xtra-cli 1.0.3 → 1.0.5

package/dist/commands/watch.js

@@ -1,123 +1,17 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.watchCommand = void 0;
-/**
- * watch.ts — Live reload secrets in dev mode
- *
- * Polls XtraSecurity Cloud for secret changes at a configurable interval.
- * When a change is detected, restarts the child process with fresh secrets.
- *
- * Usage:
- *   xtra watch -p proj123 -e dev node app.js
- *   xtra watch -p proj123 -e dev --interval 10 npm run dev --shell
- */
-const commander_1 = require("commander");
-const api_1 = require("../lib/api");
-const config_1 = require("../lib/config");
-const chalk_1 = __importDefault(require("chalk"));
-const child_process_1 = require("child_process");
-let child = null;
-let lastHash = "";
-function hashSecrets(secrets) {
-    return JSON.stringify(Object.keys(secrets).sort().map(k => `${k}=${secrets[k]}`));
-}
-async function startProcess(command, args, secrets, useShell) {
-    if (child) {
-        process.stdout.write(chalk_1.default.cyan("\n  [watch] ") + chalk_1.default.yellow("Secret change detected — restarting...\n"));
-        child.kill("SIGTERM");
-        // Give it 500ms to terminate gracefully
-        await new Promise(r => setTimeout(r, 500));
-    }
-    const envVars = { ...process.env, ...secrets };
-    process.stdout.write(chalk_1.default.cyan("  [watch] ") + chalk_1.default.green(`Starting: ${command} ${args.join(" ")}\n`));
-    child = (0, child_process_1.spawn)(command, args, {
-        env: envVars,
-        stdio: "inherit",
-        shell: useShell,
-    });
-    child.on("exit", (code) => {
-        if (code !== null && code !== 0) {
-            process.stdout.write(chalk_1.default.cyan("  [watch] ") + chalk_1.default.red(`Process exited with code ${code}\n`));
-        }
-        child = null;
-    });
-    child.on("error", (err) => {
-        process.stdout.write(chalk_1.default.cyan("  [watch] ") + chalk_1.default.red(`Failed to start: ${err.message}\n`));
-        child = null;
-    });
-}
-exports.watchCommand = new commander_1.Command("watch")
-    .description("Live reload — auto-restart process when secrets change in cloud")
-    .option("-p, --project <id>", "Project ID")
-    .option("-e, --env <environment>", "Environment", "development")
-    .option("-b, --branch <branch>", "Branch", "main")
-    .option("--interval <seconds>", "Poll interval in seconds", "5")
-    .option("--shell", "Use shell mode for the child process (for npm run etc.)", false)
-    .argument("<command>", "Command to run")
-    .argument("[args...]", "Command arguments")
-    .addHelpText("after", `
-Examples:
-  $ xtra watch -p proj123 -e dev node app.js
-  $ xtra watch -p proj123 -e dev --interval 10 --shell npm run dev
-  $ xtra watch -p proj123 -e dev -- node -r dotenv/config server.js
-`)
-    .action(async (command, args, options) => {
-    let { project, env, branch, interval, shell: useShell } = options;
-    const envMap = { dev: "development", stg: "staging", prod: "production" };
-    env = envMap[env] || env;
-    if (!project)
-        project = (0, config_1.getRcConfig)().project;
-    if (!project) {
-        console.error(chalk_1.default.red("Error: Project ID required. Use -p <id> or run 'xtra project set'."));
-        process.exit(1);
-    }
-    // Block production watch — too dangerous
-    if (env === "production") {
-        console.error(chalk_1.default.red("⚠ xtra watch is not allowed in PRODUCTION for safety reasons."));
-        console.error(chalk_1.default.gray("   Use 'xtra run' for one-shot production injection."));
-        process.exit(1);
-    }
-    const pollMs = Math.max(3, parseInt(interval)) * 1000;
-    const isWindows = process.platform === "win32";
-    const finalShell = useShell || isWindows;
-    console.log(chalk_1.default.bold.cyan("\n● xtra watch") + chalk_1.default.bold(` — watching ${env}/${branch} (every ${interval}s)\n`));
-    console.log(chalk_1.default.gray(`  Press Ctrl+C to stop.\n`));
-    // Graceful shutdown
-    process.on("SIGINT", () => {
-        if (child)
-            child.kill("SIGTERM");
-        console.log(chalk_1.default.cyan("\n  [watch] ") + chalk_1.default.gray("Stopped."));
-        process.exit(0);
-    });
-    // Initial fetch & start
-    try {
-        const secrets = await api_1.api.getSecrets(project, env, branch);
-        lastHash = hashSecrets(secrets);
-        await startProcess(command, args, secrets, finalShell);
-    }
-    catch (e) {
-        console.error(chalk_1.default.red("Failed to fetch secrets: " + (e?.response?.data?.error || e.message)));
-        process.exit(1);
-    }
-    // Poll loop
-    setInterval(async () => {
-        try {
-            const secrets = await api_1.api.getSecrets(project, env, branch);
-            const hash = hashSecrets(secrets);
-            if (hash !== lastHash) {
-                lastHash = hash;
-                await startProcess(command, args, secrets, finalShell);
-            }
-            else {
-                process.stdout.write(chalk_1.default.cyan("  [watch] ") + chalk_1.default.gray(`${new Date().toLocaleTimeString()} — no changes  \r`));
-            }
-        }
-        catch (e) {
-            process.stdout.write(chalk_1.default.cyan("\n  [watch] ") + chalk_1.default.yellow(`Poll failed: ${e.message}\n`));
-            // Don't exit — keep trying
-        }
-    }, pollMs);
-});
