xtra-cli 1.0.4 → 1.0.5

package/dist/commands/secrets.js

@@ -1,305 +1,14 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.secretsCommand = void 0;
-const commander_1 = require("commander");
-const api_1 = require("../lib/api");
-const chalk_1 = __importDefault(require("chalk"));
-const ora_1 = __importDefault(require("ora"));
-const table_1 = require("table");
-const config_1 = require("../lib/config");
-exports.secretsCommand = new commander_1.Command("secrets")
-    .description("Manage secrets (List, Set, Delete)")
-    .option("-p, --project <projectId>", "Project ID")
-    .option("-e, --env <environment>", "Environment (development, staging, production)", "development")
-    .option("-b, --branch <branchName>", "Branch Name");
-// LIST
-exports.secretsCommand
-    .command("list")
-    .description("List all secrets for a project/environment")
-    .option("--show", "Reveal secret values", false)
-    .addHelpText("after", `
-Examples:
-  $ xtra secrets list
-  $ xtra secrets list -e production --show
-`)
-    .action(async (options) => {
-    const parentOpts = exports.secretsCommand.opts();
-    let { project, env, branch } = parentOpts;
-    // Load .xtrarc from CWD (local project config has priority over global conf store)
-    const rc = (0, config_1.getRcConfig)();
-    if (!project)
-        project = rc.project;
-    if (!branch)
-        branch = rc.branch;
-    if (!env || env === "development")
-        env = rc.env; // only override if still at default
-    // Normalize Env
-    const envMap = { dev: "development", stg: "staging", prod: "production" };
-    env = envMap[env] || env;
-    const { show } = options;
-    if (!project) {
-        console.error(chalk_1.default.red("Error: Project ID is required. Use -p <id> or run `xtra init` first."));
-        process.exit(1);
-    }
-    const spinner = (0, ora_1.default)(`Fetching secrets for ${env} (branch: ${branch})...`).start();
-    try {
-        const secrets = await api_1.api.getSecrets(project, env, branch);
-        spinner.stop();
-        if (!secrets || Object.keys(secrets).length === 0) {
-            console.log(chalk_1.default.yellow("No secrets found."));
-            return;
-        }
-        if (show) {
-            console.log(chalk_1.default.red("⚠ Warning: Secret values will be visible in your terminal and shell history!"));
-        }
-        const data = [
-            [chalk_1.default.bold("Key"), chalk_1.default.bold("Value"), chalk_1.default.bold("Env")]
-        ];
-        Object.entries(secrets).forEach(([key, value]) => {
-            data.push([
-                key,
-                show ? value : "********",
-                env
-            ]);
-        });
-        console.log((0, table_1.table)(data));
-        // Audit Log
-        try {
-            const { logAudit } = await Promise.resolve().then(() => __importStar(require("../lib/audit")));
-            logAudit("SECRET_LIST", project, env, { branch, count: Object.keys(secrets).length });
-        }
-        catch (e) { }
-    }
-    catch (error) {
-        spinner.fail("Failed to fetch secrets");
-        console.error(chalk_1.default.red(error.message));
-    }
-});
-// SET
-exports.secretsCommand
-    .command("set")
-    .description("Set one or more secrets (KEY=VALUE)")
-    .argument("<secrets...>", "Secrets to set (format: KEY=VALUE)")
-    .option("-f, --force", "Force update (overwrite remote changes without warning)", false)
-    .addHelpText("after", `
-Examples:
-  $ xtra secrets set API_KEY=xyz
-  $ xtra secrets set DB_USER=admin DB_PASS=secret -e staging
-`)
-    .action(async (args, options) => {
-    const parentOpts = exports.secretsCommand.opts();
-    let { project, env, branch } = parentOpts;
-    // Use active branch from config if not specified
-    if (!branch) {
-        branch = (0, config_1.getConfigValue)("branch") || "main";
-    }
-    // Normalize Env
-    const envMap = { dev: "development", stg: "staging", prod: "production" };
