai usage --start-date 2026-05-01 --end-date 2026-05-31
+```
+
+### OAuth (admin)
+
+```bash
+butterbase oauth configure google \
+  --client-id ... --client-secret ... \
+  --redirect-uri https://app.example/cb \
+  --scope openid --scope email
+butterbase oauth list
+butterbase oauth get google
+butterbase oauth update google --enabled false
+butterbase oauth delete google
+```
+
+### Audit logs
+
+```bash
+butterbase audit query --category auth --event-type login --limit 50
+butterbase audit query --from 2026-05-01 --to 2026-05-31 --action create --resource-type user
+butterbase audit query --actor-id user_123 --json
+```
+
+### App config (server-side)
+
+```bash
+butterbase apps config get
+butterbase apps config cors --allowed-origin https://app.example --allow-credentials true
+butterbase apps config jwt --access-token-ttl 15m --refresh-token-ttl-days 30
+butterbase apps config storage --public-read true --max-file-size-mb 25 --allowed-content-type image/png --allowed-content-type image/jpeg
+butterbase apps config access-mode authenticated
+butterbase apps config secure --table posts --table comments --user-column author_id --access-mode authenticated
+```
+
+### Regions + multi-region moves
+
+```bash
+butterbase regions list
+butterbase apps move app_abc us-west-2 --follow
+butterbase apps migrations active                 # current app
+butterbase apps migrations status app_abc m_xyz
+butterbase apps migrations abort app_abc m_xyz     # before cutover
+butterbase apps migrations reverse app_abc m_xyz   # after cutover
+butterbase apps replicas list
+butterbase apps replicas teardown m_xyz
+```
+
+### App-level billing (Stripe Connect)
+
+```bash
+butterbase app-billing plans list
+butterbase app-billing plans create --name pro --price-cents 1999 --interval month
+butterbase app-billing plans update plan_abc --price-cents 2499
+butterbase app-billing products list
+butterbase app-billing products create --name "Lifetime access" --price-cents 9900
+butterbase app-billing subscribe plan_abc
+butterbase app-billing subscription
+butterbase app-billing cancel
+butterbase app-billing purchase prod_xyz
+butterbase app-billing orders list
+butterbase app-billing orders get order_abc
+```
+
+### Scoped API keys + integrations
+
+```bash
+butterbase keys generate ci-key --scope schema:read --scope functions:invoke
+butterbase integrations configure github --scope repo --scope read:user
+butterbase integrations connect github --redirect-url https://app.example/cb --scope repo
+```
+
+### Functions deploy (full options)
+
+```bash
+butterbase functions deploy fn.ts \
+  --name my-fn \
+  --trigger cron --trigger-config '{"schedule":"*/5 * * * *"}' \
+  --env API_KEY=sk_... --env DEBUG=true \
+  --timeout-ms 9000 --memory-mb 256
+```
+
+### RLS
+
+```bash
+butterbase rls create --table posts --policy-name posts_own \
+  --command SELECT --using "author_id = auth.uid()" \
+  --role user --restrictive
+butterbase rls delete posts                 # delete all policies on table
+butterbase rls delete posts --policy posts_own
+```
+
 ## Global Options
 
 Most commands support the `--app` flag to specify an app ID:
@@ -284,6 +386,22 @@ butterbase integrations tools gmail --app app_abc123
 butterbase integrations execute GMAIL_SEND_EMAIL --data '{"to":"x@y.com","subject":"Hi","body":"Hello"}' --app app_abc123
 ```
 
+## Error output
+
+The CLI throws typed `ButterbaseError`s from `@butterbase/sdk`. The top-level
+handler renders the class name, message, and the structured fields the backend
+returned (`code`, `status`, `remediation`). Example for an unauthenticated call:
+
+```
+AuthError: Invalid API key
+  code:        AUTH_INVALID_API_KEY
+  status:      401
+  remediation: Rotate the key with `butterbase keys generate` and update ~/.butterbase/config.json.
+```
+
+The error codes come from `@butterbase/shared`'s `ErrorCodes` namespace — see
+the SDK README for the full list.
