xtra-cli 1.0.3 → 1.0.5

package/dist/commands/template.js

@@ -1,276 +1,22 @@
-"use strict";
-/**
- * template.ts — Secret Templating Engine for xtra-cli
- *
- * Reads a template file containing {{ secrets.KEY }} placeholders,
- * fetches secrets from XtraSecurity Cloud, substitutes all placeholders,
- * and writes the rendered output to the specified file (or stdout).
- *
- * Supported placeholder syntaxes:
- *   {{ secrets.DATABASE_URL }}      → fetches DATABASE_URL from secrets
- *   {{ secrets.PORT | 3000 }}       → with fallback default value "3000"
- *   {{ env.NODE_ENV }}              → reads from local process environment
- *
- * Example:
- *   # config.yaml.tpl
- *   database:
- *     url: {{ secrets.DATABASE_URL }}
- *     pool: {{ secrets.DB_POOL_SIZE | 10 }}
- *   app:
- *     port: {{ env.PORT | 3000 }}
- *     env: {{ env.NODE_ENV | development }}
- *
- * Usage:
- *   xtra template render config.yaml.tpl -o config.yaml -p proj123 -e production
- *   xtra template render nginx.conf.tpl | tee /etc/nginx/nginx.conf
- *   xtra template check config.yaml.tpl -p proj123 -e production
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.templateCommand = void 0;
-const commander_1 = require("commander");
-const api_1 = require("../lib/api");
-const config_1 = require("../lib/config");
-const chalk_1 = __importDefault(require("chalk"));
-const ora_1 = __importDefault(require("ora"));
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-// ─── Placeholder Regex ────────────────────────────────────────────────────────
-// Matches: {{ secrets.KEY }}, {{ secrets.KEY | default }}, {{ env.KEY | default }}
-const PLACEHOLDER_RE = /\{\{\s*(secrets|env)\.([A-Z0-9_a-z]+)(?:\s*\|\s*([^}]*?))?\s*\}\}/g;
-function renderTemplate(template, secrets, processEnv) {
-    const missingKeys = [];
-    const usedDefaults = [];
-    let replacedCount = 0;
-    const output = template.replace(PLACEHOLDER_RE, (_, source, key, defaultVal) => {
-        let value;
-        if (source === "secrets") {
-            value = secrets[key];
-        }
-        else if (source === "env") {
-            value = processEnv[key];
-        }
-        if (value !== undefined && value !== "") {
-            replacedCount++;
-            return value;
-        }
-        if (defaultVal !== undefined) {
-            const trimmedDefault = defaultVal.trim();
-            usedDefaults.push(`${source}.${key} → "${trimmedDefault}"`);
-            replacedCount++;
-            return trimmedDefault;
-        }
-        missingKeys.push(`${source}.${key}`);
-        return `{{ ${source}.${key} }}`; // Leave unreplaced — user will see it clearly
-    });
-    return { output, replacedCount, missingKeys, usedDefaults };
-}
-// ─── Command ──────────────────────────────────────────────────────────────────
-exports.templateCommand = new commander_1.Command("template")
-    .description("Secret templating engine — inject secrets into config file templates")
-    .addHelpText("after", `
-Template Syntax:
-  {{ secrets.KEY }}           Replace with secret value
-  {{ secrets.KEY | default }} Replace with secret value, fall back to "default"
-  {{ env.KEY }}               Replace with local environment variable
-  {{ env.KEY | default }}     Replace with local env variable, fall back to "default"
-
-Examples:
-  $ xtra template render config.yaml.tpl -p proj123 -e production -o config.yaml
-  $ xtra template render nginx.conf.tpl -p proj123 -e production | sudo tee /etc/nginx/nginx.conf
-  $ xtra template check config.yaml.tpl -p proj123 -e production
-  $ xtra template list config.yaml.tpl
-`);
-// ── render ────────────────────────────────────────────────────────────────────
-exports.templateCommand
-    .command("render <templateFile>")
-    .description("Render a template file by injecting secrets and environment variables")
-    .option("-p, --project <id>", "Project ID")
-    .option("-e, --env <environment>", "Environment (default: development)", "development")
-    .option("-b, --branch <branch>", "Branch name", "main")
-    .option("-o, --output <file>", "Output file (default: stdout)")
-    .option("--strict", "Exit with error if any placeholder is unresolved", false)
-    .action(async (templateFile, options) => {
-    let { project, env, branch, output, strict } = options;
-    // Normalize env shorthand
-    const envMap = { dev: "development", stg: "staging", prod: "production" };
-    env = envMap[env] || env;
-    if (!project)
-        project = (0, config_1.getRcConfig)().project;
-    if (!project) {
-        console.error(chalk_1.default.red("Error: Project ID required. Use -p <id> or run 'xtra project set'."));
-        process.exit(1);
-    }
-    // Read template file
-    const templatePath = path.resolve(process.cwd(), templateFile);
-    if (!fs.existsSync(templatePath)) {
-        console.error(chalk_1.default.red(`Error: Template file not found: ${templatePath}`));
-        process.exit(1);
-    }
-    const template = fs.readFileSync(templatePath, "utf8");
-    // Count how many placeholders exist
-    const allPlaceholders = [...template.matchAll(PLACEHOLDER_RE)];
-    if (allPlaceholders.length === 0) {
-        console.warn(chalk_1.default.yellow("Warning: No {{ secrets.* }} or {{ env.* }} placeholders found in template."));
-    }
-    const spinner = (0, ora_1.default)(`Fetching secrets for ${project}/${env}...`).start();
