@rodyssey/cli 0.4.0 → 0.5.0

package/dist/cli.js

@@ -2071,7 +2071,7 @@ var {
 // package.json
 var package_default = {
   name: "@rodyssey/cli",
-  version: "0.4.0",
+  version: "0.5.0",
   description: "Scaffold new projects from airconcepts templates",
   repository: {
     type: "git",
@@ -2671,7 +2671,7 @@ async function create(projectName, repoUrl, templateName, autoCreate) {
 
 // src/deploy.ts
 import { execSync as execSync2 } from "node:child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync4, readdirSync, statSync, unlinkSync } from "node:fs";
+import { existsSync as existsSync7, readFileSync as readFileSync6, readdirSync, statSync, unlinkSync } from "node:fs";
 import { join as join2 } from "node:path";
 
 // node_modules/mime/dist/types/other.js
@@ -3857,8 +3857,12 @@ var Mime_default = Mime;
 // node_modules/mime/dist/src/index.js
 var src_default = new Mime_default(standard_default, other_default)._freeze();
 
-// src/sync-widget-manifest.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "node:fs";
+// src/config-file.ts
+import { existsSync as existsSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { resolve as resolve2 } from "node:path";
+
+// src/update-webapp-config.ts
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "node:fs";
 import { resolve } from "node:path";
 var CONFIG_URLS = {
   local: "http://localhost:5176/api/webapps/config",
@@ -3866,10 +3870,516 @@ var CONFIG_URLS = {
   staging: "https://staging-cms.rodyssey.ai/api/webapps/config",
   production: "https://cms.rodyssey.ai/api/webapps/config"
 };
+function parseJsonOption(value, optionName) {
+  const maybePath = resolve(process.cwd(), value);
+  const raw = existsSync4(maybePath) ? readFileSync3(maybePath, "utf-8") : value;
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      throw new Error("value must be a JSON object");
+    }
+    return parsed;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Invalid ${optionName}: ${message}`);
+  }
+}
+function coerceMaybeNull(value) {
+  if (value === undefined)
+    return;
+  if (value === "null")
+    return null;
+  return value;
+}
+function resolveConfigUrl(options, required = true) {
+  const configUrl = options.url || process.env.WEBAPP_CONFIG_URL || CONFIG_URLS[options.env];
+  if (!configUrl) {
+    if (!required)
+      return;
+    console.error("❌ Error: no webapp config endpoint configured.");
+    console.error(`\uD83D\uDCA1 Use one of these environments: ${Object.keys(CONFIG_URLS).join(", ")}, pass --url, or set WEBAPP_CONFIG_URL in your .env file.`);
+    process.exit(1);
+  }
+  const url = new URL(configUrl);
+  if (!options.host && !options.port) {
+    return url.toString().replace(/\/$/, "");
+  }
+  if (options.host)
+    url.hostname = options.host;
+  if (options.port)
+    url.port = String(options.port);
+  return url.toString().replace(/\/$/, "");
+}
+function buildDetailsPayload(options) {
+  const payload = options.details ? parseJsonOption(options.details, "--details") : {};
+  const title = coerceMaybeNull(options.title);
+  const description = coerceMaybeNull(options.description);
+  const coverImg = coerceMaybeNull(options.coverImg);
+  if (title !== undefined)
+    payload.title = title;
+  if (description !== undefined)
+    payload.description = description;
+  if (coverImg !== undefined)
+    payload.coverImg = coverImg;
+  if (options.localization !== undefined) {
+    payload.localization = options.localization === "null" ? null : parseJsonOption(options.localization, "--localization");
+  }
+  return payload;
+}
+function resolveWebappId(webappId) {
+  const resolved = webappId || process.env.WEBAPP_ID;
+  if (!resolved) {
+    console.error("❌ Error: WEBAPP_ID is not set. Pass --webapp-id or set it in your .env file.");
+    process.exit(1);
+  }
+  return resolved;
+}
+function ensureDeployToken(env) {
+  if (process.env.DEPLOY_TOKEN)
+    return;
+  console.error("❌ Error: DEPLOY_TOKEN is not set in environment variables.");
+  console.info(`\uD83D\uDCA1 Please check your .env or .env.${env} file.`);
+  process.exit(1);
+}
+function getConfigUrl(options, required = true) {
+  return resolveConfigUrl(options, required);
+}
+async function patchWebappConfig(options) {
+  loadEnv(options.env);
+  const webappId = resolveWebappId(options.webappId);
+  const CONFIG_URL = getConfigUrl(options, false);
+  if (!CONFIG_URL) {
+    throw new Error("No webapp config endpoint configured.");
+  }
+  ensureDeployToken(options.env);
+  const response = await fetch(CONFIG_URL, {
+    method: "PATCH",
+    headers: {
+      Authorization: `Bearer ${process.env.DEPLOY_TOKEN}`,
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({ webappId, details: options.details })
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`Config update failed: ${response.status} ${response.statusText}
+${errorText}`);
+  }
+  return await response.json().catch(() => {
+    return;
+  });
+}
+async function fetchWebappConfig(options) {
+  loadEnv(options.env);
+  const webappId = resolveWebappId(options.webappId);
+  const CONFIG_URL = getConfigUrl(options, false);
+  if (!CONFIG_URL) {
+    throw new Error("No webapp config endpoint configured.");
+  }
+  ensureDeployToken(options.env);
+  const url = new URL(CONFIG_URL);
+  url.searchParams.set("webappId", webappId);
+  const response = await fetch(url, {
+    method: "GET",
+    headers: {
+      Authorization: `Bearer ${process.env.DEPLOY_TOKEN}`,
+      Accept: "application/json"
+    }
+  });
+  if (!response.ok) {
+    const errorText = await response.text();
+    throw new Error(`Config fetch failed: ${response.status} ${response.statusText}
+${errorText}`);
+  }
+  return await response.json();
+}
+async function getWebappConfig(options) {
+  loadEnv(options.env);
+  const webappId = resolveWebappId(options.webappId);
+  const CONFIG_URL = getConfigUrl(options);
+  if (!CONFIG_URL)
+    return;
+  const url = new URL(CONFIG_URL);
+  url.searchParams.set("webappId", webappId);
+  console.log(`⚙️ Pulling webapp config for [${options.env}] environment...`);
+  console.log(`\uD83D\uDCCD Config URL: ${url.toString()}`);
+  console.log(`\uD83D\uDCCD Webapp ID: ${webappId}
+`);
+  const config = await fetchWebappConfig(options);
+  const output = JSON.stringify(config, null, 2);
+  if (options.out) {
+    writeFileSync3(options.out, `${output}
+`, "utf-8");
+    console.log(`✅ Webapp config written to ${options.out}`);
+    return;
+  }
+  console.log(output);
+}
+async function updateWebappConfig(options) {
+  loadEnv(options.env);
+  const webappId = resolveWebappId(options.webappId);
+  const details = buildDetailsPayload(options);
+  if (Object.keys(details).length === 0) {
+    console.error("❌ Error: no detail fields provided. Use --title, --description, --cover-img, --localization, or --details.");
+    process.exit(1);
+  }
+  const payload = { webappId, details };
+  const CONFIG_URL = getConfigUrl(options, !options.dryRun);
+  if (!options.dryRun)
+    ensureDeployToken(options.env);
+  console.log(`⚙️ Updating webapp config for [${options.env}] environment...`);
+  if (CONFIG_URL) {
+    console.log(`\uD83D\uDCCD Config URL: ${CONFIG_URL}`);
+  }
+  console.log(`\uD83D\uDCCD Webapp ID: ${webappId}
+`);
+  if (options.dryRun) {
+    console.log("\uD83E\uDDEA Dry run payload:");
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  if (!CONFIG_URL)
+    return;
+  const result = await patchWebappConfig({
+    env: options.env,
+    details,
+    webappId,
+    url: options.url,
+    host: options.host,
+    port: options.port
+  });
+  console.log("✅ Webapp config updated");
+  if (result !== undefined) {
+    console.log(`
+\uD83D\uDCCB Update result:`, result);
+  }
+}
+
+// src/cli-ui.ts
+function isPlainObject(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
