@whop/cli 0.3.0 → 0.5.0

package/dist/index.js

@@ -5,9 +5,11 @@ import {
   Cli_exports,
   Identity,
   OAuthError,
+  Openapi_exports,
   Profile,
   PromptCancelledError,
   apiBaseUrl,
+  apps_spec_default,
   buildTarget,
   buildVersion,
   chooseAuthMethod,
@@ -33,7 +35,7 @@ import {
   switchProfile,
   upsertProfile,
   validateApiKey
-} from "./chunk-4WNH276N.js";
+} from "./chunk-X34EUMEM.js";
 import {
   external_exports
 } from "./chunk-KFCNNWPI.js";
@@ -120,6 +122,10 @@ var groups_default = [
     "audiences",
     "Audiences"
   ],
+  [
+    "media",
+    "Media"
+  ],
   [
     "social-accounts",
     "Social Accounts"
@@ -312,7 +318,7 @@ async function loginAdapter(c2) {
   const accountId = getActiveProfile()?.accountId ?? "";
   if (accountId) {
     try {
-      const { createWhopFetch: createWhopFetch2 } = await import("./api-A6NYSDKW.js");
+      const { createWhopFetch: createWhopFetch2 } = await import("./api-E6Y2WAEG.js");
       const fetch3 = createWhopFetch2();
       const res = await fetch3(
         new Request(
@@ -592,11 +598,11 @@ function buildAuthGroup() {
 }
 
 // src/apps/commands.ts
-import { isCancel, select, text } from "@clack/prompts";
+import { isCancel, select, spinner, text } from "@clack/prompts";
 import { spawnSync as spawnSync2 } from "child_process";
 import { createHash } from "crypto";
 import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync } from "fs";
-import { join as join3, resolve as resolve2 } from "path";
+import { join as join3, relative, resolve as resolve2 } from "path";
 import chalk from "chalk";
 
 // src/journey/client.ts
@@ -642,6 +648,9 @@ async function getApp(appId) {
 async function updateAppRoute(appId, route) {
   return makeWhopRequest("PATCH", `/apps/${appId}`, { route });
 }
+async function updateAppSecrets(appId, secrets) {
+  return makeWhopRequest("PATCH", `/apps/${appId}`, { secrets });
+}
 async function createAppBuild(input) {
   return makeWhopRequest("POST", "/app_builds", {
     app_id: input.app_id,
@@ -653,13 +662,6 @@ async function createAppBuild(input) {
 async function getAppBuild(buildId) {
   return makeWhopRequest("GET", `/app_builds/${buildId}`);
 }
-async function listAppBuilds(appId) {
-  const response = await makeWhopRequest(
-    "GET",
-    `/app_builds?app_id=${encodeURIComponent(appId)}&platform=web`
-  );
-  return response.data ?? [];
-}
 async function promoteAppBuild(buildId) {
   return makeWhopRequest(
     "POST",
@@ -767,7 +769,11 @@ var DLX_RUNNERS = {
   bun: ["bunx"],
   yarn: ["yarn", "dlx"]
 };
-var PM_PRIORITY = ["bun", "pnpm", "npm"];
+var PM_PRIORITY = [
+  "bun",
+  "pnpm",
+  "npm"
+];
 function isPmInstalled(pm) {
   const result = spawnSync(pm, ["--version"], {
     stdio: "ignore",
@@ -791,6 +797,34 @@ function pmInstallHint(pm) {
       return "npm install -g yarn";
   }
 }
+var TANSTACK_CREATE_FLAGS = [
+  "--framework",
+  "React",
+  "--deployment",
+  "cloudflare",
+  "--no-git",
+  "--no-install",
+  "--no-intent",
+  "--no-toolchain",
+  "--no-examples",
+  "--non-interactive"
+];
+function tanstackCreateCommand(pm, projectName) {
+  return [
+    ...DLX_RUNNERS[pm],
+    "@tanstack/cli@latest",
+    "create",
+    projectName,
+    ...TANSTACK_CREATE_FLAGS
+  ].join(" ");
+}
+function outputTail(result) {
+  const combined = [result.stdout, result.stderr].filter(Boolean).join("\n").trim();
+  if (!combined) return "";
+  return `
+
+${combined.split("\n").slice(-15).join("\n")}`;
+}
 function runTanstackCreate(options) {
   const [runner, ...runnerArgs] = DLX_RUNNERS[options.pm];
   const result = spawnSync(
@@ -802,26 +836,18 @@ function runTanstackCreate(options) {
       options.projectName,
       "--target-dir",
       options.targetDir,
-      "--framework",
-      "React",
-      "--deployment",
-      "cloudflare",
-      "--no-git",
-      "--no-install",
-      "--no-intent",
-      "--no-toolchain",
-      "--no-examples",
-      "--non-interactive"
+      ...TANSTACK_CREATE_FLAGS
     ],
     {
-      stdio: options.quiet ? "ignore" : "inherit",
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf-8",
       shell: SPAWN_VIA_SHELL
     }
   );
   if (result.error) throw result.error;
   if (result.status !== 0) {
     throw new Error(
-      `\`${options.pm === "npm" ? "npx" : options.pm} @tanstack/cli create\` failed (exit ${result.status}). Check your network connection and try again.`
+      `\`${options.pm === "npm" ? "npx" : options.pm} @tanstack/cli create\` failed (exit ${result.status}). Check your network connection and try again.${outputTail(result)}`
     );
   }
 }
@@ -831,6 +857,11 @@ var VITE_CONFIG_NAMES = [
   "vite.config.js",
   "vite.config.mjs"
 ];
+function findViteConfig(dir) {
+  return VITE_CONFIG_NAMES.map((name) => join2(dir, name)).find(
+    (path3) => existsSync2(path3)
+  );
+}
 var WRANGLER_CONFIG_NAMES = ["wrangler.jsonc", "wrangler.json"];
 function cliDependencyVersion() {
   return buildVersion ? `^${buildVersion}` : "latest";
@@ -867,9 +898,7 @@ function patchPackageJson(dir, manualSteps) {
 `);
 }
 function patchViteConfig(dir, manualSteps) {
-  const file = VITE_CONFIG_NAMES.map((name) => join2(dir, name)).find(
-    (path3) => existsSync2(path3)
-  );
+  const file = findViteConfig(dir);
   if (!file) {
     manualSteps.push(
       "No vite config found (looked for vite.config.ts/.mts/.js/.mjs). Whop hosting serves Vite builds \u2014 create a vite config that builds with @cloudflare/vite-plugin (emitting dist/client and, for SSR, dist/server) and includes the whop() plugin from @whop/cli/vite in its plugins array."