-    env = envMap[env] || env;
-    if (!project) {
-        project = (0, config_1.getConfigValue)("project");
-    }
-    if (!project) {
-        console.error(chalk_1.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first."));
-        process.exit(1);
-    }
-    // Parse key=value pairs
-    const payload = {};
-    args.forEach((arg) => {
-        const idx = arg.indexOf("=");
-        if (idx === -1) {
-            console.warn(chalk_1.default.yellow(`Skipping invalid format: ${arg} (expected KEY=VALUE)`));
-            return;
-        }
-        const key = arg.substring(0, idx);
-        const value = arg.substring(idx + 1);
-        payload[key] = value;
-    });
-    if (Object.keys(payload).length === 0) {
-        console.error(chalk_1.default.red("No valid secrets provided."));
-        return;
-    }
-    // 🔒 Production gate: require explicit confirmation before writing to production
-    if (env === "production" && !options.force) {
-        const inquirer = require("inquirer");
-        const { confirm } = await inquirer.prompt([{
-                type: "confirm",
-                name: "confirm",
-                message: chalk_1.default.red(`⚠  You are about to SET ${Object.keys(payload).length} secret(s) in PRODUCTION. Are you sure?`),
-                default: false,
-            }]);
-        if (!confirm) {
-            console.log(chalk_1.default.yellow("Aborted."));
-            return;
-        }
-    }
-    const spinner = (0, ora_1.default)(`Setting ${Object.keys(payload).length} secrets for ${env} (branch: ${branch})...`);
-    if (options.force) {
-        spinner.start();
-    }
-    try {
-        let expectedVersions = undefined;
-        if (!options.force) {
-            // Fetch current versions for optimistic locking
-            spinner.text = "Fetching current versions...";
-            spinner.start();
-            try {
-                const remoteSecrets = await api_1.api.getSecretVersions(project, env, branch);
-                expectedVersions = {};
-                spinner.stop();
-                // Populate expected versions for keys we are updating
-                Object.keys(payload).forEach(key => {
-                    if (remoteSecrets[key]) {
-                        expectedVersions[key] = remoteSecrets[key].version;
-                    }
-                });
-            }
-            catch (verErr) {
-                spinner.warn(chalk_1.default.yellow("Could not fetch remote versions. Conflict detection disabled."));
-            }
-        }
-        spinner.start(`Updating secrets...`);
-        await api_1.api.setSecrets(project, env, payload, expectedVersions, branch);
-        spinner.succeed("Secrets updated successfully.");
-        // Log Audit
-        try {
-            const { logAudit } = require("../lib/audit");
-            logAudit("SECRET_UPDATE", project, env, { keys: Object.keys(payload), branch });
-        }
-        catch (e) { }
-    }
-    catch (error) {
-        spinner.stop();
-        if (error.response && error.response.status === 409) {
-            // Conflict Detected
-            const conflicts = error.response.data.conflicts || [];
-            console.log(chalk_1.default.red("\n⚠ Conflict Detected! The following secrets have changed remotely:\n"));
-            const conflictTable = [[chalk_1.default.bold("Key"), chalk_1.default.bold("Remote Version"), chalk_1.default.bold("Remote Value")]];
-            conflicts.forEach((c) => {
-                conflictTable.push([c.key, c.actual, c.remoteValue]);
-            });
-            console.log((0, table_1.table)(conflictTable));
-            const inquirer = require("inquirer");
-            const { confirm } = await inquirer.prompt([{
-                    type: "confirm",
-                    name: "confirm",
-                    message: "Do you want to overwrite these changes exactly as you specified?",
-                    default: false