-    let secrets = {};
-    try {
-        secrets = await api_1.api.getSecrets(project, env, branch);
-        spinner.succeed(`Loaded ${Object.keys(secrets).length} secrets.`);
-    }
-    catch (e) {
-        spinner.fail("Failed to fetch secrets.");
-        const safeErr = e?.response?.data?.error || e.message;
-        console.error(chalk_1.default.red(safeErr));
-        process.exit(1);
-    }
-    // Render
-    const { output: rendered, replacedCount, missingKeys, usedDefaults } = renderTemplate(template, secrets, process.env);
-    // Report
-    console.log(chalk_1.default.green(`✅ Replaced ${replacedCount} placeholder(s).`));
-    if (usedDefaults.length > 0) {
-        console.log(chalk_1.default.yellow(`âš   Used defaults for: ${usedDefaults.join(", ")}`));
-    }
-    if (missingKeys.length > 0) {
-        console.log(chalk_1.default.red(`✗  Unresolved placeholders: ${missingKeys.join(", ")}`));
-        if (strict) {
-            console.error(chalk_1.default.red("Aborting due to --strict mode."));
-            process.exit(1);
-        }
-    }
-    // Write output
-    if (output) {
-        const outPath = path.resolve(process.cwd(), output);
-        fs.writeFileSync(outPath, rendered, "utf8");
-        console.log(chalk_1.default.blue(`→ Written to: ${outPath}`));
-    }
-    else {
-        // Print to stdout (so user can pipe it)
-        process.stdout.write(rendered);
-    }
-    // Audit log
-    try {
-        const { logAudit } = require("../lib/audit");
-        logAudit("TEMPLATE_RENDERED", project, env, {
-            template: templateFile,
-            output: output || "stdout",
-            replacedCount,
-            missingKeys,
-        });
-    }
-    catch (e) { }
-});
-// ── check ─────────────────────────────────────────────────────────────────────
-exports.templateCommand
-    .command("check <templateFile>")
-    .description("Validate that all template placeholders have matching secrets (dry-run)")
-    .option("-p, --project <id>", "Project ID")
-    .option("-e, --env <environment>", "Environment", "development")
-    .option("-b, --branch <branch>", "Branch name", "main")
-    .action(async (templateFile, options) => {
-    let { project, env, branch } = options;
-    const envMap = { dev: "development", stg: "staging", prod: "production" };
-    env = envMap[env] || env;
-    if (!project)
-        project = (0, config_1.getRcConfig)().project;
-    if (!project) {
-        console.error(chalk_1.default.red("Error: Project ID required."));
-        process.exit(1);
-    }
-    const templatePath = path.resolve(process.cwd(), templateFile);
-    if (!fs.existsSync(templatePath)) {
-        console.error(chalk_1.default.red(`Template file not found: ${templatePath}`));
-        process.exit(1);
-    }
-    const template = fs.readFileSync(templatePath, "utf8");
-    const spinner = (0, ora_1.default)(`Fetching secrets for check...`).start();
-    let secrets = {};
-    try {
-        secrets = await api_1.api.getSecrets(project, env, branch);
-        spinner.stop();
-    }
-    catch (e) {
-        spinner.fail("Failed to fetch secrets.");
-        process.exit(1);
-    }
-    const { replacedCount, missingKeys, usedDefaults } = renderTemplate(template, secrets, process.env);
-    const allCount = [...template.matchAll(PLACEHOLDER_RE)].length;
-    console.log(chalk_1.default.bold(`\nTemplate Check: ${templateFile}\n`));
-    console.log(`  Total placeholders : ${allCount}`);
-    console.log(`  Resolved           : ${chalk_1.default.green(replacedCount)}`);
-    console.log(`  Using defaults     : ${chalk_1.default.yellow(usedDefaults.length)}`);
-    console.log(`  Unresolved         : ${chalk_1.default.red(missingKeys.length)}`);
-    if (usedDefaults.length > 0) {
-        console.log(chalk_1.default.yellow(`\n  Defaults used:`));
-        usedDefaults.forEach(d => console.log(`    - ${d}`));
-    }
-    if (missingKeys.length > 0) {
-        console.log(chalk_1.default.red(`\n  Missing secrets (no default):`));
-        missingKeys.forEach(k => console.log(chalk_1.default.red(`    ✗ ${k}`)));
-        process.exit(1);
-    }
-    else {
-        console.log(chalk_1.default.green("\n  ✅ All placeholders are resolvable!"));
-    }
-});
-// ── list ──────────────────────────────────────────────────────────────────────
-exports.templateCommand
-    .command("list <templateFile>")
-    .description("List all placeholders found in a template file (no API call needed)")
-    .action((templateFile) => {
-    const templatePath = path.resolve(process.cwd(), templateFile);
-    if (!fs.existsSync(templatePath)) {
-        console.error(chalk_1.default.red(`Template file not found: ${templatePath}`));
-        process.exit(1);
-    }
-    const template = fs.readFileSync(templatePath, "utf8");
-    const matches = [...template.matchAll(PLACEHOLDER_RE)];
-    if (matches.length === 0) {
-        console.log(chalk_1.default.yellow("No placeholders found in this template."));
-        return;
-    }
-    console.log(chalk_1.default.bold(`\nPlaceholders in ${path.basename(templateFile)}:\n`));
-    matches.forEach(m => {
-        const [, source, key, def] = m;
-        const defaultHint = def ? chalk_1.default.gray(` (default: "${def.trim()}")`) : "";
-        const icon = source === "secrets" ? "🔒" : "📦";
-        console.log(`  ${icon} ${chalk_1.default.cyan(`{{ ${source}.${key} }}`)}${defaultHint}`);
