xtra-cli 1.0.3 → 1.0.5

package/dist/commands/profile.js

@@ -1,184 +1,14 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.profileCommand = void 0;
-const commander_1 = require("commander");
-const chalk_1 = __importDefault(require("chalk"));
-const table_1 = require("table");
-const inquirer_1 = __importDefault(require("inquirer"));
-const profiles_1 = require("../lib/profiles");
-// ─── Helper ───────────────────────────────────────────────────────────────────
-const safeError = (e) => e?.message || "Unknown error";
-// ─── xtra profile ─────────────────────────────────────────────────────────────
-exports.profileCommand = new commander_1.Command("profile")
-    .description("Manage named configuration profiles (token, apiUrl, project per profile)")
-    .addHelpText("after", `
-Examples:
-  $ xtra profile list                       # Show all profiles
-  $ xtra profile create work --url https://app.xtrasecurity.io/api
-  $ xtra profile use work                   # Switch active profile
-  $ xtra profile set work --project abc123  # Set a value in a profile
-  $ xtra profile delete old-profile         # Remove a profile
-  $ xtra --profile work secrets list        # Use profile for one command
-`);
-// ── LIST ──────────────────────────────────────────────────────────────────────
-exports.profileCommand
-    .command("list")
-    .alias("ls")
-    .description("List all saved profiles")
-    .action(() => {
-    const profiles = (0, profiles_1.listProfiles)();
-    const active = (0, profiles_1.getActiveProfileName)();
-    if (Object.keys(profiles).length === 0) {
-        console.log(chalk_1.default.yellow("No profiles found."));
-        return;
-    }
-    const rows = [
-        [chalk_1.default.bold("Profile"), chalk_1.default.bold("API URL"), chalk_1.default.bold("Project"), chalk_1.default.bold("Status")]
-    ];
-    for (const [name, data] of Object.entries(profiles)) {
-        const isActive = name === active;
-        rows.push([
-            isActive ? chalk_1.default.green(`▶ ${name}`) : chalk_1.default.white(`  ${name}`),
-            chalk_1.default.gray(data.apiUrl || "(default)"),
-            chalk_1.default.cyan(data.project || "(not set)"),
-            isActive ? chalk_1.default.green("active") : chalk_1.default.gray("inactive"),
-        ]);
-    }
-    console.log(chalk_1.default.bold("\nProfiles:\n"));
-    console.log((0, table_1.table)(rows));
-    console.log(chalk_1.default.gray(`Tip: Use XTRA_PROFILE=<name> to override per-command.\n`));
-});
-// ── CREATE ────────────────────────────────────────────────────────────────────
-exports.profileCommand
-    .command("create <name>")
-    .description("Create a new profile")
-    .option("--url <apiUrl>", "XtraSecurity API URL for this profile")
-    .option("--project <projectId>", "Default project ID for this profile")
-    .option("--token <token>", "Auth token for this profile")
-    .action(async (name, options) => {
-    try {
-        // If no options given, prompt interactively
-        let { url, project, token } = options;
-        if (!url && !project && !token) {
-            const answers = await inquirer_1.default.prompt([
-                {
-                    type: "input",
-                    name: "url",
-                    message: "API URL:",
-                    default: "https://www.xtrasecurity.in/api",
-                },
-                {
-                    type: "input",
-                    name: "project",
-                    message: "Default Project ID (optional):",
-                    default: "",
-                },
-            ]);
-            url = answers.url;
-            project = answers.project || undefined;
-        }
-        (0, profiles_1.createProfile)(name, { apiUrl: url, project: project || undefined, token: token || undefined });
-        console.log(chalk_1.default.green(`✅ Profile '${name}' created!`));
-        console.log(chalk_1.default.gray(`   Activate it with: xtra profile use ${name}`));
-    }
-    catch (e) {
-        console.error(chalk_1.default.red(safeError(e)));
-    }
-});
-// ── USE ───────────────────────────────────────────────────────────────────────
-exports.profileCommand
-    .command("use <name>")
-    .description("Switch to a different profile (persists across sessions)")
-    .action((name) => {
-    try {
-        (0, profiles_1.setActiveProfile)(name);
-        console.log(chalk_1.default.green(`✅ Switched to profile '${name}'.`));
-        console.log(chalk_1.default.gray(`   All future commands will use this profile.`));
-    }
-    catch (e) {
-        console.error(chalk_1.default.red(safeError(e)));
-    }
-});
-// ── SET ───────────────────────────────────────────────────────────────────────
-exports.profileCommand
-    .command("set <name>")
-    .description("Update a value in an existing profile")
-    .option("--url <apiUrl>", "Update the API URL")
-    .option("--project <projectId>", "Update the default project ID")
-    .option("--token <token>", "Update the auth token")
-    .option("--env <environment>", "Update the default environment")
-    .action((name, options) => {
-    const fieldMap = {
-        url: "apiUrl",
-        project: "project",
-        token: "token",
-        env: "env",
-    };
-    const updated = [];
-    try {
-        for (const [flag, field] of Object.entries(fieldMap)) {
-            if (options[flag]) {
-                (0, profiles_1.setProfileValue)(name, field, options[flag]);
-                updated.push(`${field} = ${field === "token" ? "****" : options[flag]}`);
-            }
-        }
-        if (updated.length === 0) {
-            console.log(chalk_1.default.yellow("No values provided. Use --url, --project, --token, or --env."));
-            return;
-        }
-        console.log(chalk_1.default.green(`✅ Profile '${name}' updated:`));
-        updated.forEach(u => console.log(chalk_1.default.gray(`   ${u}`)));
-    }
-    catch (e) {
-        console.error(chalk_1.default.red(safeError(e)));
-    }
-});
-// ── CURRENT ───────────────────────────────────────────────────────────────────
-exports.profileCommand
-    .command("current")
-    .description("Show the currently active profile")
-    .action(() => {
-    const name = (0, profiles_1.getActiveProfileName)();
-    const profiles = (0, profiles_1.listProfiles)();
-    const data = profiles[name] || {};
-    console.log(chalk_1.default.bold(`\nActive Profile: ${chalk_1.default.green(name)}\n`));
-    const rows = [
-        [chalk_1.default.bold("Key"), chalk_1.default.bold("Value")],
-        ["API URL", chalk_1.default.cyan(data.apiUrl || "(default)")],
-        ["Project", chalk_1.default.cyan(data.project || "(not set)")],
-        ["Branch", chalk_1.default.cyan(data.branch || "(not set)")],
-        ["Env", chalk_1.default.cyan(data.env || "(not set)")],
-        ["Token", data.token ? chalk_1.default.green("Set ✓") : chalk_1.default.gray("Not set")],
-    ];
-    console.log((0, table_1.table)(rows));
-});
-// ── DELETE ────────────────────────────────────────────────────────────────────
-exports.profileCommand
-    .command("delete <name>")
-    .alias("rm")
-    .description("Delete a profile")
-    .option("-y, --yes", "Skip confirmation prompt")
-    .action(async (name, options) => {
-    try {
-        if (!options.yes) {
-            const { confirm } = await inquirer_1.default.prompt([{
-                    type: "confirm",