-                }]);
-            if (confirm) {
-                const retrySpinner = (0, ora_1.default)("Overwriting secrets...").start();
-                try {
-                    // Start retry with Force (no expectedVersions)
-                    await api_1.api.setSecrets(project, env, payload, undefined, branch);
-                    retrySpinner.succeed("Secrets overwritten successfully.");
-                    // Log Audit Force
-                    try {
-                        const { logAudit } = require("../lib/audit");
-                        logAudit("SECRET_UPDATE_FORCE", project, env, { keys: Object.keys(payload), branch });
-                    }
-                    catch (e) { }
-                }
-                catch (retryErr) {
-                    retrySpinner.fail("Failed to overwrite secrets.");
-                    console.error(chalk_1.default.red(retryErr.message));
-                }
-            }
-            else {
-                console.log(chalk_1.default.yellow("Update cancelled."));
-            }
-            return; // Handled
-        }
-        if (spinner.isSpinning)
-            spinner.fail("Failed to update secrets");
-        if (error.response && error.response.data && error.response.data.error) {
-            console.error(chalk_1.default.red(`Server Error: ${error.response.data.error}`));
-        }
-        else {
-            console.error(chalk_1.default.red(error.message));
-        }
-    }
-});
-// LINK
-exports.secretsCommand
-    .command("link")
-    .description("Link a secret to another secret (Reference)")
-    .argument("<key>", "Key of the secret to create (e.g. DB_URL)")
-    .requiredOption("--source <source>", "Source path (format: project/env/key)")
-    .addHelpText("after", `
-Examples:
-  $ xtra secrets link SHARED_DB_URL --source shared-proj/production/DB_URL
-`)
-    .action(async (key, options) => {
-    const parentOpts = exports.secretsCommand.opts();
-    let { project, env } = parentOpts;
-    // Normalize Env
-    const envMap = { dev: "development", stg: "staging", prod: "production" };
-    env = envMap[env] || env;
-    const { source } = options;
-    if (!project) {
-        project = (0, config_1.getConfigValue)("project");
-    }
-    if (!project) {
-        console.error(chalk_1.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first."));
-        process.exit(1);
-    }
-    // Parse Source: "proj-123/prod/DATABASE_URL"
-    const parts = source.split("/");
-    if (parts.length !== 3) {
-        console.error(chalk_1.default.red("Error: Source must be in format 'projectId/env/key'"));
-        return;
-    }
-    const [sourceProjectId, sourceEnv, sourceKey] = parts;
-    const spinner = (0, ora_1.default)(`Linking ${key} to ${source}...`).start();
-    try {
-        await api_1.api.linkSecret(project, env, key, sourceProjectId, sourceEnv, sourceKey);
-        spinner.succeed(chalk_1.default.green(`Secret '${key}' successfully linked to '${sourceKey}'`));
-        // Audit log
-        try {
-            const { logAudit } = require("../lib/audit");
-            logAudit("SECRET_LINKED", project, env, { key, source });
-        }
-        catch (e) { }
-    }
-    catch (error) {
-        spinner.fail("Failed to link secret");
-        const safeErr = error?.response?.data?.error || error.message || "Unknown error";
-        console.error(chalk_1.default.red(`Server Error: ${safeErr}`));
-    }
-});