+
 ## License
 
 MIT

package/dist/bin/butterbase.js

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
+import { renderError } from '../src/lib/errors.js';
 import { initCommand } from '../src/commands/init.js';
 import { loginCommand, logoutCommand, configGetCommand, configSetCommand } from '../src/commands/config.js';
 import { appsListCommand, appsCreateCommand, appsUseCommand, appsDeleteCommand, appsPauseCommand, appsResumeCommand } from '../src/commands/apps.js';
 import { schemaGetCommand, schemaApplyCommand } from '../src/commands/schema.js';
-import { functionsListCommand, functionsDeployCommand, functionsLogsCommand, functionsDeleteCommand } from '../src/commands/functions.js';
+import { functionsListCommand, functionsDeployCommand, functionsLogsCommand, functionsDeleteCommand, functionsInvokeCommand, functionsEnvSetCommand, functionsEnvListCommand } from '../src/commands/functions.js';
 import { storageListCommand, storageUploadCommand, storageDeleteCommand, storageConfigCommand } from '../src/commands/storage.js';
 import { realtimeEnableCommand, realtimeConfigCommand, realtimeDisableCommand } from '../src/commands/realtime.js';
 import { deployCommand } from '../src/commands/deploy.js';
@@ -20,7 +21,17 @@ import { pluginSetupCommand } from '../src/commands/plugin.js';
 import { integrationsListCommand, integrationsConfigCommand, integrationsConfigureCommand, integrationsDisableCommand, integrationsConnectCommand, integrationsConnectionsCommand, integrationsDisconnectCommand, integrationsToolsCommand, integrationsExecuteCommand, } from '../src/commands/integrations.js';
 import { domainsListCommand, domainsAddCommand, domainsStatusCommand, domainsVerifyCommand, domainsDeleteCommand, } from '../src/commands/domains.js';
 import { partnersListCommand, partnersCurlCommand } from '../src/commands/partners.js';
+import { rlsListCommand, rlsCreateCommand, rlsEnableCommand, rlsDeleteCommand } from '../src/commands/rls.js';
+import { billingStatusCommand, billingPortalCommand, billingTopupCommand, billingCapGetCommand, billingCapRaiseCommand, billingPlansCommand, billingUsageCommand, } from '../src/commands/billing.js';
+import { ragCollectionsListCommand, ragCollectionsCreateCommand, ragCollectionsGetCommand, ragCollectionsDeleteCommand, ragIngestCommand, ragDocsListCommand, ragDocsDeleteCommand, ragQueryCommand, } from '../src/commands/rag.js';
 import { doDeployCommand, doListCommand, doGetCommand, doDeleteCommand, doUsageCommand, doEnvListCommand, doEnvSetCommand, doEnvUnsetCommand, } from '../src/commands/do.js';
+import { aiChatCommand, aiEmbedCommand, aiModelsCommand, aiConfigGetCommand, aiConfigSetCommand, aiUsageCommand, } from '../src/commands/ai.js';
+import { oauthConfigureCommand, oauthListCommand, oauthGetCommand, oauthUpdateCommand, oauthDeleteCommand, } from '../src/commands/oauth.js';
+import { auditQueryCommand } from '../src/commands/audit.js';
+import { appConfigGetCommand, appCorsCommand, appJwtCommand, appStorageCommand, appAccessModeCommand, appSecureCommand, } from '../src/commands/app-config.js';
+import { regionsListCommand } from '../src/commands/regions.js';
+import { moveCommand, migrationStatusCommand, migrationActiveCommand, migrationAbortCommand, migrationReverseCommand, replicasListCommand, replicaTeardownCommand, } from '../src/commands/move.js';
+import { plansListCommand, plansCreateCommand, plansUpdateCommand, productsListCommand, productsCreateCommand, productsUpdateCommand, subscribeCommand, subscriptionCommand, cancelCommand, purchaseCommand, ordersListCommand, ordersGetCommand, } from '../src/commands/app-billing.js';
 const program = new Command();
 program
     .name('butterbase')
@@ -77,6 +88,94 @@ apps
     .command('resume [app-id]')
     .description('Resume a paused app — restore data-plane traffic')
     .action(appsResumeCommand);
+const appsConfig = apps.command('config').description('Read or update the app\'s server-side config');
+appsConfig
+    .command('get')
+    .description('Show the app\'s full config')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => appConfigGetCommand(opts));
+appsConfig
+    .command('cors')
+    .description('Update CORS config')
+    .option('--app <appId>', 'Override current app')
