xtra-cli 1.0.0

package/dist/commands/completion.js

@@ -0,0 +1,227 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.completionCommand = void 0;
+const commander_1 = require("commander");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const chalk_1 = __importDefault(require("chalk"));
+// ─── All CLI top-level commands ───────────────────────────────────────────────
+const ALL_COMMANDS = [
+    "login", "run", "secrets", "generate", "status", "diff", "rollback",
+    "scan", "logs", "export", "import", "rotate", "audit", "access",
+    "branch", "checkout", "project", "admin", "integration", "kubernetes",
+    "history", "env", "ui", "completion"
+];
+const SUBCOMMANDS = {
+    secrets: ["list", "set", "link"],
+    branch: ["list", "create", "delete", "update"],
+    admin: ["users", "roles", "role", "set-role"],
+    access: ["request", "list", "approve"],
+    audit: ["verify", "export"],
+    integration: ["sync", "export", "apply"],
+    env: ["clone"],
+    project: ["set", "current"],
+    completion: ["bash", "zsh", "powershell", "install"],
+};
+// ─── Bash completion script ───────────────────────────────────────────────────
+function bashScript() {
+    const subMap = Object.entries(SUBCOMMANDS)
+        .map(([cmd, subs]) => `      ${cmd}) echo "${subs.join(" ")}" ;;`)
+        .join("\n");
+    return `# xtra bash completion
+# Add to ~/.bashrc:  source <(xtra completion bash)
+_xtra_completions() {
+  local cur prev words
+  cur="\${COMP_WORDS[COMP_CWORD]}"
+  prev="\${COMP_WORDS[COMP_CWORD-1]}"
+
+  if [ "\${COMP_CWORD}" -eq 1 ]; then
+    COMPREPLY=( $(compgen -W "${ALL_COMMANDS.join(" ")}" -- "$cur") )
+    return
+  fi
+
+  local subcommands=""
+  case "\${COMP_WORDS[1]}" in
+${subMap}
+    *) ;;
+  esac
+
+  if [ -n "$subcommands" ]; then
+    COMPREPLY=( $(compgen -W "$subcommands" -- "$cur") )
+  fi
+}
+complete -F _xtra_completions xtra
+`;
+}
+// ─── Zsh completion script ────────────────────────────────────────────────────
+function zshScript() {
+    const subDefs = Object.entries(SUBCOMMANDS)
+        .map(([cmd, subs]) => `    (${cmd})\n      local subcmds=(${subs.map(s => `'${s}'`).join(" ")})\n      _describe 'subcommand' subcmds ;;`)
+        .join("\n");
+    return `#compdef xtra
+# xtra zsh completion
+# Add to ~/.zshrc:  source <(xtra completion zsh)
+_xtra() {
+  local state
+  _arguments \\
+    '1: :->command' \\
+    '*: :->args'
+
+  case $state in
+    command)
+      local commands=(${ALL_COMMANDS.map(c => `'${c}'`).join(" ")})
+      _describe 'command' commands ;;
+    args)
+      case $words[2] in
+${subDefs}
+      esac ;;
+  esac
+}
+_xtra
+`;
+}
+// ─── PowerShell completion script ────────────────────────────────────────────
+function powershellScript() {
+    const subMap = Object.entries(SUBCOMMANDS)
+        .map(([cmd, subs]) => `        '${cmd}' { $subCommands = @(${subs.map(s => `'${s}'`).join(", ")}) }`)
+        .join("\n");
+    return `# xtra PowerShell completion
+# Add to $PROFILE:  xtra completion powershell | Invoke-Expression
+Register-ArgumentCompleter -Native -CommandName xtra -ScriptBlock {
+  param($wordToComplete, $commandAst, $cursorPosition)
+  $tokens = $commandAst.CommandElements
+  $topCommands = @(${ALL_COMMANDS.map(c => `'${c}'`).join(", ")})
+
+  if ($tokens.Count -le 2) {
+    $topCommands | Where-Object { $_ -like "$wordToComplete*" } |
+      ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_) }
+    return
+  }
+
+  $subCommands = @()
+  switch ($tokens[1]) {
+${subMap}
+  }
+  $subCommands | Where-Object { $_ -like "$wordToComplete*" } |
+    ForEach-Object { [System.Management.Automation.CompletionResult]::new($_, $_, 'ParameterValue', $_) }
+}
+`;
+}
+// ─── Install helper ───────────────────────────────────────────────────────────
+function installCompletion(shell) {
+    const home = os.homedir();
+    let rcFile;
+    let snippet;
+    let script;
+    switch (shell) {
+        case "bash":
+            rcFile = path.join(home, ".bashrc");
+            snippet = `\n# xtra CLI completion\nsource <(xtra completion bash)\n`;
+            script = bashScript();
+            break;
+        case "zsh":
+            rcFile = path.join(home, ".zshrc");
+            snippet = `\n# xtra CLI completion\nsource <(xtra completion zsh)\n`;