+var pe=Object.create;var I=Object.defineProperty;var ge=Object.getOwnPropertyDescriptor;var de=Object.getOwnPropertyNames;var le=Object.getPrototypeOf,ue=Object.prototype.hasOwnProperty;var A=(e,t)=>()=>(e&&(t=e(e=0)),t);var V=(e,t)=>{for(var r in t)I(e,r,{get:t[r],enumerable:!0})},J=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of de(t))!ue.call(e,n)&&n!==r&&I(e,n,{get:()=>t[n],enumerable:!(s=ge(t,n))||s.enumerable});return e};var u=(e,t,r)=>(r=e!=null?pe(le(e)):{},J(t||!e||!e.__esModule?I(r,"default",{value:e,enumerable:!0}):r,e)),R=e=>J(I({},"__esModule",{value:!0}),e);var M,_,H,P,y,T,S,C,G,z,U=A(()=>{M=u(require("conf")),_=u(require("fs")),H=u(require("path")),P="https://www.xtrasecurity.in/api",y=new M.default({projectName:"xtra-cli",defaults:{apiUrl:P}}),T=y.get("apiUrl");T&&!process.env.XTRA_API_URL&&(T.includes("localhost")||T.includes("xtra-security.vercel.app"))&&y.set("apiUrl",P);S=()=>({...y.store,apiUrl:process.env.XTRA_API_URL||y.get("apiUrl")||P}),C=e=>y.get(e),G=()=>y.get("token"),z=()=>{let e={};try{let t=H.default.join(process.cwd(),".xtrarc");_.default.existsSync(t)&&(e=JSON.parse(_.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||y.get("project")||"",env:e.env||y.get("env")||"development",branch:e.branch||y.get("branch")||"main"}}});var Y,X,W,fe,o,h,B=A(()=>{Y=u(require("axios"));U();X=u(require("fs")),W=u(require("path")),fe=JSON.parse(X.readFileSync(W.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:e}=S(),t=G();return Y.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":fe.version,...t?{Authorization:`Bearer ${t}`}:{}}})},h={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,getSecrets:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data,getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:r,expectedVersions:s,branch:n})).data,getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,c)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:c})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=S(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=S(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});function re(){let e=Q.get("masterKey");e||(e=j.default.randomBytes(32).toString("hex"),Q.set("masterKey",e));let t=(0,ee.machineIdSync)();return j.default.createHash("sha256").update(e+t).digest()}var j,Z,ee,te,Q,se,ne,oe=A(()=>{j=u(require("crypto")),Z=u(require("conf")),ee=require("node-machine-id"),te="aes-256-gcm",Q=new Z.default({projectName:"xtra-cli-crypto"});se=e=>{let t=j.default.randomBytes(16),r=re(),s=j.default.createCipheriv(te,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let c=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:c.toString("hex")}},ne=e=>{let t=re(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=j.default.createDecipheriv(te,t,r);n.setAuthTag(s);let c=n.update(e.content,"hex","utf8");return c+=n.final("utf8"),c}});var b={};V(b,{loadAuditLogs:()=>O,logAudit:()=>me,saveAuditLogs:()=>D,syncAuditLogs:()=>he});function ye(e){if(!e||typeof e!="object")return e;let t={...e},r=["password","token","secret","value","apiKey","secretValue"];for(let s of Object.keys(t))r.some(n=>s.toLowerCase().includes(n))&&(t[s]="[REDACTED]");return t}async function ce(e){try{if(!S().token)return!1;let r={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:ye(e.details),timestamp:e.timestamp,projectId:e.projectId};return await h.post("/audit/cli-logs",{logs:[r]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function me(e,t,r,s){let n={id:(0,ie.v4)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:r,details:s,synced:!1},c=O();c.push(n),D(c),ce(n).then(m=>{if(m){n.synced=!0;let g=O(),d=g.findIndex(i=>i.id===n.id);d!==-1&&(g[d].synced=!0,D(g))}}).catch(()=>{})}function O(){if(!x.default.existsSync(q))return[];try{let e=x.default.readFileSync(q,"utf-8"),t=JSON.parse(e),r=ne(t);return JSON.parse(r)}catch{return[]}}function D(e){x.default.existsSync(N)||x.default.mkdirSync(N,{recursive:!0});let t=JSON.stringify(e),r=se(t);x.default.writeFileSync(q,JSON.stringify(r),"utf-8")}async function he(){let e=O(),t=e.filter(s=>!s.synced);if(t.length===0)return 0;let r=0;for(let s of t)await ce(s)&&(s.synced=!0,r++);return r>0&&D(e),r}var x,F,ie,N,q,$=A(()=>{x=u(require("fs")),F=u(require("path")),ie=require("uuid");oe();U();B();N=F.default.join(process.cwd(),".xtra"),q=F.default.join(N,"audit.enc")});var ve={};V(ve,{secretsCommand:()=>v});module.exports=R(ve);var ae=require("commander");B();var a=u(require("chalk")),k=u(require("ora")),K=require("table");U();var v=new ae.Command("secrets").description("Manage secrets (List, Set, Delete)").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Environment (development, staging, production)","development").option("-b, --branch <branchName>","Branch Name");v.command("list").description("List all secrets for a project/environment").option("--show","Reveal secret values",!1).addHelpText("after",`