-                    name: "confirm",
-                    message: chalk_1.default.red(`Delete profile '${name}'? This cannot be undone.`),
-                    default: false,
-                }]);
-            if (!confirm) {
-                console.log(chalk_1.default.gray("Cancelled."));
-                return;
-            }
-        }
-        (0, profiles_1.deleteProfile)(name);
-        console.log(chalk_1.default.green(`✅ Profile '${name}' deleted.`));
-    }
-    catch (e) {
-        console.error(chalk_1.default.red(safeError(e)));
-    }
-});
+var U=Object.create;var f=Object.defineProperty;var j=Object.getOwnPropertyDescriptor;var $=Object.getOwnPropertyNames;var A=Object.getPrototypeOf,R=Object.prototype.hasOwnProperty;var b=(e,r)=>{for(var t in r)f(e,t,{get:r[t],enumerable:!0})},w=(e,r,t,i)=>{if(r&&typeof r=="object"||typeof r=="function")for(let n of $(r))!R.call(e,n)&&n!==t&&f(e,n,{get:()=>r[n],enumerable:!(i=j(r,n))||i.enumerable});return e};var u=(e,r,t)=>(t=e!=null?U(A(e)):{},w(r||!e||!e.__esModule?f(t,"default",{value:e,enumerable:!0}):t,e)),I=e=>w(f({},"__esModule",{value:!0}),e);var D={};b(D,{profileCommand:()=>c});module.exports=I(D);var k=require("commander"),o=u(require("chalk")),g=require("table"),P=u(require("inquirer"));var m=u(require("conf")),s=new m.default({projectName:"xtra-cli",defaults:{activeProfile:"default",profiles:{default:{apiUrl:process.env.XTRA_API_URL||"https://www.xtrasecurity.in/api"}}}});function a(){return s.get("profiles")||{}}function p(){return process.env.XTRA_PROFILE||s.get("activeProfile")||"default"}function h(e){if(!a()[e])throw new Error(`Profile '${e}' does not exist. Create it first with 'xtra profile create ${e}'.`);s.set("activeProfile",e)}function y(e,r={}){let t=a();if(t[e])throw new Error(`Profile '${e}' already exists. Use 'xtra profile set' to edit it.`);t[e]={apiUrl:process.env.XTRA_API_URL||"https://www.xtrasecurity.in/api",...r},s.set("profiles",t)}function v(e){if(e==="default")throw new Error("Cannot delete the 'default' profile.");let r=a();if(!r[e])throw new Error(`Profile '${e}' not found.`);delete r[e],s.set("profiles",r),p()===e&&s.set("activeProfile","default")}function x(e,r,t){let i=a();if(!i[e])throw new Error(`Profile '${e}' not found.`);i[e][r]=t,s.set("profiles",i)}var d=e=>e?.message||"Unknown error",c=new k.Command("profile").description("Manage named configuration profiles (token, apiUrl, project per profile)").addHelpText("after",`
+Examples:
+  $ xtra profile list                       # Show all profiles
+  $ xtra profile create work --url https://app.xtrasecurity.io/api
+  $ xtra profile use work                   # Switch active profile
+  $ xtra profile set work --project abc123  # Set a value in a profile
+  $ xtra profile delete old-profile         # Remove a profile
+  $ xtra --profile work secrets list        # Use profile for one command
+`);c.command("list").alias("ls").description("List all saved profiles").action(()=>{let e=a(),r=p();if(Object.keys(e).length===0){console.log(o.default.yellow("No profiles found."));return}let t=[[o.default.bold("Profile"),o.default.bold("API URL"),o.default.bold("Project"),o.default.bold("Status")]];for(let[i,n]of Object.entries(e)){let l=i===r;t.push([l?o.default.green(`\u25B6 ${i}`):o.default.white(`  ${i}`),o.default.gray(n.apiUrl||"(default)"),o.default.cyan(n.project||"(not set)"),l?o.default.green("active"):o.default.gray("inactive")])}console.log(o.default.bold(`
+Profiles:
+`)),console.log((0,g.table)(t)),console.log(o.default.gray(`Tip: Use XTRA_PROFILE=<name> to override per-command.
+`))});c.command("create <name>").description("Create a new profile").option("--url <apiUrl>","XtraSecurity API URL for this profile").option("--project <projectId>","Default project ID for this profile").option("--token <token>","Auth token for this profile").action(async(e,r)=>{try{let{url:t,project:i,token:n}=r;if(!t&&!i&&!n){let l=await P.default.prompt([{type:"input",name:"url",message:"API URL:",default:"https://www.xtrasecurity.in/api"},{type:"input",name:"project",message:"Default Project ID (optional):",default:""}]);t=l.url,i=l.project||void 0}y(e,{apiUrl:t,project:i||void 0,token:n||void 0}),console.log(o.default.green(`\u2705 Profile '${e}' created!`)),console.log(o.default.gray(`   Activate it with: xtra profile use ${e}`))}catch(t){console.error(o.default.red(d(t)))}});c.command("use <name>").description("Switch to a different profile (persists across sessions)").action(e=>{try{h(e),console.log(o.default.green(`\u2705 Switched to profile '${e}'.`)),console.log(o.default.gray("   All future commands will use this profile."))}catch(r){console.error(o.default.red(d(r)))}});c.command("set <name>").description("Update a value in an existing profile").option("--url <apiUrl>","Update the API URL").option("--project <projectId>","Update the default project ID").option("--token <token>","Update the auth token").option("--env <environment>","Update the default environment").action((e,r)=>{let t={url:"apiUrl",project:"project",token:"token",env:"env"},i=[];try{for(let[n,l]of Object.entries(t))r[n]&&(x(e,l,r[n]),i.push(`${l} = ${l==="token"?"****":r[n]}`));if(i.length===0){console.log(o.default.yellow("No values provided. Use --url, --project, --token, or --env."));return}console.log(o.default.green(`\u2705 Profile '${e}' updated:`)),i.forEach(n=>console.log(o.default.gray(`   ${n}`)))}catch(n){console.error(o.default.red(d(n)))}});c.command("current").description("Show the currently active profile").action(()=>{let e=p(),t=a()[e]||{};console.log(o.default.bold(`
+Active Profile: ${o.default.green(e)}
+`));let i=[[o.default.bold("Key"),o.default.bold("Value")],["API URL",o.default.cyan(t.apiUrl||"(default)")],["Project",o.default.cyan(t.project||"(not set)")],["Branch",o.default.cyan(t.branch||"(not set)")],["Env",o.default.cyan(t.env||"(not set)")],["Token",t.token?o.default.green("Set \u2713"):o.default.gray("Not set")]];console.log((0,g.table)(i))});c.command("delete <name>").alias("rm").description("Delete a profile").option("-y, --yes","Skip confirmation prompt").action(async(e,r)=>{try{if(!r.yes){let{confirm:t}=await P.default.prompt([{type:"confirm",name:"confirm",message:o.default.red(`Delete profile '${e}'? This cannot be undone.`),default:!1}]);if(!t){console.log(o.default.gray("Cancelled."));return}}v(e),console.log(o.default.green(`\u2705 Profile '${e}' deleted.`))}catch(t){console.error(o.default.red(d(t)))}});0&&(module.exports={profileCommand});

package/dist/commands/project.js

@@ -1,165 +1 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.projectCommand = void 0;
-const commander_1 = require("commander");
-const chalk_1 = __importDefault(require("chalk"));
-const ora_1 = __importDefault(require("ora"));
-const inquirer_1 = __importDefault(require("inquirer"));
-const config_1 = require("../lib/config");
-const api_1 = require("../lib/api");
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-exports.projectCommand = new commander_1.Command("project")
-    .alias("projects")
-    .description("Manage project context");
-const updateConfigs = (projectId, projectName) => {
-    const oldProject = (0, config_1.getConfigValue)("project");
-    // Always update global
-    (0, config_1.setConfig)("project", projectId);
-    // Clear branch if project changed
-    if (oldProject !== projectId) {
-        (0, config_1.setConfig)("branch", "main"); // Reset to main or clear? Projects have different branches.