@@ -962,26 +991,36 @@ function replaceTopLevelName(content, route) {
 
 // src/apps/commands.ts
 var BUILD_ARCHIVE = "dist/whop-build.zip";
-var AppSchema = external_exports.object({
-  id: external_exports.string(),
-  name: external_exports.string(),
-  route: external_exports.string().nullable().optional(),
-  url: external_exports.string().optional(),
-  directory: external_exports.string().optional(),
-  install_failed: external_exports.boolean().optional()
-});
+var UNSAFE_DEV_ENV_KEYS = /* @__PURE__ */ new Set([
+  "PATH",
+  "NODE_OPTIONS",
+  "NODE_EXTRA_CA_CERTS",
+  "NODE_REPL_EXTERNAL_MODULE"
+]);
+var UNSAFE_DEV_ENV_PREFIXES = ["NPM_", "PNPM_", "YARN_", "BUN_", "LD_", "DYLD_"];
+function isUnsafeDevEnvKey(key) {
+  const upper = key.toUpperCase();
+  return UNSAFE_DEV_ENV_KEYS.has(upper) || UNSAFE_DEV_ENV_PREFIXES.some((prefix) => upper.startsWith(prefix));
+}
 var BuildSchema = external_exports.object({
   id: external_exports.string(),
   status: external_exports.string(),
   is_production: external_exports.boolean().optional(),
   url: external_exports.string().optional()
 });
-function detectPackageManager2(projectDir) {
+var DeployAbort = class extends Error {
+  constructor(options) {
+    super(options.message);
+    this.options = options;
+  }
+};
+function detectProjectPackageManager(projectDir) {
   if (existsSync3(join3(projectDir, "bun.lock")) || existsSync3(join3(projectDir, "bun.lockb")))
     return "bun";
   if (existsSync3(join3(projectDir, "pnpm-lock.yaml"))) return "pnpm";
   if (existsSync3(join3(projectDir, "yarn.lock"))) return "yarn";
-  return "npm";
+  if (existsSync3(join3(projectDir, "package-lock.json"))) return "npm";
+  return detectPackageManager() ?? "npm";
 }
 function hasScript(projectDir, script) {
   try {
@@ -995,7 +1034,7 @@ function hasScript(projectDir, script) {
 }
 var SPAWN_VIA_SHELL2 = process.platform === "win32";
 function runScript(projectDir, script, extraEnv = {}) {
-  const pm = detectPackageManager2(projectDir);
+  const pm = detectProjectPackageManager(projectDir);
   const result = spawnSync2(pm, ["run", script], {
     cwd: projectDir,
     stdio: "inherit",
@@ -1013,501 +1052,413 @@ function runScript(projectDir, script, extraEnv = {}) {
     );
   }
 }
+function runInstall(c2, projectDir) {
+  const pm = detectProjectPackageManager(projectDir);
+  const spin = c2.agent ? null : spinner();
+  spin?.start(`Installing dependencies with ${pm}`);
+  const result = spawnSync2(pm, ["install"], {
+    cwd: projectDir,
+    stdio: ["ignore", "pipe", "pipe"],
+    encoding: "utf-8",
+    shell: SPAWN_VIA_SHELL2
+  });
+  if (result.error || result.status !== 0) {
+    spin?.error(`${pm} install failed`);
+    throw new Error(
+      `\`${pm} install\` failed${result.status != null ? ` with exit code ${result.status}` : ""} \u2014 run it manually inside ${projectDir}, then re-run \`whop apps deploy\`.${outputTail(result)}`
+    );
+  }
+  spin?.stop(`Installed dependencies with ${pm}`);
+}
 function log(c2, message) {
   if (!c2.agent) console.log(message);
 }
-function loadProject(dir) {
-  const projectDir = dir ? resolve2(dir) : findProjectDir();
-  if (!projectDir) {
-    return {
-      ok: false,
-      error: {
-        code: "NO_PROJECT",
-        message: `No ${APP_CONFIG_FILENAME} found in this directory or any parent. Run \`whop apps create --existing\` to link this project to a Whop app.`,
-        cta: {
-          commands: [
-            {
-              command: "apps create --existing",
-              description: "Link this project to a Whop app"
-            }
-          ]
-        }
-      }
-    };
-  }
-  const config = readAppConfig(projectDir);
-  if (!config) {
-    return {
-      ok: false,
-      error: {
-        code: "INVALID_CONFIG",
-        message: `${join3(projectDir, APP_CONFIG_FILENAME)} is missing or malformed. Run \`whop apps create --existing\` to regenerate it.`
-      }
-    };
-  }
-  return { ok: true, projectDir, config };
-}
 async function promptText(message, placeholder, initialValue) {
   const value = await text({ message, placeholder, initialValue });
   if (isCancel(value)) return null;
   return String(value);
 }
+function cancelled() {
+  throw new DeployAbort({
+    code: "CANCELLED",
+    message: "Cancelled.",
+    exitCode: 130
+  });
+}
 function formatManualSteps(steps) {
   return steps.map((step, i) => `  ${i + 1}. ${step}`).join("\n");
 }
-async function runRegisterFlow(c2, options) {
-  const projectDir = resolve2(options.dir ?? ".");
-  if (!existsSync3(join3(projectDir, "package.json"))) {
-    return c2.error({
-      code: "NO_PACKAGE_JSON",
-      message: `No package.json in ${projectDir} \u2014 --existing wires up a project that's already here. Drop --existing to scaffold a new one.`
+function formatAppList(apps) {
+  const recent = [...apps].sort((a, b) => (b.created_at ?? 0) - (a.created_at ?? 0)).slice(0, 10);
+  return recent.map(
+    (a) => `  ${a.id}  ${a.name}${a.route ? `  (${a.route}.whop.app)` : ""}`
+  ).join("\n");
+}
+async function registerSpecCommands(group, tag) {
+  const spec2 = filterSpecByTag(apps_spec_default, tag);
+  const generated = await Openapi_exports.generateCommands(
+    spec2,
+    createWhopFetch()
+  );
+  for (const [name, entry] of generated) {
+    if ("run" in entry) group.command(name, entry);
+  }
+}
+function ensurePackageManager() {
+  const pm = detectPackageManager();
+  if (pm) return pm;
+  throw new DeployAbort({
+    code: "NO_PACKAGE_MANAGER",
+    message: `No package manager found (looked for bun, pnpm, npm). Install one and re-run \`whop apps deploy\`:
+
+  bun (recommended): ${pmInstallHint("bun")}
+  pnpm:              ${pmInstallHint("pnpm")}
+  npm:               ${pmInstallHint("npm")}`
+  });
+}
+async function ensureViteApp(c2, pm, dirOption) {
+  const projectDir = dirOption ? resolve2(dirOption) : findProjectDir() ?? process.cwd();
+  const isViteApp = existsSync3(join3(projectDir, "package.json")) && findViteConfig(projectDir) !== void 0;
+  if (isViteApp) return { projectDir, freshlyScaffolded: false };
+  if (c2.agent) {
+    throw new DeployAbort({
+      code: "NOT_A_VITE_APP",
+      message: [
+        `${projectDir} doesn't look like a Vite app (missing package.json or vite config).`,
+        "",
+        "Ask the user whether to scaffold a new app here, or locate their existing Vite app.",
+        "",
+        "To scaffold a new app (TanStack Start), run:",
+        `  ${tanstackCreateCommand(pm, "<app-name>")}`,
+        `  cd <app-name> && ${pm} install`,
+        "",
+        "Then re-run `whop apps deploy` from inside the app directory.",
+        "Or, if a Vite app already exists somewhere else, re-run `whop apps deploy --dir <path-to-app>`."