+var N=Object.create;var d=Object.defineProperty;var B=Object.getOwnPropertyDescriptor;var D=Object.getOwnPropertyNames;var q=Object.getPrototypeOf,J=Object.prototype.hasOwnProperty;var E=(e,t)=>{for(var s in t)d(e,s,{get:t[s],enumerable:!0})},S=(e,t,s,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of D(t))!J.call(e,o)&&o!==s&&d(e,o,{get:()=>t[o],enumerable:!(n=B(t,o))||n.enumerable});return e};var l=(e,t,s)=>(s=e!=null?N(q(e)):{},S(t||!e||!e.__esModule?d(s,"default",{value:e,enumerable:!0}):s,e)),M=e=>S(d({},"__esModule",{value:!0}),e);var H={};E(H,{watchCommand:()=>F});module.exports=M(H);var T=require("commander");var C=l(require("axios"));var x=l(require("conf")),m=l(require("fs")),k=l(require("path")),w="https://www.xtrasecurity.in/api",g=new x.default({projectName:"xtra-cli",defaults:{apiUrl:w}}),h=g.get("apiUrl");h&&!process.env.XTRA_API_URL&&(h.includes("localhost")||h.includes("xtra-security.vercel.app"))&&g.set("apiUrl",w);var u=()=>({...g.store,apiUrl:process.env.XTRA_API_URL||g.get("apiUrl")||w});var b=()=>g.get("token");var I=()=>{let e={};try{let t=k.default.join(process.cwd(),".xtrarc");m.default.existsSync(t)&&(e=JSON.parse(m.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||g.get("project")||"",env:e.env||g.get("env")||"development",branch:e.branch||g.get("branch")||"main"}};var P=l(require("fs")),R=l(require("path")),V=JSON.parse(P.readFileSync(R.join(__dirname,"../../package.json"),"utf-8")),r=()=>{let{apiUrl:e}=u(),t=b();return C.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":V.version,...t?{Authorization:`Bearer ${t}`}:{}}})},f={login:async(e,t,s)=>(await r().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,n,o="main")=>(await r().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:n,branch:o})).data,getSecretDetails:async(e,t,s,n="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${n}`)).data,syncLogs:async e=>(await r().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,n,o,i)=>(await r().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:n,sourceEnv:o,sourceKey:i})).data,rotateSecret:async(e,t,s,n,o)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:n,parsedNewValue:o})).data,promoteSecret:async(e,t,s)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await r().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,n)=>{let o={format:e};return t&&(o.startDate=t),s&&(o.endDate=s),n&&(o.projectId=n),(await r().post("/audit/export",o,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,n)=>(await r().post("/access/request",{projectId:e,secretId:n,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await r().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=u(),s=t?`&workspaceId=${t}`:"";return(await r().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await r().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=u(),t=e?`/project?workspaceId=${e}`:"/project";return(await r().get(t)).data},getBranches:async e=>(await r().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await r().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await r().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await r().put("/branch",{id:e,...t})).data,getRoles:async()=>(await r().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await r().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await r().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await r().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await r().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await r().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await r().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await r().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,n)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:n})).data,cloneEnvironment:async(e,t,s,n,o)=>(await r().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:n,branch:o})).data,generateJitLink:async e=>(await r().post("/jit/generate",e)).data,claimJitLink:async e=>(await r().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await r().get(`/jit/${e}`)).data,post:async(e,t)=>(await r().post(e,t)).data};var a=l(require("chalk")),L=require("child_process"),p=null,v="";function U(e){return JSON.stringify(Object.keys(e).sort().map(t=>`${t}=${e[t]}`))}async function A(e,t,s,n){p&&(process.stdout.write(a.default.cyan(`
+  [watch] `)+a.default.yellow(`Secret change detected \u2014 restarting...
+`)),p.kill("SIGTERM"),await new Promise(i=>setTimeout(i,500)));let o={...process.env,...s};process.stdout.write(a.default.cyan("  [watch] ")+a.default.green(`Starting: ${e} ${t.join(" ")}
+`)),p=(0,L.spawn)(e,t,{env:o,stdio:"inherit",shell:n}),p.on("exit",i=>{i!==null&&i!==0&&process.stdout.write(a.default.cyan("  [watch] ")+a.default.red(`Process exited with code ${i}
+`)),p=null}),p.on("error",i=>{process.stdout.write(a.default.cyan("  [watch] ")+a.default.red(`Failed to start: ${i.message}
+`)),p=null})}var F=new T.Command("watch").description("Live reload \u2014 auto-restart process when secrets change in cloud").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment","development").option("-b, --branch <branch>","Branch","main").option("--interval <seconds>","Poll interval in seconds","5").option("--shell","Use shell mode for the child process (for npm run etc.)",!1).argument("<command>","Command to run").argument("[args...]","Command arguments").addHelpText("after",`
+Examples:
+  $ xtra watch -p proj123 -e dev node app.js
+  $ xtra watch -p proj123 -e dev --interval 10 --shell npm run dev
+  $ xtra watch -p proj123 -e dev -- node -r dotenv/config server.js
+`).action(async(e,t,s)=>{let{project:n,env:o,branch:i,interval:y,shell:_}=s;o={dev:"development",stg:"staging",prod:"production"}[o]||o,n||(n=I().project),n||(console.error(a.default.red("Error: Project ID required. Use -p <id> or run 'xtra project set'.")),process.exit(1)),o==="production"&&(console.error(a.default.red("\u26A0 xtra watch is not allowed in PRODUCTION for safety reasons.")),console.error(a.default.gray("   Use 'xtra run' for one-shot production injection.")),process.exit(1));let G=Math.max(3,parseInt(y))*1e3,O=process.platform==="win32",$=_||O;console.log(a.default.bold.cyan(`
+\u25CF xtra watch`)+a.default.bold(` \u2014 watching ${o}/${i} (every ${y}s)
+`)),console.log(a.default.gray(`  Press Ctrl+C to stop.