+}
+function compact(value) {
+  return JSON.stringify(value);
+}
+function pretty(value) {
+  return JSON.stringify(value, null, 2);
+}
+function useColor() {
+  return !!process.stdout.isTTY && !process.env.NO_COLOR;
+}
+function paint(code, text) {
+  return useColor() ? `\x1B[${code}m${text}\x1B[0m` : text;
+}
+var green = (s) => paint("32", s);
+var red = (s) => paint("31", s);
+var yellow = (s) => paint("33", s);
+var dim = (s) => paint("2", s);
+var strike = (s) => paint("9", s);
+async function prompt(question) {
+  const readline = await import("node:readline");
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolveAnswer) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolveAnswer(answer);
+    });
+  });
+}
+function isExplicitYes(answer) {
+  const trimmed = answer.trim().toLowerCase();
+  return trimmed === "y" || trimmed === "yes";
+}
+function pathToDot(path3) {
+  return path3.replace(/^\//, "").replaceAll("/", ".");
+}
+function deepEqual(a, b) {
+  if (a === b)
+    return true;
+  if (typeof a !== typeof b)
+    return false;
+  if (a === null || b === null)
+    return false;
+  if (Array.isArray(a) || Array.isArray(b)) {
+    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
+      return false;
+    return a.every((v, i) => deepEqual(v, b[i]));
+  }
+  if (typeof a === "object" && typeof b === "object") {
+    const ak = Object.keys(a);
+    const bk = Object.keys(b);
+    if (ak.length !== bk.length)
+      return false;
+    return ak.every((k) => deepEqual(a[k], b[k]));
+  }
+  return false;
+}
+function diffJson(before, after, path3 = "") {
+  if (deepEqual(before, after))
+    return [];
+  if (before === undefined)
+    return [{ path: path3, kind: "add", after }];
+  if (after === undefined)
+    return [{ path: path3, kind: "remove", before }];
+  if (!isPlainObject(before) || !isPlainObject(after)) {
+    return [{ path: path3, kind: "change", before, after }];
+  }
+  const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
+  const out = [];
+  for (const key of keys) {
+    out.push(...diffJson(before[key], after[key], `${path3}/${key}`));
+  }
+  return out;
+}
+function deltaLine(d) {
+  const path3 = pathToDot(d.path) || "(root)";
+  if (d.kind === "add")
+    return green(`  ${path3}: ${compact(d.after)}`);
+  if (d.kind === "change") {
+    return yellow(`  ${path3}: ${strike(compact(d.before))} → ${compact(d.after)}`);
+  }
+  return red(strike(`  ${path3}: ${compact(d.before)}`));
+}
+function formatObjectDelta(deltas, header) {
+  if (deltas.length === 0)
+    return `${header}
+${dim("  (no changes)")}`;
+  const adds = deltas.filter((d) => d.kind === "add");
+  const changes = deltas.filter((d) => d.kind === "change");
+  const removes = deltas.filter((d) => d.kind === "remove");
+  const sections = [];
+  if (adds.length)
+    sections.push([green("New"), ...adds.map(deltaLine)].join(`
+`));
+  if (changes.length)
+    sections.push([yellow("Update"), ...changes.map(deltaLine)].join(`
+`));
+  if (removes.length)
+    sections.push([red("Delete"), ...removes.map(deltaLine)].join(`
+`));
+  return `${header}
+
+${sections.join(`
+
+`)}`;
+}
+
+// src/config-file.ts
+var DEFAULT_CONFIG_FILE = "webapp.config.json";
+function isClearSignalEmpty(value) {
+  if (value === null)
+    return true;
+  if (Array.isArray(value) && value.length === 0)
+    return true;
+  if (isPlainObject(value) && Object.keys(value).length === 0)
+    return true;
+  return false;
+}
+function sanitizeDetails(details) {
+  const out = {};
+  for (const [key, value] of Object.entries(details)) {
+    if (isClearSignalEmpty(value))
+      continue;
+    out[key] = value;
+  }
+  return out;
+}
+function unwrapDetails(payload) {
+  if (isPlainObject(payload) && isPlainObject(payload.details)) {
+    return payload.details;
+  }
+  if (isPlainObject(payload) && "details" in payload)
+    return {};
+  if (isPlainObject(payload))
+    return payload;
+  return {};
+}
+function projectDetailsPatch(current, patch) {
+  const next = { ...current };
+  for (const [key, value] of Object.entries(patch)) {
+    if (isClearSignalEmpty(value)) {
+      delete next[key];
+    } else {
+      next[key] = value;
+    }
+  }
+  return next;
+}
+function computeDetailsDelta(current, fileDetails) {
+  return diffJson(current, projectDetailsPatch(current, fileDetails));
+}
+function readConfigFile(filePath) {
+  if (!existsSync5(filePath)) {
+    throw new Error(`Config file not found: ${filePath}. Run \`ro app config pull\` first.`);
+  }
+  let raw;
+  try {
+    raw = readFileSync4(filePath, "utf-8");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Could not read ${filePath}: ${message}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`Invalid JSON in ${filePath}: ${message}`);
+  }
+  if (!isPlainObject(parsed)) {
+    throw new Error(`${filePath} must contain a JSON object.`);
+  }
+  return parsed;
+}
+async function pullWebappConfig(options) {
+  const raw = await fetchWebappConfig({
+    env: options.env,
+    webappId: options.webappId,
+    url: options.url,
+    host: options.host,
+    port: options.port
+  });
+  const details = unwrapDetails(raw);
+  const cleaned = sanitizeDetails(details);
+  const stripped = Object.keys(details).length - Object.keys(cleaned).length;
+  const fileName = options.out || DEFAULT_CONFIG_FILE;
+  const outPath = resolve2(process.cwd(), fileName);
+  writeFileSync4(outPath, `${JSON.stringify(cleaned, null, 2)}
+`, "utf-8");
+  console.log(`✅ Wrote ${fileName} (${Object.keys(cleaned).length} fields, ${stripped} empty default${stripped === 1 ? "" : "s"} stripped)`);
+}
+async function pushWebappConfig(options) {
+  const fileName = options.file || DEFAULT_CONFIG_FILE;
+  const filePath = resolve2(process.cwd(), fileName);
+  const fileDetails = readConfigFile(filePath);
+  const raw = await fetchWebappConfig({
+    env: options.env,
+    webappId: options.webappId,
+    url: options.url,
+    host: options.host,
+    port: options.port
+  });
+  const current = unwrapDetails(raw);
+  const deltas = computeDetailsDelta(current, fileDetails);
+  console.log(formatObjectDelta(deltas, `Pushing ${fileName} → [${options.env}]`));
+  if (deltas.length === 0) {
+    console.log(`
+✓ Already in sync — nothing to push.`);
+    return;
+  }
+  if (options.dryRun) {
+    console.log(`
+↷ Dry run — no request sent.`);
+    return;
+  }
+  const tty = !!process.stdin.isTTY && !!process.stdout.isTTY;
+  if (!options.yes) {
+    if (!tty) {
+      throw new Error("Refusing to push in non-interactive mode. Pass --yes to confirm or --dry-run to preview.");
+    }
+    const answer = await prompt(`
+Proceed with push on [${options.env}]? (y/N): `);
+    if (!isExplicitYes(answer)) {
+      console.log("✋ Aborted.");
+      return;
+    }
+  }
+  await patchWebappConfig({
+    env: options.env,
+    details: fileDetails,
+    webappId: options.webappId,
+    url: options.url,
+    host: options.host,
+    port: options.port
+  });
+  console.log(`
+✅ Webapp config pushed.`);
+}
+async function checkConfigDriftOnDeploy(options) {
+  const fileName = options.file || DEFAULT_CONFIG_FILE;
+  const filePath = resolve2(process.cwd(), fileName);
+  if (!existsSync5(filePath))
+    return;
+  if (!process.env.WEBAPP_ID) {
+    console.warn(`
+⚠️  Skipping config drift check: WEBAPP_ID is not set.`);
+    return;
+  }
+  let fileDetails;
+  try {
+    fileDetails = readConfigFile(filePath);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn(`
+⚠️  Skipping config drift check: ${message}`);
+    return;
+  }
+  let current;
+  try {
+    const raw = await fetchWebappConfig({
+      env: options.env,
+      host: options.host,
+      port: options.port
+    });