-    });
-    console.log(`\n  Total: ${chalk_1.default.bold(matches.length)} placeholder(s)\n`);
-});
+var fe=Object.create;var R=Object.defineProperty;var me=Object.getOwnPropertyDescriptor;var ye=Object.getOwnPropertyNames;var he=Object.getPrototypeOf,ve=Object.prototype.hasOwnProperty;var A=(e,t)=>()=>(e&&(t=e(e=0)),t);var G=(e,t)=>{for(var s in t)R(e,s,{get:t[s],enumerable:!0})},M=(e,t,s,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of ye(t))!ve.call(e,r)&&r!==s&&R(e,r,{get:()=>t[r],enumerable:!(n=me(t,r))||n.enumerable});return e};var l=(e,t,s)=>(s=e!=null?fe(he(e)):{},M(t||!e||!e.__esModule?R(s,"default",{value:e,enumerable:!0}):s,e)),H=e=>M(R({},"__esModule",{value:!0}),e);var V,L,Y,B,h,U,w,z,O,I=A(()=>{V=l(require("conf")),L=l(require("fs")),Y=l(require("path")),B="https://www.xtrasecurity.in/api",h=new V.default({projectName:"xtra-cli",defaults:{apiUrl:B}}),U=h.get("apiUrl");U&&!process.env.XTRA_API_URL&&(U.includes("localhost")||U.includes("xtra-security.vercel.app"))&&h.set("apiUrl",B);w=()=>({...h.store,apiUrl:process.env.XTRA_API_URL||h.get("apiUrl")||B}),z=()=>h.get("token"),O=()=>{let e={};try{let t=Y.default.join(process.cwd(),".xtrarc");L.default.existsSync(t)&&(e=JSON.parse(L.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||h.get("project")||"",env:e.env||h.get("env")||"development",branch:e.branch||h.get("branch")||"main"}}});var X,W,Z,$e,o,S,_=A(()=>{X=l(require("axios"));I();W=l(require("fs")),Z=l(require("path")),$e=JSON.parse(W.readFileSync(Z.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:e}=w(),t=z();return X.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":$e.version,...t?{Authorization:`Bearer ${t}`}:{}}})},S={login:async(e,t,s)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,n,r="main")=>(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:n,branch:r})).data,getSecretDetails:async(e,t,s,n="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${n}`)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,n,r,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:n,sourceEnv:r,sourceKey:i})).data,rotateSecret:async(e,t,s,n,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:n,parsedNewValue:r})).data,promoteSecret:async(e,t,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,n)=>{let r={format:e};return t&&(r.startDate=t),s&&(r.endDate=s),n&&(r.projectId=n),(await o().post("/audit/export",r,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,n)=>(await o().post("/access/request",{projectId:e,secretId:n,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=w(),s=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=w(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await o().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:n})).data,cloneEnvironment:async(e,t,s,n,r)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:n,branch:r})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});function ne(){let e=Q.get("masterKey");e||(e=x.default.randomBytes(32).toString("hex"),Q.set("masterKey",e));let t=(0,te.machineIdSync)();return x.default.createHash("sha256").update(e+t).digest()}var x,ee,te,se,Q,re,oe,ae=A(()=>{x=l(require("crypto")),ee=l(require("conf")),te=require("node-machine-id"),se="aes-256-gcm",Q=new ee.default({projectName:"xtra-cli-crypto"});re=e=>{let t=x.default.randomBytes(16),s=ne(),n=x.default.createCipheriv(se,s,t),r=n.update(e,"utf8","hex");r+=n.final("hex");let i=n.getAuthTag();return{iv:t.toString("hex"),content:r,tag:i.toString("hex")}},oe=e=>{let t=ne(),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.tag,"hex"),r=x.default.createDecipheriv(se,t,s);r.setAuthTag(n);let i=r.update(e.content,"hex","utf8");return i+=r.final("utf8"),i}});var pe={};G(pe,{loadAuditLogs:()=>E,logAudit:()=>xe,saveAuditLogs:()=>C,syncAuditLogs:()=>je});function we(e){if(!e||typeof e!="object")return e;let t={...e},s=["password","token","secret","value","apiKey","secretValue"];for(let n of Object.keys(t))s.some(r=>n.toLowerCase().includes(r))&&(t[n]="[REDACTED]");return t}async function ce(e){try{if(!w().token)return!1;let s={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:we(e.details),timestamp:e.timestamp,projectId:e.projectId};return await S.post("/audit/cli-logs",{logs:[s]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function xe(e,t,s,n){let r={id:(0,ie.v4)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:s,details:n,synced:!1},i=E();i.push(r),C(i),ce(r).then(d=>{if(d){r.synced=!0;let u=E(),c=u.findIndex(p=>p.id===r.id);c!==-1&&(u[c].synced=!0,C(u))}}).catch(()=>{})}function E(){if(!j.default.existsSync(N))return[];try{let e=j.default.readFileSync(N,"utf-8"),t=JSON.parse(e),s=oe(t);return JSON.parse(s)}catch{return[]}}function C(e){j.default.existsSync(F)||j.default.mkdirSync(F,{recursive:!0});let t=JSON.stringify(e),s=re(t);j.default.writeFileSync(N,JSON.stringify(s),"utf-8")}async function je(){let e=E(),t=e.filter(n=>!n.synced);if(t.length===0)return 0;let s=0;for(let n of t)await ce(n)&&(n.synced=!0,s++);return s>0&&C(e),s}var j,K,ie,F,N,le=A(()=>{j=l(require("fs")),K=l(require("path")),ie=require("uuid");ae();I();_();F=K.default.join(process.cwd(),".xtra"),N=K.default.join(F,"audit.enc")});var be={};G(be,{templateCommand:()=>D});module.exports=H(be);var ge=require("commander");_();I();var a=l(require("chalk")),J=l(require("ora")),m=l(require("fs")),$=l(require("path")),P=/\{\{\s*(secrets|env)\.([A-Z0-9_a-z]+)(?:\s*\|\s*([^}]*?))?\s*\}\}/g;function de(e,t,s){let n=[],r=[],i=0;return{output:e.replace(P,(u,c,p,b)=>{let g;if(c==="secrets"?g=t[p]:c==="env"&&(g=s[p]),g!==void 0&&g!=="")return i++,g;if(b!==void 0){let f=b.trim();return r.push(`${c}.${p} \xE2\u2020\u2019 "${f}"`),i++,f}return n.push(`${c}.${p}`),`{{ ${c}.${p} }}`}),replacedCount:i,missingKeys:n,usedDefaults:r}}var D=new ge.Command("template").description("Secret templating engine \xE2\u20AC\u201D inject secrets into config file templates").addHelpText("after",`