+`)),process.on("SIGINT",()=>{p&&p.kill("SIGTERM"),console.log(a.default.cyan(`
+  [watch] `)+a.default.gray("Stopped.")),process.exit(0)});try{let c=await f.getSecrets(n,o,i);v=U(c),await A(e,t,c,$)}catch(c){console.error(a.default.red("Failed to fetch secrets: "+(c?.response?.data?.error||c.message))),process.exit(1)}setInterval(async()=>{try{let c=await f.getSecrets(n,o,i),j=U(c);j!==v?(v=j,await A(e,t,c,$)):process.stdout.write(a.default.cyan("  [watch] ")+a.default.gray(`${new Date().toLocaleTimeString()} \u2014 no changes  \r`))}catch(c){process.stdout.write(a.default.cyan(`
+  [watch] `)+a.default.yellow(`Poll failed: ${c.message}
+`))}},G)});0&&(module.exports={watchCommand});

package/dist/lib/api.js

@@ -1,187 +1 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.api = void 0;
-const axios_1 = __importDefault(require("axios"));
-const config_1 = require("./config");
-const getClient = () => {
-    const { apiUrl } = (0, config_1.getConfig)();
-    const token = (0, config_1.getAuthToken)();
-    const client = axios_1.default.create({
-        baseURL: apiUrl,
-        headers: {
-            "Content-Type": "application/json",
-            ...(token ? { Authorization: `Bearer ${token}` } : {}),
-        },
-    });
-    return client;
-};
-exports.api = {
-    login: async (email, password, apiKey) => {
-        const response = await getClient().post("/auth/cli-login", {
-            email,
-            password,
-            apiKey,
-        });
-        return response.data;
-    },
-    // Placeholders for future methods
-    getSecrets: async (projectId, env, branch = "main") => {
-        // Fixed path to match Next.js dynamic route folder structure
-        const response = await getClient().get(`/projects/${projectId}/envs/${env}/secrets?branch=${branch}`);
-        return response.data;
-    },
-    getSecretVersions: async (projectId, env, branch = "main") => {
-        const response = await getClient().get(`/projects/${projectId}/envs/${env}/secrets?includeVersions=true&branch=${branch}`);
-        return response.data;
-    },
-    setSecrets: async (projectId, env, secrets, expectedVersions, branch = "main") => {
-        const response = await getClient().post(`/projects/${projectId}/envs/${env}/secrets`, { secrets, expectedVersions, branch });
-        return response.data;
-    },
-    getSecretDetails: async (projectId, env, key, branch = "main") => {
-        const response = await getClient().get(`/projects/${projectId}/envs/${env}/secrets/${key}?branch=${branch}`);
-        return response.data;
-    },
-    syncLogs: async (logs) => {
-        const response = await getClient().post("/audit/cli-logs", { logs });
-        return response.data;
-    },
-    linkSecret: async (projectId, env, key, sourceProjectId, sourceEnv, sourceKey) => {
-        const response = await getClient().post(`/projects/${projectId}/envs/${env}/secrets/link`, {
-            key,
-            sourceProjectId,
-            sourceEnv,
-            sourceKey
-        });
-        return response.data;
-    },
-    rotateSecret: async (projectId, env, key, strategy, parsedNewValue) => {
-        const response = await getClient().post(`/projects/${projectId}/envs/${env}/secrets/${key}/rotate`, {
-            strategy,
-            parsedNewValue
-        });
-        return response.data;
-    },
-    promoteSecret: async (projectId, env, key) => {
-        const response = await getClient().post(`/projects/${projectId}/envs/${env}/secrets/${key}/promote`, {});
-        return response.data;
-    },
-    verifyAuditLogs: async () => {
-        const response = await getClient().get("/audit/verify");
-        return response.data;
-    },
-    exportAuditLogs: async (format, start, end, projectId) => {
-        const body = { format };
-        if (start)
-            body.startDate = start;
-        if (end)
-            body.endDate = end;
-        if (projectId)
-            body.projectId = projectId;
-        const response = await getClient().post("/audit/export", body, { responseType: format === "csv" ? "text" : "json" });
-        return response.data;
-    },
-    // JIT Access
-    requestAccess: async (projectId, reason, duration, secretId) => {
-        const response = await getClient().post("/access/request", { projectId, secretId, reason, duration });
-        return response.data;
-    },
-    approveAccess: async (requestId, decision) => {
-        const response = await getClient().post("/access/approve", { requestId, decision });
-        return response.data;
-    },
-    listAccessRequests: async (mode) => {
-        const response = await getClient().get(`/access/list?mode=${mode}`);
-        return response.data;
-    },
-    // Project Management
-    getProjects: async () => {
-        const { workspace } = (0, config_1.getConfig)();
-        const url = workspace ? `/project?workspaceId=${workspace}` : "/project";
-        const response = await getClient().get(url);
-        return response.data;
-    },
-    // Branch Management
-    getBranches: async (projectId) => {
-        const response = await getClient().get(`/branch?projectId=${projectId}`);
-        return response.data;
-    },
-    createBranch: async (projectId, name, description) => {
-        const response = await getClient().post("/branch", { projectId, name, description });
-        return response.data;
-    },
-    deleteBranch: async (branchId) => {
-        const response = await getClient().delete(`/branch/${branchId}`);
-        return response.data;
-    },
-    updateBranch: async (branchId, updates) => {