-    }
-    // Update/Create local .xtrarc to make project context "sticky" to the directory
-    const rcPath = path.join(process.cwd(), ".xtrarc");
-    let rc = {};
-    if (fs.existsSync(rcPath)) {
-        try {
-            rc = JSON.parse(fs.readFileSync(rcPath, "utf-8"));
-        }
-        catch (e) {
-            console.error(chalk_1.default.yellow(`  ⚠ Could not parse existing local .xtrarc: ${e instanceof Error ? e.message : 'Unknown error'}`));
-        }
-    }
-    rc.project = projectId;
-    if (oldProject !== projectId) {
-        rc.branch = "main"; // Reset branch on project change
-    }
-    // Add other relevant defaults if it's a new file
-    if (!rc.env)
-        rc.env = "development";
-    if (!rc.apiUrl)
-        rc.apiUrl = (0, config_1.getConfigValue)("apiUrl") || "https://www.xtrasecurity.in/api";
-    try {
-        fs.writeFileSync(rcPath, JSON.stringify(rc, null, 2), "utf8");
-        console.log(chalk_1.default.gray(`  ✔ Updated local .xtrarc (Project context locked to this folder)`));
-    }
-    catch (e) {
-        console.error(chalk_1.default.yellow(`  ⚠ Could not write local .xtrarc: ${e instanceof Error ? e.message : 'Unknown error'}`));
-    }
-    console.log(chalk_1.default.green(`✔ Default project set to '${projectName}'`));
-    const currentBranch = (0, config_1.getConfigValue)("branch");
-    if (currentBranch) {
-        console.log(chalk_1.default.gray(`  Active branch: ${currentBranch}`));
-    }
-};
-// SET
-exports.projectCommand
-    .command("set")
-    .description("Set the default project ID")
-    .argument("[projectId]", "Project ID to set as default (optional - will show list if not provided)")
-    .action(async (projectId) => {
-    // If projectId is provided, set it directly
-    if (projectId) {
-        updateConfigs(projectId, projectId);
-        return;
-    }
-    // Otherwise, fetch projects and show interactive selector
-    const spinner = (0, ora_1.default)("Fetching your projects...").start();
-    try {
-        const projects = await api_1.api.getProjects();
-        spinner.stop();
-        if (!Array.isArray(projects) || projects.length === 0) {
-            console.log(chalk_1.default.yellow("No projects found."));
-            return;
-        }
-        const choices = projects.map((p) => ({
-            name: `${p.name} (${p.id})`,
-            value: p.id,
-            short: p.name
-        }));
-        const { selectedProject } = await inquirer_1.default.prompt([{
-                type: "list",
-                name: "selectedProject",
-                message: "Select a project:",
-                choices
-            }]);
-        const selectedName = projects.find((p) => p.id === selectedProject)?.name || selectedProject;
-        updateConfigs(selectedProject, selectedName);
-    }
-    catch (error) {
-        spinner.fail("Failed to fetch projects");
-        if (error.response?.data?.error) {
-            console.error(chalk_1.default.red(`Error: ${error.response.data.error}`));
-        }
-        else {
-            console.error(chalk_1.default.red(error.message));
-        }
-    }
-});
-// GET (show current)
-exports.projectCommand
-    .command("current")
-    .description("Show the current default project")
-    .action(async () => {
-    const projectId = (0, config_1.getConfigValue)("project");
-    const branch = (0, config_1.getConfigValue)("branch");
-    if (projectId) {
-        // Try to fetch project name
-        try {
-            const projects = await api_1.api.getProjects();
-            const project = projects.find((p) => p.id === projectId);
-            if (project) {
-                console.log(chalk_1.default.cyan(`Project: ${project.name} (${projectId})`));
-            }
-            else {
-                console.log(chalk_1.default.cyan(`Project: ${projectId}`));
-            }
-        }
-        catch {
-            console.log(chalk_1.default.cyan(`Project: ${projectId}`));
-        }
-    }
-    else {
-        console.log(chalk_1.default.yellow("No default project set. Use 'xtra project set' to set one."));
-    }
-    if (branch) {
-        console.log(chalk_1.default.cyan(`Branch: ${branch}`));
-    }
-});
+var L=Object.create;var u=Object.defineProperty;var N=Object.getOwnPropertyDescriptor;var _=Object.getOwnPropertyNames;var B=Object.getPrototypeOf,J=Object.prototype.hasOwnProperty;var O=(e,t)=>{for(var s in t)u(e,s,{get:t[s],enumerable:!0})},S=(e,t,s,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of _(t))!J.call(e,n)&&n!==s&&u(e,n,{get:()=>t[n],enumerable:!(r=N(t,n))||r.enumerable});return e};var p=(e,t,s)=>(s=e!=null?L(B(e)):{},S(t||!e||!e.__esModule?u(s,"default",{value:e,enumerable:!0}):s,e)),T=e=>S(u({},"__esModule",{value:!0}),e);var D={};O(D,{projectCommand:()=>$});module.exports=T(D);var P=require("commander"),a=p(require("chalk")),I=p(require("ora")),A=p(require("inquirer"));var x=p(require("conf")),f=p(require("fs"));var h="https://www.xtrasecurity.in/api",g=new x.default({projectName:"xtra-cli",defaults:{apiUrl:h}}),m=g.get("apiUrl");m&&!process.env.XTRA_API_URL&&(m.includes("localhost")||m.includes("xtra-security.vercel.app"))&&g.set("apiUrl",h);var y=()=>({...g.store,apiUrl:process.env.XTRA_API_URL||g.get("apiUrl")||h}),l=e=>g.get(e),w=(e,t)=>{if(g.set(e,t),e==="token"&&process.platform!=="win32"&&f.default.existsSync(g.path))try{f.default.chmodSync(g.path,384)}catch{}};var v=()=>g.get("token");var b=p(require("axios"));var k=p(require("fs")),U=p(require("path")),q=JSON.parse(k.readFileSync(U.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:e}=y(),t=v();return b.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":q.version,...t?