+Template Syntax:
+  {{ secrets.KEY }}           Replace with secret value
+  {{ secrets.KEY | default }} Replace with secret value, fall back to "default"
+  {{ env.KEY }}               Replace with local environment variable
+  {{ env.KEY | default }}     Replace with local env variable, fall back to "default"
+
+Examples:
+  $ xtra template render config.yaml.tpl -p proj123 -e production -o config.yaml
+  $ xtra template render nginx.conf.tpl -p proj123 -e production | sudo tee /etc/nginx/nginx.conf
+  $ xtra template check config.yaml.tpl -p proj123 -e production
+  $ xtra template list config.yaml.tpl
+`);D.command("render <templateFile>").description("Render a template file by injecting secrets and environment variables").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment (default: development)","development").option("-b, --branch <branch>","Branch name","main").option("-o, --output <file>","Output file (default: stdout)").option("--strict","Exit with error if any placeholder is unresolved",!1).action(async(e,t)=>{let{project:s,env:n,branch:r,output:i,strict:d}=t;n={dev:"development",stg:"staging",prod:"production"}[n]||n,s||(s=O().project),s||(console.error(a.default.red("Error: Project ID required. Use -p <id> or run 'xtra project set'.")),process.exit(1));let c=$.resolve(process.cwd(),e);m.existsSync(c)||(console.error(a.default.red(`Error: Template file not found: ${c}`)),process.exit(1));let p=m.readFileSync(c,"utf8");[...p.matchAll(P)].length===0&&console.warn(a.default.yellow("Warning: No {{ secrets.* }} or {{ env.* }} placeholders found in template."));let g=(0,J.default)(`Fetching secrets for ${s}/${n}...`).start(),f={};try{f=await S.getSecrets(s,n,r),g.succeed(`Loaded ${Object.keys(f).length} secrets.`)}catch(y){g.fail("Failed to fetch secrets.");let ue=y?.response?.data?.error||y.message;console.error(a.default.red(ue)),process.exit(1)}let{output:k,replacedCount:v,missingKeys:T,usedDefaults:q}=de(p,f,process.env);if(console.log(a.default.green(`\u2705 Replaced ${v} placeholder(s).`)),q.length>0&&console.log(a.default.yellow(`\u26A0  Used defaults for: ${q.join(", ")}`)),T.length>0&&(console.log(a.default.red(`\u2717  Unresolved placeholders: ${T.join(", ")}`)),d&&(console.error(a.default.red("Aborting due to --strict mode.")),process.exit(1))),i){let y=$.resolve(process.cwd(),i);m.writeFileSync(y,k,"utf8"),console.log(a.default.blue(`\xE2\u2020\u2019 Written to: ${y}`))}else process.stdout.write(k);try{let{logAudit:y}=(le(),H(pe));y("TEMPLATE_RENDERED",s,n,{template:e,output:i||"stdout",replacedCount:v,missingKeys:T})}catch{}});D.command("check <templateFile>").description("Validate that all template placeholders have matching secrets (dry-run)").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment","development").option("-b, --branch <branch>","Branch name","main").action(async(e,t)=>{let{project:s,env:n,branch:r}=t;n={dev:"development",stg:"staging",prod:"production"}[n]||n,s||(s=O().project),s||(console.error(a.default.red("Error: Project ID required.")),process.exit(1));let d=$.resolve(process.cwd(),e);m.existsSync(d)||(console.error(a.default.red(`Template file not found: ${d}`)),process.exit(1));let u=m.readFileSync(d,"utf8"),c=(0,J.default)("Fetching secrets for check...").start(),p={};try{p=await S.getSecrets(s,n,r),c.stop()}catch{c.fail("Failed to fetch secrets."),process.exit(1)}let{replacedCount:b,missingKeys:g,usedDefaults:f}=de(u,p,process.env),k=[...u.matchAll(P)].length;console.log(a.default.bold(`
+Template Check: ${e}
+`)),console.log(`  Total placeholders : ${k}`),console.log(`  Resolved           : ${a.default.green(b)}`),console.log(`  Using defaults     : ${a.default.yellow(f.length)}`),console.log(`  Unresolved         : ${a.default.red(g.length)}`),f.length>0&&(console.log(a.default.yellow(`
+  Defaults used:`)),f.forEach(v=>console.log(`    - ${v}`))),g.length>0?(console.log(a.default.red(`
+  Missing secrets (no default):`)),g.forEach(v=>console.log(a.default.red(`    \u2717 ${v}`))),process.exit(1)):console.log(a.default.green(`
+  \u2705 All placeholders are resolvable!`))});D.command("list <templateFile>").description("List all placeholders found in a template file (no API call needed)").action(e=>{let t=$.resolve(process.cwd(),e);m.existsSync(t)||(console.error(a.default.red(`Template file not found: ${t}`)),process.exit(1));let n=[...m.readFileSync(t,"utf8").matchAll(P)];if(n.length===0){console.log(a.default.yellow("No placeholders found in this template."));return}console.log(a.default.bold(`
+Placeholders in ${$.basename(e)}:
+`)),n.forEach(r=>{let[,i,d,u]=r,c=u?a.default.gray(` (default: "${u.trim()}")`):"";console.log(`  ${i==="secrets"?"\u{1F512}":"\u{1F4E6}"} ${a.default.cyan(`{{ ${i}.${d} }}`)}${c}`)}),console.log(`
+  Total: ${a.default.bold(n.length)} placeholder(s)
+`)});0&&(module.exports={templateCommand});