-        const response = await getClient().put("/branch", { id: branchId, ...updates });
-        return response.data;
-    },
-    // Admin - Role Management
-    getRoles: async () => {
-        const response = await getClient().get("/admin/roles");
-        return response.data;
-    },
-    getUsers: async (teamId) => {
-        const params = teamId ? `?teamId=${teamId}` : "";
-        const response = await getClient().get(`/admin/users${params}`);
-        return response.data;
-    },
-    setUserRole: async (email, role, teamId) => {
-        const response = await getClient().put("/admin/users/role", { email, role, teamId });
-        return response.data;
-    },
-    // Integrations
-    getIntegrationStatus: async (provider) => {
-        const response = await getClient().get(`/integrations/${provider}`);
-        return response.data;
-    },
-    getIntegrationRepos: async (provider) => {
-        const response = await getClient().get(`/integrations/${provider}/sync`);
-        return response.data.repos;
-    },
-    syncSecretsToGithub: async (data) => {
-        const response = await getClient().post("/api/integrations/github/sync", data);
-        return response.data;
-    },
-    exportKubernetesSecret: async (projectId, params) => {
-        const query = new URLSearchParams(params).toString();
-        const response = await getClient().get(`/projects/${projectId}/kubernetes?${query}`);
-        return response.data; // This returns the YAML string directly
-    },
-    // Advanced Features
-    getSecretHistory: async (projectId, env, key) => {
-        const response = await getClient().get(`/projects/${projectId}/envs/${env}/secrets/${key}/history`);
-        return response.data;
-    },
-    rollbackSecret: async (projectId, env, key, version) => {
-        const response = await getClient().post(`/projects/${projectId}/envs/${env}/secrets/${key}/history`, { version });
-        return response.data;
-    },
-    cloneEnvironment: async (projectId, fromEnv, toEnv, overwrite, branch) => {
-        const response = await getClient().post(`/projects/${projectId}/envs/clone`, { fromEnv, toEnv, overwrite, branch });
-        return response.data;
-    },
-    // JIT Link Management
-    generateJitLink: async (opts) => {
-        const response = await getClient().post("/jit/generate", opts);
-        return response.data;
-    },
-    claimJitLink: async (token) => {
-        const response = await getClient().post("/jit/claim", { token });
-        return response.data;
-    },
-    getJitInfo: async (token) => {
-        const response = await getClient().get(`/jit/${token}`);
-        return response.data;
-    },
-    // Generic POST method for audit logging and other uses
-    post: async (endpoint, data) => {
-        const response = await getClient().post(endpoint, data);
-        return response.data;
-    }
-};
+var $=Object.create;var c=Object.defineProperty;var j=Object.getOwnPropertyDescriptor;var S=Object.getOwnPropertyNames;var v=Object.getPrototypeOf,b=Object.prototype.hasOwnProperty;var k=(s,e)=>{for(var t in e)c(s,t,{get:e[t],enumerable:!0})},l=(s,e,t,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let a of S(e))!b.call(s,a)&&a!==t&&c(s,a,{get:()=>e[a],enumerable:!(r=j(e,a))||r.enumerable});return s};var p=(s,e,t)=>(t=s!=null?$(v(s)):{},l(e||!s||!s.__esModule?c(t,"default",{value:s,enumerable:!0}):t,s)),x=s=>l(c({},"__esModule",{value:!0}),s);var C={};k(C,{api:()=>U});module.exports=x(C);var w=p(require("axios"));var y=p(require("conf"));var d="https://www.xtrasecurity.in/api",i=new y.default({projectName:"xtra-cli",defaults:{apiUrl:d}}),u=i.get("apiUrl");u&&!process.env.XTRA_API_URL&&(u.includes("localhost")||u.includes("xtra-security.vercel.app"))&&i.set("apiUrl",d);var g=()=>({...i.store,apiUrl:process.env.XTRA_API_URL||i.get("apiUrl")||d});var m=()=>i.get("token");var f=p(require("fs")),h=p(require("path")),I=JSON.parse(f.readFileSync(h.join(__dirname,"../../package.json"),"utf-8")),n=()=>{let{apiUrl:s}=g(),e=m();return w.default.create({baseURL:s,headers:{"Content-Type":"application/json","X-CLI-Version":I.version,...e?{Authorization:`Bearer ${e}`}:{}}})},U={login:async(s,e,t)=>(await n().post("/auth/cli-login",{email:s,password:e,apiKey:t})).data,getSecrets:async(s,e,t="main")=>(await n().get(`/projects/${s}/envs/${e}/secrets?branch=${t}`)).data,getSecretVersions:async(s,e,t="main")=>(await n().get(`/projects/${s}/envs/${e}/secrets?includeVersions=true&branch=${t}`)).data,setSecrets:async(s,e,t,r,a="main")=>(await n().post(`/projects/${s}/envs/${e}/secrets`,{secrets:t,expectedVersions:r,branch:a})).data,getSecretDetails:async(s,e,t,r="main")=>(await n().get(`/projects/${s}/envs/${e}/secrets/${t}?branch=${r}`)).data,syncLogs:async s=>(await n().post("/audit/cli-logs",{logs:s})).data,linkSecret:async(s,e,t,r,a,o)=>(await n().post(`/projects/${s}/envs/${e}/secrets/link`,{key:t,sourceProjectId:r,sourceEnv:a,sourceKey:o})).data,rotateSecret:async(s,e,t,r,a)=>(await n().post(`/projects/${s}/envs/${e}/secrets/${t}/rotate`,{strategy:r,parsedNewValue:a})).data,promoteSecret:async(s,e,t)=>(await n().post(`/projects/${s}/envs/${e}/secrets/${t}/promote`,{})).data,verifyAuditLogs:async()=>(await n().get("/audit/verify")).data,exportAuditLogs:async(s,e,t,r)=>{let a={format:s};return e&&(a.startDate=e),t&&(a.endDate=t),r&&(a.projectId=r),(await n().post("/audit/export",a,{responseType:s==="csv"?"text":"json"})).data},requestAccess:async(s,e,t,r)=>(await n().post("/access/request",{projectId:s,secretId:r,reason:e,duration:t})).data,approveAccess:async(s,e)=>(await n().post("/access/approve",{requestId:s,decision:e})).data,listAccessRequests:async s=>{let{workspace:e}=g(),t=e?