+Examples:
+  $ xtra secrets list
+  $ xtra secrets list -e production --show
+`).action(async e=>{let t=v.opts(),{project:r,env:s,branch:n}=t,c=z();r||(r=c.project),n||(n=c.branch),(!s||s==="development")&&(s=c.env),s={dev:"development",stg:"staging",prod:"production"}[s]||s;let{show:g}=e;r||(console.error(a.default.red("Error: Project ID is required. Use -p <id> or run `xtra init` first.")),process.exit(1));let d=(0,k.default)(`Fetching secrets for ${s} (branch: ${n})...`).start();try{let i=await h.getSecrets(r,s,n);if(d.stop(),!i||Object.keys(i).length===0){console.log(a.default.yellow("No secrets found."));return}g&&console.log(a.default.red("\u26A0 Warning: Secret values will be visible in your terminal and shell history!"));let p=[[a.default.bold("Key"),a.default.bold("Value"),a.default.bold("Env")]];Object.entries(i).forEach(([l,f])=>{p.push([l,g?f:"********",s])}),console.log((0,K.table)(p));try{let{logAudit:l}=await Promise.resolve().then(()=>($(),b));l("SECRET_LIST",r,s,{branch:n,count:Object.keys(i).length})}catch{}}catch(i){d.fail("Failed to fetch secrets"),console.error(a.default.red(i.message))}});v.command("set").description("Set one or more secrets (KEY=VALUE)").argument("<secrets...>","Secrets to set (format: KEY=VALUE)").option("-f, --force","Force update (overwrite remote changes without warning)",!1).addHelpText("after",`
+Examples:
+  $ xtra secrets set API_KEY=xyz
+  $ xtra secrets set DB_USER=admin DB_PASS=secret -e staging
+`).action(async(e,t)=>{let r=v.opts(),{project:s,env:n,branch:c}=r;c||(c=C("branch")||"main"),n={dev:"development",stg:"staging",prod:"production"}[n]||n,s||(s=C("project")),s||(console.error(a.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let g={};if(e.forEach(i=>{let p=i.indexOf("=");if(p===-1){console.warn(a.default.yellow(`Skipping invalid format: ${i} (expected KEY=VALUE)`));return}let l=i.substring(0,p),f=i.substring(p+1);g[l]=f}),Object.keys(g).length===0){console.error(a.default.red("No valid secrets provided."));return}if(n==="production"&&!t.force){let i=require("inquirer"),{confirm:p}=await i.prompt([{type:"confirm",name:"confirm",message:a.default.red(`\u26A0  You are about to SET ${Object.keys(g).length} secret(s) in PRODUCTION. Are you sure?`),default:!1}]);if(!p){console.log(a.default.yellow("Aborted."));return}}let d=(0,k.default)(`Setting ${Object.keys(g).length} secrets for ${n} (branch: ${c})...`);t.force&&d.start();try{let i;if(!t.force){d.text="Fetching current versions...",d.start();try{let p=await h.getSecretVersions(s,n,c);i={},d.stop(),Object.keys(g).forEach(l=>{p[l]&&(i[l]=p[l].version)})}catch{d.warn(a.default.yellow("Could not fetch remote versions. Conflict detection disabled."))}}d.start("Updating secrets..."),await h.setSecrets(s,n,g,i,c),d.succeed("Secrets updated successfully.");try{let{logAudit:p}=($(),R(b));p("SECRET_UPDATE",s,n,{keys:Object.keys(g),branch:c})}catch{}}catch(i){if(d.stop(),i.response&&i.response.status===409){let p=i.response.data.conflicts||[];console.log(a.default.red(`
+\u26A0 Conflict Detected! The following secrets have changed remotely:
+`));let l=[[a.default.bold("Key"),a.default.bold("Remote Version"),a.default.bold("Remote Value")]];p.forEach(w=>{l.push([w.key,w.actual,w.remoteValue])}),console.log((0,K.table)(l));let f=require("inquirer"),{confirm:L}=await f.prompt([{type:"confirm",name:"confirm",message:"Do you want to overwrite these changes exactly as you specified?",default:!1}]);if(L){let w=(0,k.default)("Overwriting secrets...").start();try{await h.setSecrets(s,n,g,void 0,c),w.succeed("Secrets overwritten successfully.");try{let{logAudit:E}=($(),R(b));E("SECRET_UPDATE_FORCE",s,n,{keys:Object.keys(g),branch:c})}catch{}}catch(E){w.fail("Failed to overwrite secrets."),console.error(a.default.red(E.message))}}else console.log(a.default.yellow("Update cancelled."));return}d.isSpinning&&d.fail("Failed to update secrets"),i.response&&i.response.data&&i.response.data.error?console.error(a.default.red(`Server Error: ${i.response.data.error}`)):console.error(a.default.red(i.message))}});v.command("link").description("Link a secret to another secret (Reference)").argument("<key>","Key of the secret to create (e.g. DB_URL)").requiredOption("--source <source>","Source path (format: project/env/key)").addHelpText("after",`
+Examples:
+  $ xtra secrets link SHARED_DB_URL --source shared-proj/production/DB_URL
+`).action(async(e,t)=>{let r=v.opts(),{project:s,env:n}=r;n={dev:"development",stg:"staging",prod:"production"}[n]||n;let{source:m}=t;s||(s=C("project")),s||(console.error(a.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let g=m.split("/");if(g.length!==3){console.error(a.default.red("Error: Source must be in format 'projectId/env/key'"));return}let[d,i,p]=g,l=(0,k.default)(`Linking ${e} to ${m}...`).start();try{await h.linkSecret(s,n,e,d,i,p),l.succeed(a.default.green(`Secret '${e}' successfully linked to '${p}'`));try{let{logAudit:f}=($(),R(b));f("SECRET_LINKED",s,n,{key:e,source:m})}catch{}}catch(f){l.fail("Failed to link secret");let L=f?.response?.data?.error||f.message||"Unknown error";console.error(a.default.red(`Server Error: ${L}`))}});0&&(module.exports={secretsCommand});

package/dist/commands/simulate.js

@@ -1,109 +1,6 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.simulateCommand = void 0;
-/**
- * simulate.ts — Dry-run mode for xtra run
- *
- * Fetches secrets and shows exactly what `xtra run` would inject into
- * the process environment — without actually executing the command.
- * Safe to use in any environment.
- */
-const commander_1 = require("commander");
-const api_1 = require("../lib/api");
-const config_1 = require("../lib/config");
-const chalk_1 = __importDefault(require("chalk"));
-const ora_1 = __importDefault(require("ora"));
-const table_1 = require("table");
-exports.simulateCommand = new commander_1.Command("simulate")
-    .description("Dry-run: show what 'xtra run' would inject without executing the command")
-    .option("-p, --project <id>", "Project ID")
-    .option("-e, --env <environment>", "Environment", "development")
-    .option("-b, --branch <branch>", "Branch", "main")
-    .argument("[command]", "Command that would be executed (display only)")
-    .option("--show-values", "Reveal secret values in output (default: masked)", false)
-    .option("--diff", "Highlight secrets that differ from local .env / process.env", false)
-    .action(async (command, options) => {
-    let { project, env, branch, showValues, diff: showDiff } = options;
-    const envMap = { dev: "development", stg: "staging", prod: "production" };
-    env = envMap[env] || env;
-    if (!project)
-        project = (0, config_1.getRcConfig)().project;
-    if (!project) {
-        console.error(chalk_1.default.red("Error: Project ID required. Use -p <id> or run 'xtra project set'."));
-        process.exit(1);
-    }
-    const spinner = (0, ora_1.default)(`Fetching secrets to simulate injection (${env}/${branch})...`).start();
-    let secrets;
-    try {
-        secrets = await api_1.api.getSecrets(project, env, branch);
-        spinner.stop();
-    }
-    catch (e) {
-        spinner.fail("Failed to fetch secrets.");
-        console.error(chalk_1.default.red(e?.response?.data?.error || e.message));
-        process.exit(1);
-    }
-    const count = Object.keys(secrets).length;
-    const termWidth = process.stdout.columns || 100;
-    const keyWidth = Math.floor(termWidth * 0.25);
-    const valWidth = Math.floor(termWidth * 0.4);