+    .option('--allowed-origin <origin>', 'Allowed origin (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--allowed-method <method>', 'Allowed method (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--allowed-header <header>', 'Allowed header (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--allow-credentials <bool>', '(true|false)', (v) => v === 'true')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => appCorsCommand(opts));
+appsConfig
+    .command('jwt')
+    .description('Update JWT TTLs')
+    .option('--app <appId>', 'Override current app')
+    .option('--access-token-ttl <duration>', 'e.g. "15m", "1h"')
+    .option('--refresh-token-ttl-days <n>', 'Refresh token lifetime in days', parseInt)
+    .option('--json', 'Output raw JSON')
+    .action((opts) => appJwtCommand(opts));
+appsConfig
+    .command('storage')
+    .description('Update storage config')
+    .option('--app <appId>', 'Override current app')
+    .option('--public-read <bool>', 'Public-read default (true|false)', (v) => v === 'true')
+    .option('--max-file-size-mb <n>', 'Per-file size cap in MB', parseInt)
+    .option('--allowed-content-type <ct>', 'Allowed content-type (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--json', 'Output raw JSON')
+    .action((opts) => appStorageCommand(opts));
+appsConfig
+    .command('access-mode <mode>')
+    .description('Set access mode: public | authenticated')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((mode, opts) => appAccessModeCommand(mode, opts));
+appsConfig
+    .command('secure')
+    .description('Enable RLS + access-mode in one shot')
+    .option('--app <appId>', 'Override current app')
+    .option('--table <name>', 'Table to secure (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--user-column <col>', 'User-id column name (default: user_id)')
+    .option('--access-mode <mode>', 'public | authenticated')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => appSecureCommand(opts));
+apps
+    .command('move <appId> <destRegion>')
+    .description('Migrate an app to another region')
+    .option('--follow', 'Poll status until terminal')
+    .option('--json', 'Output raw JSON')
+    .action((appId, destRegion, opts) => moveCommand(appId, destRegion, opts));
+const appsMigrations = apps.command('migrations').description('Read or control in-flight migrations');
+appsMigrations
+    .command('status <appId> <migrationId>')
+    .description('Get status of a specific migration')
+    .option('--json', 'Output raw JSON')
+    .action((appId, migrationId, opts) => migrationStatusCommand(appId, migrationId, opts));
+appsMigrations
+    .command('active [appId]')
+    .description('Show the currently-active migration for an app')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((appId, opts) => migrationActiveCommand(appId, opts));
+appsMigrations
+    .command('abort <appId> <migrationId>')
+    .description('Cancel a migration that has not yet reached cutover')
+    .option('--json', 'Output raw JSON')
+    .action((appId, migrationId, opts) => migrationAbortCommand(appId, migrationId, opts));
+appsMigrations
+    .command('reverse <appId> <migrationId>')
+    .description('Roll a completed migration back to source')
+    .option('--json', 'Output raw JSON')
+    .action((appId, migrationId, opts) => migrationReverseCommand(appId, migrationId, opts));
+const appsReplicas = apps.command('replicas').description('Manage retained source replicas after a move');
+appsReplicas
+    .command('list')
+    .description('List active retained source replicas')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => replicasListCommand(opts));
+appsReplicas
+    .command('teardown <migrationId>')
+    .description('Decommission a retained source replica')
+    .option('--json', 'Output raw JSON')
+    .action((migrationId, opts) => replicaTeardownCommand(migrationId, opts));
 // Schema
 const schema = program.command('schema').description('Manage database schema');
 schema
@@ -104,8 +203,12 @@ functions
     .description('Deploy a function')
     .option('--app <app-id>', 'App ID (uses current app if not specified)')
     .option('--name <name>', 'Function name (defaults to filename)')
-    .option('--trigger <type>', 'Trigger type (http, cron)', 'http')
+    .option('--trigger <type>', 'Trigger type (http, cron, s3_upload, webhook, websocket)', 'http')