+      ].join("\n"),
+      retryable: true,
+      cta: {
+        commands: [
+          {
+            command: "apps deploy",
+            description: "Re-run from inside a Vite app directory"
+          }
+        ]
+      }
     });
   }
-  const existing = readAppConfig(projectDir);
-  if (existing) {
-    const { manualSteps: manualSteps2 } = whopifyProject({
-      targetDir: projectDir,
-      route: existing.route
+  const choice = await select({
+    message: `${projectDir} doesn't look like a Vite app. What do you want to do?`,
+    options: [
+      {
+        value: "scaffold",
+        label: "Scaffold a new Whop app here (TanStack Start)"
+      },
+      { value: "cancel", label: "Cancel \u2014 I'll cd into my app directory" }
+    ]
+  });
+  if (isCancel(choice) || choice === "cancel") cancelled();
+  const scaffolded = await scaffoldNewApp(c2, pm);
+  return { projectDir: scaffolded, freshlyScaffolded: true };
+}
+async function scaffoldNewApp(c2, pm) {
+  const name = await promptText("What is your app called?", "My Site");
+  if (name === null) cancelled();
+  const slug = slugify(name);
+  const routeInput = await promptText(
+    "Which route should it live at? (your-route.whop.app)",
+    slug,
+    slug
+  );
+  if (routeInput === null) cancelled();
+  const route = slugify(routeInput);
+  if (!route) {
+    throw new DeployAbort({
+      code: "ROUTE_REQUIRED",
+      message: `Couldn't derive a route from "${routeInput}" \u2014 use letters and numbers (e.g. my-site).`,
+      retryable: true
     });
-    if (manualSteps2.length > 0) {
-      return c2.error({
-        code: "WHOPIFY_INCOMPLETE",
-        message: `This project is already linked to ${existing.app_id} (${existing.route}), but it isn't fully wired for Whop hosting yet. Complete these steps:
-
-${formatManualSteps(manualSteps2)}
+  }
+  const targetDir = resolve2(`./${route}`);
+  if (existsSync3(targetDir) && readdirSync(targetDir).length > 0) {
+    throw new DeployAbort({
+      code: "TARGET_NOT_EMPTY",
+      message: `Target directory is not empty: ${targetDir}. Pick a different route, or run \`whop apps deploy\` from an empty directory.`
+    });
+  }
+  let app;
+  try {
+    app = await createApp({ name, route });
+  } catch (err) {
+    throw new DeployAbort({
+      code: "CREATE_FAILED",
+      message: err instanceof Error ? err.message : "Failed to register the app",
+      retryable: true
+    });
+  }
+  const spin = c2.agent ? null : spinner();
+  spin?.start("Scaffolding the latest TanStack Start template");
+  try {
+    runTanstackCreate({ targetDir, projectName: route, pm });
+    spin?.stop(`Scaffolded ${route} from the latest TanStack Start template`);
+  } catch (err) {
+    spin?.error("Scaffold failed");
+    throw new DeployAbort({
+      code: "SCAFFOLD_FAILED",
+      message: `${err instanceof Error ? err.message : "Failed to scaffold the project"}
 
-Then run \`whop apps deploy\`. Re-running \`whop apps create --existing\` re-checks the wiring.`
-      });
-    }
-    if (!c2.agent && !c2.formatExplicit) {
-      console.log(
-        `${chalk.green.bold(`\u2713 Already linked to ${existing.name}`)} ${chalk.dim(`(${existing.app_id})`)} \u2014 wiring verified. Delete ${APP_CONFIG_FILENAME} to relink.`
-      );
-    }
-    return c2.ok({
-      id: existing.app_id,
-      name: existing.name,
-      route: existing.route,
-      directory: projectDir
+The app ${app.id} is already registered \u2014 scaffold into a fresh directory and re-run \`whop apps deploy --app ${app.id}\` there.`
     });
   }
-  let linked = null;
-  if (options.link) {
-    const apps = await listApps();
-    linked = apps.find((a) => a.id === options.link) ?? null;
-    if (!linked) {
-      return c2.error({
+  writeAppConfig(targetDir, { app_id: app.id, name, route });
+  return targetDir;
+}
+async function ensureAppLinked(c2, projectDir, appOption) {
+  if (appOption) {
+    let app;
+    try {
+      app = await getApp(appOption);
+    } catch (err) {
+      throw new DeployAbort({
         code: "APP_NOT_FOUND",
-        message: `No app ${options.link} found on your account.`
+        message: `Could not load app ${appOption}: ${err instanceof Error ? err.message : "unknown error"}`,
+        retryable: true
       });
     }
+    const config2 = await withRoute(c2, app);
+    writeAppConfig(projectDir, config2);
+    log(
+      c2,
+      chalk.dim(
+        `Linked ${config2.name} (${config2.app_id}) \u2192 ${APP_CONFIG_FILENAME}`
+      )
+    );
+    return config2;
   }
-  let name = options.name ?? linked?.name;
-  if (!name) {
-    if (c2.agent) {
-      return c2.error({
-        code: "NAME_REQUIRED",
-        message: 'Pass a name: `whop apps create "My Site"`.',
-        retryable: true
-      });
+  const existing = readAppConfig(projectDir);
+  if (existing) return existing;
+  const apps = await listApps();
+  if (c2.agent) {
+    const reuse = apps.length > 0 ? `This account has existing apps \u2014 ask the user whether to reuse one:
+${formatAppList(apps)}
+
+To reuse one:  whop apps deploy --app <app_id>
+
+` : "This account has no apps yet, so a new one must be created.\n\n";
+    throw new DeployAbort({
+      code: "NO_APP_LINKED",
+      message: [
+        `No ${APP_CONFIG_FILENAME} here \u2014 this project isn't linked to a Whop app yet.`,
+        "",
+        `${reuse}To create a new app, ask the user for a name and route (the route becomes <route>.whop.app), then run:`,
+        '  whop apps create --name "My Site" --route my-site',
+        "",
+        "Then deploy with the returned app id:",
+        "  whop apps deploy --app <app_id>"
+      ].join("\n"),
+      retryable: true,
+      cta: {
+        commands: [
+          {
+            command: "apps create",
+            description: "Create a new app (pass --name and --route)"
+          },
+          {
+            command: "apps deploy",
+            description: "Re-run with --app <app_id> to link and deploy"
+          }
+        ]
+      }
+    });
+  }
+  let selected = null;
+  if (apps.length > 0) {
+    const recent = [...apps].sort(
+      (a, b) => (b.created_at ?? 0) - (a.created_at ?? 0)
+    );
+    const choice = await select({
+      message: "Which app should this project deploy to?",
+      options: [
+        ...recent.map((a) => ({
+          value: a.id,
+          label: `${a.name} (${a.id}${a.route ? `, ${a.route}.whop.app` : ""})`
+        })),
+        { value: "__new__", label: "Create a new app" }
+      ]
+    });
+    if (isCancel(choice)) cancelled();
+    if (choice !== "__new__") {
+      selected = recent.find((a) => a.id === choice) ?? null;
     }
-    const value = await promptText("What is your app called?", "My Site");
-    if (value === null)
-      return c2.error({
-        code: "CANCELLED",
-        message: "Cancelled.",
-        exitCode: 130
-      });
-    name = value;
   }
-  if (!linked) {
-    const apps = await listApps();
+  if (!selected) {
+    const name = await promptText("What is your app called?", "My Site");
+    if (name === null) cancelled();
     const slug = slugify(name);
-    const similar = apps.filter(
-      (a) => slugify(a.name) === slug || a.route === (options.route ?? slug)
+    const routeInput = await promptText(
+      "Which route should it live at? (your-route.whop.app)",
+      slug,
+      slug
     );
-    if (similar.length > 0 && !c2.agent) {
-      const choice = await select({