+            script = zshScript();
+            break;
+        case "powershell":
+            rcFile = path.join(home, "Documents", "WindowsPowerShell", "Microsoft.PowerShell_profile.ps1");
+            snippet = `\n# xtra CLI completion\nxtra completion powershell | Invoke-Expression\n`;
+            script = powershellScript();
+            break;
+        default:
+            console.error(chalk_1.default.red(`Unsupported shell: ${shell}. Use bash, zsh, or powershell.`));
+            process.exit(1);
+    }
+    // Write the completion script to a temp file path for reference
+    const scriptPath = path.join(home, `.xtra-completion.${shell}`);
+    fs.writeFileSync(scriptPath, script, "utf8");
+    // Append sourcing snippet to rc file if not already there
+    let rcContent = "";
+    try {
+        rcContent = fs.readFileSync(rcFile, "utf8");
+    }
+    catch (_) { }
+    if (rcContent.includes("xtra completion")) {
+        console.log(chalk_1.default.yellow(`Completion already installed in ${rcFile}. Skipping.`));
+    }
+    else {
+        fs.appendFileSync(rcFile, snippet, "utf8");
+        console.log(chalk_1.default.green(`✅ Completion installed!\n`));
+        console.log(`  Script saved to: ${chalk_1.default.cyan(scriptPath)}`);
+        console.log(`  Sourced in:      ${chalk_1.default.cyan(rcFile)}`);
+        console.log(`\nRestart your shell or run: ${chalk_1.default.bold(`source ${rcFile}`)}`);
+    }
+}
+// ─── Commander command ────────────────────────────────────────────────────────
+exports.completionCommand = new commander_1.Command("completion")
+    .description("Generate shell completion scripts (bash, zsh, powershell)")
+    .argument("[shell]", "Target shell: bash | zsh | powershell", "bash")
+    .option("--install", "Automatically install completion into your shell profile")
+    .addHelpText("after", `
+Examples:
+  $ xtra completion bash        # Print bash completion script
+  $ xtra completion zsh         # Print zsh completion script
+  $ xtra completion powershell  # Print PowerShell completion script
+  $ source <(xtra completion bash)          # Activate in current session
+  $ xtra completion bash --install          # Auto-install to ~/.bashrc
+  $ xtra completion powershell --install    # Auto-install to $PROFILE
+`)
+    .action((shell, options) => {
+    const normalizedShell = shell.toLowerCase();
+    if (options.install) {
+        installCompletion(normalizedShell);
+        return;
+    }
+    switch (normalizedShell) {
+        case "bash":
+            process.stdout.write(bashScript());
+            break;
+        case "zsh":
+            process.stdout.write(zshScript());
+            break;
+        case "powershell":
+            process.stdout.write(powershellScript());
+            break;
+        default:
+            console.error(chalk_1.default.red(`Unknown shell: '${shell}'. Use bash, zsh, or powershell.`));
+            process.exit(1);
+    }
+});

package/dist/commands/diff.js

@@ -0,0 +1,162 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diffCommand = void 0;
+const commander_1 = require("commander");
+const api_1 = require("../lib/api");
+const chalk_1 = __importDefault(require("chalk"));
+const ora_1 = __importDefault(require("ora"));
+const config_1 = require("../lib/config");
+const crypto_1 = require("../lib/crypto");
+const diff = __importStar(require("diff"));
+exports.diffCommand = new commander_1.Command("diff")
+    .description("Show differences between local cache and remote secrets")
+    .argument("[env1]", "Source Environment")
+    .argument("[env2]", "Target Environment")
+    .option("-p, --project <projectId>", "Project ID")
+    .option("-e, --env <environment>", "Environment (dev, stg, prod)", "dev")
+    .option("-b, --branch <branchName>", "Branch Name")
+    .option("--show", "Show actual value differences (sensitive)", false)
+    .action(async (env1, env2, options) => {
+    let { project, env, branch, show } = options;
+    // Use config fallback
+    if (!project)
+        project = (0, config_1.getRcConfig)().project;
+    if (!branch) {
+        branch = (0, config_1.getRcConfig)().branch || "main";
+    }
+    if (!project) {
+        console.error(chalk_1.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first."));