+    current = unwrapDetails(raw);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn(`
+⚠️  Could not check config drift: ${message}`);
+    return;
+  }
+  const deltas = computeDetailsDelta(current, fileDetails);
+  if (deltas.length === 0)
+    return;
+  console.log(`
+\uD83D\uDCDD ${fileName} differs from the CMS:`);
+  console.log(formatObjectDelta(deltas, `Config drift on [${options.env}]`));
+  const tty = !!process.stdin.isTTY && !!process.stdout.isTTY;
+  let shouldPush = options.pushConfig === true;
+  if (!shouldPush) {
+    if (!tty) {
+      console.log(`
+ℹ️  ${fileName} differs from CMS — run 'ro app config push' to sync, or deploy with --push-config.`);
+      return;
+    }
+    const answer = await prompt(`
+Push ${fileName} to the CMS now? (y/N): `);
+    shouldPush = isExplicitYes(answer);
+  }
+  if (!shouldPush) {
+    console.log(`
+↷ Skipped. Run 'ro app config push' later to sync.`);
+    return;
+  }
+  try {
+    await patchWebappConfig({
+      env: options.env,
+      details: fileDetails,
+      host: options.host,
+      port: options.port
+    });
+    console.log("✅ Webapp config pushed.");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn(`
+⚠️  Config push failed (deploy still succeeded): ${message}`);
+    console.warn("   Retry with: ro app config push");
+  }
+}
+
+// src/sync-widget-manifest.ts
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "node:fs";
+import { resolve as resolve3 } from "node:path";
+var CONFIG_URLS2 = {
+  local: "http://localhost:5176/api/webapps/config",
+  development: "https://development-cms.rodyssey.ai/api/webapps/config",
+  staging: "https://staging-cms.rodyssey.ai/api/webapps/config",
+  production: "https://cms.rodyssey.ai/api/webapps/config"
+};
 function resolveWidgetConfigUrl(options) {
-  const rawUrl = options.url || process.env.WEBAPP_CONFIG_URL || CONFIG_URLS[options.env];
+  const rawUrl = options.url || process.env.WEBAPP_CONFIG_URL || CONFIG_URLS2[options.env];
   if (!rawUrl) {
-    throw new Error(`Unknown environment "${options.env}". Use one of: ${Object.keys(CONFIG_URLS).join(", ")}, pass --url, or set WEBAPP_CONFIG_URL.`);
+    throw new Error(`Unknown environment "${options.env}". Use one of: ${Object.keys(CONFIG_URLS2).join(", ")}, pass --url, or set WEBAPP_CONFIG_URL.`);
   }
   const url = new URL(rawUrl);
   if (options.host)
@@ -3879,43 +4389,49 @@ function resolveWidgetConfigUrl(options) {
   return url.toString().replace(/\/$/, "");
 }
 function resolveManifestPath(manifest) {
-  if (manifest)
-    return resolve(process.cwd(), manifest);
+  if (manifest) {
+    const manifestPath = resolve3(process.cwd(), manifest);
+    if (!existsSync6(manifestPath)) {
+      throw new Error(`Widget manifest not found: ${manifestPath}`);
+    }
+    return manifestPath;
+  }
   const candidates = [
-    resolve(process.cwd(), "build/client/widgets.manifest.json"),
-    resolve(process.cwd(), "dist/widgets.manifest.json")
+    resolve3(process.cwd(), "build/client/widgets.manifest.json"),
+    resolve3(process.cwd(), "dist/widgets.manifest.json")
   ];
-  const found = candidates.find((candidate) => existsSync4(candidate));
-  if (!found) {
-    throw new Error("No widget manifest found. Run `bun run build` first or pass --manifest <path>.");
-  }
+  const found = candidates.find((candidate) => existsSync6(candidate));
   return found;
 }
 function readManifest(path3) {
-  const parsed = JSON.parse(readFileSync3(path3, "utf-8"));
+  const parsed = JSON.parse(readFileSync5(path3, "utf-8"));
   if (!Array.isArray(parsed)) {
     throw new Error(`Widget manifest must be a JSON array: ${path3}`);
   }
   return parsed;
 }
-function resolveWebappId(webappId) {
+function resolveWebappId2(webappId) {
   const resolved = webappId || process.env.WEBAPP_ID;
   if (!resolved) {
     throw new Error("WEBAPP_ID is not set. Add it to .env or pass --webapp-id.");
   }
   return resolved;
 }
-function ensureDeployToken(env) {
+function ensureDeployToken2(env) {
   if (process.env.DEPLOY_TOKEN)
     return;
   throw new Error(`DEPLOY_TOKEN is not set. Please check your .env or .env.${env} file.`);
 }
 async function syncWidgetManifest(options) {
   loadEnv(options.env);
-  const webappId = resolveWebappId(options.webappId);
-  if (!options.dryRun)
-    ensureDeployToken(options.env);
   const manifestPath = resolveManifestPath(options.manifest);
+  if (!manifestPath) {
+    console.log("No widget manifest found; skipping widget manifest sync.");
+    return;
+  }
+  const webappId = resolveWebappId2(options.webappId);
+  if (!options.dryRun)
+    ensureDeployToken2(options.env);
   const manifest = readManifest(manifestPath);
   const payload = { webappId, details: { widgetManifest: manifest } };
   const configUrl = resolveWidgetConfigUrl(options);
@@ -3974,7 +4490,7 @@ function pickNumber(value) {
   return typeof value === "number" && Number.isFinite(value) ? value : undefined;
 }
 function isFullstackProject() {
-  return existsSync5("app") && existsSync5("workers/app.ts") && existsSync5("wrangler.jsonc");
+  return existsSync7("app") && existsSync7("workers/app.ts") && existsSync7("wrangler.jsonc");
 }
 function resolveDeployUrl(env, overrides) {
   let deployUrl = DEPLOY_URLS[env];
@@ -4050,7 +4566,7 @@ function collectScripts(scriptFiles) {
   const payload = { api: {}, cron: {}, cronConfig: null };
   const summary = { apiEndpoints: [], cronJobs: [], mcpEndpoints: [] };
   for (const filePath of scriptFiles) {
-    const content = readFileSync4(filePath, "utf-8");
+    const content = readFileSync6(filePath, "utf-8");
     const relativePath = normalizeBuildRelativePath(filePath);
     if (relativePath === "cron-jobs/cron.config.json") {
       payload.cronConfig = readCronConfig(filePath, content);
@@ -4166,7 +4682,7 @@ ${JSON.stringify(result, null, 2)}`);
   return { summary, result };
 }
 function getAllFiles(dirPath, arrayOfFiles = []) {
-  if (!existsSync5(dirPath))
+  if (!existsSync7(dirPath))
     return arrayOfFiles;
   const files = readdirSync(dirPath);
   files.forEach(function(f) {
@@ -4180,7 +4696,7 @@ function getAllFiles(dirPath, arrayOfFiles = []) {
   return arrayOfFiles;
 }
 function fileToBlob(filePath) {
-  const buffer = readFileSync4(filePath);
+  const buffer = readFileSync6(filePath);
   return new Blob([buffer], { type: src_default.getType(filePath) || "application/octet-stream" });
 }
 async function deployFullstack(env, overrides) {
@@ -4304,7 +4820,7 @@ ${errorText}`);
   console.log(`✅ Created ${ZIP_FILE}
 `);
   console.log("☁️  Step 4: Deploying HTML zip to server...");
-  const zipBuffer = readFileSync4(ZIP_FILE);
+  const zipBuffer = readFileSync6(ZIP_FILE);
   try {
     const response = await fetch(DEPLOY_URL, {
       method: "POST",
@@ -4334,7 +4850,7 @@ ${errorText}`);
     console.error("❌ Deploy failed:", error);
     throw error;
   } finally {
-    if (existsSync5(ZIP_FILE)) {
+    if (existsSync7(ZIP_FILE)) {
       unlinkSync(ZIP_FILE);
       console.log(`
 \uD83E\uDDF9 Cleaned up ${ZIP_FILE}`);
@@ -4347,18 +4863,23 @@ async function deploy(env = "development", overrides = {}) {
   loadEnv(env);
   if (isFullstackProject()) {
     await deployFullstack(env, overrides);
-    return;
+  } else {
+    await deploySpa(env, overrides);
+  }
+  if (!overrides.skipConfigCheck) {
+    await checkConfigDriftOnDeploy({
+      env,
+      pushConfig: overrides.pushConfig,
+      host: overrides.host,
+      port: overrides.port
+    });
   }
-  await deploySpa(env, overrides);
 }
 
 // src/global-config.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "node:fs";
-import { resolve as resolve2 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "node:fs";
+import { resolve as resolve4 } from "node:path";
 var PROD_ENV = "production";
-function isPlainObject(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