-    const localWidth = Math.floor(termWidth * 0.15);
-    console.log(chalk_1.default.bold.cyan("\n● Simulation") + chalk_1.default.bold(` — xtra run ${command ? chalk_1.default.cyan(command) : "(no command specified)"}\n`));
-    console.log(chalk_1.default.gray(`   Project : ${chalk_1.default.white(project)}`));
-    console.log(chalk_1.default.gray(`   Env     : ${chalk_1.default.white(env)}`));
-    console.log(chalk_1.default.gray(`   Branch  : ${chalk_1.default.white(branch)}`));
-    console.log(chalk_1.default.gray(`   Secrets : ${chalk_1.default.white(count)} would be injected\n`));
-    if (count === 0) {
-        console.log(chalk_1.default.yellow("  No secrets found for this environment/branch."));
-        return;
-    }
-    const rows = [
-        [chalk_1.default.bold("Key"), chalk_1.default.bold("Injected Value"), chalk_1.default.bold("Local .env"), chalk_1.default.bold("Status")]
-    ];
-    for (const [key, value] of Object.entries(secrets)) {
-        const localVal = process.env[key];
-        const displayVal = showValues ? chalk_1.default.cyan(value) : chalk_1.default.gray("••••••••");
-        let status = chalk_1.default.green("Injected");
-        let localDisplay = "-";
-        if (showDiff && localVal !== undefined) {
-            localDisplay = showValues ? chalk_1.default.yellow(localVal) : chalk_1.default.gray("••••••••");
-            if (localVal === value) {
-                status = chalk_1.default.gray("Same");
-            }
-            else {
-                status = chalk_1.default.yellow("⚡ Override");
-            }
-        }
-        else if (showDiff) {
-            status = chalk_1.default.blue("New");
-            localDisplay = chalk_1.default.gray("(not set)");
-        }
-        rows.push([chalk_1.default.white(key), displayVal, showDiff ? localDisplay : "-", status]);
-    }
-    console.log((0, table_1.table)(rows, {
-        columns: [
-            { width: keyWidth, wrapWord: true },
-            { width: valWidth, wrapWord: true },
-            { width: localWidth, wrapWord: true },
-            { width: 10 }
-        ],
-        border: {
-            topBody: `─`, topJoin: `┬`, topLeft: `┌`, topRight: `┐`,
-            bottomBody: `─`, bottomJoin: `┴`, bottomLeft: `└`, bottomRight: `┘`,
-            bodyLeft: `│`, bodyRight: `│`, bodyJoin: `│`,
-            joinBody: `─`, joinLeft: `├`, joinRight: `┤`, joinJoin: `┼`
-        }
-    }));
-    // Summary
-    if (!showValues) {
-        console.log(chalk_1.default.gray("  Tip: use --show-values to reveal actual secret values"));
-    }
-    if (!showDiff) {
-        console.log(chalk_1.default.gray("  Tip: use --diff to compare against your local process.env"));
-    }
-    console.log(chalk_1.default.bold.green(`\n  ✔ Simulation complete.`) + chalk_1.default.bold(` ${count} secret(s) would be injected.`));
-    console.log(chalk_1.default.gray("  Run without 'simulate' to actually execute the command.\n"));
-});
+var G=Object.create;var u=Object.defineProperty;var W=Object.getOwnPropertyDescriptor;var F=Object.getOwnPropertyNames;var M=Object.getPrototypeOf,E=Object.prototype.hasOwnProperty;var H=(e,t)=>{for(var s in t)u(e,s,{get:t[s],enumerable:!0})},R=(e,t,s,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let a of F(t))!E.call(e,a)&&a!==s&&u(e,a,{get:()=>t[a],enumerable:!(n=W(t,a))||n.enumerable});return e};var c=(e,t,s)=>(s=e!=null?G(M(e)):{},R(t||!e||!e.__esModule?u(s,"default",{value:e,enumerable:!0}):s,e)),X=e=>R(u({},"__esModule",{value:!0}),e);var Q={};H(Q,{simulateCommand:()=>z});module.exports=X(Q);var J=require("commander");var A=c(require("axios"));var I=c(require("conf")),j=c(require("fs")),U=c(require("path")),$="https://www.xtrasecurity.in/api",p=new I.default({projectName:"xtra-cli",defaults:{apiUrl:$}}),v=p.get("apiUrl");v&&!process.env.XTRA_API_URL&&(v.includes("localhost")||v.includes("xtra-security.vercel.app"))&&p.set("apiUrl",$);var y=()=>({...p.store,apiUrl:process.env.XTRA_API_URL||p.get("apiUrl")||$});var C=()=>p.get("token");var L=()=>{let e={};try{let t=U.default.join(process.cwd(),".xtrarc");j.default.existsSync(t)&&(e=JSON.parse(j.