+    .option('--trigger-config <json>', 'Trigger config as JSON (e.g. \'{"schedule":"*/5 * * * *"}\')')
     .option('--description <desc>', 'Function description')
+    .option('--env <kv>', 'Env var as KEY=value (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--timeout-ms <n>', 'Per-invocation timeout (ms)', parseInt)
+    .option('--memory-mb <n>', 'Memory limit (MB)', parseInt)
     .action(functionsDeployCommand);
 functions
     .command('logs <function-name>')
@@ -120,6 +223,25 @@ functions
     .description('Delete a function')
     .option('--app <app-id>', 'App ID (uses current app if not specified)')
     .action(functionsDeleteCommand);
+functions
+    .command('invoke <function-name>')
+    .description('Invoke a deployed function')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .option('--data <json>', 'Request body as JSON string')
+    .option('--json', 'Output as JSON')
+    .action(functionsInvokeCommand);
+const functionsEnvCmd = functions.command('env').description('Manage function environment variables');
+functionsEnvCmd
+    .command('set <function-name> <vars...>')
+    .description('Set env vars (KEY=VALUE pairs)')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .action(functionsEnvSetCommand);
+functionsEnvCmd
+    .command('list <function-name>')
+    .description('List env var keys (values are write-only)')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .option('--json', 'Output as JSON')
+    .action(functionsEnvListCommand);
 // Storage
 const storage = program.command('storage').description('Manage file storage');
 storage
@@ -265,6 +387,7 @@ const keys = program.command('keys').description('Manage API keys');
 keys
     .command('generate [name]')
     .description('Generate a new API key')
+    .option('--scope <scope>', 'Add a scope (repeatable)', (v, prev) => prev.concat(v), [])
     .option('--json', 'Output as JSON')
     .action(keysGenerateCommand);
 keys
@@ -300,6 +423,7 @@ integrations
     .description('Enable a toolkit for the app')
     .option('--app <app-id>', 'App ID')
     .option('--display-name <name>', 'Human-readable display name')
+    .option('--scope <scope>', 'Add a scope (repeatable)', (v, prev) => prev.concat(v), [])
     .action(integrationsConfigureCommand);
 integrations
     .command('disable <toolkit>')
@@ -312,6 +436,7 @@ integrations
     .option('--app <app-id>', 'App ID')
     .option('--redirect-url <url>', 'URL to redirect after OAuth')
     .option('--user-id <uuid>', 'User ID (for API key auth)')
+    .option('--scope <scope>', 'Add a scope (repeatable)', (v, prev) => prev.concat(v), [])
     .action(integrationsConnectCommand);
 integrations
     .command('connections')
@@ -431,6 +556,353 @@ partners
     .option('-d, --data <body>', 'Request JSON body')
     .option('-x, --execute', 'Execute the curl instead of just printing it')
     .action((slug, path, opts) => partnersCurlCommand(slug, path, opts));
+// RLS
+const rls = program.command('rls').description('Manage Row-Level Security policies');
+rls
+    .command('list')
+    .description('List RLS policies')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .option('--json', 'Output as JSON')
+    .action(rlsListCommand);
+rls
+    .command('create')
+    .description('Create an RLS policy (user-isolation or custom)')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .option('--table <table>', 'Target table name')
+    .option('--user-isolation', 'Enable user-isolation mode (uses --table, --user-column, --public-read-column)')
+    .option('--user-column <col>', 'Column containing the user ID')
+    .option('--public-read-column <col>', 'Boolean column enabling public read override')
+    .option('--policy-name <name>', 'Policy name (custom mode)')
+    .option('--command <cmd>', 'SQL command (SELECT, INSERT, UPDATE, DELETE, ALL)')
+    .option('--using <expr>', 'USING expression')
+    .option('--with-check <expr>', 'WITH CHECK expression')
+    .option('--restrictive', 'Create as RESTRICTIVE policy')
+    .option('--role <role>', 'Restrict to a Postgres role (anon | user)')
+    .option('--json', 'Output as JSON')
+    .action(rlsCreateCommand);
+rls
+    .command('enable <table>')
