@whop/cli 0.4.0 → 0.6.0

package/dist/index.js

@@ -35,97 +35,145 @@ import {
   switchProfile,
   upsertProfile,
   validateApiKey
-} from "./chunk-2K4WBZA5.js";
+} from "./chunk-GKKJXDPK.js";
 import {
   external_exports
 } from "./chunk-KFCNNWPI.js";
 
 // src/api/groups.json
 var groups_default = [
-  [
-    "accounts",
-    "Accounts"
-  ],
-  [
-    "users",
-    "Users"
-  ],
-  [
-    "stats",
-    "Stats"
-  ],
-  [
-    "ledgers",
-    "Ledgers"
-  ],
-  [
-    "payouts",
-    "Payouts"
-  ],
-  [
-    "cards",
-    "Cards"
-  ],
-  [
-    "transfers",
-    "Transfers"
-  ],
-  [
-    "deposits",
-    "Deposits"
-  ],
-  [
-    "swaps",
-    "Swaps"
-  ],
-  [
-    "verifications",
-    "Verifications"
-  ],
-  [
-    "products",
-    "Products"
-  ],
-  [
-    "plans",
-    "Plans"
-  ],
-  [
-    "checkout-configurations",
-    "Checkout Configurations"
-  ],
-  [
-    "referrals",
-    "Referrals"
-  ],
-  [
-    "people",
-    "People"
-  ],
-  [
-    "events",
-    "Events"
-  ],
-  [
-    "ads",
-    "Ads"
-  ],
-  [
-    "ad-campaigns",
-    "Ad Campaigns"
-  ],
-  [
-    "ad-groups",
-    "Ad Groups"
-  ],
-  [
-    "audiences",
-    "Audiences"
-  ],
-  [
-    "social-accounts",
-    "Social Accounts"
-  ]
+  {
+    name: "accounts",
+    tag: "Accounts",
+    description: "A business on Whop: profile, wallet, capabilities, settings.",
+    group: "Core Resources"
+  },
+  {
+    name: "users",
+    tag: "Users",
+    description: "A person on Whop: profile and connected identities.",
+    group: "Core Resources"
+  },
+  {
+    name: "stats",
+    tag: "Stats",
+    description: "Aggregated financial time series for reporting.",
+    group: "Core Resources"
+  },
+  {
+    name: "ledgers",
+    tag: "Ledgers",
+    description: "The activity feed behind an account or user's balance.",
+    group: "Money"
+  },
+  {
+    name: "payouts",
+    tag: "Payouts",
+    description: "Send money from a balance to a bank or wallet.",
+    group: "Money"
+  },
+  {
+    name: "cards",
+    tag: "Cards",
+    description: "Issue cards that spend from a balance.",
+    group: "Money"
+  },
+  {
+    name: "transfers",
+    tag: "Transfers",
+    description: "Move funds between Whop accounts and users.",
+    group: "Money"
+  },
+  {
+    name: "deposits",
+    tag: "Deposits",
+    description: "Add funds to a balance.",
+    group: "Money"
+  },
+  {
+    name: "swaps",
+    tag: "Swaps",
+    description: "Convert a balance between currencies.",
+    group: "Money"
+  },
+  {
+    name: "verifications",
+    tag: "Verifications",
+    description: "Identity review required before payouts and card issuing.",
+    group: "Money"
+  },
+  {
+    name: "products",
+    tag: "Products",
+    description: "The things you sell. Each owns plans and a store page.",
+    group: "Commerce"
+  },
+  {
+    name: "plans",
+    tag: "Plans",
+    description: "Pricing for a product: one-time, recurring, trials, stock.",
+    group: "Commerce"
+  },
+  {
+    name: "checkout-configurations",
+    tag: "Checkout Configurations",
+    description: "Turn a plan into a shareable, prefilled checkout link.",
+    group: "Commerce"
+  },
+  {
+    name: "referrals",
+    tag: "Referrals",
+    description: "Track who referred a purchase and what they earn.",
+    group: "Commerce"
+  },
+  {
+    name: "people",
+    tag: "People",
+    description: "Visitors and customers of an account, aggregated from pixel events.",
+    group: "Tracking"
+  },
+  {
+    name: "events",
+    tag: "Events",
+    description: "Conversion and engagement events tracked for attribution.",
+    group: "Tracking"
+  },
+  {
+    name: "ads",
+    tag: "Ads",
+    description: "The creative: copy, assets, and destination URL.",
+    group: "Ads"
+  },
+  {
+    name: "ad-campaigns",
+    tag: "Ad Campaigns",
+    description: "Platform, objective, and budget for a set of ads.",
+    group: "Ads"
+  },
+  {
+    name: "ad-groups",
+    tag: "Ad Groups",
+    description: "Audience, placements, and schedule within a campaign.",
+    group: "Ads"
+  },
+  {
+    name: "audiences",
+    tag: "Audiences",
+    description: "Reusable targeting lists for ad groups.",
+    group: "Ads"
+  },
+  {
+    name: "media",
+    tag: "Media",
+    description: "AI-generated assets, billed from a balance, attachable wherever files are accepted.",
+    group: "Media"
+  },
+  {
+    name: "social-accounts",
+    tag: "Social Accounts",
+    description: "Connected Facebook and Instagram accounts that run ads.",