-}
 function applyMergePatch(target, patch) {
   if (!isPlainObject(patch))
     return patch;
@@ -4375,8 +4896,8 @@ function applyMergePatch(target, patch) {
 function parseFlag(name, value) {
   if (value === "null")
     return null;
-  const candidatePath = resolve2(process.cwd(), value);
-  const raw = existsSync6(candidatePath) ? readFileSync5(candidatePath, "utf-8") : value;
+  const candidatePath = resolve4(process.cwd(), value);
+  const raw = existsSync8(candidatePath) ? readFileSync7(candidatePath, "utf-8") : value;
   try {
     return JSON.parse(raw);
   } catch (error) {
@@ -4392,95 +4913,20 @@ function buildPayload(options) {
   if (options.publicConfig !== undefined) {
     payload.publicConfig = parseFlag("public-config", options.publicConfig);
   }
-  if (payload.config === undefined && payload.publicConfig === undefined) {
-    throw new Error("Provide at least one of --config or --public-config.");
-  }
-  return payload;
-}
-function resolveEndpoint(env, override, cmsUrl) {
-  if (override)
-    return override;
-  return `${resolveCmsUrl(env, cmsUrl)}/api/cli/cms/global-config`;
-}
-async function prompt(question) {
-  const readline = await import("node:readline");
-  const rl = readline.createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-  return new Promise((resolveAnswer) => {
-    rl.question(question, (answer) => {
-      rl.close();
-      resolveAnswer(answer);
-    });
-  });
-}
-function isExplicitYes(answer) {
-  const trimmed = answer.trim().toLowerCase();
-  return trimmed === "y" || trimmed === "yes";
-}
-function pretty(value) {
-  return JSON.stringify(value, null, 2);
-}
-function compact(value) {
-  return JSON.stringify(value);
-}
-function useColor() {
-  return !!process.stdout.isTTY && !process.env.NO_COLOR;
-}
-function paint(code, text) {
-  return useColor() ? `\x1B[${code}m${text}\x1B[0m` : text;
-}
-var green = (s) => paint("32", s);
-var red = (s) => paint("31", s);
-var yellow = (s) => paint("33", s);
-var dim = (s) => paint("2", s);
-var strike = (s) => paint("9", s);
-var COLUMN_LABEL = {
-  config: "Config",
-  publicConfig: "Public Config"
-};
-function pathToDot(path3) {
-  return path3.replace(/^\//, "").replaceAll("/", ".");
-}
-function deepEqual(a, b) {
-  if (a === b)
-    return true;
-  if (typeof a !== typeof b)
-    return false;
-  if (a === null || b === null)
-    return false;
-  if (Array.isArray(a) || Array.isArray(b)) {
-    if (!Array.isArray(a) || !Array.isArray(b) || a.length !== b.length)
-      return false;
-    return a.every((v, i) => deepEqual(v, b[i]));
-  }
-  if (typeof a === "object" && typeof b === "object") {
-    const ak = Object.keys(a);
-    const bk = Object.keys(b);
-    if (ak.length !== bk.length)
-      return false;
-    return ak.every((k) => deepEqual(a[k], b[k]));
-  }
-  return false;
-}
-function diffJson(before, after, path3 = "") {
-  if (deepEqual(before, after))
-    return [];
-  if (before === undefined)
-    return [{ path: path3, kind: "add", after }];
-  if (after === undefined)
-    return [{ path: path3, kind: "remove", before }];
-  if (!isPlainObject(before) || !isPlainObject(after)) {
-    return [{ path: path3, kind: "change", before, after }];
-  }
-  const keys = new Set([...Object.keys(before), ...Object.keys(after)]);
-  const out = [];
-  for (const key of keys) {
-    out.push(...diffJson(before[key], after[key], `${path3}/${key}`));
+  if (payload.config === undefined && payload.publicConfig === undefined) {
+    throw new Error("Provide at least one of --config or --public-config.");
   }
-  return out;
+  return payload;
+}
+function resolveEndpoint(env, override, cmsUrl) {
+  if (override)
+    return override;
+  return `${resolveCmsUrl(env, cmsUrl)}/api/cli/cms/global-config`;
 }
+var COLUMN_LABEL = {
+  config: "Config",
+  publicConfig: "Public Config"
+};
 function buildColumnDeltas(current, payload, method) {
   const out = [];
   for (const column of ["config", "publicConfig"]) {
@@ -4500,7 +4946,7 @@ function buildColumnDeltas(current, payload, method) {
   }
   return out;
 }
-function deltaLine(d, showColumnTag) {
+function deltaLine2(d, showColumnTag) {
   const tag = showColumnTag ? `[${COLUMN_LABEL[d.column]}] ` : "";
   const path3 = pathToDot(d.path) || `(entire ${COLUMN_LABEL[d.column]})`;
   if (d.kind === "add") {
@@ -4524,15 +4970,15 @@ ${dim("  (no changes)")}`;
   const removes = deltas.filter((d) => d.kind === "remove");
   const sections = [];
   if (adds.length > 0) {
-    sections.push([green("New"), ...adds.map((d) => deltaLine(d, showTag))].join(`
+    sections.push([green("New"), ...adds.map((d) => deltaLine2(d, showTag))].join(`
 `));
   }
   if (changes.length > 0) {
-    sections.push([yellow("Update"), ...changes.map((d) => deltaLine(d, showTag))].join(`
+    sections.push([yellow("Update"), ...changes.map((d) => deltaLine2(d, showTag))].join(`
 `));
   }
   if (removes.length > 0) {
-    sections.push([red("Delete"), ...removes.map((d) => deltaLine(d, showTag))].join(`
+    sections.push([red("Delete"), ...removes.map((d) => deltaLine2(d, showTag))].join(`
 `));
   }
   return `${header}
@@ -4571,8 +5017,8 @@ ${pretty(payload)}`);
   }
   const text = pretty(payload);
   if (options.out) {
-    const outPath = resolve2(process.cwd(), options.out);
-    writeFileSync3(outPath, `${text}
+    const outPath = resolve4(process.cwd(), options.out);
+    writeFileSync5(outPath, `${text}
 `, "utf-8");
     console.log(`✅ Wrote global config to ${outPath}`);
   } else {
@@ -4666,190 +5112,167 @@ async function patchGlobalConfig(options) {
   await writeGlobalConfig("PATCH", options);
 }
 
-// src/promote.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
-import { resolve as resolve4 } from "node:path";
-
-// src/update-webapp-config.ts
-import { existsSync as existsSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "node:fs";
-import { resolve as resolve3 } from "node:path";
-var CONFIG_URLS2 = {
-  local: "http://localhost:5176/api/webapps/config",
-  development: "https://development-cms.rodyssey.ai/api/webapps/config",
-  staging: "https://staging-cms.rodyssey.ai/api/webapps/config",
-  production: "https://cms.rodyssey.ai/api/webapps/config"
-};
-function parseJsonOption(value, optionName) {
-  const maybePath = resolve3(process.cwd(), value);
-  const raw = existsSync7(maybePath) ? readFileSync6(maybePath, "utf-8") : value;
-  try {
-    const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      throw new Error("value must be a JSON object");
-    }
-    return parsed;
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`Invalid ${optionName}: ${message}`);
+// src/group.ts
+import { writeFileSync as writeFileSync6 } from "node:fs";
+import { resolve as resolve5 } from "node:path";
+var PROD_ENV2 = "production";
+var ENTITY_TYPES = ["webapp", "character", "scene", "story"];
+function parseEntityType(raw) {
+  if (raw && ENTITY_TYPES.includes(raw)) {
+    return raw;
   }
+  throw new Error(`--type must be one of: ${ENTITY_TYPES.join(", ")}`);
 }
-function coerceMaybeNull(value) {
-  if (value === undefined)
-    return;
-  if (value === "null")
-    return null;
-  return value;
-}
-function resolveConfigUrl(options, required = true) {
-  const configUrl = options.url || process.env.WEBAPP_CONFIG_URL || CONFIG_URLS2[options.env];
-  if (!configUrl) {
-    if (!required)
-      return;
-    console.error("❌ Error: no webapp config endpoint configured.");
-    console.error(`\uD83D\uDCA1 Use one of these environments: ${Object.keys(CONFIG_URLS2).join(", ")}, pass --url, or set WEBAPP_CONFIG_URL in your .env file.`);
-    process.exit(1);
+function resolveEntityId(type, explicitId) {
+  if (explicitId)
+    return explicitId;
+  if (type === "webapp") {