+    .description('Enable RLS on a table')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .action(rlsEnableCommand);
+rls
+    .command('delete <table>')
+    .description('Delete RLS policies on a table (all by default, or named with --policy)')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .option('--policy <name>', 'Delete only this named policy')
+    .action(rlsDeleteCommand);
+// Billing
+const billing = program.command('billing').description('Manage billing, plans, and spending');
+billing
+    .command('status')
+    .description('Show current plan and billing status')
+    .option('--json', 'Output as JSON')
+    .action(billingStatusCommand);
+billing
+    .command('portal')
+    .description('Print the billing portal URL')
+    .option('--json', 'Output as JSON')
+    .action(billingPortalCommand);
+billing
+    .command('topup <amount>')
+    .description('Add credit balance (amount in USD)')
+    .option('--json', 'Output as JSON')
+    .action(billingTopupCommand);
+billing
+    .command('cap')
+    .description('Show current spending cap')
+    .option('--json', 'Output as JSON')
+    .action(billingCapGetCommand);
+billing
+    .command('cap:raise')
+    .description('Raise the spending cap')
+    .option('--raise-by <amount>', 'Amount in USD to raise the cap by')
+    .option('--json', 'Output as JSON')
+    .action(billingCapRaiseCommand);
+billing
+    .command('plans')
+    .description('List available plans')
+    .option('--json', 'Output as JSON')
+    .action(billingPlansCommand);
+billing
+    .command('usage')
+    .description('Show usage metrics')
+    .option('--start <date>', 'Start date (ISO 8601)')
+    .option('--end <date>', 'End date (ISO 8601)')
+    .option('--meter <type>', 'Filter by meter type')
+    .option('--json', 'Output as JSON')
+    .action(billingUsageCommand);
+// RAG
+const rag = program.command('rag').description('Manage RAG collections and documents');
+const ragCollections = rag.command('collections').description('Manage RAG collections');
+ragCollections
+    .command('list')
+    .description('List RAG collections')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .option('--json', 'Output as JSON')
+    .action(ragCollectionsListCommand);
+ragCollections
+    .command('create <name>')
+    .description('Create a RAG collection')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .option('--description <text>', 'Collection description')
+    .option('--access-mode <mode>', 'Access mode (public, authenticated, service_key)')
+    .option('--chunk-size <n>', 'Chunk size in tokens')
+    .option('--chunk-overlap <n>', 'Chunk overlap in tokens')
+    .option('--json', 'Output as JSON')
+    .action(ragCollectionsCreateCommand);
+ragCollections
+    .command('get <name>')
+    .description('Get a RAG collection')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .option('--json', 'Output as JSON')
+    .action(ragCollectionsGetCommand);
+ragCollections
+    .command('delete <name>')
+    .description('Delete a RAG collection')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .action(ragCollectionsDeleteCommand);
+rag
+    .command('ingest <file-or-text>')
+    .description('Ingest a document or text into a RAG collection')
+    .requiredOption('--collection <name>', 'Target collection name')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .option('--text', 'Treat the argument as raw text instead of a file path')
+    .option('--filename <name>', 'Override the filename stored with the document')
+    .option('--metadata <json>', 'Document metadata as JSON string')
+    .option('--json', 'Output as JSON')
+    .action(ragIngestCommand);
+const ragDocs = rag.command('docs').description('Manage RAG documents');
+ragDocs
+    .command('list <collection>')
+    .description('List documents in a RAG collection')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .option('--json', 'Output as JSON')
+    .action(ragDocsListCommand);
+ragDocs
+    .command('delete <collection> <doc-id>')
+    .description('Delete a document from a RAG collection')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .action(ragDocsDeleteCommand);
+rag
+    .command('query <collection>')
+    .description('Query a RAG collection')
+    .option('--app <app-id>', 'App ID (uses current app if not specified)')