+    group: "Identity"
+  }
 ];
 
 // src/auth/commands.ts
@@ -314,7 +362,7 @@ async function loginAdapter(c2) {
   const accountId = getActiveProfile()?.accountId ?? "";
   if (accountId) {
     try {
-      const { createWhopFetch: createWhopFetch2 } = await import("./api-7L74UEG4.js");
+      const { createWhopFetch: createWhopFetch2 } = await import("./api-P7EWPZKG.js");
       const fetch3 = createWhopFetch2();
       const res = await fetch3(
         new Request(
@@ -644,6 +692,9 @@ async function getApp(appId) {
 async function updateAppRoute(appId, route) {
   return makeWhopRequest("PATCH", `/apps/${appId}`, { route });
 }
+async function updateAppSecrets(appId, secrets) {
+  return makeWhopRequest("PATCH", `/apps/${appId}`, { secrets });
+}
 async function createAppBuild(input) {
   return makeWhopRequest("POST", "/app_builds", {
     app_id: input.app_id,
@@ -984,6 +1035,17 @@ function replaceTopLevelName(content, route) {
 
 // src/apps/commands.ts
 var BUILD_ARCHIVE = "dist/whop-build.zip";
+var UNSAFE_DEV_ENV_KEYS = /* @__PURE__ */ new Set([
+  "PATH",
+  "NODE_OPTIONS",
+  "NODE_EXTRA_CA_CERTS",
+  "NODE_REPL_EXTERNAL_MODULE"
+]);
+var UNSAFE_DEV_ENV_PREFIXES = ["NPM_", "PNPM_", "YARN_", "BUN_", "LD_", "DYLD_"];
+function isUnsafeDevEnvKey(key) {
+  const upper = key.toUpperCase();
+  return UNSAFE_DEV_ENV_KEYS.has(upper) || UNSAFE_DEV_ENV_PREFIXES.some((prefix) => upper.startsWith(prefix));
+}
 var BuildSchema = external_exports.object({
   id: external_exports.string(),
   status: external_exports.string(),
@@ -1359,6 +1421,77 @@ async function withRoute(c2, app) {
     });
   }
 }
+function resolveSecretsAppId(appOption) {
+  if (appOption) return appOption;
+  const projectDir = findProjectDir();
+  const config = projectDir ? readAppConfig(projectDir) : null;
+  if (config) return config.app_id;
+  throw new Error(
+    `No app specified. Pass --app app_xxx or run inside a project with ${APP_CONFIG_FILENAME}.`
+  );
+}
+function buildSecretsGroup() {
+  const secrets = Cli_exports.create("secrets", {
+    description: "Manage app secrets \u2014 encrypted at rest, injected as env bindings into the hosted runtime and `whop apps dev`"
+  });
+  secrets.command("list", {
+    description: "Show the app's secrets",
+    options: external_exports.object({
+      app: external_exports.string().optional().describe("App id (defaults to the project's linked app)")
+    }),
+    run: async (c2) => {
+      const remote = await getApp(resolveSecretsAppId(c2.options.app));
+      return c2.ok({ app_id: remote.id, secrets: remote.secrets ?? {} });
+    }
+  });
+  secrets.command("set", {
+    description: "Add or overwrite secrets",
+    options: external_exports.object({
+      secret: external_exports.array(external_exports.string()).min(1).describe("KEY=VALUE pair (repeatable)"),
+      app: external_exports.string().optional().describe("App id (defaults to the project's linked app)")
+    }),
+    examples: [
+      { options: { secret: ["MAIL_API_KEY=mail-key-123"] } },
+      { options: { secret: ["A=1", "B=2"], app: "app_xxxxxxxx" } }
+    ],
+    run: async (c2) => {
+      const updates = {};
+      for (const pair of c2.options.secret) {
+        const eq = pair.indexOf("=");
+        if (eq <= 0) {
+          return c2.error({
+            code: "INVALID_SECRET",
+            message: `"${pair}" is not KEY=VALUE. Use --secret NAME=value (an empty value deletes the secret).`
+          });
+        }
+        updates[pair.slice(0, eq)] = pair.slice(eq + 1);
+      }
+      const remote = await updateAppSecrets(
+        resolveSecretsAppId(c2.options.app),
+        updates
+      );
+      return c2.ok({ app_id: remote.id, secrets: remote.secrets ?? {} });
+    }
+  });
+  secrets.command("unset", {
+    description: "Delete secrets by name",
+    options: external_exports.object({
+      key: external_exports.array(external_exports.string()).min(1).describe("Secret name (repeatable)"),
+      app: external_exports.string().optional().describe("App id (defaults to the project's linked app)")
+    }),
+    examples: [{ options: { key: ["MAIL_API_KEY"] } }],
+    run: async (c2) => {
+      const updates = {};
+      for (const key of c2.options.key) updates[key] = null;
+      const remote = await updateAppSecrets(
+        resolveSecretsAppId(c2.options.app),
+        updates
+      );
+      return c2.ok({ app_id: remote.id, secrets: remote.secrets ?? {} });
+    }
+  });
+  return secrets;
+}