`&workspaceId=${e}`:"";return(await n().get(`/access/list?mode=${s}${t}`)).data},getAccessRequestStatus:async s=>(await n().get(`/access/request?id=${s}`)).data,getProjects:async()=>{let{workspace:s}=g(),e=s?`/project?workspaceId=${s}`:"/project";return(await n().get(e)).data},getBranches:async s=>(await n().get(`/branch?projectId=${s}`)).data,createBranch:async(s,e,t)=>(await n().post("/branch",{projectId:s,name:e,description:t})).data,deleteBranch:async s=>(await n().delete(`/branch/${s}`)).data,updateBranch:async(s,e)=>(await n().put("/branch",{id:s,...e})).data,getRoles:async()=>(await n().get("/admin/roles")).data,getUsers:async s=>{let e=s?`?teamId=${s}`:"";return(await n().get(`/admin/users${e}`)).data},setUserRole:async(s,e,t)=>(await n().put("/admin/users/role",{email:s,role:e,teamId:t})).data,getIntegrationStatus:async s=>(await n().get(`/integrations/${s}`)).data,getIntegrationRepos:async s=>(await n().get(`/integrations/${s}/sync`)).data.repos,syncSecretsToGithub:async s=>(await n().post("/integrations/github/sync",s)).data,exportKubernetesSecret:async(s,e)=>{let t=new URLSearchParams(e).toString();return(await n().get(`/projects/${s}/kubernetes?${t}`)).data},getSecretHistory:async(s,e,t)=>(await n().get(`/projects/${s}/envs/${e}/secrets/${t}/history`)).data,rollbackSecret:async(s,e,t,r)=>(await n().post(`/projects/${s}/envs/${e}/secrets/${t}/history`,{version:r})).data,cloneEnvironment:async(s,e,t,r,a)=>(await n().post(`/projects/${s}/envs/clone`,{fromEnv:e,toEnv:t,overwrite:r,branch:a})).data,generateJitLink:async s=>(await n().post("/jit/generate",s)).data,claimJitLink:async s=>(await n().post("/jit/claim",{token:s})).data,getJitInfo:async s=>(await n().get(`/jit/${s}`)).data,post:async(s,e)=>(await n().post(s,e)).data};0&&(module.exports={api});

package/dist/lib/api.test.js

@@ -1,89 +1 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const api_1 = require("./api");
-const axios_1 = __importDefault(require("axios"));
-const config_1 = require("./config");
-// Mock axios and config
-jest.mock('axios');
-jest.mock('./config');
-const mockAxios = axios_1.default;
-describe('API Client', () => {
-    const mockCreate = jest.fn();
-    const mockGet = jest.fn();
-    const mockPost = jest.fn();
-    beforeAll(() => {
-        mockAxios.create = mockCreate;
-        config_1.getConfig.mockReturnValue({ apiUrl: 'http://localhost:3000/api' });
-        config_1.getAuthToken.mockReturnValue('test-token-123');
-        mockCreate.mockReturnValue({
-            get: mockGet,
-            post: mockPost,
-        });
-    });
-    beforeEach(() => {
-        jest.clearAllMocks();
-    });
-    describe('login', () => {
-        it('should send login request with email and password', async () => {
-            mockPost.mockResolvedValue({ data: { token: 'new-token' } });
-            const result = await api_1.api.login('user@example.com', 'password123');
-            expect(mockPost).toHaveBeenCalledWith('/auth/cli-login', {
-                email: 'user@example.com',
-                password: 'password123',
-                apiKey: undefined
-            });
-            expect(result).toEqual({ token: 'new-token' });
-        });
-        it('should send login request with API key', async () => {
-            mockPost.mockResolvedValue({ data: { token: 'api-key-token' } });
-            const result = await api_1.api.login(undefined, undefined, 'xtra_key_abc123');
-            expect(mockPost).toHaveBeenCalledWith('/auth/cli-login', {
-                email: undefined,
-                password: undefined,
-                apiKey: 'xtra_key_abc123'
-            });
-            expect(result).toEqual({ token: 'api-key-token' });
-        });
-    });
-    describe('getSecrets', () => {
-        it('should fetch secrets for project and environment', async () => {
-            const mockSecrets = { secrets: [{ key: 'DB_URL', value: 'postgres://...' }] };
-            mockGet.mockResolvedValue({ data: mockSecrets });
-            const result = await api_1.api.getSecrets('proj-123', 'production', 'main');
-            expect(mockGet).toHaveBeenCalledWith('/projects/proj-123/envs/production/secrets?branch=main');
-            expect(result).toEqual(mockSecrets);
-        });
-        it('should use default branch if not specified', async () => {
-            mockGet.mockResolvedValue({ data: { secrets: [] } });
-            await api_1.api.getSecrets('proj-123', 'dev');
-            expect(mockGet).toHaveBeenCalledWith('/projects/proj-123/envs/dev/secrets?branch=main');
-        });
-    });
-    describe('setSecrets', () => {
-        it('should post secrets to API', async () => {
-            const secrets = { DB_URL: 'postgres://new', API_KEY: 'key123' };
-            mockPost.mockResolvedValue({ data: { success: true } });
-            const result = await api_1.api.setSecrets('proj-123', 'staging', secrets);
-            expect(mockPost).toHaveBeenCalledWith('/projects/proj-123/envs/staging/secrets', {
-                secrets,
-                expectedVersions: undefined,
-                branch: 'main'
-            });
-            expect(result).toEqual({ success: true });
-        });
-    });
-    describe('rotateSecret', () => {
-        it('should rotate secret with strategy', async () => {
-            mockPost.mockResolvedValue({ data: { newValue: 'rotated-value' } });
-            const result = await api_1.api.rotateSecret('proj-123', 'prod', 'API_KEY', 'regenerate');
-            expect(mockPost).toHaveBeenCalledWith('/projects/proj-123/envs/prod/secrets/API_KEY/rotate', {
-                strategy: 'regenerate',