+    .requiredOption('-q, --query <text>', 'Query string')
+    .option('--top-k <n>', 'Number of results to return')
+    .option('--threshold <n>', 'Minimum similarity threshold')
+    .option('--synthesize', 'Synthesize an answer from retrieved chunks')
+    .option('--model <model>', 'LLM model to use for synthesis')
+    .option('--json', 'Output as JSON')
+    .action(ragQueryCommand);
+// AI Gateway
+const ai = program.command('ai').description('Use the app\'s AI gateway (chat, embeddings, models, BYOK, usage)');
+ai
+    .command('chat <prompt>')
+    .description('Send a single-turn chat completion')
+    .option('--app <appId>', 'Override current app')
+    .option('--model <model>', 'Model id (default: app default)')
+    .option('--temperature <n>', 'Sampling temperature', parseFloat)
+    .option('--max-tokens <n>', 'Max output tokens', parseInt)
+    .option('--system <message>', 'Prepend a system message')
+    .option('--json', 'Output raw JSON')
+    .action((prompt, opts) => aiChatCommand(prompt, opts));
+ai
+    .command('embed <input...>')
+    .description('Embed text(s) into vectors')
+    .option('--app <appId>', 'Override current app')
+    .option('--model <model>', 'Embedding model')
+    .option('--json', 'Output raw JSON')
+    .action((input, opts) => aiEmbedCommand(input, opts));
+ai
+    .command('models')
+    .description('List available AI models')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => aiModelsCommand(opts));
+const aiConfig = ai.command('config').description('Read or update AI config');
+aiConfig
+    .command('get')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => aiConfigGetCommand(opts));
+aiConfig
+    .command('set')
+    .option('--app <appId>', 'Override current app')
+    .option('--default-model <model>')
+    .option('--allowed-models <models...>')
+    .option('--max-tokens-per-request <n>', 'Cap on tokens per request', parseInt)
+    .option('--byok-key <key>', 'Set or clear BYOK key (empty string clears)')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => aiConfigSetCommand(opts));
+ai
+    .command('usage')
+    .description('AI token + cost usage over a window')
+    .option('--app <appId>', 'Override current app')
+    .option('--start-date <date>', 'ISO date')
+    .option('--end-date <date>', 'ISO date')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => aiUsageCommand({
+    app: opts.app, startDate: opts.startDate, endDate: opts.endDate, json: opts.json,
+}));
+// OAuth
+const oauth = program.command('oauth').description('Manage OAuth providers for end-user auth');
+oauth
+    .command('configure <provider>')
+    .description('Configure an OAuth provider (e.g. google, github, apple)')
+    .requiredOption('--client-id <id>')
+    .requiredOption('--client-secret <secret>')
+    .option('--app <appId>', 'Override current app')
+    .option('--redirect-uri <uri>', 'Add a redirect URI (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--scope <scope>', 'Add a scope (repeatable)', (v, prev) => prev.concat(v), [])
+    .option('--authorization-url <url>')
+    .option('--token-url <url>')
+    .option('--userinfo-url <url>')
+    .option('--json', 'Output raw JSON')
+    .action((provider, opts) => oauthConfigureCommand(provider, opts));
+oauth
+    .command('list')
+    .description('List configured OAuth providers')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => oauthListCommand(opts));
+oauth
+    .command('get <provider>')
+    .description('Show config for a provider')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((provider, opts) => oauthGetCommand(provider, opts));
+oauth
+    .command('update <provider>')
+    .description('Update provider config (any field optional)')
+    .option('--app <appId>', 'Override current app')
+    .option('--client-id <id>')
+    .option('--client-secret <secret>')
+    .option('--redirect-uri <uri>', 'Replace redirect URIs', (v, prev) => prev.concat(v), [])
+    .option('--scope <scope>', 'Replace scopes', (v, prev) => prev.concat(v), [])
+    .option('--enabled <bool>', 'Enable/disable (true|false)', (v) => v === 'true')
+    .option('--json', 'Output raw JSON')
+    .action((provider, opts) => oauthUpdateCommand(provider, opts));
+oauth
+    .command('delete <provider>')