-        message: `Found existing app${similar.length > 1 ? "s" : ""} with a similar name \u2014 link one or create new?`,
-        options: [
-          ...similar.map((a) => ({
-            value: a.id,
-            label: `Link ${a.name} (${a.id}${a.route ? `, ${a.route}` : ""})`
-          })),
-          { value: "__new__", label: `Create a new app called "${name}"` }
-        ]
+    if (routeInput === null) cancelled();
+    const route = slugify(routeInput);
+    if (!route) {
+      throw new DeployAbort({
+        code: "ROUTE_REQUIRED",
+        message: `Couldn't derive a route from "${routeInput}" \u2014 use letters and numbers (e.g. my-site).`,
+        retryable: true
       });
-      if (isCancel(choice))
-        return c2.error({
-          code: "CANCELLED",
-          message: "Cancelled.",
-          exitCode: 130
-        });
-      if (choice !== "__new__") {
-        linked = similar.find((a) => a.id === choice) ?? null;
-      }
-    } else if (similar.length > 0 && c2.agent) {
-      return c2.error({
-        code: "SIMILAR_APPS_FOUND",
-        message: `Existing app(s) with a similar name: ${similar.map((a) => `${a.name} (${a.id})`).join(
-          ", "
-        )}. Pass --link <app_id> to link one, or --name with a distinct name to create new.`,
+    }
+    try {
+      selected = await createApp({ name, route });
+    } catch (err) {
+      throw new DeployAbort({
+        code: "CREATE_FAILED",
+        message: err instanceof Error ? err.message : "Failed to register the app",
         retryable: true
       });
     }
   }
-  let route = options.route ?? slugify(name);
-  if (!options.route && !linked && !c2.agent) {
-    const value = await promptText(
-      "Which route should it live at? (your-route.whop.app)",
-      slugify(name),
-      slugify(name)
-    );
-    if (value === null)
-      return c2.error({
-        code: "CANCELLED",
-        message: "Cancelled.",
-        exitCode: 130
-      });
-    route = slugify(value);
+  const config = await withRoute(c2, selected);
+  writeAppConfig(projectDir, config);
+  log(
+    c2,
+    chalk.dim(
+      `Linked ${config.name} (${config.app_id}) \u2192 ${APP_CONFIG_FILENAME}`
+    )
+  );
+  return config;
+}
+async function withRoute(c2, app) {
+  if (app.route) return { app_id: app.id, name: app.name, route: app.route };
+  if (c2.agent) {
+    throw new DeployAbort({
+      code: "ROUTE_REQUIRED",
+      message: `App ${app.id} (${app.name}) has no route \u2014 hosted apps are served from <route>.whop.app. Ask the user which route to claim, then run:
+  whop apps update ${app.id} --route <route>
+  whop apps deploy --app ${app.id}`,
+      retryable: true,
+      cta: {
+        commands: [
+          {
+            command: `apps update ${app.id}`,
+            description: "Set the route (pass --route)"
+          }
+        ]
+      }
+    });
   }
-  if (!route && !linked?.route) {
-    return c2.error({
+  const slug = slugify(app.name);
+  const routeInput = await promptText(
+    `${app.name} has no route yet. Which route should it live at? (your-route.whop.app)`,
+    slug,
+    slug
+  );
+  if (routeInput === null) cancelled();
+  const route = slugify(routeInput);
+  if (!route) {
+    throw new DeployAbort({
       code: "ROUTE_REQUIRED",
-      message: `Couldn't derive a route from "${name}" \u2014 pass --route with letters and numbers (e.g. --route my-site).`,
+      message: `Couldn't derive a route from "${routeInput}" \u2014 use letters and numbers (e.g. my-site).`,
       retryable: true
     });
   }
-  let whopApp;
   try {
-    if (linked) {
-      whopApp = linked;
-      route = options.route ?? linked.route ?? slugify(name);
-      if (!linked.route || options.route && options.route !== linked.route) {
-        whopApp = await updateAppRoute(linked.id, route);
-      }
-    } else {
-      whopApp = await createApp({
-        name,
-        route,
-        ...options.companyId ? { company_id: options.companyId } : {}
-      });
-    }
+    const updated = await updateAppRoute(app.id, route);
+    return {
+      app_id: updated.id,
+      name: updated.name,
+      route: updated.route ?? route
+    };
   } catch (err) {
-    return c2.error({
-      code: "CREATE_FAILED",
-      message: err instanceof Error ? err.message : "Failed to register the app",
+    throw new DeployAbort({
+      code: "UPDATE_FAILED",
+      message: err instanceof Error ? err.message : "Failed to set the route",
       retryable: true
     });
   }
-  writeAppConfig(projectDir, { app_id: whopApp.id, name, route });
-  const { manualSteps } = whopifyProject({ targetDir: projectDir, route });
-  if (manualSteps.length > 0) {
-    return c2.error({
-      code: "WHOPIFY_INCOMPLETE",
-      message: `${name} is registered on Whop (${whopApp.id}) and ${APP_CONFIG_FILENAME} is written, but the project isn't fully wired for hosting yet. Complete these steps:
-
-${formatManualSteps(manualSteps)}
-
-Then run \`whop apps deploy\`. Re-running \`whop apps create --existing\` re-checks the wiring and applies anything it can.`
-    });
-  }
-  const url = whopApp.hosted_url ?? void 0;
-  if (!c2.agent && !c2.formatExplicit) {
-    console.log(
-      [
-        "",
-        chalk.green.bold(`\u2713 ${linked ? "Linked" : "Created"} ${name}`),
-        `  ${chalk.dim(whopApp.id)}${url ? ` \u2192 ${chalk.cyan.underline(url)}` : ""}`,
-        "",
-        `${chalk.bold("Next")}  ${chalk.cyan.bold("whop apps deploy")}`,
-        ""
-      ].join("\n")
-    );
-  }
-  return c2.ok({ id: whopApp.id, name, route, url, directory: projectDir });
 }
-function buildAppGroup() {
-  const app = Cli_exports.create("apps", {
-    description: "Build and deploy fully-hosted web apps on Whop (*.whop.app)"
+function resolveSecretsAppId(appOption) {
+  if (appOption) return appOption;
+  const projectDir = findProjectDir();
+  const config = projectDir ? readAppConfig(projectDir) : null;
+  if (config) return config.app_id;
+  throw new Error(
+    `No app specified. Pass --app app_xxx or run inside a project with ${APP_CONFIG_FILENAME}.`
+  );
+}
+function buildSecretsGroup() {
+  const secrets = Cli_exports.create("secrets", {
+    description: "Manage app secrets \u2014 encrypted at rest, injected as env bindings into the hosted runtime and `whop apps dev`"
   });
-  app.command("create", {
-    description: "Create a Whop app: scaffold a new project (default) or wire up an existing one",
-    hint: "Registers the app on Whop, writes whop.app.json, and wires the whop() deploy plugin into the vite config. By default it scaffolds the latest TanStack Start template into ./<route>. Pass --existing to register + whopify the Vite project in the current directory (or --dir) instead \u2014 safe to re-run, already-linked projects just get their wiring re-checked. --link reuses an existing app record in either mode.",
-    args: external_exports.object({
-      name: external_exports.string().optional().describe("App name (e.g. 'My Site'; when linking, defaults to the linked app's name)")
+  secrets.command("list", {
+    description: "Show the app's secrets",
+    options: external_exports.object({
+      app: external_exports.string().optional().describe("App id (defaults to the project's linked app)")
     }),
+    run: async (c2) => {
+      const remote = await getApp(resolveSecretsAppId(c2.options.app));
+      return c2.ok({ app_id: remote.id, secrets: remote.secrets ?? {} });
+    }
+  });