+        process.exit(1);
+    }
+    // Normalize Env Map
+    const envMap = { dev: "development", stg: "staging", prod: "production" };
+    if (env1 && env2) {
+        // COMPARE TWO REMOTE ENVIRONMENTS
+        const sourceEnv = envMap[env1] || env1;
+        const targetEnv = envMap[env2] || env2;
+        const spinner = (0, ora_1.default)(`Fetching secrets for ${sourceEnv} and ${targetEnv} (branch: ${branch})...`).start();
+        try {
+            const [sourceSecrets, targetSecrets] = await Promise.all([
+                api_1.api.getSecrets(project, sourceEnv, branch),
+                api_1.api.getSecrets(project, targetEnv, branch)
+            ]);
+            spinner.stop();
+            console.log(chalk_1.default.bold(`\nDiff Report (${sourceEnv} <-> ${targetEnv} @ ${branch}):\n`));
+            compareSecrets(sourceSecrets, targetSecrets, show);
+        }
+        catch (error) {
+            spinner.fail("Failed to fetch secrets");
+            console.error(chalk_1.default.red(error.message));
+        }
+    }
+    else {
+        // DEFAULT: COMPARE REMOTE VS LOCAL CACHE
+        const targetEnv = envMap[env] || env;
+        const spinner = (0, ora_1.default)(`Fetching remote state for ${targetEnv} (branch: ${branch})...`).start();
+        try {
+            const remoteSecrets = await api_1.api.getSecrets(project, targetEnv, branch);
+            let localSecrets = {};
+            try {
+                const cacheKey = `cache.${project}.${targetEnv}.${branch}`;
+                const encrypted = (0, config_1.getConfigValue)(cacheKey);
+                if (encrypted) {
+                    const decryptedStr = (0, crypto_1.decrypt)(encrypted);
+                    localSecrets = JSON.parse(decryptedStr);
+                }
+            }
+            catch (e) { }
+            spinner.stop();
+            console.log(chalk_1.default.bold(`\nDiff Report (Remote ${targetEnv} vs Local Cache):\n`));
+            compareSecrets(remoteSecrets, localSecrets, show); // Note: verify order or adjust message
+            // existing logic compared local (arg1) to remote (arg2)
+            // But usually diff is "What is in A that is not in B"
+            // Let's call a shared helper or inline it but consistent
+            // To match previous behavior: comparing LOCAL against REMOTE
+            // But wait, user wants to see what's different in Remote.
+            // Let's stick to the previous logic structure for consistency if I extract it.
+            // Actually, I'll just rewrite the comparison block to be generic.
+        }
+        catch (error) {
+            spinner.fail("Failed to run diff.");
+            console.error(chalk_1.default.red(error.message));
+        }
+    }
+});
+function compareSecrets(source, target, show) {
+    const allKeys = new Set([...Object.keys(source), ...Object.keys(target)]);
+    let hasDiff = false;
+    allKeys.forEach(key => {
+        const val1 = source[key];
+        const val2 = target[key];
+        if (val1 === val2)
+            return;
+        hasDiff = true;
+        if (val1 === undefined) {
+            // Present in Target, missing in Source
+            console.log(chalk_1.default.green(`+ ${key} (Only in Target)`));
+            if (show)
+                console.log(chalk_1.default.green(`  + "${val2}"`));
+        }
+        else if (val2 === undefined) {
+            // Present in Source, missing in Target
+            console.log(chalk_1.default.red(`- ${key} (Only in Source)`));
+            if (show)
+                console.log(chalk_1.default.red(`  - "${val1}"`));
+        }
+        else {
+            console.log(chalk_1.default.yellow(`~ ${key} (Modified)`));
+            if (show) {
+                const changes = diff.diffChars(val1, val2);
+                let diffStr = "  ";
+                changes.forEach(part => {
+                    const color = part.added ? chalk_1.default.green :
+                        part.removed ? chalk_1.default.red : chalk_1.default.gray;
+                    diffStr += color(part.value);
+                });
+                console.log(diffStr);
+            }
+        }
+    });
+    if (!hasDiff) {
+        console.log(chalk_1.default.green("✔ No differences found."));