 async function buildAppGroup() {
   const app = Cli_exports.create("apps", {
     description: "Build and deploy fully-hosted web apps on Whop (*.whop.app)"
@@ -1369,6 +1502,7 @@ async function buildAppGroup() {
   });
   await registerSpecCommands(builds, "App builds");
   app.command(builds);
+  app.command(buildSecretsGroup());
   app.command("dev", {
     description: "Run the local dev server for this app",
     hint: "Starts the project's dev script with WHOP_APP_ID set and a short-lived access token injected as WHOP_API_KEY (minted from your CLI credential), so server-side SDK calls work locally without env setup. An explicitly exported WHOP_API_KEY is used as-is.",
@@ -1423,6 +1557,40 @@ async function buildAppGroup() {
           );
         }
       }
+      try {
+        const remote = await getApp(config.app_id);
+        const secretEntries = Object.entries(remote.secrets ?? {}).filter(
+          ([key]) => !(key in process.env) && !(key in injected)
+        );
+        const unsafe = secretEntries.filter(([key]) => isUnsafeDevEnvKey(key));
+        for (const [key, value] of secretEntries) {
+          if (!isUnsafeDevEnvKey(key)) injected[key] = value;
+        }
+        if (unsafe.length > 0) {
+          log(
+            c2,
+            chalk.yellow(
+              `Skipped app secret${unsafe.length === 1 ? "" : "s"} ${unsafe.map(([key]) => key).join(", ")} \u2014 these names control the local runtime and are never injected by \`whop apps dev\`.`
+            )
+          );
+        }
+        const injectedCount = secretEntries.length - unsafe.length;
+        if (injectedCount > 0) {
+          log(
+            c2,
+            chalk.dim(
+              `Injected ${injectedCount} app secret${injectedCount === 1 ? "" : "s"} into the environment (${secretEntries.filter(([key]) => !isUnsafeDevEnvKey(key)).map(([key]) => key).join(", ")}).`
+            )
+          );
+        }
+      } catch (err) {
+        log(
+          c2,
+          chalk.yellow(
+            `Couldn't fetch app secrets (${err instanceof Error ? err.message : "unknown error"}) \u2014 continuing without them.`
+          )
+        );
+      }
       log(c2, chalk.dim(`Starting dev server for ${config.name}...`));
       try {
         runScript(projectDir, "dev", injected);
@@ -1443,9 +1611,7 @@ async function buildAppGroup() {
       app: external_exports.string().optional().describe(
         "Link this project to an app (app_xxx) before deploying \u2014 writes whop.app.json, replacing any existing link"
       ),
-      skip_promote: external_exports.boolean().optional().describe(
-        "Upload the build without promoting it to production"
-      ),
+      skip_promote: external_exports.boolean().optional().describe("Upload the build without promoting it to production"),
       skip_typecheck: external_exports.boolean().optional().describe("Skip the typecheck step"),
       skip_build: external_exports.boolean().optional().describe("Skip the build step and upload the existing dist/ output")
     }),
@@ -2218,7 +2384,7 @@ ${c.success("\u2713 Your store is fully set up.")}`);
 // package.json
 var package_default = {
   name: "@whop/cli",
-  version: "0.4.0",
+  version: "0.6.0",
   description: "The Whop CLI \u2014 build and manage Whop apps from your terminal. Human and agent friendly.",
   keywords: [
     "agent",
@@ -2239,7 +2405,8 @@ var package_default = {
     "whop-cli": "dist/index.js"
   },
   files: [
-    "dist"
+    "dist",
+    "skills"
   ],
   type: "module",
   exports: {
@@ -2791,7 +2958,9 @@ var HANDWRITTEN_GROUPS = [
 var HANDWRITTEN_GROUP_NAMES = new Set(
   HANDWRITTEN_GROUPS.map(({ name }) => name)
 );
-var API_GROUPS = groups_default.map(([name, tag]) => ({ name, tag })).filter(({ name }) => !HANDWRITTEN_GROUP_NAMES.has(name));
+var API_GROUPS = groups_default.filter(
+  ({ name }) => !HANDWRITTEN_GROUP_NAMES.has(name)
+);
 var COMMAND_GROUPS = [...API_GROUPS, ...HANDWRITTEN_GROUPS];
 async function registerHandwrittenGroups(cli2) {
   for (const group of HANDWRITTEN_GROUPS) await group.register(cli2);
@@ -2885,6 +3054,11 @@ var cli = Cli_exports.create("whop", {
   description: "Build and manage Whop apps from your terminal.",
   renderer: render,
   sync: {
+    // Shipped skill files generated by scripts/sync-spec.ts from the
+    // spec's own tag copy (x-whop-summary + description, authored in
+    // backend/openapi/v1/tags.yml). A matching directory name overrides
+    // the auto-generated skill for that command group.