+  secrets.command("set", {
+    description: "Add or overwrite secrets",
     options: external_exports.object({
-      route: external_exports.string().optional().describe("Subdomain route to claim (e.g. my-site \u2192 my-site.whop.app)"),
-      dir: external_exports.string().optional().describe(
-        "Directory to scaffold into (defaults to ./<route>); with --existing, the project directory (defaults to the current directory)"
-      ),
-      existing: external_exports.boolean().optional().describe(
-        "Wire up the existing Vite project here instead of scaffolding a new one"
-      ),
-      link: external_exports.string().optional().describe(
-        "Reuse an existing app by id (app_xxx) instead of creating a new one \u2014 works when scaffolding and with --existing"
-      ),
-      company_id: external_exports.string().optional().describe(
-        "Business account to create the app under (defaults to your active account)"
-      ),
-      install: external_exports.boolean().optional().describe(
-        "Install dependencies after scaffolding fresh (default: true)"
-      ),
-      pm: external_exports.enum(["npm", "pnpm", "bun", "yarn"]).optional().describe(
-        "Package manager to use (default: first of bun, pnpm, npm found on your PATH)"
-      )
+      secret: external_exports.array(external_exports.string()).min(1).describe("KEY=VALUE pair (repeatable)"),
+      app: external_exports.string().optional().describe("App id (defaults to the project's linked app)")
     }),
-    output: AppSchema,
-    outputPolicy: "agent-only",
     examples: [
-      {
-        args: { name: "My Site" },
-        options: { route: "my-site" },
-        description: "Scaffold 'My Site' into ./my-site, live at my-site.whop.app"
-      },
-      {
-        args: { name: "My Site" },
-        options: { existing: true },
-        description: "Register + wire up the Vite project in the current directory"
-      }
+      { options: { secret: ["MAIL_API_KEY=mail-key-123"] } },
+      { options: { secret: ["A=1", "B=2"], app: "app_xxxxxxxx" } }
     ],
     run: async (c2) => {
-      const explicitDir = c2.options.dir ? resolve2(c2.options.dir) : void 0;
-      if (c2.options.existing) {
-        const linkedDir = explicitDir ?? findProjectDir();
-        const projectDir = linkedDir && readAppConfig(linkedDir) ? linkedDir : explicitDir ?? process.cwd();
-        return runRegisterFlow(c2, {
-          dir: projectDir,
-          name: c2.args.name,
-          route: c2.options.route,
-          link: c2.options.link,
-          companyId: c2.options.company_id
-        });
-      }
-      if (!explicitDir && existsSync3(join3(process.cwd(), "package.json"))) {
-        log(
-          c2,
-          chalk.dim(
-            "Detected an existing project here \u2014 scaffolding a new app in a subdirectory. Pass --existing to wire up this project instead."
-          )
-        );
-      }
-      let linked = null;
-      if (c2.options.link) {
-        const apps = await listApps();
-        linked = apps.find((a) => a.id === c2.options.link) ?? null;
-        if (!linked) {
-          return c2.error({
-            code: "APP_NOT_FOUND",
-            message: `No app ${c2.options.link} found on your account.`
-          });
-        }
-      }
-      let name = c2.args.name ?? linked?.name;
-      if (!name) {
-        if (c2.agent) {
+      const updates = {};
+      for (const pair of c2.options.secret) {
+        const eq = pair.indexOf("=");
+        if (eq <= 0) {
           return c2.error({
-            code: "NAME_REQUIRED",
-            message: 'Pass a name: `whop apps create "My Site"`.',
-            retryable: true
-          });
-        }
-        const value = await promptText("What is your app called?", "My Site");
-        if (value === null)
-          return c2.error({
-            code: "CANCELLED",
-            message: "Cancelled.",
-            exitCode: 130
-          });
-        name = value;
-      }
-      let route = c2.options.route ?? linked?.route ?? slugify(name);
-      if (!c2.options.route && !linked?.route && !c2.agent) {
-        const value = await promptText(
-          "Which route should it live at? (your-route.whop.app)",
-          slugify(name),
-          slugify(name)
-        );
-        if (value === null)
-          return c2.error({
-            code: "CANCELLED",
-            message: "Cancelled.",
-            exitCode: 130
-          });
-        route = slugify(value);
-      }
-      if (!route) {
-        return c2.error({
-          code: "ROUTE_REQUIRED",
-          message: `Couldn't derive a route from "${name}" \u2014 pass --route with letters and numbers (e.g. --route my-site).`,
-          retryable: true
-        });
-      }
-      let pm = c2.options.pm;
-      if (pm && !isPmInstalled(pm)) {
-        return c2.error({
-          code: "PM_NOT_INSTALLED",
-          message: `${pm} is not installed (or not on your PATH). Install it: ${pmInstallHint(pm)}`
-        });
-      }
-      if (!pm) pm = detectPackageManager() ?? void 0;
-      if (!pm) {
-        if (c2.agent) {
-          return c2.error({
-            code: "NO_PACKAGE_MANAGER",
-            message: `No package manager found (looked for bun, pnpm, npm). Install bun (recommended): ${pmInstallHint("bun")} \u2014 then re-run \`whop apps create\`.`
-          });
-        }
-        const choice = await select({
-          message: "No package manager found (bun, pnpm, or npm). Which one do you want to install?",
-          options: [
-            { value: "bun", label: "bun", hint: "recommended" },
-            { value: "pnpm", label: "pnpm" },
-            { value: "npm", label: "npm", hint: "comes with Node.js" }
-          ]
-        });
-        if (isCancel(choice)) {
-          return c2.error({
-            code: "CANCELLED",
-            message: "Cancelled.",
-            exitCode: 130
-          });
-        }
-        return c2.error({
-          code: "NO_PACKAGE_MANAGER",
-          message: `Install ${String(choice)} with:
-
-  ${pmInstallHint(choice)}
-
-then re-run \`whop apps create\`.`
-        });
-      }
-      const targetDir = resolve2(c2.options.dir ?? `./${route}`);
-      if (existsSync3(targetDir) && readdirSync(targetDir).length > 0) {
-        return c2.error({
-          code: "TARGET_NOT_EMPTY",
-          message: `Target directory is not empty: ${targetDir}. Choose an empty directory with --dir, or a different route.`
-        });
-      }
-      let whopApp;
-      try {
-        if (linked) {
-          whopApp = linked;
-          if (!linked.route || c2.options.route && c2.options.route !== linked.route) {
-            whopApp = await updateAppRoute(linked.id, route);
-          }
-        } else {
-          whopApp = await createApp({
-            name,
-            route,
-            ...c2.options.company_id ? { company_id: c2.options.company_id } : {}
+            code: "INVALID_SECRET",
+            message: `"${pair}" is not KEY=VALUE. Use --secret NAME=value (an empty value deletes the secret).`
           });
         }
-      } catch (err) {
-        return c2.error({
-          code: "CREATE_FAILED",
-          message: err instanceof Error ? err.message : "Failed to create the app on Whop",
-          retryable: true
-        });
-      }
-      let whopifySteps = [];
-      try {
-        log(
-          c2,
-          chalk.dim("\nScaffolding with the latest TanStack Start template...")