{Authorization:`Bearer ${t}`}:{}}})},j={login:async(e,t,s)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,r,n="main")=>(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:r,branch:n})).data,getSecretDetails:async(e,t,s,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${r}`)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,r,n,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:r,sourceEnv:n,sourceKey:i})).data,rotateSecret:async(e,t,s,r,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:r,parsedNewValue:n})).data,promoteSecret:async(e,t,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,r)=>{let n={format:e};return t&&(n.startDate=t),s&&(n.endDate=s),r&&(n.projectId=r),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,r)=>(await o().post("/access/request",{projectId:e,secretId:r,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=y(),s=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=y(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await o().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:r})).data,cloneEnvironment:async(e,t,s,r,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:r,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,post:async(e,t)=>(await o().post(e,t)).data};var d=p(require("fs")),R=p(require("path")),$=new P.Command("project").alias("projects").description("Manage project context"),C=(e,t)=>{let s=l("project");w("project",e),s!==e&&w("branch","main");let r=R.join(process.cwd(),".xtrarc"),n={};if(d.existsSync(r))try{n=JSON.parse(d.readFileSync(r,"utf-8"))}catch(c){console.error(a.default.yellow(`  \u26A0 Could not parse existing local .xtrarc: ${c instanceof Error?c.message:"Unknown error"}`))}n.project=e,s!==e&&(n.branch="main"),n.env||(n.env="development"),n.apiUrl||(n.apiUrl=l("apiUrl")||"https://www.xtrasecurity.in/api");try{d.writeFileSync(r,JSON.stringify(n,null,2),"utf8"),console.log(a.default.gray("  \u2714 Updated local .xtrarc (Project context locked to this folder)"))}catch(c){console.error(a.default.yellow(`  \u26A0 Could not write local .xtrarc: ${c instanceof Error?c.message:"Unknown error"}`))}console.log(a.default.green(`\u2714 Default project set to '${t}'`));let i=l("branch");i&&console.log(a.default.gray(`  Active branch: ${i}`))};$.command("set").description("Set the default project ID").argument("[projectId]","Project ID to set as default (optional - will show list if not provided)").action(async e=>{if(e){C(e,e);return}let t=(0,I.default)("Fetching your projects...").start();try{let s=await j.getProjects();if(t.stop(),!Array.isArray(s)||s.length===0){console.log(a.default.yellow("No projects found."));return}let r=s.map(c=>({name:`${c.name} (${c.id})`,value:c.id,short:c.name})),{selectedProject:n}=await A.default.prompt([{type:"list",name:"selectedProject",message:"Select a project:",choices:r}]),i=s.find(c=>c.id===n)?.name||n;C(n,i)}catch(s){t.fail("Failed to fetch projects"),s.response?.data?.error?console.error(a.default.red(`Error: ${s.response.data.error}`)):console.error(a.default.red(s.message))}});$.command("current").description("Show the current default project").action(async()=>{let e=l("project"),t=l("branch");if(e)try{let r=(await j.getProjects()).find(n=>n.id===e);console.log(r?a.default.cyan(`Project: ${r.name} (${e})`):a.default.cyan(`Project: ${e}`))}catch{console.log(a.default.cyan(`Project: ${e}`))}else console.log(a.default.yellow("No default project set. Use 'xtra project set' to set one."));t&&console.log(a.default.cyan(`Branch: ${t}`))});0&&(module.exports={projectCommand});

package/dist/commands/rollback.js

@@ -1,95 +1 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.rollbackCommand = void 0;
-const commander_1 = require("commander");
-const api_1 = require("../lib/api");
-const chalk_1 = __importDefault(require("chalk"));
-const ora_1 = __importDefault(require("ora"));
-const inquirer_1 = __importDefault(require("inquirer"));
-const crypto_1 = require("../lib/crypto");
-const config_1 = require("../lib/config");
-exports.rollbackCommand = new commander_1.Command("rollback")
-    .description("Rollback a secret to a previous version")
-    .argument("<key>", "Secret Key to rollback")
-    .option("-p, --project <projectId>", "Project ID")
-    .option("-e, --env <environment>", "Environment (dev, stg, prod)", "dev")
-    .action(async (key, options) => {
-    let { project, env } = options;
-    // Use config fallback
-    if (!project)
-        project = (0, config_1.getRcConfig)().project;
-    if (!project) {
-        console.error(chalk_1.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first."));
-        process.exit(1);
-    }
-    // Normalize Env
-    const envMap = { dev: "development", stg: "staging", prod: "production" };
-    env = envMap[env] || env;
-    const spinner = (0, ora_1.default)(`Fetching history for ${key}...`).start();
-    try {
-        const secret = await api_1.api.getSecretDetails(project, env, key);
-        spinner.stop();
-        if (!secret.history || !Array.isArray(secret.history) || secret.history.length === 0) {
-            console.log(chalk_1.default.yellow(`No history found for ${key}. Cannot rollback.`));
-            return;
-        }
-        // Prepare choices
-        // Current version
-        const choices = [];
-        // History versions (reverse order to show latest first)
-        const history = [...secret.history].reverse();
-        history.forEach((h) => {
-            let displayValue = "********";
-            try {
-                const enc = JSON.parse(h.value[0]);
-                displayValue = (0, crypto_1.decrypt)(enc);
-            }
-            catch (e) {
-                displayValue = h.value[0];
-            }
-            choices.push({
-                name: `v${h.version} - ${new Date(h.updatedAt).toLocaleString()} (Value: ${displayValue.substring(0, 10)}...)`,
-                value: h
-            });
-        });
-        const { selectedVersion } = await inquirer_1.default.prompt([
-            {
-                type: "list",
-                name: "selectedVersion",
-                message: "Select version to restore:",
-                choices: choices
-            }
-        ]);
-        // Restore
-        const confirmSpinner = (0, ora_1.default)(`Restoring version v${selectedVersion.version}...`).start();
-        // We use setSecrets to update it to the old value. 
