@whop/cli 0.4.0 → 0.5.0

package/dist/index.js

@@ -35,7 +35,7 @@ import {
   switchProfile,
   upsertProfile,
   validateApiKey
-} from "./chunk-2K4WBZA5.js";
+} from "./chunk-X34EUMEM.js";
 import {
   external_exports
 } from "./chunk-KFCNNWPI.js";
@@ -122,6 +122,10 @@ var groups_default = [
     "audiences",
     "Audiences"
   ],
+  [
+    "media",
+    "Media"
+  ],
   [
     "social-accounts",
     "Social Accounts"
@@ -314,7 +318,7 @@ async function loginAdapter(c2) {
   const accountId = getActiveProfile()?.accountId ?? "";
   if (accountId) {
     try {
-      const { createWhopFetch: createWhopFetch2 } = await import("./api-7L74UEG4.js");
+      const { createWhopFetch: createWhopFetch2 } = await import("./api-E6Y2WAEG.js");
       const fetch3 = createWhopFetch2();
       const res = await fetch3(
         new Request(
@@ -644,6 +648,9 @@ async function getApp(appId) {
 async function updateAppRoute(appId, route) {
   return makeWhopRequest("PATCH", `/apps/${appId}`, { route });
 }
+async function updateAppSecrets(appId, secrets) {
+  return makeWhopRequest("PATCH", `/apps/${appId}`, { secrets });
+}
 async function createAppBuild(input) {
   return makeWhopRequest("POST", "/app_builds", {
     app_id: input.app_id,
@@ -984,6 +991,17 @@ function replaceTopLevelName(content, route) {
 