+    }
+    else if (!show) {
+        console.log(chalk_1.default.gray("\n(Use --show to reveal secret values)"));
+    }
+}

package/dist/commands/doctor.js

@@ -0,0 +1,164 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.doctorCommand = void 0;
+/**
+ * doctor.ts — Diagnose common xtra-cli setup issues
+ */
+const commander_1 = require("commander");
+const chalk_1 = __importDefault(require("chalk"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const axios_1 = __importDefault(require("axios"));
+const config_1 = require("../lib/config");
+// ─── Box Drawing Helpers ─────────────────────────────────────────────────────
+const W = 65;
+const B = { tl: "╭", tr: "╮", bl: "╰", br: "╯", h: "─", v: "│" };
+function hline(w) { return B.h.repeat(w); }
+const PASS = chalk_1.default.green("✓  ");
+const FAIL = chalk_1.default.red("✗  ");
+const WARN = chalk_1.default.yellow("⚠  ");
+async function runChecks() {
+    const checks = [];
+    const config = (0, config_1.getConfig)();
+    // 1. Node Version
+    const nodeMajor = parseInt(process.versions.node.split(".")[0]);
+    checks.push({
+        name: "Node.js Version",
+        status: nodeMajor >= 18 ? "pass" : "fail",
+        message: `v${process.versions.node} ${nodeMajor >= 18 ? "(OK)" : "(requires >=18)"}`,
+    });
+    // 2. Auth Token
+    const token = (0, config_1.getAuthToken)();
+    checks.push({
+        name: "Auth Token",
+        status: token ? "pass" : "fail",
+        message: token ? `Set (${token.substring(0, 8)}...)` : "Not set — run 'xtra login'",
+    });
+    // 3. API URL Configured
+    const apiUrl = config.apiUrl || process.env.XTRA_API_URL || "https://xtra-security.vercel.app/api";
+    checks.push({
+        name: "API URL",
+        status: config.apiUrl || process.env.XTRA_API_URL ? "pass" : "warn",
+        message: apiUrl,
+    });
+    // 4. API Reachability
+    try {
+        const res = await axios_1.default.get(`${apiUrl}/health`, { timeout: 4000 });
+        checks.push({
+            name: "API Connectivity",
+            status: res.status === 200 ? "pass" : "warn",
+            message: `${res.status} ${res.statusText}`,
+        });
+    }
+    catch (e) {
+        const msg = e.code === "ECONNREFUSED" ? "Connection refused (offline?)"
+            : e.code === "ETIMEDOUT" ? "Timed out (unreachable)"
+                : e.response?.status === 404 ? "API reachable (health endpoint missing)"
+                    : e.message;
+        // Special case: if it hits a 404 it means DNS and port work, but route is missing
+        const status = e.response?.status === 404 ? "pass" : "fail";
+        checks.push({ name: "API Connectivity", status, message: msg });
+    }
+    // 5. Active Project
+    const project = (0, config_1.getRcConfig)().project;
+    checks.push({
+        name: "Active Project",
+        status: project ? "pass" : "warn",
+        message: project ? project : "Not set — run 'xtra project set <id>'",
+    });
+    // 6. Active Branch
+    const branch = (0, config_1.getRcConfig)().branch || "main";
+    checks.push({
+        name: "Active Branch",
+        status: "pass",
+        message: branch,
+    });
+    // 7. Config files
+    const rcPath = path.join(process.cwd(), ".xtrarc");
+    const jsonPath = path.join(process.cwd(), "xtra.json");
+    const hasConfig = fs.existsSync(rcPath) || fs.existsSync(jsonPath);
+    checks.push({
+        name: "Project Config",
+        status: hasConfig ? "pass" : "warn",
+        message: hasConfig ? (fs.existsSync(rcPath) ? ".xtrarc found" : "xtra.json found") : "Not found (run 'xtra init')",
+    });
+    return checks;
+}
+exports.doctorCommand = new commander_1.Command("doctor")
+    .description("Diagnose CLI configuration and API connectivity")
+    .option("--json", "Output results as JSON", false)
+    .action(async (options) => {
+    if (!options.json) {
+        console.log();
+        console.log(chalk_1.default.bold.cyan("  ⚕ XtraSecurity Diagnostics"));
+        console.log(chalk_1.default.hex("#4a5568")("  " + B.tl + hline(W) + B.tr));
+    }
+    const checks = await runChecks();
+    if (options.json) {
+        process.stdout.write(JSON.stringify(checks, null, 2) + "\n");
+        return;
+    }
+    let failures = 0, warnings = 0;