-        // This will create a NEW version in history (preserving the timeline).
-        let restoredValue = selectedVersion.value[0];
-        try {
-            const enc = JSON.parse(restoredValue);
-            restoredValue = (0, crypto_1.decrypt)(enc);
-        }
-        catch (e) { }
-        const payload = { [key]: restoredValue };
-        await api_1.api.setSecrets(project, env, payload);
-        confirmSpinner.succeed(`Successfully rolled back ${key} to v${selectedVersion.version}`);
-        // Log Audit
-        try {
-            const { logAudit } = require("../lib/audit");
-            logAudit("SECRET_ROLLBACK", project, env, { key, version: selectedVersion.version });
-        }
-        catch (e) { }
-    }
-    catch (error) {
-        spinner.fail("Failed to rollback.");
-        if (error.response && error.response.status === 404) {
-            console.error(chalk_1.default.red("Secret not found."));
-        }
-        else {
-            console.error(chalk_1.default.red(error.message));
-        }
-    }
-});
+var it=Object.create;var w=Object.defineProperty;var ct=Object.getOwnPropertyDescriptor;var pt=Object.getOwnPropertyNames;var gt=Object.getPrototypeOf,dt=Object.prototype.hasOwnProperty;var S=(t,e)=>()=>(t&&(e=t(t=0)),e);var P=(t,e)=>{for(var s in e)w(t,s,{get:e[s],enumerable:!0})},T=(t,e,s,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of pt(e))!dt.call(t,n)&&n!==s&&w(t,n,{get:()=>e[n],enumerable:!(r=ct(e,n))||r.enumerable});return t};var i=(t,e,s)=>(s=t!=null?it(gt(t)):{},T(e||!t||!t.__esModule?w(s,"default",{value:t,enumerable:!0}):s,t)),_=t=>T(w({},"__esModule",{value:!0}),t);var J,C,F,R,g,A,l,V,q,j=S(()=>{J=i(require("conf")),C=i(require("fs")),F=i(require("path")),R="https://www.xtrasecurity.in/api",g=new J.default({projectName:"xtra-cli",defaults:{apiUrl:R}}),A=g.get("apiUrl");A&&!process.env.XTRA_API_URL&&(A.includes("localhost")||A.includes("xtra-security.vercel.app"))&&g.set("apiUrl",R);l=()=>({...g.store,apiUrl:process.env.XTRA_API_URL||g.get("apiUrl")||R}),V=()=>g.get("token"),q=()=>{let t={};try{let e=F.default.join(process.cwd(),".xtrarc");C.default.existsSync(e)&&(t=JSON.parse(C.default.readFileSync(e,"utf-8")))}catch{}return{project:t.project||g.get("project")||"",env:t.env||g.get("env")||"development",branch:t.branch||g.get("branch")||"main"}}});var G,K,z,ut,o,m,L=S(()=>{G=i(require("axios"));j();K=i(require("fs")),z=i(require("path")),ut=JSON.parse(K.readFileSync(z.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:t}=l(),e=V();return G.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":ut.version,...e?{Authorization:`Bearer ${e}`}:{}}})},m={login:async(t,e,s)=>(await o().post("/auth/cli-login",{email:t,password:e,apiKey:s})).data,getSecrets:async(t,e,s="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets?branch=${s}`)).data,getSecretVersions:async(t,e,s="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(t,e,s,r,n="main")=>(await o().post(`/projects/${t}/envs/${e}/secrets`,{secrets:s,expectedVersions:r,branch:n})).data,getSecretDetails:async(t,e,s,r="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets/${s}?branch=${r}`)).data,syncLogs:async t=>(await o().post("/audit/cli-logs",{logs:t})).data,linkSecret:async(t,e,s,r,n,a)=>(await o().post(`/projects/${t}/envs/${e}/secrets/link`,{key:s,sourceProjectId:r,sourceEnv:n,sourceKey:a})).data,rotateSecret:async(t,e,s,r,n)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/rotate`,{strategy:r,parsedNewValue:n})).data,promoteSecret:async(t,e,s)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(t,e,s,r)=>{let n={format:t};return e&&(n.startDate=e),s&&(n.endDate=s),r&&(n.projectId=r),(await o().post("/audit/export",n,{responseType:t==="csv"?"text":"json"})).data},requestAccess:async(t,e,s,r)=>(await o().post("/access/request",{projectId:t,secretId:r,reason:e,duration:s})).data,approveAccess:async(t,e)=>(await o().post("/access/approve",{requestId:t,decision:e})).data,listAccessRequests:async t=>{let{workspace:e}=l(),s=e?`&workspaceId=${e}`:"";return(await o().get(`/access/list?mode=${t}${s}`)).data},getAccessRequestStatus:async t=>(await o().get(`/access/request?id=${t}`)).data,getProjects:async()=>{let{workspace:t}=l(),e=t?`/project?workspaceId=${t}`:"/project";return(await o().get(e)).data},getBranches:async t=>(await o().get(`/branch?projectId=${t}`)).data,createBranch:async(t,e,s)=>(await o().post("/branch",{projectId:t,name:e,description:s})).data,deleteBranch:async t=>(await o().delete(`/branch/${t}`)).data,updateBranch:async(t,e)=>(await o().put("/branch",{id:t,...e})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async t=>{let e=t?`?teamId=${t}`:"";return(await o().get(`/admin/users${e}`)).data},setUserRole:async(t,e,s)=>(await o().put("/admin/users/role",{email:t,role:e,teamId:s})).data,getIntegrationStatus:async t=>(await o().get(`/integrations/${t}`)).data,getIntegrationRepos:async t=>(await o().get(`/integrations/${t}/sync`)).data.repos,syncSecretsToGithub:async t=>(await o().post("/integrations/github/sync",t)).data,exportKubernetesSecret:async(t,e)=>{let s=new URLSearchParams(e).toString();return(await o().get(`/projects/${t}/kubernetes?