package/dist/commands/ui.js

@@ -1,289 +1,2 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.uiCommand = void 0;
-const commander_1 = require("commander");
-const chalk_1 = __importDefault(require("chalk"));
-const readline = __importStar(require("readline"));
-const api_1 = require("../lib/api");
-const config_1 = require("../lib/config");
-const ENVS = ["development", "staging", "production"];
-const ENV_COLORS = {
-    development: chalk_1.default.green,
-    staging: chalk_1.default.yellow,
-    production: chalk_1.default.red,
-};
-const W = process.stdout.columns || 120;
-// ─── Box Drawing Helpers ─────────────────────────────────────────────────────
-const B = {
-    tl: "╭", tr: "╮", bl: "╰", br: "╯",
-    h: "─", v: "│", x: "┼",
-    lt: "├", rt: "┤", tt: "┬", bt: "┴",
-};
-function hline(width, c = B.h) { return c.repeat(width); }
-function box(title, lines, width, active) {
-    const border = active ? chalk_1.default.cyan : chalk_1.default.hex("#2d3a4d");
-    const inner = width - 2;
-    const pad = (s) => s.padEnd(inner).slice(0, inner);
-    const label = active
-        ? chalk_1.default.bold.cyan(` ${title} `)
-        : chalk_1.default.hex("#4a5568")(` ${title} `);
-    const titleLine = border(B.tl) + label + border(hline(inner - title.length - 2)) + border(B.tr);
-    const body = lines.map(l => border(B.v) + l.slice(0, inner).padEnd(inner) + border(B.v));
-    const foot = border(B.bl) + border(hline(inner)) + border(B.br);
-    return [titleLine, ...body, foot];
-}
-function clear() { process.stdout.write("\x1B[H\x1B[2J\x1B[3J"); }
-// ─── Main TUI ────────────────────────────────────────────────────────────────
-async function runUI() {
-    let panel = "projects";
-    let projects = [];
-    let projIdx = 0;
-    let envIdx = 0;
-    let secrets = [];
-    let secIdx = 0;
-    let status = "Loading…";
-    let loading = false;
-    let showValues = false;
-    // ── Loaders ────────────────────────────────────────────────────────────────
-    async function loadProjects() {
-        status = "Loading projects…";
-        draw();
-        try {
-            const raw = await api_1.api.getProjects();
-            projects = Array.isArray(raw) ? raw : raw.projects ?? [];
-            status = projects.length > 0
-                ? `${projects.length} project(s) found  ·  ↑↓ navigate  ·  Enter to load secrets`
-                : "No projects found. Run `xtra login` first.";
-        }
-        catch (e) {
-            status = chalk_1.default.red(`✗ ${e.message}`);
-        }
-        draw();
-    }
-    async function loadSecrets() {
-        if (!projects[projIdx])
-            return;
-        loading = true;
-        status = `Fetching secrets for ${chalk_1.default.cyan(projects[projIdx].name)} / ${ENV_COLORS[ENVS[envIdx]](ENVS[envIdx])}…`;
-        draw();
-        try {
-            const rc = (0, config_1.getRcConfig)();
-            const branch = rc.branch || "main";
-            const raw = await api_1.api.getSecrets(projects[projIdx].id, ENVS[envIdx], branch);
-            if (raw && typeof raw === "object" && !Array.isArray(raw)) {
-                secrets = Object.entries(raw).map(([key, value]) => ({
-                    id: key, key, value: String(value), updatedAt: new Date().toISOString(),
-                }));
-            }
-            else if (Array.isArray(raw)) {
-                secrets = raw;
-            }
-            else {
-                secrets = [];
-            }
-            secIdx = 0;
-            status = secrets.length > 0
-                ? `${secrets.length} secret(s) ·  V toggle values  ·  Tab switch panel  ·  Q quit`
-                : "No secrets in this environment.";
-        }
-        catch (e) {
-            secrets = [];
-            status = chalk_1.default.red(`✗ ${e.message}`);
-        }
-        loading = false;
-        draw();
-    }
-    // ── Render ─────────────────────────────────────────────────────────────────
-    function draw() {
-        clear();
-        // ── Header ──────────────────────────────────────────────────────────────
-        const appTitle = chalk_1.default.bold.cyan("  🔒 XtraSecurity") + chalk_1.default.hex("#4a5a6b")(" — Interactive Secrets Shell");
-        const env = ENV_COLORS[ENVS[envIdx]] ? ENV_COLORS[ENVS[envIdx]](ENVS[envIdx]) : chalk_1.default.white(ENVS[envIdx]);
-        const crumb = projects[projIdx]
-            ? chalk_1.default.hex("#4a5568")(`  ${projects[projIdx].name} `) + chalk_1.default.hex("#4a5568")("/") + chalk_1.default.hex("#4a5568")(` ${ENVS[envIdx]}`)
-            : chalk_1.default.hex("#4a5568")("  No project selected");
-        console.log();
-        console.log(appTitle + chalk_1.default.hex("#2d3a4d")("  │") + crumb);
-        console.log(chalk_1.default.hex("#1e293b")(hline(W)));
-        console.log();
-        // ── Left column: Projects (22 chr) + Env (22 chr) ─────────────────────
-        const LEFT_W = 26;
-        const RIGHT_W = W - LEFT_W - 3;
-        // Projects panel
-        const projLines = (projects.length > 0 ? projects : [{ id: "", name: "(loading…)" }]).map((p, i) => {
-            const active = i === projIdx;
-            const icon = active ? chalk_1.default.cyan("▶ ") : "  ";
-            const name = active && panel === "projects"
-                ? chalk_1.default.bold.bgCyan.black(` ${p.name} `.padEnd(LEFT_W - 4))