+    include: ["skills/*"],
     suggestions: [
       "start selling on Whop",
       "show my Whop business accounts",
@@ -2936,94 +3110,12 @@ cli.use(async (c2, next) => {
   return next();
 });
 await registerHandwrittenGroups(cli);
-for (const { name, tag } of API_GROUPS) {
-  cli.command(name, { fetch: fetch2, openapi: spec(tag) });
+for (const { name, tag, description } of API_GROUPS) {
+  cli.command(name, { description, fetch: fetch2, openapi: spec(tag) });
 }
 var cli_default = cli;
 
-// src/api/api-structure.json
-var api_structure_default = [
-  {
-    group: "Core Resources",
-    tags: [
-      "Accounts",
-      "Users",
-      "Webhooks",
-      "Stats"
-    ]
-  },
-  {
-    group: "Money",
-    tags: [
-      "Ledgers",
-      "Payouts",
-      "Cards",
-      "Transfers",
-      "Deposits",
-      "Swaps",
-      "Payout Methods",
-      "Verifications"
-    ]
-  },
-  {
-    group: "Commerce",
-    tags: [
-      "Products",
-      "Plans",
-      "Checkout Configurations",
-      "Referrals"
-    ]
-  },
-  {
-    group: "Tracking",
-    tags: [
-      "People",
-      "Events"
-    ]
-  },
-  {
-    group: "Ads",
-    tags: [
-      "Ads",
-      "Ad Campaigns",
-      "Ad Groups",
-      "Audiences"
-    ]
-  },
-  {
-    group: "Identity",
-    tags: [
-      "Social Accounts"
-    ]
-  }
-];
-
-// src/api/tag-descriptions.json
-var tag_descriptions_default = {
-  Accounts: "Your Whop account",
-  Users: "Users on your platform",
-  Stats: "Platform-wide statistics",
-  Ledgers: "Transaction history",
-  Payouts: "Withdraw earnings",
-  Cards: "Issued virtual cards",
-  Transfers: "Move funds between accounts",
-  Deposits: "Add funds to your balance",
-  Swaps: "Convert between currencies",
-  Verifications: "Identity verification status",
-  Products: "What you're selling",
-  Plans: "Pricing for your products",
-  "Checkout Configurations": "Optional / advanced: customize the checkout page",
-  Referrals: "Referral programs",
-  Ads: "Ad creatives",
-  "Ad Campaigns": "Top-level campaign organization",
-  "Ad Groups": "Sets of related ads",
-  Audiences: "Who sees your ads",
-  "Social Accounts": "Linked social profiles"
-};
-
 // src/lib/grouped-help.ts
-var descriptions = tag_descriptions_default;
-var toCliName = (tag) => tag.toLowerCase().replace(/\s+/g, "-");
 var SECTION_LABELS = {
   "get-started": "Get Started",
   auth: "Auth"
@@ -3060,14 +3152,12 @@ var handwrittenSection = (section) => ({
 });
 function buildGroupedHelp(version, description) {
   const lines = [];
-  const presentCommands = new Set(API_GROUPS.map(({ name }) => name));
-  const apiSections = api_structure_default.map(({ group, tags }) => ({
-    label: group,
-    commands: tags.filter((tag) => presentCommands.has(toCliName(tag))).map((tag) => ({
-      name: toCliName(tag),
-      description: descriptions[tag] ?? ""
-    }))
-  })).filter((section) => section.commands.length > 0);
+  const apiSections = [];
+  for (const { name, description: description2, group } of API_GROUPS) {
+    let section = apiSections.find((s) => s.label === group);
+    if (!section) apiSections.push(section = { label: group, commands: [] });
+    section.commands.push({ name, description: description2 });
+  }
   const commerceSections = apiSections.filter(
     (section) => section.label.toLowerCase() === "commerce"
   );