+    .description('Delete an OAuth provider configuration')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((provider, opts) => oauthDeleteCommand(provider, opts));
+// Audit
+const audit = program.command('audit').description('Query the app\'s audit log');
+audit
+    .command('query')
+    .description('Query audit log entries with optional filters')
+    .option('--app <appId>', 'Override current app')
+    .option('--category <c>')
+    .option('--event-type <e>')
+    .option('--action <a>')
+    .option('--resource-type <t>')
+    .option('--resource-id <id>')
+    .option('--actor-id <id>')
+    .option('--from <iso>', 'Start of window (ISO date)')
+    .option('--to <iso>', 'End of window (ISO date)')
+    .option('--limit <n>', 'Max rows', parseInt)
+    .option('--offset <n>', 'Pagination offset', parseInt)
+    .option('--json', 'Output raw JSON')
+    .action((opts) => auditQueryCommand(opts));
+// Regions
+const regions = program.command('regions').description('Multi-region operations');
+regions
+    .command('list')
+    .description('List supported regions')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => regionsListCommand(opts));
+// App Billing (Stripe Connect — plans/products/subscriptions/orders)
+const appBilling = program.command('app-billing').description('Manage app-level Stripe Connect billing (plans/products/subscriptions/orders)');
+const abPlans = appBilling.command('plans').description('Subscription plans');
+abPlans
+    .command('list')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => plansListCommand(opts));
+abPlans
+    .command('create')
+    .requiredOption('--name <name>')
+    .requiredOption('--price-cents <n>', 'Price in cents', parseInt)
+    .requiredOption('--interval <month|year>')
+    .option('--description <desc>')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => plansCreateCommand(opts));
+abPlans
+    .command('update <planId>')
+    .option('--name <name>')
+    .option('--price-cents <n>', 'Price in cents', parseInt)
+    .option('--description <desc>')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((planId, opts) => plansUpdateCommand(planId, opts));
+const abProducts = appBilling.command('products').description('One-time products');
+abProducts
+    .command('list')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => productsListCommand(opts));
+abProducts
+    .command('create')
+    .requiredOption('--name <name>')
+    .requiredOption('--price-cents <n>', 'Price in cents', parseInt)
+    .option('--description <desc>')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => productsCreateCommand(opts));
+abProducts
+    .command('update <productId>')
+    .option('--name <name>')
+    .option('--price-cents <n>', 'Price in cents', parseInt)
+    .option('--description <desc>')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((productId, opts) => productsUpdateCommand(productId, opts));
+appBilling
+    .command('subscribe <planId>')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((planId, opts) => subscribeCommand(planId, opts));
+appBilling
+    .command('subscription')
+    .description('Show the current subscription')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => subscriptionCommand(opts));
+appBilling
+    .command('cancel')
+    .description('Cancel the current subscription')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => cancelCommand(opts));
+appBilling
+    .command('purchase <productId>')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((productId, opts) => purchaseCommand(productId, opts));
+const abOrders = appBilling.command('orders').description('Order history');
+abOrders
+    .command('list')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((opts) => ordersListCommand(opts));
+abOrders
+    .command('get <orderId>')
+    .option('--app <appId>', 'Override current app')
+    .option('--json', 'Output raw JSON')
+    .action((orderId, opts) => ordersGetCommand(orderId, opts));
+// Top-level error handlers for unhandled exceptions / rejections
+process.on('uncaughtException', (err) => {
+    console.error(renderError(err));
+    process.exit(1);
+});
+process.on('unhandledRejection', (err) => {
+    console.error(renderError(err));
+    process.exit(1);
+});
 // Parse arguments
 program.parse();
 //# sourceMappingURL=butterbase.js.map