-        );
-        runTanstackCreate({
-          targetDir,
-          projectName: route,
-          pm,
-          quiet: Boolean(c2.agent)
-        });
-        whopifySteps = whopifyProject({ targetDir, route }).manualSteps;
-      } catch (err) {
-        return c2.error({
-          code: "SCAFFOLD_FAILED",
-          message: err instanceof Error ? err.message : "Failed to scaffold the project"
-        });
-      }
-      writeAppConfig(targetDir, { app_id: whopApp.id, name, route });
-      if (whopifySteps.length > 0) {
-        return c2.error({
-          code: "WHOPIFY_INCOMPLETE",
-          message: `Scaffolded ${targetDir} and registered ${whopApp.id}, but the project needs manual wiring:
-
-${formatManualSteps(whopifySteps)}
-
-Then run \`whop apps deploy\`. Re-running \`whop apps create --existing\` in the project re-checks the wiring.`
-        });
+        updates[pair.slice(0, eq)] = pair.slice(eq + 1);
       }
-      let installFailed = false;
-      if (c2.options.install !== false) {
-        log(c2, chalk.dim(`
-Installing dependencies with ${pm}...`));
-        const result = spawnSync2(pm, ["install"], {
-          cwd: targetDir,
-          stdio: c2.agent ? "ignore" : "inherit",
-          shell: SPAWN_VIA_SHELL2
-        });
-        installFailed = Boolean(result.error) || result.status !== 0;
-        if (installFailed) {
-          log(
-            c2,
-            chalk.yellow(
-              `
-${pm} install failed \u2014 run it manually inside ${targetDir}.`
-            )
-          );
-        }
-      }
-      const url = whopApp.hosted_url ?? void 0;
-      if (!c2.agent && !c2.formatExplicit) {
-        console.log(
-          [
-            "",
-            chalk.green.bold(`\u2713 ${name} is ready`),
-            `  ${chalk.dim(whopApp.id)}`,
-            "",
-            `  ${chalk.bold("Directory")}  ${targetDir}`,
-            ...url ? [
-              `  ${chalk.bold("URL")}        ${chalk.cyan.underline(url)} ${chalk.dim("(after first deploy)")}`
-            ] : [],
-            "",
-            `${chalk.bold("Next")}`,
-            `  cd ${targetDir}`,
-            `  ${chalk.cyan.bold("whop apps dev")}      ${chalk.dim("\u2192 local dev server")}`,
-            `  ${chalk.cyan.bold("whop apps deploy")}   ${chalk.dim("\u2192 ship it live")}`,
-            ""
-          ].join("\n")
-        );
-      }
-      return c2.ok({
-        id: whopApp.id,
-        name,
-        route,
-        url,
-        directory: targetDir,
-        install_failed: installFailed
-      });
+      const remote = await updateAppSecrets(
+        resolveSecretsAppId(c2.options.app),
+        updates
+      );
+      return c2.ok({ app_id: remote.id, secrets: remote.secrets ?? {} });
     }
   });
-  app.command("list", {
-    description: "List the apps on your business account",
-    output: external_exports.array(AppSchema),
-    outputPolicy: "agent-only",
+  secrets.command("unset", {
+    description: "Delete secrets by name",
+    options: external_exports.object({
+      key: external_exports.array(external_exports.string()).min(1).describe("Secret name (repeatable)"),
+      app: external_exports.string().optional().describe("App id (defaults to the project's linked app)")
+    }),
+    examples: [{ options: { key: ["MAIL_API_KEY"] } }],
     run: async (c2) => {
-      const apps = await listApps();
-      return c2.ok(
-        apps.map((a) => ({
-          id: a.id,
-          name: a.name,
-          route: a.route,
-          url: a.hosted_url ?? void 0
-        }))
+      const updates = {};
+      for (const key of c2.options.key) updates[key] = null;
+      const remote = await updateAppSecrets(
+        resolveSecretsAppId(c2.options.app),
+        updates
       );
+      return c2.ok({ app_id: remote.id, secrets: remote.secrets ?? {} });
     }
   });
+  return secrets;
+}
+async function buildAppGroup() {
+  const app = Cli_exports.create("apps", {
+    description: "Build and deploy fully-hosted web apps on Whop (*.whop.app)"
+  });
+  await registerSpecCommands(app, "Apps");
+  const builds = Cli_exports.create("builds", {
+    description: "Manage app builds (list, inspect, promote)"
+  });
+  await registerSpecCommands(builds, "App builds");
+  app.command(builds);
+  app.command(buildSecretsGroup());
   app.command("dev", {
     description: "Run the local dev server for this app",
     hint: "Starts the project's dev script with WHOP_APP_ID set and a short-lived access token injected as WHOP_API_KEY (minted from your CLI credential), so server-side SDK calls work locally without env setup. An explicitly exported WHOP_API_KEY is used as-is.",
@@ -1515,10 +1466,24 @@ ${pm} install failed \u2014 run it manually inside ${targetDir}.`
       dir: external_exports.string().optional().describe("Project directory (defaults to the current directory)")
     }),
     run: async (c2) => {
-      const project = loadProject(c2.options.dir);
-      if (!project.ok) return c2.error(project.error);
+      const projectDir = c2.options.dir ? resolve2(c2.options.dir) : findProjectDir();
+      const config = projectDir ? readAppConfig(projectDir) : null;
+      if (!projectDir || !config) {
+        return c2.error({
+          code: "NO_PROJECT",
+          message: `No ${APP_CONFIG_FILENAME} found in this directory or any parent. Run \`whop apps deploy\` to link this project to a Whop app.`,
+          cta: {
+            commands: [
+              {
+                command: "apps deploy",
+                description: "Link this project to a Whop app and ship it"
+              }
+            ]
+          }
+        });
+      }
       const injected = {
-        WHOP_APP_ID: project.config.app_id
+        WHOP_APP_ID: config.app_id
       };
       if (process.env.WHOP_API_KEY) {
         log(
@@ -1548,9 +1513,43 @@ ${pm} install failed \u2014 run it manually inside ${targetDir}.`
           );
         }
       }
-      log(c2, chalk.dim(`Starting dev server for ${project.config.name}...`));
       try {
-        runScript(project.projectDir, "dev", injected);
+        const remote = await getApp(config.app_id);
+        const secretEntries = Object.entries(remote.secrets ?? {}).filter(
+          ([key]) => !(key in process.env) && !(key in injected)
+        );
+        const unsafe = secretEntries.filter(([key]) => isUnsafeDevEnvKey(key));
+        for (const [key, value] of secretEntries) {
+          if (!isUnsafeDevEnvKey(key)) injected[key] = value;
+        }
+        if (unsafe.length > 0) {
+          log(
+            c2,
+            chalk.yellow(
+              `Skipped app secret${unsafe.length === 1 ? "" : "s"} ${unsafe.map(([key]) => key).join(", ")} \u2014 these names control the local runtime and are never injected by \`whop apps dev\`.`
+            )
+          );
+        }
+        const injectedCount = secretEntries.length - unsafe.length;
+        if (injectedCount > 0) {
+          log(
+            c2,
+            chalk.dim(