-                : active
-                    ? chalk_1.default.bold.cyan(p.name)
-                    : chalk_1.default.hex("#6b7c93")(p.name);
-            return ` ${icon}${name}`;
-        });
-        const projBox = box("PROJECTS", projLines, LEFT_W, panel === "projects");
-        // Env panel
-        const envLines = ENVS.map((e, i) => {
-            const active = i === envIdx;
-            const icon = active ? chalk_1.default.cyan("▶ ") : "  ";
-            const col = ENV_COLORS[e] ?? chalk_1.default.white;
-            const name = active && panel === "env"
-                ? chalk_1.default.bold.bgCyan.black(` ${e} `.padEnd(LEFT_W - 4))
-                : active
-                    ? col.bold(e)
-                    : chalk_1.default.hex("#6b7c93")(e);
-            return ` ${icon}${name}`;
-        });
-        const envBox = box("ENVIRONMENT", envLines, LEFT_W, panel === "env");
-        // Secrets panel
-        const KW = Math.floor((RIGHT_W - 3) * 0.45);
-        const VW = Math.floor((RIGHT_W - 3) * 0.35);
-        const DW = RIGHT_W - KW - VW - 4;
-        const secHeader = chalk_1.default.bold.hex("#64748b")("KEY".padEnd(KW)) + "  " + chalk_1.default.bold.hex("#64748b")("VALUE".padEnd(VW)) + "  " + chalk_1.default.bold.hex("#64748b")("UPDATED".padEnd(DW));
-        const divider = chalk_1.default.hex("#1e293b")(hline(KW) + "  " + hline(VW) + "  " + hline(DW));
-        let secLines;
-        if (loading) {
-            secLines = [` ${chalk_1.default.cyan("⠋")} Loading…`];
-        }
-        else if (secrets.length === 0) {
-            secLines = [` ${chalk_1.default.hex("#4a5568")("No secrets in this environment.")}`];
-        }
-        else {
-            secLines = [" " + secHeader, " " + divider, ...secrets.map((s, i) => {
-                    const sel = i === secIdx && panel === "secrets";
-                    const key = s.key.padEnd(KW).slice(0, KW);
-                    const val = showValues ? s.value.padEnd(VW).slice(0, VW) : "●".repeat(Math.min(8, VW)).padEnd(VW).slice(0, VW);
-                    const dt = new Date(s.updatedAt).toLocaleDateString("en-GB", { day: "2-digit", month: "short" }).padEnd(DW);
-                    if (sel) {
-                        return chalk_1.default.bold.bgHex("#0e243e")(" ▶ " + chalk_1.default.cyan(key) + "  " + chalk_1.default.greenBright(val) + "  " + chalk_1.default.hex("#4a9eff")(dt) + " ");
-                    }
-                    return "   " + chalk_1.default.white(key) + "  " + chalk_1.default.hex("#4a5568")(val) + "  " + chalk_1.default.hex("#374151")(dt);
-                })];
-        }
-        const secBox = box(`SECRETS (${secrets.length})`, secLines, RIGHT_W, panel === "secrets");
-        // ── Print side-by-side ────────────────────────────────────────────────
-        const leftPanel = [...projBox, ...["", ""], ...envBox];
-        const maxRows = Math.max(leftPanel.length, secBox.length);
-        const gap = chalk_1.default.hex("#1e293b")("  │  ");
-        for (let r = 0; r < maxRows; r++) {
-            const l = leftPanel[r] ?? " ".repeat(LEFT_W);
-            const rr = secBox[r] ?? " ".repeat(RIGHT_W);
-            console.log(l + gap + rr);
-        }
-        // ── Footer ───────────────────────────────────────────────────────────
-        console.log();
-        console.log(chalk_1.default.hex("#1e293b")(hline(W)));
-        const keys = [
-            [chalk_1.default.hex("#64748b")("↑↓"), "Navigate"],
-            [chalk_1.default.hex("#64748b")("Enter"), "Select"],
-            [chalk_1.default.hex("#64748b")("Tab"), "Switch Panel"],
-            [chalk_1.default.hex("#64748b")("V"), showValues ? chalk_1.default.green("Hide values") : chalk_1.default.yellow("Show values")],
-            [chalk_1.default.hex("#64748b")("Q"), "Quit"],
-        ].map(([k, a]) => `${k} ${chalk_1.default.hex("#374151")(a)}`).join(chalk_1.default.hex("#1e293b")("  ·  "));
-        console.log("  " + keys);
-        console.log();
-        console.log("  " + (status || ""));
-    }
-    // ── Keyboard ──────────────────────────────────────────────────────────────
-    readline.emitKeypressEvents(process.stdin);
-    if (process.stdin.isTTY)
-        process.stdin.setRawMode(true);
-    process.stdin.on("keypress", async (_str, key) => {
-        if (!key)
-            return;
-        // Quit
-        if (key.name === "q" || (key.ctrl && key.name === "c")) {
-            if (process.stdin.isTTY)
-                process.stdin.setRawMode(false);
-            clear();
-            console.log(chalk_1.default.cyan("  Goodbye! 👋\n"));
-            process.exit(0);
-        }
-        // Toggle secret values with V
-        if (key.name === "v") {
-            showValues = !showValues;
-            draw();
-            return;
-        }
-        // Tab cycle panels
-        if (key.name === "tab") {
-            panel = panel === "projects" ? "env" : panel === "env" ? "secrets" : "projects";
-            draw();
-            return;
-        }
-        if (panel === "projects") {
-            if (key.name === "up")
-                projIdx = Math.max(0, projIdx - 1);
-            if (key.name === "down")
-                projIdx = Math.min(projects.length - 1, projIdx + 1);
-            if (key.name === "return") {
-                panel = "env";
-                draw();
-                return;
-            }
-        }