+    if (process.env.WEBAPP_ID)
+      return process.env.WEBAPP_ID;
+    return missingId("(for --type webapp it defaults to WEBAPP_ID from .env, which is also missing)");
   }
-  const url = new URL(configUrl);
-  if (!options.host && !options.port) {
-    return url.toString().replace(/\/$/, "");
-  }
-  if (options.host)
-    url.hostname = options.host;
-  if (options.port)
-    url.port = String(options.port);
-  return url.toString().replace(/\/$/, "");
+  return missingId(`(no default exists for --type ${type})`);
 }
-function buildDetailsPayload(options) {
-  const payload = options.details ? parseJsonOption(options.details, "--details") : {};
-  const title = coerceMaybeNull(options.title);
-  const description = coerceMaybeNull(options.description);
-  const coverImg = coerceMaybeNull(options.coverImg);
-  if (title !== undefined)
-    payload.title = title;
-  if (description !== undefined)
-    payload.description = description;
-  if (coverImg !== undefined)
-    payload.coverImg = coverImg;
-  if (options.localization !== undefined) {
-    payload.localization = options.localization === "null" ? null : parseJsonOption(options.localization, "--localization");
-  }
-  return payload;
+function missingId(detail) {
+  throw new Error(`--id is required ${detail}`);
 }
-function resolveWebappId2(webappId) {
-  const resolved = webappId || process.env.WEBAPP_ID;
-  if (!resolved) {
-    console.error("❌ Error: WEBAPP_ID is not set. Pass --webapp-id or set it in your .env file.");
-    process.exit(1);
-  }
-  return resolved;
+function orFallback(value, fallback) {
+  return value && value.trim().length > 0 ? value : fallback;
 }
-function ensureDeployToken2(env) {
-  if (process.env.DEPLOY_TOKEN)
-    return;
-  console.error("❌ Error: DEPLOY_TOKEN is not set in environment variables.");
-  console.info(`\uD83D\uDCA1 Please check your .env or .env.${env} file.`);
-  process.exit(1);
+function capitalize(s) {
+  return s.charAt(0).toUpperCase() + s.slice(1);
 }
-function getConfigUrl(options, required = true) {
-  return resolveConfigUrl(options, required);
+function formatGroupList(type, env, groups) {
+  const lines = [
+    `\uD83D\uDCE6 ${capitalize(type)} groups on [${env}] — ${groups.length} found`
+  ];
+  for (const g of groups) {
+    const name = orFallback(g.name, "(unnamed)");
+    const where = g.isSystem ? "system" : `school: ${g.schoolName ?? g.schoolId ?? "unknown"}`;
+    const desc = orFallback(g.description, "");
+    lines.push("");
+    lines.push(`• ${name}  (${g.itemCount} items · ${where})`);
+    lines.push(`  id: ${g.id}`);
+    lines.push(`  ${desc || dim("(no description)")}`);
+  }
+  return lines.join(`
+`);
 }
-async function fetchWebappConfig(options) {
-  loadEnv(options.env);
-  const webappId = resolveWebappId2(options.webappId);
-  const CONFIG_URL = getConfigUrl(options);
-  if (!CONFIG_URL) {
-    throw new Error("No webapp config endpoint configured.");
+function formatItemList(type, env, group, items) {
+  const label = orFallback(group.name, group.id);
+  const lines = [
+    `\uD83D\uDCE6 Items in ${type} group "${label}" on [${env}] — ${items.length} found`
+  ];
+  for (const item of items) {
+    lines.push("");
+    lines.push(`• ${orFallback(item.label, "(unlabeled)")}  (order: ${item.orderIndex ?? "-"})`);
+    lines.push(`  id: ${item.entityId}`);
   }
-  ensureDeployToken2(options.env);
-  const url = new URL(CONFIG_URL);
-  url.searchParams.set("webappId", webappId);
+  return lines.join(`
+`);
+}
+function groupsBaseUrl(env, cmsUrl) {
+  return `${resolveCmsUrl(env, cmsUrl)}/api/cli/groups`;
+}
+async function resolveWriteAuth(env, cmsUrl) {
+  if (env === PROD_ENV2) {
+    console.log(`
+\uD83D\uDD10 Logging in to ${PROD_ENV2} CMS (ephemeral, not stored)...`);
+    const session = await login({ env, cmsUrl, persist: false });
+    console.log(`✅ Logged in to ${session.cmsUrl}`);
+    return { baseUrl: `${session.cmsUrl}/api/cli/groups`, token: session.token };
+  }
+  return { baseUrl: groupsBaseUrl(env, cmsUrl), token: resolveSessionToken(env) };
+}
+async function requestJson(method, url, token, body) {
   const response = await fetch(url, {
-    method: "GET",
+    method,
     headers: {
-      Authorization: `Bearer ${process.env.DEPLOY_TOKEN}`,
-      Accept: "application/json"
-    }
+      Accept: "application/json",
+      Authorization: `Bearer ${token}`,
+      ...body !== undefined ? { "Content-Type": "application/json" } : {}
+    },
+    ...body !== undefined ? { body: JSON.stringify(body) } : {}
   });
+  const payload = await readResponsePayload(response);
   if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(`Config fetch failed: ${response.status} ${response.statusText}
-${errorText}`);
+    throw new Error(`${method} ${url} failed: ${response.status} ${response.statusText}
+${pretty(payload)}`);
   }
-  return await response.json();
+  return payload;
 }
-async function getWebappConfig(options) {
-  loadEnv(options.env);
-  const webappId = resolveWebappId2(options.webappId);
-  const CONFIG_URL = getConfigUrl(options);
-  if (!CONFIG_URL)
-    return;
-  const url = new URL(CONFIG_URL);
-  url.searchParams.set("webappId", webappId);
-  console.log(`⚙️ Pulling webapp config for [${options.env}] environment...`);
-  console.log(`\uD83D\uDCCD Config URL: ${url.toString()}`);
-  console.log(`\uD83D\uDCCD Webapp ID: ${webappId}
-`);
-  const config = await fetchWebappConfig(options);
-  const output = JSON.stringify(config, null, 2);
+function emitRead(payload, human, options) {
   if (options.out) {
-    writeFileSync4(options.out, `${output}
+    const outPath = resolve5(process.cwd(), options.out);
+    writeFileSync6(outPath, `${pretty(payload)}
 `, "utf-8");
-    console.log(`✅ Webapp config written to ${options.out}`);
+    console.log(`✅ Wrote response to ${outPath}`);
     return;
   }
-  console.log(output);
+  console.log(options.json ? pretty(payload) : human);
 }
-async function updateWebappConfig(options) {
+async function listGroups(options) {
+  const type = parseEntityType(options.type);
+  const url = `${groupsBaseUrl(options.env, options.cmsUrl)}?type=${type}`;
+  const payload = await requestJson("GET", url, resolveSessionToken(options.env));
+  emitRead(payload, formatGroupList(type, options.env, payload.groups ?? []), options);
+}
+async function listGroupItems(groupId, options) {
+  const type = parseEntityType(options.type);
+  const url = `${groupsBaseUrl(options.env, options.cmsUrl)}/${encodeURIComponent(groupId)}/items?type=${type}`;
+  const payload = await requestJson("GET", url, resolveSessionToken(options.env));
+  emitRead(payload, formatItemList(type, options.env, payload.group ?? { id: groupId, name: null }, payload.items ?? []), options);
+}
+async function writeMembership(mode, groupId, options) {
+  const type = parseEntityType(options.type);
   loadEnv(options.env);
-  const webappId = resolveWebappId2(options.webappId);
-  const details = buildDetailsPayload(options);
-  if (Object.keys(details).length === 0) {
-    console.error("❌ Error: no detail fields provided. Use --title, --description, --cover-img, --localization, or --details.");
-    process.exit(1);
-  }
-  const payload = { webappId, details };
-  const CONFIG_URL = getConfigUrl(options, !options.dryRun);
-  if (!options.dryRun)
-    ensureDeployToken2(options.env);
-  console.log(`⚙️ Updating webapp config for [${options.env}] environment...`);
-  if (CONFIG_URL) {
-    console.log(`\uD83D\uDCCD Config URL: ${CONFIG_URL}`);
-  }
-  console.log(`\uD83D\uDCCD Webapp ID: ${webappId}
-`);
+  const entityId = resolveEntityId(type, options.id);
+  const verb = mode === "assign" ? "Assign" : "Remove";
+  const arrow = mode === "assign" ? "→" : "←";