-                parsedNewValue: undefined
-            });
-            expect(result).toEqual({ newValue: 'rotated-value' });
-        });
-    });
-});
+var j=Object.create;var y=Object.defineProperty;var v=Object.getOwnPropertyDescriptor;var x=Object.getOwnPropertyNames;var b=Object.getPrototypeOf,S=Object.prototype.hasOwnProperty;var $=(e,t,s,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of x(t))!S.call(e,o)&&o!==s&&y(e,o,{get:()=>t[o],enumerable:!(n=v(t,o))||n.enumerable});return e};var p=(e,t,s)=>(s=e!=null?j(b(e)):{},$(t||!e||!e.__esModule?y(s,"default",{value:e,enumerable:!0}):s,e));var h=p(require("axios"));var m=p(require("conf"));var u="https://www.xtrasecurity.in/api",g=new m.default({projectName:"xtra-cli",defaults:{apiUrl:u}}),l=g.get("apiUrl");l&&!process.env.XTRA_API_URL&&(l.includes("localhost")||l.includes("xtra-security.vercel.app"))&&g.set("apiUrl",u);var c=()=>({...g.store,apiUrl:process.env.XTRA_API_URL||g.get("apiUrl")||u});var d=()=>g.get("token");var w=p(require("fs")),f=p(require("path")),R=JSON.parse(w.readFileSync(f.join(__dirname,"../../package.json"),"utf-8")),r=()=>{let{apiUrl:e}=c(),t=d();return h.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":R.version,...t?{Authorization:`Bearer ${t}`}:{}}})},a={login:async(e,t,s)=>(await r().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,n,o="main")=>(await r().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:n,branch:o})).data,getSecretDetails:async(e,t,s,n="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${n}`)).data,syncLogs:async e=>(await r().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,n,o,i)=>(await r().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:n,sourceEnv:o,sourceKey:i})).data,rotateSecret:async(e,t,s,n,o)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:n,parsedNewValue:o})).data,promoteSecret:async(e,t,s)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await r().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,n)=>{let o={format:e};return t&&(o.startDate=t),s&&(o.endDate=s),n&&(o.projectId=n),(await r().post("/audit/export",o,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,n)=>(await r().post("/access/request",{projectId:e,secretId:n,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await r().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=c(),s=t?`&workspaceId=${t}`:"";return(await r().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await r().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=c(),t=e?`/project?workspaceId=${e}`:"/project";return(await r().get(t)).data},getBranches:async e=>(await r().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await r().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await r().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await r().put("/branch",{id:e,...t})).data,getRoles:async()=>(await r().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await r().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await r().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await r().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await r().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await r().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await r().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await r().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,n)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:n})).data,cloneEnvironment:async(e,t,s,n,o)=>(await r().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:n,branch:o})).data,generateJitLink:async e=>(await r().post("/jit/generate",e)).data,claimJitLink:async e=>(await r().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await r().get(`/jit/${e}`)).data,post:async(e,t)=>(await r().post(e,t)).data};var k=p(require("axios"));jest.mock("axios");jest.mock("./config");var I=k.default;describe("API Client",()=>{let e=jest.fn(),t=jest.fn(),s=jest.fn();beforeAll(()=>{I.create=e,c.mockReturnValue({apiUrl:"http://localhost:3000/api"}),d.mockReturnValue("test-token-123"),e.mockReturnValue({get:t,post:s})}),beforeEach(()=>{jest.clearAllMocks()}),describe("login",()=>{it("should send login request with email and password",async()=>{s.mockResolvedValue({data:{token:"new-token"}});let n=await a.login("user@example.com","password123");expect(s).toHaveBeenCalledWith("/auth/cli-login",{email:"user@example.com",password:"password123",apiKey:void 0}),expect(n).toEqual({token:"new-token"})}),it("should send login request with API key",async()=>{s.mockResolvedValue({data:{token:"api-key-token"}});let n=await a.login(void 0,void 0,"xtra_key_abc123");expect(s).toHaveBeenCalledWith("/auth/cli-login",{email:void 0,password:void 0,apiKey:"xtra_key_abc123"}),expect(n).toEqual({token:"api-key-token"})})}),describe("getSecrets",()=>{it("should fetch secrets for project and environment",async()=>{let n={secrets:[{key:"DB_URL",value:"postgres://..."}]};t.mockResolvedValue({data:n});let o=await a.getSecrets("proj-123","production","main");expect(t).toHaveBeenCalledWith("/projects/proj-123/envs/production/secrets?branch=main"),expect(o).toEqual(n)}),it("should use default branch if not specified",async()=>{t.mockResolvedValue({data:{secrets:[]}}),await a.getSecrets("proj-123","dev"),expect(t).toHaveBeenCalledWith("/projects/proj-123/envs/dev/secrets?branch=main")})}),describe("setSecrets",()=>{it("should post secrets to API",async()=>{let n={DB_URL:"postgres://new",API_KEY:"key123"};s.mockResolvedValue({data:{success:!0}});let o=await a.setSecrets("proj-123","staging",n);expect(s).toHaveBeenCalledWith("/projects/proj-123/envs/staging/secrets",{secrets:n,expectedVersions:void 0,branch:"main"}),expect(o).toEqual({success:!0})})}),describe("rotateSecret",()=>{it("should rotate secret with strategy",async()=>{s.mockResolvedValue({data:{newValue:"rotated-value"}});let n=await a.rotateSecret("proj-123","prod","API_KEY","regenerate");expect(s).toHaveBeenCalledWith("/projects/proj-123/envs/prod/secrets/API_KEY/rotate",{strategy:"regenerate",parsedNewValue:void 0}),expect(n).toEqual({newValue:"rotated-value"})})})});