${s}`)).data},getSecretHistory:async(t,e,s)=>(await o().get(`/projects/${t}/envs/${e}/secrets/${s}/history`)).data,rollbackSecret:async(t,e,s,r)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/history`,{version:r})).data,cloneEnvironment:async(t,e,s,r,n)=>(await o().post(`/projects/${t}/envs/clone`,{fromEnv:e,toEnv:s,overwrite:r,branch:n})).data,generateJitLink:async t=>(await o().post("/jit/generate",t)).data,claimJitLink:async t=>(await o().post("/jit/claim",{token:t})).data,getJitInfo:async t=>(await o().get(`/jit/${t}`)).data,post:async(t,e)=>(await o().post(t,e)).data}});function W(){let t=H.get("masterKey");t||(t=y.default.randomBytes(32).toString("hex"),H.set("masterKey",t));let e=(0,X.machineIdSync)();return y.default.createHash("sha256").update(t+e).digest()}var y,M,X,Q,H,Y,h,U=S(()=>{y=i(require("crypto")),M=i(require("conf")),X=require("node-machine-id"),Q="aes-256-gcm",H=new M.default({projectName:"xtra-cli-crypto"});Y=t=>{let e=y.default.randomBytes(16),s=W(),r=y.default.createCipheriv(Q,s,e),n=r.update(t,"utf8","hex");n+=r.final("hex");let a=r.getAuthTag();return{iv:e.toString("hex"),content:n,tag:a.toString("hex")}},h=t=>{let e=W(),s=Buffer.from(t.iv,"hex"),r=Buffer.from(t.tag,"hex"),n=y.default.createDecipheriv(Q,e,s);n.setAuthTag(r);let a=n.update(t.content,"hex","utf8");return a+=n.final("utf8"),a}});var et={};P(et,{loadAuditLogs:()=>x,logAudit:()=>yt,saveAuditLogs:()=>$,syncAuditLogs:()=>ft});function lt(t){if(!t||typeof t!="object")return t;let e={...t},s=["password","token","secret","value","apiKey","secretValue"];for(let r of Object.keys(e))s.some(n=>r.toLowerCase().includes(n))&&(e[r]="[REDACTED]");return e}async function tt(t){try{if(!l().token)return!1;let s={action:t.action,entity:"cli-project",entityId:t.projectId||"global",details:lt(t.details),timestamp:t.timestamp,projectId:t.projectId};return await m.post("/audit/cli-logs",{logs:[s]}),!0}catch(e){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",e),!1}}function yt(t,e,s,r){let n={id:(0,Z.v4)(),timestamp:new Date().toISOString(),action:t,projectId:e,environment:s,details:r,synced:!1},a=x();a.push(n),$(a),tt(n).then(c=>{if(c){n.synced=!0;let d=x(),b=d.findIndex(u=>u.id===n.id);b!==-1&&(d[b].synced=!0,$(d))}}).catch(()=>{})}function x(){if(!f.default.existsSync(B))return[];try{let t=f.default.readFileSync(B,"utf-8"),e=JSON.parse(t),s=h(e);return JSON.parse(s)}catch{return[]}}function $(t){f.default.existsSync(O)||f.default.mkdirSync(O,{recursive:!0});let e=JSON.stringify(t),s=Y(e);f.default.writeFileSync(B,JSON.stringify(s),"utf-8")}async function ft(){let t=x(),e=t.filter(r=>!r.synced);if(e.length===0)return 0;let s=0;for(let r of e)await tt(r)&&(r.synced=!0,s++);return s>0&&$(t),s}var f,D,Z,O,B,st=S(()=>{f=i(require("fs")),D=i(require("path")),Z=require("uuid");U();j();L();O=D.default.join(process.cwd(),".xtra"),B=D.default.join(O,"audit.enc")});var ht={};P(ht,{rollbackCommand:()=>mt});module.exports=_(ht);var rt=require("commander");L();var v=i(require("chalk")),E=i(require("ora")),nt=i(require("inquirer"));U();j();var mt=new rt.Command("rollback").description("Rollback a secret to a previous version").argument("<key>","Secret Key to rollback").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Environment (dev, stg, prod)","dev").action(async(t,e)=>{let{project:s,env:r}=e;s||(s=q().project),s||(console.error(v.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1)),r={dev:"development",stg:"staging",prod:"production"}[r]||r;let a=(0,E.default)(`Fetching history for ${t}...`).start();try{let c=await m.getSecretDetails(s,r,t);if(a.stop(),!c.history||!Array.isArray(c.history)||c.history.length===0){console.log(v.default.yellow(`No history found for ${t}. Cannot rollback.`));return}let d=[];[...c.history].reverse().forEach(p=>{let I="********";try{let N=JSON.parse(p.value[0]);I=h(N)}catch{I=p.value[0]}d.push({name:`v${p.version} - ${new Date(p.updatedAt).toLocaleString()} (Value: ${I.substring(0,10)}...)`,value:p})});let{selectedVersion:u}=await nt.default.prompt([{type:"list",name:"selectedVersion",message:"Select version to restore:",choices:d}]),ot=(0,E.default)(`Restoring version v${u.version}...`).start(),k=u.value[0];try{let p=JSON.parse(k);k=h(p)}catch{}let at={[t]:k};await m.setSecrets(s,r,at),ot.succeed(`Successfully rolled back ${t} to v${u.version}`);try{let{logAudit:p}=(st(),_(et));p("SECRET_ROLLBACK",s,r,{key:t,version:u.version})}catch{}}catch(c){a.fail("Failed to rollback."),c.response&&c.response.status===404?console.error(v.default.red("Secret not found.")):console.error(v.default.red(c.message))}});0&&(module.exports={rollbackCommand});

package/dist/commands/rotate.js

@@ -1,93 +1,3 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.rotateCommand = void 0;
-const commander_1 = require("commander");
-const api_1 = require("../lib/api");
-const config_1 = require("../lib/config");
-const chalk_1 = __importDefault(require("chalk"));
-const ora_1 = __importDefault(require("ora"));
-exports.rotateCommand = new commander_1.Command("rotate")
-    .description("Rotate a secret (Zero-Downtime Shadow Mode)")
-    .argument("<key>", "Key of the secret to rotate")
-    .option("-p, --project <projectId>", "Project ID")
-    .option("-e, --env <environment>", "Environment", "development")
-    .option("--strategy <strategy>", "Rotation strategy", "shadow")
-    .option("--promote", "Promote the shadow value to active", false)
-    .option("--value <value>", "New value for the secret (optional)")
-    .action(async (key, options) => {
-    let { project, env, strategy, promote, value } = options;
-    // Use config fallback
-    if (!project)
-        project = (0, config_1.getRcConfig)().project;
-    // Normalize Env
-    const envMap = { dev: "development", stg: "staging", prod: "production" };
-    env = envMap[env] || env;
-    if (!project) {
-        console.error(chalk_1.default.red("Error: Project ID is required. Use -p <id> or checkout a branch."));
-        process.exit(1);
-    }
-    // Production confirmation gate
-    if (env === "production") {
-        const inquirer = require("inquirer");
-        const { confirmProd } = await inquirer.prompt([{
-                type: "confirm",
-                name: "confirmProd",
-                message: chalk_1.default.red(`âš  You are about to rotate a secret in PRODUCTION (${key}). Proceed?`),
-                default: false,
-            }]);