+              `Injected ${injectedCount} app secret${injectedCount === 1 ? "" : "s"} into the environment (${secretEntries.filter(([key]) => !isUnsafeDevEnvKey(key)).map(([key]) => key).join(", ")}).`
+            )
+          );
+        }
+      } catch (err) {
+        log(
+          c2,
+          chalk.yellow(
+            `Couldn't fetch app secrets (${err instanceof Error ? err.message : "unknown error"}) \u2014 continuing without them.`
+          )
+        );
+      }
+      log(c2, chalk.dim(`Starting dev server for ${config.name}...`));
+      try {
+        runScript(projectDir, "dev", injected);
       } catch (err) {
         return c2.error({
           code: "DEV_FAILED",
@@ -1562,12 +1561,13 @@ ${pm} install failed \u2014 run it manually inside ${targetDir}.`
   });
   app.command("deploy", {
     description: "Build, upload and ship this app live",
-    hint: "Typechecks, builds with Vite, uploads the build to Whop, and promotes it to production. Use --no-promote to upload a preview-only build.",
+    hint: "The one-stop deploy: verifies the project is a Whop-ready Vite app (offering to scaffold or link one if not), builds, typechecks, uploads the build, and promotes it to production. Use --skip_promote to upload a preview-only build, then promote it later with `whop apps builds promote <build_id>`.",
     options: external_exports.object({
       dir: external_exports.string().optional().describe("Project directory (defaults to the current directory)"),
-      promote: external_exports.boolean().optional().describe(
-        "Promote this build to production after upload (default: true)"
+      app: external_exports.string().optional().describe(
+        "Link this project to an app (app_xxx) before deploying \u2014 writes whop.app.json, replacing any existing link"
       ),
+      skip_promote: external_exports.boolean().optional().describe("Upload the build without promoting it to production"),
       skip_typecheck: external_exports.boolean().optional().describe("Skip the typecheck step"),
       skip_build: external_exports.boolean().optional().describe("Skip the build step and upload the existing dist/ output")
     }),
@@ -1576,20 +1576,45 @@ ${pm} install failed \u2014 run it manually inside ${targetDir}.`
     examples: [
       { description: "Build and ship to production" },
       {
-        options: { promote: false },
+        options: { app: "app_xxxxxxxx" },
+        description: "Link this project to an existing app, then deploy"
+      },
+      {
+        options: { skip_promote: true },
         description: "Upload a preview build without promoting"
       }
     ],
     run: async (c2) => {
-      const project = loadProject(c2.options.dir);
-      if (!project.ok) return c2.error(project.error);
-      const { projectDir, config } = project;
       try {
+        const pm = ensurePackageManager();
+        const { projectDir, freshlyScaffolded } = await ensureViteApp(
+          c2,
+          pm,
+          c2.options.dir
+        );
+        const config = await ensureAppLinked(c2, projectDir, c2.options.app);
+        const { manualSteps } = whopifyProject({
+          targetDir: projectDir,
+          route: config.route
+        });
+        if (manualSteps.length > 0) {
+          return c2.error({
+            code: "WHOPIFY_INCOMPLETE",
+            message: `${config.name} is linked (${config.app_id}), but the project isn't fully wired for Whop hosting yet. Complete these steps:
+
+${formatManualSteps(manualSteps)}
+
+Then re-run \`whop apps deploy\` \u2014 it re-checks the wiring and applies anything it can.`
+          });
+        }
         if (!c2.options.skip_build) {
-          log(c2, chalk.dim("[1/3] Building..."));
+          if (freshlyScaffolded || !existsSync3(join3(projectDir, "node_modules", "@whop", "cli"))) {
+            runInstall(c2, projectDir);
+          }
+          log(c2, chalk.dim("[1/4] Building..."));
           runScript(projectDir, "build", { WHOP_APP_ID: config.app_id });
           if (!c2.options.skip_typecheck && hasScript(projectDir, "typecheck")) {
-            log(c2, chalk.dim("[2/3] Typechecking..."));
+            log(c2, chalk.dim("[2/4] Typechecking..."));
             runScript(projectDir, "typecheck");
           }
         }
@@ -1600,26 +1625,50 @@ ${pm} install failed \u2014 run it manually inside ${targetDir}.`
             message: `No build archive at ${BUILD_ARCHIVE}. Add the whop() plugin from @whop/cli/vite to your vite config, then build. See https://whop.com/docs/apps/hosting.`
           });
         }
-        log(c2, chalk.dim("[3/3] Uploading + creating build..."));
         const zip = readFileSync3(archivePath);
+        const sizeMb = (zip.byteLength / 1024 / 1024).toFixed(1);
         const checksum = createHash("sha256").update(zip).digest("hex");
-        const fileId = await uploadBuildArchive(
-          new Uint8Array(zip),
-          `${config.route}-build.zip`
-        );
-        await waitForFileReady(fileId);
-        let build = await createAppBuild({
-          app_id: config.app_id,
-          checksum,
-          file_id: fileId
-        });
-        if (c2.options.promote !== false) {
-          await promoteAppBuild(build.id);
-          build = await waitForBuildPromotion(build.id);
+        const spin = c2.agent ? null : spinner();
+        spin?.start(`[3/4] Uploading build archive (${sizeMb} MB)`);
+        let build;
+        try {
+          const fileId = await uploadBuildArchive(
+            new Uint8Array(zip),
+            `${config.route}-build.zip`
+          );
+          spin?.message("[3/4] Processing archive");
+          await waitForFileReady(fileId);
+          spin?.message("[3/4] Creating build");
+          build = await createAppBuild({
+            app_id: config.app_id,
+            checksum,
+            file_id: fileId
+          });
+          spin?.stop(`[3/4] Build uploaded (${build.id})`);
+        } catch (err) {
+          spin?.error("[3/4] Upload failed");
+          throw err;
+        }
+        if (!c2.options.skip_promote) {
+          const promoteSpin = c2.agent ? null : spinner();
+          promoteSpin?.start("[4/4] Promoting to production");
+          try {
+            await promoteAppBuild(build.id);
+            build = await waitForBuildPromotion(build.id);
+            promoteSpin?.stop(
+              build.is_production ? "[4/4] Promoted to production" : `[4/4] Promotion pending (status: ${build.status})`
+            );
+          } catch (err) {
+            promoteSpin?.error("[4/4] Promote failed");
+            throw err;
+          }
+        } else {
+          log(c2, chalk.dim("[4/4] Skipping promotion (--skip_promote)"));
         }
         const promoted = build.is_production === true;
         const productionUrl = promoted ? (await getApp(config.app_id)).hosted_url ?? void 0 : void 0;
         if (!c2.agent && !c2.formatExplicit) {
+          const cdTarget = relative(process.cwd(), projectDir) || ".";
           console.log(
             [
               "",
@@ -1631,19 +1680,39 @@ ${pm} install failed \u2014 run it manually inside ${targetDir}.`
               ...promoted && productionUrl ? [