 // src/apps/commands.ts
 var BUILD_ARCHIVE = "dist/whop-build.zip";
+var UNSAFE_DEV_ENV_KEYS = /* @__PURE__ */ new Set([
+  "PATH",
+  "NODE_OPTIONS",
+  "NODE_EXTRA_CA_CERTS",
+  "NODE_REPL_EXTERNAL_MODULE"
+]);
+var UNSAFE_DEV_ENV_PREFIXES = ["NPM_", "PNPM_", "YARN_", "BUN_", "LD_", "DYLD_"];
+function isUnsafeDevEnvKey(key) {
+  const upper = key.toUpperCase();
+  return UNSAFE_DEV_ENV_KEYS.has(upper) || UNSAFE_DEV_ENV_PREFIXES.some((prefix) => upper.startsWith(prefix));
+}
 var BuildSchema = external_exports.object({
   id: external_exports.string(),
   status: external_exports.string(),
@@ -1359,6 +1377,77 @@ async function withRoute(c2, app) {
     });
   }
 }
+function resolveSecretsAppId(appOption) {
+  if (appOption) return appOption;
+  const projectDir = findProjectDir();
+  const config = projectDir ? readAppConfig(projectDir) : null;
+  if (config) return config.app_id;
+  throw new Error(
+    `No app specified. Pass --app app_xxx or run inside a project with ${APP_CONFIG_FILENAME}.`
+  );
+}
+function buildSecretsGroup() {
+  const secrets = Cli_exports.create("secrets", {
+    description: "Manage app secrets \u2014 encrypted at rest, injected as env bindings into the hosted runtime and `whop apps dev`"
+  });
+  secrets.command("list", {
+    description: "Show the app's secrets",
+    options: external_exports.object({
+      app: external_exports.string().optional().describe("App id (defaults to the project's linked app)")
+    }),
+    run: async (c2) => {
+      const remote = await getApp(resolveSecretsAppId(c2.options.app));
+      return c2.ok({ app_id: remote.id, secrets: remote.secrets ?? {} });
+    }
+  });
+  secrets.command("set", {
+    description: "Add or overwrite secrets",
+    options: external_exports.object({
+      secret: external_exports.array(external_exports.string()).min(1).describe("KEY=VALUE pair (repeatable)"),
+      app: external_exports.string().optional().describe("App id (defaults to the project's linked app)")
+    }),
+    examples: [
+      { options: { secret: ["MAIL_API_KEY=mail-key-123"] } },
+      { options: { secret: ["A=1", "B=2"], app: "app_xxxxxxxx" } }
+    ],
+    run: async (c2) => {
+      const updates = {};
+      for (const pair of c2.options.secret) {
+        const eq = pair.indexOf("=");
+        if (eq <= 0) {
+          return c2.error({
+            code: "INVALID_SECRET",
+            message: `"${pair}" is not KEY=VALUE. Use --secret NAME=value (an empty value deletes the secret).`
+          });
+        }
+        updates[pair.slice(0, eq)] = pair.slice(eq + 1);
+      }
+      const remote = await updateAppSecrets(
+        resolveSecretsAppId(c2.options.app),
+        updates
+      );
+      return c2.ok({ app_id: remote.id, secrets: remote.secrets ?? {} });
+    }
+  });
+  secrets.command("unset", {
+    description: "Delete secrets by name",
+    options: external_exports.object({
+      key: external_exports.array(external_exports.string()).min(1).describe("Secret name (repeatable)"),
+      app: external_exports.string().optional().describe("App id (defaults to the project's linked app)")
+    }),
+    examples: [{ options: { key: ["MAIL_API_KEY"] } }],
+    run: async (c2) => {
+      const updates = {};
+      for (const key of c2.options.key) updates[key] = null;
+      const remote = await updateAppSecrets(
+        resolveSecretsAppId(c2.options.app),
+        updates
+      );
+      return c2.ok({ app_id: remote.id, secrets: remote.secrets ?? {} });
+    }
+  });
+  return secrets;
+}
 async function buildAppGroup() {
   const app = Cli_exports.create("apps", {
     description: "Build and deploy fully-hosted web apps on Whop (*.whop.app)"
@@ -1369,6 +1458,7 @@ async function buildAppGroup() {
   });
   await registerSpecCommands(builds, "App builds");
   app.command(builds);
+  app.command(buildSecretsGroup());
   app.command("dev", {
     description: "Run the local dev server for this app",
     hint: "Starts the project's dev script with WHOP_APP_ID set and a short-lived access token injected as WHOP_API_KEY (minted from your CLI credential), so server-side SDK calls work locally without env setup. An explicitly exported WHOP_API_KEY is used as-is.",
@@ -1423,6 +1513,40 @@ async function buildAppGroup() {
           );
         }
       }
+      try {
+        const remote = await getApp(config.app_id);
+        const secretEntries = Object.entries(remote.secrets ?? {}).filter(
+          ([key]) => !(key in process.env) && !(key in injected)
+        );
+        const unsafe = secretEntries.filter(([key]) => isUnsafeDevEnvKey(key));
+        for (const [key, value] of secretEntries) {
+          if (!isUnsafeDevEnvKey(key)) injected[key] = value;
+        }
+        if (unsafe.length > 0) {
+          log(
+            c2,
+            chalk.yellow(
+              `Skipped app secret${unsafe.length === 1 ? "" : "s"} ${unsafe.map(([key]) => key).join(", ")} \u2014 these names control the local runtime and are never injected by \`whop apps dev\`.`
+            )
+          );
+        }
+        const injectedCount = secretEntries.length - unsafe.length;
+        if (injectedCount > 0) {
+          log(
+            c2,
+            chalk.dim(
+              `Injected ${injectedCount} app secret${injectedCount === 1 ? "" : "s"} into the environment (${secretEntries.filter(([key]) => !isUnsafeDevEnvKey(key)).map(([key]) => key).join(", ")}).`
+            )
+          );
+        }
+      } catch (err) {
+        log(
+          c2,
+          chalk.yellow(
+            `Couldn't fetch app secrets (${err instanceof Error ? err.message : "unknown error"}) \u2014 continuing without them.`
+          )
+        );
+      }
       log(c2, chalk.dim(`Starting dev server for ${config.name}...`));
       try {
         runScript(projectDir, "dev", injected);
@@ -1443,9 +1567,7 @@ async function buildAppGroup() {
       app: external_exports.string().optional().describe(
         "Link this project to an app (app_xxx) before deploying \u2014 writes whop.app.json, replacing any existing link"
       ),
-      skip_promote: external_exports.boolean().optional().describe(
-        "Upload the build without promoting it to production"
-      ),
+      skip_promote: external_exports.boolean().optional().describe("Upload the build without promoting it to production"),
       skip_typecheck: external_exports.boolean().optional().describe("Skip the typecheck step"),
       skip_build: external_exports.boolean().optional().describe("Skip the build step and upload the existing dist/ output")
     }),
@@ -2218,7 +2340,7 @@ ${c.success("\u2713 Your store is fully set up.")}`);
 // package.json
 var package_default = {
   name: "@whop/cli",
-  version: "0.4.0",
+  version: "0.5.0",
   description: "The Whop CLI \u2014 build and manage Whop apps from your terminal. Human and agent friendly.",
   keywords: [
     "agent",
@@ -2990,6 +3112,12 @@ var api_structure_default = [
       "Audiences"
     ]
   },
+  {
+    group: "Media",
+    tags: [
+      "Media"
+    ]
+  },
   {
     group: "Identity",
     tags: [