package/dist/lib/audit.js

@@ -1,136 +1 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.logAudit = logAudit;
-exports.loadAuditLogs = loadAuditLogs;
-exports.saveAuditLogs = saveAuditLogs;
-exports.syncAuditLogs = syncAuditLogs;
-const fs_1 = __importDefault(require("fs"));
-const path_1 = __importDefault(require("path"));
-const uuid_1 = require("uuid");
-const crypto_1 = require("./crypto");
-const config_1 = require("./config");
-const api_1 = require("./api");
-const MANIFEST_DIR = path_1.default.join(process.cwd(), ".xtra");
-const AUDIT_FILE = path_1.default.join(MANIFEST_DIR, "audit.enc");
-/**
- * Sanitize sensitive data from details
- */
-function sanitizeDetails(details) {
-    if (!details || typeof details !== 'object')
-        return details;
-    const sanitized = { ...details };
-    const sensitiveKeys = ['password', 'token', 'secret', 'value', 'apiKey', 'secretValue'];
-    for (const key of Object.keys(sanitized)) {
-        if (sensitiveKeys.some(sk => key.toLowerCase().includes(sk))) {
-            sanitized[key] = '[REDACTED]';
-        }
-    }
-    return sanitized;
-}
-/**
- * Send audit log to backend API
- */
-async function sendToBackend(entry) {
-    try {
-        const config = (0, config_1.getConfig)();
-        // Skip if not authenticated
-        if (!config.token) {
-            return false;
-        }
-        const payload = {
-            action: entry.action,
-            entity: 'cli-project',
-            entityId: entry.projectId || 'global',
-            details: sanitizeDetails(entry.details),
-            timestamp: entry.timestamp,
-            projectId: entry.projectId,
-        };
-        await api_1.api.post('/audit/cli-logs', { logs: [payload] });
-        return true;
-    }
-    catch (error) {
-        // Silently fail - don't disrupt CLI operations
-        if (process.env.DEBUG) {
-            console.error('Failed to send audit log to backend:', error);
-        }
-        return false;
-    }
-}
-function logAudit(action, projectId, environment, details) {
-    const entry = {
-        id: (0, uuid_1.v4)(),
-        timestamp: new Date().toISOString(),
-        action,
-        projectId,
-        environment,
-        details,
-        synced: false
-    };
-    // Save locally
-    const logs = loadAuditLogs();
-    logs.push(entry);
-    saveAuditLogs(logs);
-    // Send to backend (non-blocking)
-    sendToBackend(entry).then((synced) => {
-        if (synced) {
-            // Mark as synced in local logs
-            entry.synced = true;
-            const updatedLogs = loadAuditLogs();
-            const index = updatedLogs.findIndex(l => l.id === entry.id);
-            if (index !== -1) {
-                updatedLogs[index].synced = true;
-                saveAuditLogs(updatedLogs);
-            }
-        }
-    }).catch(() => {
-        // Ignore errors
-    });
-}
-function loadAuditLogs() {
-    if (!fs_1.default.existsSync(AUDIT_FILE)) {
-        return [];
-    }
-    try {
-        const encryptedStr = fs_1.default.readFileSync(AUDIT_FILE, "utf-8");
-        const encryptedObj = JSON.parse(encryptedStr);
-        const decrypted = (0, crypto_1.decrypt)(encryptedObj);
-        return JSON.parse(decrypted);
-    }
-    catch (error) {
-        // console.error("Failed to load audit logs", error);
-        return [];
-    }
-}
-function saveAuditLogs(logs) {
-    if (!fs_1.default.existsSync(MANIFEST_DIR)) {
-        fs_1.default.mkdirSync(MANIFEST_DIR, { recursive: true });
-    }
-    const serialized = JSON.stringify(logs);
-    const encryptedObj = (0, crypto_1.encrypt)(serialized);
-    fs_1.default.writeFileSync(AUDIT_FILE, JSON.stringify(encryptedObj), "utf-8");
-}
-/**
- * Sync unsynced audit logs to backend
- */
-async function syncAuditLogs() {
-    const logs = loadAuditLogs();
-    const unsynced = logs.filter(l => !l.synced);
-    if (unsynced.length === 0) {
-        return 0;
-    }
-    let syncedCount = 0;
-    for (const entry of unsynced) {
-        const success = await sendToBackend(entry);
-        if (success) {
-            entry.synced = true;
-            syncedCount++;
-        }
-    }
-    if (syncedCount > 0) {
-        saveAuditLogs(logs);
-    }
-    return syncedCount;
-}
+var J=Object.create;var u=Object.defineProperty;var F=Object.getOwnPropertyDescriptor;var G=Object.getOwnPropertyNames;var q=Object.getPrototypeOf,K=Object.prototype.hasOwnProperty;var V=(t,e)=>{for(var s in e)u(t,s,{get:e[s],enumerable:!0})},$=(t,e,s,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of G(e))!K.call(t,r)&&r!==s&&u(t,r,{get:()=>e[r],enumerable:!(n=F(e,r))||n.enumerable});return t};var i=(t,e,s)=>(s=t!=null?J(q(t)):{},$(e||!t||!t.