                 `  ${chalk.bold("Live")}  ${chalk.cyan.underline(productionUrl)}`
               ] : [
-                `${chalk.bold("Promote when ready")}  ${chalk.cyan.bold(`whop apps promote ${build.id}`)}`
+                `${chalk.bold("Promote when ready")}  ${chalk.cyan.bold(`whop apps builds promote ${build.id}`)}`
               ],
+              ...freshlyScaffolded ? [
+                "",
+                chalk.bold("Next"),
+                ...cdTarget !== "." ? [`  cd ${cdTarget}`] : [],
+                `  ${chalk.cyan.bold("whop apps dev")}      ${chalk.dim("\u2192 local dev server")}`,
+                `  ${chalk.cyan.bold("whop apps deploy")}   ${chalk.dim("\u2192 ship your changes")}`
+              ] : [],
               ""
             ].join("\n")
           );
         }
-        return c2.ok({
-          id: build.id,
-          status: build.status,
-          is_production: promoted,
-          url: productionUrl
-        });
+        return c2.ok(
+          {
+            id: build.id,
+            status: build.status,
+            is_production: promoted,
+            url: productionUrl
+          },
+          promoted ? void 0 : {
+            cta: {
+              commands: [
+                {
+                  command: `apps builds promote ${build.id}`,
+                  description: "Promote this build to production"
+                }
+              ]
+            }
+          }
+        );
       } catch (err) {
+        if (err instanceof DeployAbort) return c2.error(err.options);
         return c2.error({
           code: "DEPLOY_FAILED",
           message: err instanceof Error ? err.message : "Deploy failed",
@@ -1652,91 +1721,6 @@ ${pm} install failed \u2014 run it manually inside ${targetDir}.`
       }
     }
   });
-  app.command("promote", {
-    description: "Promote a previously uploaded build to production",
-    args: external_exports.object({
-      build_id: external_exports.string().describe("The build to promote (apbu_xxx)")
-    }),
-    options: external_exports.object({
-      dir: external_exports.string().optional().describe("Project directory (defaults to the current directory)")
-    }),
-    output: BuildSchema,
-    outputPolicy: "agent-only",
-    run: async (c2) => {
-      const project = loadProject(c2.options.dir);
-      if (!project.ok) return c2.error(project.error);
-      try {
-        await promoteAppBuild(c2.args.build_id);
-        const build = await waitForBuildPromotion(c2.args.build_id);
-        if (!build.is_production) {
-          return c2.error({
-            code: "PROMOTE_PENDING",
-            message: `Build ${build.id} was accepted but is still processing (status: ${build.status}). It will go live once approved \u2014 re-run \`whop apps promote ${build.id}\` to confirm.`,
-            retryable: true
-          });
-        }
-        const url = (await getApp(project.config.app_id)).hosted_url ?? void 0;
-        if (!c2.agent && !c2.formatExplicit) {
-          console.log(
-            [
-              "",
-              chalk.green.bold("\u2713 Promoted to production"),
-              `  ${chalk.dim(build.id)}`,
-              ...url ? [`  ${chalk.bold("Live")}  ${chalk.cyan.underline(url)}`] : [],
-              ""
-            ].join("\n")
-          );
-        }
-        return c2.ok({
-          id: build.id,
-          status: build.status,
-          is_production: build.is_production,
-          url
-        });
-      } catch (err) {
-        return c2.error({
-          code: "PROMOTE_FAILED",
-          message: err instanceof Error ? err.message : "Promote failed",
-          retryable: true
-        });
-      }
-    }
-  });
-  app.command("builds", {
-    description: "List builds for this app",
-    options: external_exports.object({
-      dir: external_exports.string().optional().describe("Project directory (defaults to the current directory)")
-    }),
-    output: external_exports.object({ builds: external_exports.array(BuildSchema) }),
-    outputPolicy: "agent-only",
-    run: async (c2) => {
-      const project = loadProject(c2.options.dir);
-      if (!project.ok) return c2.error(project.error);
-      try {
-        const builds = await listAppBuilds(project.config.app_id);
-        const rows = builds.map((build) => ({
-          id: build.id,
-          status: build.status,
-          is_production: build.is_production
-        }));
-        if (!c2.agent && !c2.formatExplicit) {
-          console.log("");
-          for (const row of rows) {
-            const marker = row.is_production ? chalk.green("\u25CF production") : chalk.dim(`\u25CB ${row.status}`);
-            console.log(`  ${row.id}  ${marker}`);
-          }
-          console.log("");
-        }
-        return c2.ok({ builds: rows });
-      } catch (err) {
-        return c2.error({
-          code: "LIST_FAILED",
-          message: err instanceof Error ? err.message : "Failed to list builds",
-          retryable: true
-        });
-      }
-    }
-  });
   return app;
 }
 
@@ -2356,7 +2340,7 @@ ${c.success("\u2713 Your store is fully set up.")}`);
 // package.json
 var package_default = {
   name: "@whop/cli",
-  version: "0.3.0",
+  version: "0.5.0",
   description: "The Whop CLI \u2014 build and manage Whop apps from your terminal. Human and agent friendly.",
   keywords: [
     "agent",
@@ -2504,7 +2488,7 @@ var DEFAULT_MANIFEST_URL = "https://github.com/whopio/whop-public-cli/releases/l
 function manifestUrl(env = process.env) {
   return env.WHOP_CLI_MANIFEST_URL?.trim() || DEFAULT_MANIFEST_URL;
 }
-var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var CHECK_INTERVAL_MS = 60 * 60 * 1e3;
 function cachePath(env) {
   return path.join(configDir(env), "update-check.json");
 }
@@ -2874,7 +2858,7 @@ var HANDWRITTEN_GROUPS = [
     name: "apps",
     description: "Build and deploy fully-hosted web apps (*.whop.app)",
     section: "get-started",
-    register: (cli2) => cli2.command(buildAppGroup())
+    register: async (cli2) => cli2.command(await buildAppGroup())
   },
   {
     name: "upgrade",
@@ -2931,8 +2915,8 @@ var HANDWRITTEN_GROUP_NAMES = new Set(
 );
 var API_GROUPS = groups_default.map(([name, tag]) => ({ name, tag })).filter(({ name }) => !HANDWRITTEN_GROUP_NAMES.has(name));
 var COMMAND_GROUPS = [...API_GROUPS, ...HANDWRITTEN_GROUPS];
-function registerHandwrittenGroups(cli2) {
-  for (const group of HANDWRITTEN_GROUPS) group.register(cli2);
+async function registerHandwrittenGroups(cli2) {
+  for (const group of HANDWRITTEN_GROUPS) await group.register(cli2);
 }
 async function setupAgents(cli2) {
   for (const argv2 of [
@@ -3073,7 +3057,7 @@ cli.use(async (c2, next) => {
   }
   return next();
 });
-registerHandwrittenGroups(cli);
+await registerHandwrittenGroups(cli);
 for (const { name, tag } of API_GROUPS) {
   cli.command(name, { fetch: fetch2, openapi: spec(tag) });
 }
@@ -3128,6 +3112,12 @@ var api_structure_default = [
       "Audiences"
     ]
   },
+  {
+    group: "Media",
+    tags: [
+      "Media"
+    ]
+  },
   {
     group: "Identity",
     tags: [