-        if (panel === "env") {
-            if (key.name === "up")
-                envIdx = Math.max(0, envIdx - 1);
-            if (key.name === "down")
-                envIdx = Math.min(ENVS.length - 1, envIdx + 1);
-            if (key.name === "return") {
-                panel = "secrets";
-                await loadSecrets();
-                return;
-            }
-        }
-        if (panel === "secrets") {
-            if (key.name === "up")
-                secIdx = Math.max(0, secIdx - 1);
-            if (key.name === "down")
-                secIdx = Math.min(secrets.length - 1, secIdx + 1);
-        }
-        draw();
-    });
-    // ── Boot ──────────────────────────────────────────────────────────────────
-    await loadProjects();
-    if (projects.length > 0)
-        await loadSecrets();
-    else
-        draw();
-}
-// ─── Commander ───────────────────────────────────────────────────────────────
-exports.uiCommand = new commander_1.Command("ui")
-    .description("Launch interactive TUI secrets dashboard (arrow keys, Tab, Q to quit)")
-    .action(async () => { await runUI(); });
+var le=Object.create;var T=Object.defineProperty;var de=Object.getOwnPropertyDescriptor;var ue=Object.getOwnPropertyNames;var he=Object.getPrototypeOf,me=Object.prototype.hasOwnProperty;var fe=(e,t)=>{for(var s in t)T(e,s,{get:t[s],enumerable:!0})},H=(e,t,s,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of ue(t))!me.call(e,o)&&o!==s&&T(e,o,{get:()=>t[o],enumerable:!(r=de(t,o))||r.enumerable});return e};var w=(e,t,s)=>(s=e!=null?le(he(e)):{},H(t||!e||!e.__esModule?T(s,"default",{value:e,enumerable:!0}):s,e)),ye=e=>H(T({},"__esModule",{value:!0}),e);var ve={};fe(ve,{uiCommand:()=>xe});module.exports=ye(ve);var ee=require("commander"),n=w(require("chalk")),te=w(require("readline"));var X=w(require("axios"));var W=w(require("conf")),M=w(require("fs")),K=w(require("path")),O="https://www.xtrasecurity.in/api",x=new W.default({projectName:"xtra-cli",defaults:{apiUrl:O}}),_=x.get("apiUrl");_&&!process.env.XTRA_API_URL&&(_.includes("localhost")||_.includes("xtra-security.vercel.app"))&&x.set("apiUrl",O);var P=()=>({...x.store,apiUrl:process.env.XTRA_API_URL||x.get("apiUrl")||O});var F=()=>x.get("token");var Q=()=>{let e={};try{let t=K.default.join(process.cwd(),".xtrarc");M.default.existsSync(t)&&(e=JSON.parse(M.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||x.get("project")||"",env:e.env||x.get("env")||"development",branch:e.branch||x.get("branch")||"main"}};var Y=w(require("fs")),z=w(require("path")),be=JSON.parse(Y.readFileSync(z.join(__dirname,"../../package.json"),"utf-8")),a=()=>{let{apiUrl:e}=P(),t=F();return X.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":be.version,...t?{Authorization:`Bearer ${t}`}:{}}})},V={login:async(e,t,s)=>(await a().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await a().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await a().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,r,o="main")=>(await a().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:r,branch:o})).data,getSecretDetails:async(e,t,s,r="main")=>(await a().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${r}`)).data,syncLogs:async e=>(await a().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,r,o,c)=>(await a().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:r,sourceEnv:o,sourceKey:c})).data,rotateSecret:async(e,t,s,r,o)=>(await a().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:r,parsedNewValue:o})).data,promoteSecret:async(e,t,s)=>(await a().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await a().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,r)=>{let o={format:e};return t&&(o.startDate=t),s&&(o.endDate=s),r&&(o.projectId=r),(await a().post("/audit/export",o,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,r)=>(await a().post("/access/request",{projectId:e,secretId:r,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await a().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=P(),s=t?`&workspaceId=${t}`:"";return(await a().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await a().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=P(),t=e?`/project?workspaceId=${e}`:"/project";return(await a().get(t)).data},getBranches:async e=>(await a().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await a().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await a().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await a().put("/branch",{id:e,...t})).data,getRoles:async()=>(await a().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await a().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await a().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await a().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await a().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await a().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await a().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await a().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,r)=>(await a().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:r})).data,cloneEnvironment:async(e,t,s,r,o)=>(await a().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:r,branch:o})).data,generateJitLink:async e=>(await a().post("/jit/generate",e)).data,claimJitLink:async e=>(await a().