-        if (!confirmProd) {
-            console.log(chalk_1.default.yellow("Aborted."));
-            return;
-        }
-    }
-    if (promote) {
-        // PROMOTE FLOW
-        const spinner = (0, ora_1.default)(`Promoting secret '${key}' in ${env}...`).start();
-        try {
-            const result = await api_1.api.promoteSecret(project, env, key);
-            spinner.succeed(chalk_1.default.green(`Successfully promoted '${key}' to version ${result.version}`));
-            try {
-                const { logAudit } = require("../lib/audit");
-                logAudit("SECRET_PROMOTE", project, env, { key, newVersion: result.version });
-            }
-            catch (e) { }
-        }
-        catch (error) {
-            spinner.fail("Promotion failed");
-            if (error.response && error.response.data && error.response.data.error) {
-                console.error(chalk_1.default.red(`Server Error: ${error.response.data.error}`));
-            }
-            else {
-                console.error(chalk_1.default.red(error.message));
-            }
-        }
-    }
-    else {
-        // ROTATE FLOW
-        const spinner = (0, ora_1.default)(`Starting rotation for '${key}' (Strategy: ${strategy})...`).start();
-        try {
-            const result = await api_1.api.rotateSecret(project, env, key, strategy, value);
-            spinner.succeed(chalk_1.default.green(`Rotation initiated for '${key}'`));
-            console.log(chalk_1.default.dim(`Shadow Value: ${result.shadowValue}`));
-            console.log(chalk_1.default.dim(`Expires At: ${result.expiresAt}`));
-            console.log(chalk_1.default.blue(`\nTo verify, run your app. To finalize, run:\nxtra rotate ${key} --promote -p ${project} -e ${env}`));
-            try {
-                const { logAudit } = require("../lib/audit");
-                logAudit("SECRET_ROTATE", project, env, { key, strategy, expiresAt: result.expiresAt });
-            }
-            catch (e) { }
-        }
-        catch (error) {
-            spinner.fail("Rotation failed");
-            if (error.response && error.response.data && error.response.data.error) {
-                console.error(chalk_1.default.red(`Server Error: ${error.response.data.error}`));
-            }
-            else {
-                console.error(chalk_1.default.red(error.message));
-            }
-        }
-    }
-});
+var et=Object.create;var w=Object.defineProperty;var rt=Object.getOwnPropertyDescriptor;var st=Object.getOwnPropertyNames;var nt=Object.getPrototypeOf,ot=Object.prototype.hasOwnProperty;var S=(t,e)=>()=>(t&&(e=t(t=0)),e);var L=(t,e)=>{for(var r in e)w(t,r,{get:e[r],enumerable:!0})},D=(t,e,r,s)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of st(e))!ot.call(t,n)&&n!==r&&w(t,n,{get:()=>e[n],enumerable:!(s=rt(e,n))||s.enumerable});return t};var p=(t,e,r)=>(r=t!=null?et(nt(t)):{},D(e||!t||!t.__esModule?w(r,"default",{value:t,enumerable:!0}):r,t)),b=t=>D(w({},"__esModule",{value:!0}),t);var B,I,N,k,d,A,u,_,q,x=S(()=>{B=p(require("conf")),I=p(require("fs")),N=p(require("path")),k="https://www.xtrasecurity.in/api",d=new B.default({projectName:"xtra-cli",defaults:{apiUrl:k}}),A=d.get("apiUrl");A&&!process.env.XTRA_API_URL&&(A.includes("localhost")||A.includes("xtra-security.vercel.app"))&&d.set("apiUrl",k);u=()=>({...d.store,apiUrl:process.env.XTRA_API_URL||d.get("apiUrl")||k}),_=()=>d.get("token"),q=()=>{let t={};try{let e=N.default.join(process.cwd(),".xtrarc");I.default.existsSync(e)&&(t=JSON.parse(I.default.readFileSync(e,"utf-8")))}catch{}return{project:t.project||d.get("project")||"",env:t.env||d.get("env")||"development",branch:t.branch||d.get("branch")||"main"}}});var J,V,F,at,o,y,C=S(()=>{J=p(require("axios"));x();V=p(require("fs")),F=p(require("path")),at=JSON.parse(V.readFileSync(F.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:t}=u(),e=_();return J.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":at.version,...e?{Authorization:`Bearer ${e}`}:{}}})},y={login:async(t,e,r)=>(await o().post("/auth/cli-login",{email:t,password:e,apiKey:r})).data,getSecrets:async(t,e,r="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets?branch=${r}`)).data,getSecretVersions:async(t,e,r="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(t,e,r,s,n="main")=>(await o().post(`/projects/${t}/envs/${e}/secrets`,{secrets:r,expectedVersions:s,branch:n})).data,getSecretDetails:async(t,e,r,s="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets/${r}?branch=${s}`)).data,syncLogs:async t=>(await o().post("/audit/cli-logs",{logs:t})).data,linkSecret:async(t,e,r,s,n,i)=>(await o().post(`/projects/${t}/envs/${e}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:i})).data,rotateSecret:async(t,e,r,s,n)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(t,e,r)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(t,e,r,s)=>{let n={format:t};return e&&(n.startDate=e),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:t==="csv"?"text":"json"})).data},requestAccess:async(t,e,r,s)=>(await o().post("/access/request",{projectId:t,secretId:s,reason:e,duration:r})).data,approveAccess:async(t,e)=>(await o().post("/access/approve",{requestId:t,decision:e})).data,listAccessRequests:async t=>{let{workspace:e}=u(),r=e?`&workspaceId=${e}`:"";return(await o().get(`/access/list?mode=${t}${r}`)).data},getAccessRequestStatus:async t=>(await o().get(`/access/request?id=${t}`)).data,getProjects:async()=>{let{workspace:t}=u(),e=t?`/project?workspaceId=${t}`:"/project";return(await o().get(e)).data},getBranches:async t=>(await o().get(`/branch?projectId=${t}`)).data,createBranch:async(t,e,r)=>(await o().post("/branch",{projectId:t,name:e,description:r})).data,deleteBranch:async t=>(await o().delete(`/branch/${t}`)).data,updateBranch:async(t,e)=>(await o().put("/branch",{id:t,...e})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async t=>{let e=t?