+    for (const c of checks) {
+        if (c.status === "fail")
+            failures++;
+        if (c.status === "warn")
+            warnings++;
+        const icon = c.status === "pass" ? PASS : c.status === "warn" ? WARN : FAIL;
+        const name = chalk_1.default.bold(chalk_1.default.white(c.name.padEnd(20)));
+        const msg = c.status === "pass" ? chalk_1.default.hex("#94a3b8")(c.message)
+            : c.status === "warn" ? chalk_1.default.yellow(c.message)
+                : chalk_1.default.red(c.message);
+        console.log(chalk_1.default.hex("#4a5568")("  " + B.v) + ` ${icon}${name}  ${msg}`.padEnd(W) + chalk_1.default.hex("#4a5568")(B.v));
+    }
+    console.log(chalk_1.default.hex("#4a5568")("  " + B.bl + hline(W) + B.br));
+    console.log();
+    if (failures === 0 && warnings === 0) {
+        console.log(chalk_1.default.green("  ✓ All systems operational. The CLI is ready to use."));
+    }
+    else {
+        const parts = [];
+        if (failures > 0)
+            parts.push(chalk_1.default.red(`${failures} error(s)`));
+        if (warnings > 0)
+            parts.push(chalk_1.default.yellow(`${warnings} warning(s)`));
+        console.log(`  Found ${parts.join(" and ")}.`);
+    }
+    console.log();
+});

package/dist/commands/env.js

@@ -0,0 +1,70 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.envCommand = void 0;
+const commander_1 = require("commander");
+const chalk_1 = __importDefault(require("chalk"));
+const api_1 = require("../lib/api");
+const config_1 = require("../lib/config");
+const inquirer_1 = __importDefault(require("inquirer"));
+exports.envCommand = new commander_1.Command("env");
+exports.envCommand
+    .command("clone")
+    .description("Clone secrets from one environment to another")
+    .requiredOption("--from <env>", "Source environment (e.g. production)")
+    .requiredOption("--to <env>", "Destination environment (e.g. staging)")
+    .option("-p, --project <id>", "Project ID")
+    .option("-b, --branch <name>", "Branch Name")
+    .option("--overwrite", "Overwrite existing secrets", false)
+    .action(async (options) => {
+    try {
+        let projectId = options.project;
+        const branch = options.branch || (0, config_1.getRcConfig)().branch || "main";
+        if (!projectId) {
+            projectId = (0, config_1.getRcConfig)().project;
+            if (!projectId) {
+                console.error(chalk_1.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first."));
+                process.exit(1);
+            }
+        }
+        const fromEnv = options.from.toLowerCase();
+        const toEnv = options.to.toLowerCase();
+        if (fromEnv === toEnv) {
+            console.error(chalk_1.default.red("Source and destination must be different."));
+            process.exit(1);
+        }
+        console.log(chalk_1.default.blue(`Cloning secrets from ${fromEnv} to ${toEnv} (branch: ${branch})...`));
+        if (options.overwrite) {
+            console.log(chalk_1.default.yellow("Warning: Existing secrets in destination will be overwritten!"));
+        }
+        const confirm = await inquirer_1.default.prompt([
+            {
+                type: "confirm",
+                name: "proceed",
+                message: "Are you sure you want to proceed?",
+                default: false
+            }
+        ]);
+        if (!confirm.proceed) {
+            console.log("Operation cancelled.");
+            return;
+        }
+        const result = await api_1.api.cloneEnvironment(projectId, fromEnv, toEnv, options.overwrite, branch);
+        if (result.success) {
+            console.log(chalk_1.default.green("\nClone successful!"));
+            console.log(`Copied: ${result.summary.copied}`);
+            console.log(`Updated: ${result.summary.updated} (overwrite: ${options.overwrite})`);
+            console.log(`Skipped: ${result.summary.skipped}`);
+        }
+    }
+    catch (error) {
+        if (error.response && error.response.data && error.response.data.error) {
+            console.error(chalk_1.default.red("Error cloning environment:"), error.response.data.error);
+        }
+        else {
+            console.error(chalk_1.default.red("Error cloning environment:"), error.message || error);
+        }
+    }
+});