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await a().get(`/jit/${e}`)).data,post:async(e,t)=>(await a().post(e,t)).data};var u=["development","staging","production"],U={development:n.default.green,staging:n.default.yellow,production:n.default.red},D=process.stdout.columns||120,$={tl:"\u256D",tr:"\u256E",bl:"\u2570",br:"\u256F",h:"\u2500",v:"\u2502",x:"\u253C",lt:"\u251C",rt:"\u2524",tt:"\u252C",bt:"\u2534"};function j(e,t=$.h){return t.repeat(e)}function G(e,t,s,r){let o=r?n.default.cyan:n.default.hex("#2d3a4d"),c=s-2,h=g=>g.padEnd(c).slice(0,c),A=r?n.default.bold.cyan(` ${e} `):n.default.hex("#4a5568")(` ${e} `),S=o($.tl)+A+o(j(c-e.length-2))+o($.tr),B=t.map(g=>o($.v)+g.slice(0,c).padEnd(c)+o($.v)),k=o($.bl)+o(j(c))+o($.br);return[S,...B,k]}function Z(){process.stdout.write("\x1B[H\x1B[2J\x1B[3J")}async function we(){let e="projects",t=[],s=0,r=0,o=[],c=0,h="Loading\u2026",A=!1,S=!1;async function B(){h="Loading projects\u2026",g();try{let l=await V.getProjects();t=Array.isArray(l)?l:l.projects??[],h=t.length>0?`${t.length} project(s) found  \xB7  \u2191\u2193 navigate  \xB7  Enter to load secrets`:"No projects found. Run `xtra login` first."}catch(l){h=n.default.red(`\u2717 ${l.message}`)}g()}async function k(){if(t[s]){A=!0,h=`Fetching secrets for ${n.default.cyan(t[s].name)} / ${U[u[r]](u[r])}\u2026`,g();try{let p=Q().branch||"main",y=await V.getSecrets(t[s].id,u[r],p);y&&typeof y=="object"&&!Array.isArray(y)?o=Object.entries(y).map(([m,v])=>({id:m,key:m,value:String(v),updatedAt:new Date().toISOString()})):Array.isArray(y)?o=y:o=[],c=0,h=o.length>0?`${o.length} secret(s) \xB7  V toggle values  \xB7  Tab switch panel  \xB7  Q quit`:"No secrets in this environment."}catch(l){o=[],h=n.default.red(`\u2717 ${l.message}`)}A=!1,g()}}function g(){Z();let l=n.default.bold.cyan("  \u{1F512} XtraSecurity")+n.default.hex("#4a5a6b")(" \u2014 Interactive Secrets Shell"),p=U[u[r]]?U[u[r]](u[r]):n.default.white(u[r]),y=t[s]?n.default.hex("#4a5568")(`  ${t[s].name} `)+n.default.hex("#4a5568")("/")+n.default.hex("#4a5568")(` ${u[r]}`):n.default.hex("#4a5568")("  No project selected");console.log(),console.log(l+n.default.hex("#2d3a4d")("  \u2502")+y),console.log(n.default.hex("#1e293b")(j(D))),console.log();let m=26,v=D-m-3,se=(t.length>0?t:[{id:"",name:"(loading\u2026)"}]).map((i,f)=>{let d=f===s,I=d?n.default.cyan("\u25B6 "):"  ",R=d&&e==="projects"?n.default.bold.bgCyan.black(` ${i.name} `.padEnd(m-4)):d?n.default.bold.cyan(i.name):n.default.hex("#6b7c93")(i.name);return` ${I}${R}`}),ne=G("PROJECTS",se,m,e==="projects"),re=u.map((i,f)=>{let d=f===r,I=d?n.default.cyan("\u25B6 "):"  ",R=U[i]??n.default.white,L=d&&e==="env"?n.default.bold.bgCyan.black(` ${i} `.padEnd(m-4)):d?R.bold(i):n.default.hex("#6b7c93")(i);return` ${I}${L}`}),oe=G("ENVIRONMENT",re,m,e==="env"),E=Math.floor((v-3)*.45),b=Math.floor((v-3)*.35),N=v-E-b-4,ae=n.default.bold.hex("#64748b")("KEY".padEnd(E))+"  "+n.default.bold.hex("#64748b")("VALUE".padEnd(b))+"  "+n.default.bold.hex("#64748b")("UPDATED".padEnd(N)),ce=n.default.hex("#1e293b")(j(E)+"  "+j(b)+"  "+j(N)),C;A?C=[` ${n.default.cyan("\u280B")} Loading\u2026`]:o.length===0?C=[` ${n.default.hex("#4a5568")("No secrets in this environment.")}`]:C=[" "+ae," "+ce,...o.map((i,f)=>{let d=f===c&&e==="secrets",I=i.key.padEnd(E).slice(0,E),R=S?i.value.padEnd(b).slice(0,b):"\u25CF".repeat(Math.min(8,b)).padEnd(b).slice(0,b),L=new Date(i.updatedAt).toLocaleDateString("en-GB",{day:"2-digit",month:"short"}).padEnd(N);return d?n.default.bold.bgHex("#0e243e")(" \u25B6 "+n.default.cyan(I)+"  "+n.default.greenBright(R)+"  "+n.default.hex("#4a9eff")(L)+" "):"   "+n.default.white(I)+"  "+n.default.hex("#4a5568")(R)+"  "+n.default.hex("#374151")(L)})];let q=G(`SECRETS (${o.length})`,C,v,e==="secrets"),J=[...ne,"","",...oe],ie=Math.max(J.length,q.length),pe=n.default.hex("#1e293b")("  \u2502  ");for(let i=0;i<ie;i++){let f=J[i]??" ".repeat(m),d=q[i]??" ".repeat(v);console.log(f+pe+d)}console.log(),console.log(n.default.hex("#1e293b")(j(D)));let ge=[[n.default.hex("#64748b")("\u2191\u2193"),"Navigate"],[n.default.hex("#64748b")("Enter"),"Select"],[n.default.hex("#64748b")("Tab"),"Switch Panel"],[n.default.hex("#64748b")("V"),S?n.default.green("Hide values"):n.default.yellow("Show values")],[n.default.hex("#64748b")("Q"),"Quit"]].map(([i,f])=>`${i} ${n.default.hex("#374151")(f)}`).join(n.default.hex("#1e293b")("  \xB7  "));console.log("  "+ge),console.log(),console.log("  "+(h||""))}te.emitKeypressEvents(process.stdin),process.stdin.isTTY&&process.stdin.setRawMode(!0),process.stdin.on("keypress",async(l,p)=>{if(p){if((p.name==="q"||p.ctrl&&p.name==="c")&&(process.stdin.isTTY&&process.stdin.setRawMode(!1),Z(),console.log(n.default.cyan(`  Goodbye! \u{1F44B}
+`)),process.exit(0)),p.name==="v"){S=!S,g();return}if(p.name==="tab"){e=e==="projects"?"env":e==="env"?"secrets":"projects",g();return}if(e==="projects"&&(p.name==="up"&&(s=Math.max(0,s-1)),p.name==="down"&&(s=Math.min(t.length-1,s+1)),p.name==="return")){e="env",g();return}if(e==="env"&&(p.name==="up"&&(r=Math.max(0,r-1)),p.name==="down"&&(r=Math.min(u.length-1,r+1)),p.name==="return")){e="secrets",await k();return}e==="secrets"&&(p.name==="up"&&(c=Math.max(0,c-1)),p.name==="down"&&(c=Math.min(o.length-1,c+1))),g()}}),await B(),t.length>0?await k():g()}var xe=new ee.Command("ui").description("Launch interactive TUI secrets dashboard (arrow keys, Tab, Q to quit)").action(async()=>{await we()});0&&(module.exports={uiCommand});