+  console.log(`${mode === "assign" ? "➕" : "➖"} ${verb} ${type} ${entityId} ${arrow} group ${groupId} on [${options.env}]`);
   if (options.dryRun) {
-    console.log("\uD83E\uDDEA Dry run payload:");
-    console.log(JSON.stringify(payload, null, 2));
+    console.log(dim(`
+↷ Dry run — no request sent.`));
     return;
   }
-  if (!CONFIG_URL)
-    return;
-  const response = await fetch(CONFIG_URL, {
-    method: "PATCH",
-    headers: {
-      Authorization: `Bearer ${process.env.DEPLOY_TOKEN}`,
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(payload)
-  });
-  if (!response.ok) {
-    const errorText = await response.text();
-    throw new Error(`Config update failed: ${response.status} ${response.statusText}
-${errorText}`);
+  const tty = !!process.stdin.isTTY && !!process.stdout.isTTY;
+  if (!options.yes) {
+    if (!tty) {
+      throw new Error("Refusing to send write in non-interactive mode. Pass --yes to confirm or --dry-run to preview.");
+    }
+    const answer = await prompt(`
+Proceed with ${mode} on [${options.env}]? (y/N): `);
+    if (!isExplicitYes(answer)) {
+      console.log("✋ Aborted.");
+      return;
+    }
   }
-  const result = await response.json().catch(() => {
+  const auth = await resolveWriteAuth(options.env, options.cmsUrl);
+  const url = `${auth.baseUrl}/${encodeURIComponent(groupId)}/items`;
+  const method = mode === "assign" ? "POST" : "DELETE";
+  const payload = await requestJson(method, url, auth.token, { type, entityId });
+  if (options.json) {
+    console.log(pretty(payload));
     return;
-  });
-  console.log("✅ Webapp config updated");
-  if (result !== undefined) {
-    console.log(`
-\uD83D\uDCCB Update result:`, result);
   }
+  if (mode === "assign") {
+    console.log(payload.alreadyPresent ? "✅ Already in group — no change." : "✅ Added to group.");
+  } else {
+    console.log(payload.removed ? "✅ Removed from group." : "✅ Was not in group — no change.");
+  }
+}
+async function assignToGroup(groupId, options) {
+  await writeMembership("assign", groupId, options);
+}
+async function removeFromGroup(groupId, options) {
+  await writeMembership("remove", groupId, options);
 }
 
 // src/promote.ts
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
+import { resolve as resolve6 } from "node:path";
 var DEFAULT_SOURCE_ENV = "development";
-var PROD_ENV2 = "production";
+var PROD_ENV3 = "production";
 var PROD_ENV_FILE = ".env.production";
 function isObject3(value) {
   return !!value && typeof value === "object" && !Array.isArray(value);
@@ -4876,8 +5299,8 @@ function unwrapSourceDetails(payload) {
   return payload;
 }
 function parseDetailsOption(value) {
-  const maybePath = resolve4(process.cwd(), value);
-  const raw = existsSync8(maybePath) ? readFileSync7(maybePath, "utf-8") : value;
+  const maybePath = resolve6(process.cwd(), value);
+  const raw = existsSync9(maybePath) ? readFileSync8(maybePath, "utf-8") : value;
   try {
     const parsed = JSON.parse(raw);
     if (!isObject3(parsed)) {
@@ -4952,10 +5375,10 @@ Deploy to production now? (y/N): `);
   }
   console.log(`
 \uD83D\uDE80 Deploying promoted webapp to production...`);
-  loadEnv(PROD_ENV2, { override: true });
+  loadEnv(PROD_ENV3, { override: true });
   process.env.WEBAPP_ID = webappId;
   process.env.DEPLOY_TOKEN = deployToken;
-  await deploy(PROD_ENV2);
+  await deploy(PROD_ENV3, { skipConfigCheck: true });
 }
 async function promote(options) {
   assertDeployOptions(options);
@@ -4966,9 +5389,9 @@ async function promote(options) {
     console.info("\uD83D\uDCA1 Run `ro app create --auto` first, or set WEBAPP_ID manually.");
     process.exit(1);
   }
-  const prodEnvPath = resolve4(process.cwd(), PROD_ENV_FILE);
-  if (existsSync8(prodEnvPath)) {
-    const content = readFileSync7(prodEnvPath, "utf-8");
+  const prodEnvPath = resolve6(process.cwd(), PROD_ENV_FILE);
+  if (existsSync9(prodEnvPath)) {
+    const content = readFileSync8(prodEnvPath, "utf-8");
     if (/^WEBAPP_ID=.+/m.test(content)) {
       console.error(`❌ Error: ${PROD_ENV_FILE} already has WEBAPP_ID. The app appears to be promoted already.`);
       process.exit(1);
@@ -5001,18 +5424,18 @@ async function promote(options) {
     }
   }
   console.log(`
-\uD83D\uDD10 Logging in to ${PROD_ENV2} CMS (ephemeral, not stored)...`);
+\uD83D\uDD10 Logging in to ${PROD_ENV3} CMS (ephemeral, not stored)...`);
   const session = await login({
-    env: PROD_ENV2,
+    env: PROD_ENV3,
     cmsUrl: options.cmsUrl,
     persist: false
   });
   console.log(`✅ Logged in to ${session.cmsUrl}`);
-  const cmsUrl = resolveCmsUrl(PROD_ENV2, options.cmsUrl);
+  const cmsUrl = resolveCmsUrl(PROD_ENV3, options.cmsUrl);
   const promoteUrl = options.promoteUrl || `${cmsUrl}/api/cli/webapps/promote`;
   const promoteBody = { webappId, details };
   console.log(`
-\uD83D\uDE80 Promoting webapp to ${PROD_ENV2}...`);
+\uD83D\uDE80 Promoting webapp to ${PROD_ENV3}...`);
   console.log(`\uD83D\uDCCD Promote URL: ${promoteUrl}`);
   console.log(`\uD83D\uDCCD Webapp ID: ${webappId}`);
   console.log("\uD83D\uDCE6 Promote body:");
@@ -5029,7 +5452,7 @@ async function promote(options) {
   });
   const payload = await readResponsePayload(response);
   if (response.status === 409) {
-    console.error(`❌ Webapp ${webappId} is already promoted to ${PROD_ENV2}.`);
+    console.error(`❌ Webapp ${webappId} is already promoted to ${PROD_ENV3}.`);
     process.exit(1);
   }
   if (!response.ok) {
@@ -5052,7 +5475,7 @@ ${JSON.stringify(payload, null, 2)}`);
 
 // src/upgrade-template.ts
 import { execSync as execSync3 } from "node:child_process";
-import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync5, mkdirSync as mkdirSync2, copyFileSync, rmSync as rmSync2 } from "node:fs";
+import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync7, mkdirSync as mkdirSync2, copyFileSync, rmSync as rmSync2 } from "node:fs";
 import path3 from "node:path";
 var TEMPLATES = {
   webapp: {
@@ -5126,12 +5549,12 @@ var FORCE_OVERWRITE_SCRIPT_NAMES = [
   "upgrade-template"
 ];
 function detectTemplate() {
-  if (existsSync9("app")) {
+  if (existsSync10("app")) {
     console.log(`\uD83D\uDD0D Detected fullstack template (found app/ directory)
 `);
     return TEMPLATES["webapp-fullstack"];
   }
-  if (existsSync9("src")) {
+  if (existsSync10("src")) {
     console.log(`\uD83D\uDD0D Detected SPA template (found src/ directory)
 `);
     return TEMPLATES["webapp"];
@@ -5186,11 +5609,11 @@ function applyPackageJsonScriptUpdates(packageJson, scriptUpdates) {
 }
 function updatePackageJsonScripts(template) {
   const pkgPath = "package.json";
-  if (!existsSync9(pkgPath)) {
+  if (!existsSync10(pkgPath)) {
     console.log("⚠️  No package.json found, skipping scripts update");
     return;
   }
-  const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+  const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
   const templateScripts = readTemplatePackageScripts(template);
   const scriptUpdates = getForcedScriptUpdates(templateScripts);
   const result = applyPackageJsonScriptUpdates(pkg, scriptUpdates);
@@ -5198,7 +5621,7 @@ function updatePackageJsonScripts(template) {
     console.log(`  \uD83D\uDCDD ${change.action} script: "${change.name}"`);
   }
   if (result.updated) {
-    writeFileSync5(pkgPath, JSON.stringify(pkg, null, 2) + `
+    writeFileSync7(pkgPath, JSON.stringify(pkg, null, 2) + `
 `, "utf-8");
     console.log(`✅ package.json scripts updated
 `);
@@ -5232,11 +5655,11 @@ function viteHandlesServerScripts(viteConfigSource) {
 }
 function ensureBuildScript() {
   const pkgPath = "package.json";
-  if (!existsSync9(pkgPath)) {
+  if (!existsSync10(pkgPath)) {
     console.log("  ⚠️  No package.json found, skipping build-script check");
     return;
   }
-  const pkg = JSON.parse(readFileSync8(pkgPath, "utf-8"));