`?teamId=${t}`:"";return(await o().get(`/admin/users${e}`)).data},setUserRole:async(t,e,r)=>(await o().put("/admin/users/role",{email:t,role:e,teamId:r})).data,getIntegrationStatus:async t=>(await o().get(`/integrations/${t}`)).data,getIntegrationRepos:async t=>(await o().get(`/integrations/${t}/sync`)).data.repos,syncSecretsToGithub:async t=>(await o().post("/integrations/github/sync",t)).data,exportKubernetesSecret:async(t,e)=>{let r=new URLSearchParams(e).toString();return(await o().get(`/projects/${t}/kubernetes?${r}`)).data},getSecretHistory:async(t,e,r)=>(await o().get(`/projects/${t}/envs/${e}/secrets/${r}/history`)).data,rollbackSecret:async(t,e,r,s)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(t,e,r,s,n)=>(await o().post(`/projects/${t}/envs/clone`,{fromEnv:e,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async t=>(await o().post("/jit/generate",t)).data,claimJitLink:async t=>(await o().post("/jit/claim",{token:t})).data,getJitInfo:async t=>(await o().get(`/jit/${t}`)).data,post:async(t,e)=>(await o().post(t,e)).data}});function H(){let t=G.get("masterKey");t||(t=l.default.randomBytes(32).toString("hex"),G.set("masterKey",t));let e=(0,M.machineIdSync)();return l.default.createHash("sha256").update(t+e).digest()}var l,K,M,z,G,X,Y,Z=S(()=>{l=p(require("crypto")),K=p(require("conf")),M=require("node-machine-id"),z="aes-256-gcm",G=new K.default({projectName:"xtra-cli-crypto"});X=t=>{let e=l.default.randomBytes(16),r=H(),s=l.default.createCipheriv(z,r,e),n=s.update(t,"utf8","hex");n+=s.final("hex");let i=s.getAuthTag();return{iv:e.toString("hex"),content:n,tag:i.toString("hex")}},Y=t=>{let e=H(),r=Buffer.from(t.iv,"hex"),s=Buffer.from(t.tag,"hex"),n=l.default.createDecipheriv(z,e,r);n.setAuthTag(s);let i=n.update(t.content,"hex","utf8");return i+=n.final("utf8"),i}});var T={};L(T,{loadAuditLogs:()=>$,logAudit:()=>ct,saveAuditLogs:()=>j,syncAuditLogs:()=>pt});function it(t){if(!t||typeof t!="object")return t;let e={...t},r=["password","token","secret","value","apiKey","secretValue"];for(let s of Object.keys(e))r.some(n=>s.toLowerCase().includes(n))&&(e[s]="[REDACTED]");return e}async function W(t){try{if(!u().token)return!1;let r={action:t.action,entity:"cli-project",entityId:t.projectId||"global",details:it(t.details),timestamp:t.timestamp,projectId:t.projectId};return await y.post("/audit/cli-logs",{logs:[r]}),!0}catch(e){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",e),!1}}function ct(t,e,r,s){let n={id:(0,Q.v4)(),timestamp:new Date().toISOString(),action:t,projectId:e,environment:r,details:s,synced:!1},i=$();i.push(n),j(i),W(n).then(h=>{if(h){n.synced=!0;let v=$(),g=v.findIndex(a=>a.id===n.id);g!==-1&&(v[g].synced=!0,j(v))}}).catch(()=>{})}function $(){if(!f.default.existsSync(P))return[];try{let t=f.default.readFileSync(P,"utf-8"),e=JSON.parse(t),r=Y(e);return JSON.parse(r)}catch{return[]}}function j(t){f.default.existsSync(R)||f.default.mkdirSync(R,{recursive:!0});let e=JSON.stringify(t),r=X(e);f.default.writeFileSync(P,JSON.stringify(r),"utf-8")}async function pt(){let t=$(),e=t.filter(s=>!s.synced);if(e.length===0)return 0;let r=0;for(let s of e)await W(s)&&(s.synced=!0,r++);return r>0&&j(t),r}var f,E,Q,R,P,U=S(()=>{f=p(require("fs")),E=p(require("path")),Q=require("uuid");Z();x();C();R=E.default.join(process.cwd(),".xtra"),P=E.default.join(R,"audit.enc")});var dt={};L(dt,{rotateCommand:()=>gt});module.exports=b(dt);var tt=require("commander");C();x();var c=p(require("chalk")),O=p(require("ora")),gt=new tt.Command("rotate").description("Rotate a secret (Zero-Downtime Shadow Mode)").argument("<key>","Key of the secret to rotate").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Environment","development").option("--strategy <strategy>","Rotation strategy","shadow").option("--promote","Promote the shadow value to active",!1).option("--value <value>","New value for the secret (optional)").action(async(t,e)=>{let{project:r,env:s,strategy:n,promote:i,value:h}=e;if(r||(r=q().project),s={dev:"development",stg:"staging",prod:"production"}[s]||s,r||(console.error(c.default.red("Error: Project ID is required. Use -p <id> or checkout a branch.")),process.exit(1)),s==="production"){let g=require("inquirer"),{confirmProd:a}=await g.prompt([{type:"confirm",name:"confirmProd",message:c.default.red(`\u26A0 You are about to rotate a secret in PRODUCTION (${t}). Proceed?`),default:!1}]);if(!a){console.log(c.default.yellow("Aborted."));return}}if(i){let g=(0,O.default)(`Promoting secret '${t}' in ${s}...`).start();try{let a=await y.promoteSecret(r,s,t);g.succeed(c.default.green(`Successfully promoted '${t}' to version ${a.version}`));try{let{logAudit:m}=(U(),b(T));m("SECRET_PROMOTE",r,s,{key:t,newVersion:a.version})}catch{}}catch(a){g.fail("Promotion failed"),a.response&&a.response.data&&a.response.data.error?console.error(c.default.red(`Server Error: ${a.response.data.error}`)):console.error(c.default.red(a.message))}}else{let g=(0,O.default)(`Starting rotation for '${t}' (Strategy: ${n})...`).start();try{let a=await y.rotateSecret(r,s,t,n,h);g.succeed(c.default.green(`Rotation initiated for '${t}'`)),console.log(c.default.dim(`Shadow Value: ${a.shadowValue}`)),console.log(c.default.dim(`Expires At: ${a.expiresAt}`)),console.log(c.default.blue(`
+To verify, run your app. To finalize, run:
+xtra rotate ${t} --promote -p ${r} -e ${s}`));try{let{logAudit:m}=(U(),b(T));m("SECRET_ROTATE",r,s,{key:t,strategy:n,expiresAt:a.expiresAt})}catch{}}catch(a){g.fail("Rotation failed"),a.response&&a.response.data&&a.response.data.error?console.error(c.default.red(`Server Error: ${a.response.data.error}`)):console.error(c.default.red(a.message))}}});0&&(module.exports={rotateCommand});