__esModule?u(s,"default",{value:t,enumerable:!0}):s,t)),z=t=>$(u({},"__esModule",{value:!0}),t);var W={};V(W,{loadAuditLogs:()=>y,logAudit:()=>M,saveAuditLogs:()=>f,syncAuditLogs:()=>Q});module.exports=z(W);var g=i(require("fs")),x=i(require("path")),D=require("uuid");var c=i(require("crypto")),k=i(require("conf")),I=require("node-machine-id"),A="aes-256-gcm",b=new k.default({projectName:"xtra-cli-crypto"});function C(){let t=b.get("masterKey");t||(t=c.default.randomBytes(32).toString("hex"),b.set("masterKey",t));let e=(0,I.machineIdSync)();return c.default.createHash("sha256").update(t+e).digest()}var U=t=>{let e=c.default.randomBytes(16),s=C(),n=c.default.createCipheriv(A,s,e),r=n.update(t,"utf8","hex");r+=n.final("hex");let a=n.getAuthTag();return{iv:e.toString("hex"),content:r,tag:a.toString("hex")}},R=t=>{let e=C(),s=Buffer.from(t.iv,"hex"),n=Buffer.from(t.tag,"hex"),r=c.default.createDecipheriv(A,e,s);r.setAuthTag(n);let a=r.update(t.content,"hex","utf8");return a+=r.final("utf8"),a};var L=i(require("conf"));var h="https://www.xtrasecurity.in/api",d=new L.default({projectName:"xtra-cli",defaults:{apiUrl:h}}),m=d.get("apiUrl");m&&!process.env.XTRA_API_URL&&(m.includes("localhost")||m.includes("xtra-security.vercel.app"))&&d.set("apiUrl",h);var p=()=>({...d.store,apiUrl:process.env.XTRA_API_URL||d.get("apiUrl")||h});var B=()=>d.get("token");var O=i(require("axios"));var T=i(require("fs")),P=i(require("path")),H=JSON.parse(T.readFileSync(P.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:t}=p(),e=B();return O.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":H.version,...e?{Authorization:`Bearer ${e}`}:{}}})},_={login:async(t,e,s)=>(await o().post("/auth/cli-login",{email:t,password:e,apiKey:s})).data,getSecrets:async(t,e,s="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets?branch=${s}`)).data,getSecretVersions:async(t,e,s="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(t,e,s,n,r="main")=>(await o().post(`/projects/${t}/envs/${e}/secrets`,{secrets:s,expectedVersions:n,branch:r})).data,getSecretDetails:async(t,e,s,n="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets/${s}?branch=${n}`)).data,syncLogs:async t=>(await o().post("/audit/cli-logs",{logs:t})).data,linkSecret:async(t,e,s,n,r,a)=>(await o().post(`/projects/${t}/envs/${e}/secrets/link`,{key:s,sourceProjectId:n,sourceEnv:r,sourceKey:a})).data,rotateSecret:async(t,e,s,n,r)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/rotate`,{strategy:n,parsedNewValue:r})).data,promoteSecret:async(t,e,s)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(t,e,s,n)=>{let r={format:t};return e&&(r.startDate=e),s&&(r.endDate=s),n&&(r.projectId=n),(await o().post("/audit/export",r,{responseType:t==="csv"?"text":"json"})).data},requestAccess:async(t,e,s,n)=>(await o().post("/access/request",{projectId:t,secretId:n,reason:e,duration:s})).data,approveAccess:async(t,e)=>(await o().post("/access/approve",{requestId:t,decision:e})).data,listAccessRequests:async t=>{let{workspace:e}=p(),s=e?`&workspaceId=${e}`:"";return(await o().get(`/access/list?mode=${t}${s}`)).data},getAccessRequestStatus:async t=>(await o().get(`/access/request?id=${t}`)).data,getProjects:async()=>{let{workspace:t}=p(),e=t?`/project?workspaceId=${t}`:"/project";return(await o().get(e)).data},getBranches:async t=>(await o().get(`/branch?projectId=${t}`)).data,createBranch:async(t,e,s)=>(await o().post("/branch",{projectId:t,name:e,description:s})).data,deleteBranch:async t=>(await o().delete(`/branch/${t}`)).data,updateBranch:async(t,e)=>(await o().put("/branch",{id:t,...e})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async t=>{let e=t?`?teamId=${t}`:"";return(await o().get(`/admin/users${e}`)).data},setUserRole:async(t,e,s)=>(await o().put("/admin/users/role",{email:t,role:e,teamId:s})).data,getIntegrationStatus:async t=>(await o().get(`/integrations/${t}`)).data,getIntegrationRepos:async t=>(await o().get(`/integrations/${t}/sync`)).data.repos,syncSecretsToGithub:async t=>(await o().post("/integrations/github/sync",t)).data,exportKubernetesSecret:async(t,e)=>{let s=new URLSearchParams(e).toString();return(await o().get(`/projects/${t}/kubernetes?${s}`)).data},getSecretHistory:async(t,e,s)=>(await o().get(`/projects/${t}/envs/${e}/secrets/${s}/history`)).data,rollbackSecret:async(t,e,s,n)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/history`,{version:n})).data,cloneEnvironment:async(t,e,s,n,r)=>(await o().post(`/projects/${t}/envs/clone`,{fromEnv:e,toEnv:s,overwrite:n,branch:r})).data,generateJitLink:async t=>(await o().post("/jit/generate",t)).data,claimJitLink:async t=>(await o().post("/jit/claim",{token:t})).data,getJitInfo:async t=>(await o().get(`/jit/${t}`)).data,post:async(t,e)=>(await o().post(t,e)).data};var w=x.default.join(process.cwd(),".xtra"),S=x.default.join(w,"audit.enc");function X(t){if(!t||typeof t!="object")return t;let e={...t},s=["password","token","secret","value","apiKey","secretValue"];for(let n of Object.keys(e))s.some(r=>n.toLowerCase().includes(r))&&(e[n]="[REDACTED]");return e}async function N(t){try{if(!p().token)return!1;let s={action:t.action,entity:"cli-project",entityId:t.projectId||"global",details:X(t.details),timestamp:t.timestamp,projectId:t.projectId};return await _.post("/audit/cli-logs",{logs:[s]}),!0}catch(e){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",e),!1}}function M(t,e,s,n){let r={id:(0,D.v4)(),timestamp:new Date().toISOString(),action:t,projectId:e,environment:s,details:n,synced:!1},a=y();a.push(r),f(a),N(r).then(v=>{if(v){r.synced=!0;let l=y(),j=l.findIndex(E=>E.id===r.id);j!==-1&&(l[j].synced=!0,f(l))}}).catch(()=>{})}function y(){if(!g.default.existsSync(S))return[];try{let t=g.default.readFileSync(S,"utf-8"),e=JSON.parse(t),s=R(e);return JSON.parse(s)}catch{return[]}}function f(t){g.default.existsSync(w)||g.default.mkdirSync(w,{recursive:!0});let e=JSON.stringify(t),s=U(e);g.default.writeFileSync(S,JSON.stringify(s),"utf-8")}async function Q(){let t=y(),e=t.filter(n=>!n.synced);if(e.length===0)return 0;let s=0;for(let n of e)await N(n)&&(n.synced=!0,s++);return s>0&&f(t),s}0&&(module.exports={loadAuditLogs,logAudit,saveAuditLogs,syncAuditLogs});