+  const pkg = JSON.parse(readFileSync9(pkgPath, "utf-8"));
   const buildScript = pkg.scripts?.build;
   if (typeof buildScript !== "string" || buildScript.trim() === "") {
     console.log(`  ⚠️  No "build" script found. Add one that runs the server-scripts pass, e.g.:
@@ -5254,17 +5677,17 @@ function ensureBuildScript() {
     return;
   }
   pkg.scripts.build = result.script;
-  writeFileSync5(pkgPath, JSON.stringify(pkg, null, 2) + `
+  writeFileSync7(pkgPath, JSON.stringify(pkg, null, 2) + `
 `, "utf-8");
   console.log(`  \uD83D\uDCDD Added "vite build --mode server-scripts" to the build script`);
 }
 function verifyViteServerScriptsMode() {
-  const configPath2 = VITE_CONFIG_CANDIDATES.find((p) => existsSync9(p));
+  const configPath2 = VITE_CONFIG_CANDIDATES.find((p) => existsSync10(p));
   if (!configPath2) {
     console.log("  ⚠️  No vite.config found. Server scripts in src/api and src/cron-jobs won't be compiled.");
     return;
   }
-  const source = readFileSync8(configPath2, "utf-8");
+  const source = readFileSync9(configPath2, "utf-8");
   if (viteHandlesServerScripts(source)) {
     console.log(`  ✅ ${configPath2} handles the server-scripts build mode`);
     return;
@@ -5289,7 +5712,7 @@ function updateCliSkill() {
     }
     execSync3(`git fetch ${cliRemote}`, { stdio: "inherit" });
     execSync3(`git checkout ${cliRemote}/main -- skills/ro-cli/SKILL.md`, { stdio: "inherit" });
-    if (existsSync9("skills/ro-cli/SKILL.md")) {
+    if (existsSync10("skills/ro-cli/SKILL.md")) {
       mkdirSync2(".agent/skills/ro-cli", { recursive: true });
       copyFileSync("skills/ro-cli/SKILL.md", ".agent/skills/ro-cli/SKILL.md");
       rmSync2("skills", { recursive: true, force: true });
@@ -5322,7 +5745,7 @@ async function upgradeTemplate() {
     const checkoutList = template.checkoutFiles.join(" ");
     execSync3(`git checkout ${template.remoteName}/main -- ${checkoutList}`, { stdio: "inherit" });
     for (const file of template.newFiles) {
-      if (!existsSync9(file)) {
+      if (!existsSync10(file)) {
         console.log(`\uD83D\uDCC2 Checking out ${file}...`);
         try {
           mkdirSync2(path3.dirname(file), { recursive: true });
@@ -5487,6 +5910,156 @@ async function updateGameSdk() {
   }
 }
 
+// src/assets.ts
+import { existsSync as existsSync11, readFileSync as readFileSync10, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
+import { basename as basename2, join as join4, relative } from "node:path";
+var ASSETS_URLS = {
+  local: "http://localhost:5176/api/webapps/assets",
+  development: "https://development-cms.rodyssey.ai/api/webapps/assets",
+  staging: "https://staging-cms.rodyssey.ai/api/webapps/assets",
+  production: "https://cms.rodyssey.ai/api/webapps/assets"
+};
+var MAX_FILES_PER_BATCH2 = 5;
+var MAX_SIZE_PER_BATCH2 = 30 * 1024 * 1024;
+function resolveAssetsUrl(options) {
+  const rawUrl = options.url || process.env.WEBAPP_ASSETS_URL || ASSETS_URLS[options.env];
+  if (!rawUrl) {
+    throw new Error(`Unknown environment "${options.env}". Use one of: ${Object.keys(ASSETS_URLS).join(", ")}, pass --url, or set WEBAPP_ASSETS_URL.`);
+  }
+  const url = new URL(rawUrl);
+  if (options.host)
+    url.hostname = options.host;
+  if (options.port)
+    url.port = String(options.port);
+  return url.toString().replace(/\/$/, "");
+}
+function normalizeRemotePath(raw) {
+  let p = raw.replaceAll("\\", "/");
+  while (p.startsWith("./"))
+    p = p.slice(2);
+  while (p.startsWith("/"))
+    p = p.slice(1);
+  const segments = p.split("/").filter((s) => s.length > 0);
+  if (segments.length === 0 || segments.includes("..") || segments.includes(".")) {
+    throw new Error(`Invalid asset path: "${raw}"`);
+  }
+  return segments.join("/");
+}
+function refuseManifest(remotePath) {
+  if (basename2(remotePath) === "widgets.manifest.json") {
+    throw new Error("widgets.manifest.json is webapp metadata, not an asset — the server would " + "overwrite the widget manifest. Use `ro app sync-widget-manifest` instead.");
+  }
+}
+function walkDir(dirPath) {
+  const out = [];
+  for (const name of readdirSync2(dirPath)) {
+    const full = join4(dirPath, name);
+    if (statSync2(full).isDirectory())
+      out.push(...walkDir(full));
+    else
+      out.push(full);
+  }
+  return out;
+}
+function collectUploads(inputs, dest) {
+  const prefix = dest ? `${normalizeRemotePath(dest)}/` : "";
+  const entries = [];
+  for (const input of inputs) {
+    if (!existsSync11(input)) {
+      throw new Error(`Path not found: ${input}`);
+    }
+    if (statSync2(input).isDirectory()) {
+      for (const file of walkDir(input)) {
+        const remotePath = normalizeRemotePath(`${prefix}${relative(input, file)}`);
+        refuseManifest(remotePath);
+        entries.push({ localPath: file, remotePath });
+      }
+    } else {
+      const remotePath = normalizeRemotePath(`${prefix}${basename2(input)}`);
+      refuseManifest(remotePath);
+      entries.push({ localPath: input, remotePath });
+    }
+  }
+  if (entries.length === 0) {
+    throw new Error("No files to upload.");
+  }
+  return entries;
+}
+function splitBatches(entries, sizeOf) {
+  const batches = [];
+  let current = [];
+  let currentSize = 0;
+  for (const entry of entries) {
+    const size = sizeOf(entry);
+    if (current.length >= MAX_FILES_PER_BATCH2 || current.length > 0 && currentSize + size > MAX_SIZE_PER_BATCH2) {
+      batches.push(current);
+      current = [];
+      currentSize = 0;
+    }
+    current.push(entry);
+    currentSize += size;
+  }
+  if (current.length > 0)
+    batches.push(current);
+  return batches;
+}
+function ensureDeployToken3(env) {
+  if (process.env.DEPLOY_TOKEN)
+    return process.env.DEPLOY_TOKEN;
+  throw new Error(`DEPLOY_TOKEN is not set. Please check your .env or .env.${env} file.`);
+}
+function fileToBlob2(filePath) {
+  return new Blob([readFileSync10(filePath)]);
+}
+async function pushAssets(inputs, options) {
+  loadEnv(options.env);
+  const entries = collectUploads(inputs, options.dest);
+  const batches = splitBatches(entries, (e) => statSync2(e.localPath).size);
+  const url = resolveAssetsUrl(options);
+  console.log(`\uD83D\uDCE4 Pushing ${entries.length} asset(s) to [${options.env}] in ${batches.length} batch(es):`);
+  for (const e of entries) {
+    console.log(`  ${e.localPath} → ${e.remotePath}`);
+  }
+  if (options.dryRun) {
+    console.log(dim(`
+↷ Dry run — no request sent.`));
+    return;
+  }
+  const token = ensureDeployToken3(options.env);
+  const uploaded = [];
+  for (const [index, batch] of batches.entries()) {
+    const formData = new FormData;
+    for (const entry of batch) {
+      formData.append(entry.remotePath, fileToBlob2(entry.localPath), entry.remotePath);
+    }
+    const response = await fetch(url, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}` },
+      body: formData
+    });
+    if (!response.ok) {
+      const errorText = await response.text();
+      throw new Error(`Asset upload failed (batch ${index + 1}/${batches.length}): ${response.status} ${response.statusText}
+${errorText}`);
+    }
+    const payload = await response.json();
+    uploaded.push(...payload.assets ?? []);
+    console.log(`✅ Batch ${index + 1}/${batches.length} uploaded`);
+  }
+  if (options.json) {
+    console.log(pretty({ success: true, assets: uploaded }));
+    return;
+  }
+  console.log(`
+✅ Uploaded ${uploaded.length} asset(s):`);
+  for (const asset of uploaded) {
+    console.log(`• ${asset.path}`);
+    console.log(`  ${asset.url}`);
+  }
+  console.log(dim("\nTip: set a cover image with `ro app config set --cover-img <url>`,"));
+  console.log(dim("or put the URL in webapp.config.json and run `ro app config push`."));
+}
+
 // src/cli.ts
 function renderError(err) {
   const msg = err instanceof Error ? err.message : String(err);
@@ -5527,15 +6100,15 @@ Available templates:
     input: process.stdin,
     output: process.stdout
   });
-  return new Promise((resolve5) => {
+  return new Promise((resolve7) => {
     rl.question(`Select a template (1-${entries.length}): `, (answer) => {
       rl.close();
       const index = parseInt(answer, 10) - 1;
       if (index >= 0 && index < entries.length) {
-        resolve5(entries[index].name);
+        resolve7(entries[index].name);
       } else {
         console.error("Invalid selection, defaulting to 'webapp'");
-        resolve5("webapp");
+        resolve7("webapp");
       }
     });
   });
@@ -5580,6 +6153,20 @@ addGlobalConfigWriteOptions(globalConfig.command("set").description("Replace the
 addGlobalConfigWriteOptions(globalConfig.command("patch").description("Merge-patch (RFC 7396) the `config` and/or `publicConfig` column. `null` values delete keys.")).action(async (options) => {
   await patchGlobalConfig(options);
 });
+var group = program.command("group").description("Manage entity groups (webapp | character | scene | story)");
+var addGroupCommonOptions = (command) => command.requiredOption("--type <entity-type>", "Entity type: webapp | character | scene | story").option("-e, --env <environment>", "CMS environment (local | development | staging | production)", "development").option("--cms-url <url>", "CMS base URL. Defaults to the selected environment");
+addGroupCommonOptions(group.command("list").description("List entity groups (id, name, description, school, item count)")).option("--json", "Print the raw JSON response").option("--out <file>", "Write the response JSON to a file").action(async (options) => {
+  await listGroups(options);
+});
+addGroupCommonOptions(group.command("items").description("List the entities in a group").argument("<group-id>", "Group ID (find it with `ro group list`)")).option("--json", "Print the raw JSON response").option("--out <file>", "Write the response JSON to a file").action(async (groupId, options) => {
+  await listGroupItems(groupId, options);
+});
+addGroupCommonOptions(group.command("assign").description("Add an entity to a group (idempotent)").argument("<group-id>", "Group ID (find it with `ro group list`)")).option("--id <entity-id>", "Entity ID. For --type webapp defaults to WEBAPP_ID from .env").option("-y, --yes", "Skip the interactive confirmation prompt").option("--dry-run", "Print the intended request without sending it").option("--json", "Print the raw JSON response").action(async (groupId, options) => {
+  await assignToGroup(groupId, options);
+});
+addGroupCommonOptions(group.command("remove").description("Remove an entity from a group").argument("<group-id>", "Group ID (find it with `ro group list`)")).option("--id <entity-id>", "Entity ID. For --type webapp defaults to WEBAPP_ID from .env").option("-y, --yes", "Skip the interactive confirmation prompt").option("--dry-run", "Print the intended request without sending it").option("--json", "Print the raw JSON response").action(async (groupId, options) => {
+  await removeFromGroup(groupId, options);
+});
 app.command("create").argument("<project-name>", "Name of the project to create").option("-t, --template <template>", "Template to use (webapp | webapp-fullstack)").option("--auto", "Create a CMS webapp and write WEBAPP_ID/DEPLOY_TOKEN to .env").option("-e, --env <environment>", "CMS environment for --auto (local | development | staging | production)", "development").option("--cms-url <url>", "CMS base URL for --auto. Defaults to the selected environment").option("--create-url <url>", "Full CMS create endpoint for --auto. Defaults to <cms-url>/api/cli/webapps/create").description("Create a new project from a template").action(async (projectName, options) => {
   let templateName;
   if (options.template) {
@@ -5613,8 +6200,8 @@ app.command("promote").description("Promote the current webapp to production (cr
 app.command("update-game-sdk").description("Download and update the GameSDK library, types, and documentation").action(async () => {
   await updateGameSdk();
 });
-app.command("deploy").description("Build and deploy the webapp to the server").option("-e, --env <environment>", "Target environment (local | development | staging | production)", "development").option("--host <host>", "Override the deploy host").option("--port <port>", "Override the deploy port", parseInt).action(async (options) => {
-  await deploy(options.env, { host: options.host, port: options.port });
+app.command("deploy").description("Build and deploy the webapp to the server").option("-e, --env <environment>", "Target environment (local | development | staging | production)", "development").option("--host <host>", "Override the deploy host").option("--port <port>", "Override the deploy port", parseInt).option("--push-config", "If webapp.config.json differs from the CMS, push it without prompting").action(async (options) => {
+  await deploy(options.env, { host: options.host, port: options.port, pushConfig: options.pushConfig });
 });
 app.command("sync-widget-manifest").description("Sync the built widget manifest to the CMS webapp config").option("-e, --env <environment>", "Target environment (local | development | staging | production)", "development").option("--manifest <path>", "Path to widgets.manifest.json. Defaults to build/client/widgets.manifest.json or dist/widgets.manifest.json").option("--url <url>", "Override the config endpoint URL").option("--host <host>", "Override the config endpoint host").option("--port <port>", "Override the config endpoint port", parseInt).option("--webapp-id <id>", "Webapp ID. Defaults to WEBAPP_ID from .env").option("--dry-run", "Print the request payload without sending it").action(async (options) => {
   await syncWidgetManifest(options);
@@ -5626,6 +6213,16 @@ addConfigTargetOptions(config.command("get").description("Pull the current webap
 addConfigSetOptions(config.command("set").description("Update webapp metadata such as title, cover image, description, and localization")).action(async (options) => {
   await updateWebappConfig(options);
 });
+addConfigTargetOptions(config.command("pull").description("Pull the CMS webapp config into a committed webapp.config.json").option("--out <file>", "Output file (default: webapp.config.json)")).action(async (options) => {
+  await pullWebappConfig(options);
+});
+addConfigTargetOptions(config.command("push").description("Push webapp.config.json back to the CMS (previews a diff and confirms)").option("--file <path>", "Config file to push (default: webapp.config.json)").option("--dry-run", "Preview the delta without sending").option("-y, --yes", "Skip the confirmation prompt")).action(async (options) => {
+  await pushWebappConfig(options);
+});
+var assets = app.command("assets").description("Manage webapp assets (R2-hosted files)");
+assets.command("push").description("Upload or overwrite webapp assets and print their public URLs").argument("<paths...>", "Files and/or directories to upload").option("--dest <remote-dir>", "Remote directory prefix (e.g. images)").option("-e, --env <environment>", "Target environment (local | development | staging | production)", "development").option("--url <url>", "Override the assets endpoint URL").option("--host <host>", "Override the assets endpoint host").option("--port <port>", "Override the assets endpoint port", parseInt).option("--dry-run", "Preview the local→remote mapping without uploading").option("--json", "Print the raw JSON result").action(async (paths, options) => {
+  await pushAssets(paths, options);
+});
 app.command("upgrade-template").description("Upgrade template files and CLI scripts from the template repository").action(async () => {
   await upgradeTemplate();
 });