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||p.get("project")||"",env:e.env||p.get("env")||"development",branch:e.branch||p.get("branch")||"main"}};var P=c(require("fs")),B=c(require("path")),K=JSON.parse(P.readFileSync(B.join(__dirname,"../../package.json"),"utf-8")),r=()=>{let{apiUrl:e}=y(),t=C();return A.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":K.version,...t?{Authorization:`Bearer ${t}`}:{}}})},_={login:async(e,t,s)=>(await r().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,n,a="main")=>(await r().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:n,branch:a})).data,getSecretDetails:async(e,t,s,n="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${n}`)).data,syncLogs:async e=>(await r().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,n,a,i)=>(await r().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:n,sourceEnv:a,sourceKey:i})).data,rotateSecret:async(e,t,s,n,a)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:n,parsedNewValue:a})).data,promoteSecret:async(e,t,s)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await r().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,n)=>{let a={format:e};return t&&(a.startDate=t),s&&(a.endDate=s),n&&(a.projectId=n),(await r().post("/audit/export",a,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,n)=>(await r().post("/access/request",{projectId:e,secretId:n,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await r().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=y(),s=t?`&workspaceId=${t}`:"";return(await r().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await r().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=y(),t=e?`/project?workspaceId=${e}`:"/project";return(await r().get(t)).data},getBranches:async e=>(await r().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await r().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await r().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await r().put("/branch",{id:e,...t})).data,getRoles:async()=>(await r().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await r().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await r().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await r().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await r().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await r().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await r().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await r().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,n)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:n})).data,cloneEnvironment:async(e,t,s,n,a)=>(await r().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:n,branch:a})).data,generateJitLink:async e=>(await r().post("/jit/generate",e)).data,claimJitLink:async e=>(await r().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await r().get(`/jit/${e}`)).data,post:async(e,t)=>(await r().post(e,t)).data};var o=c(require("chalk")),T=c(require("ora")),D=require("table"),z=new J.Command("simulate").description("Dry-run: show what 'xtra run' would inject without executing the command").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment","development").option("-b, --branch <branch>","Branch","main").argument("[command]","Command that would be executed (display only)").option("--show-values","Reveal secret values in output (default: masked)",!1).option("--diff","Highlight secrets that differ from local .env / process.env",!1).action(async(e,t)=>{let{project:s,env:n,branch:a,showValues:i,diff:g}=t;n={dev:"development",stg:"staging",prod:"production"}[n]||n,s||(s=L().project),s||(console.error(o.default.red("Error: Project ID required. Use -p <id> or run 'xtra project set'.")),process.exit(1));let S=(0,T.default)(`Fetching secrets to simulate injection (${n}/${a})...`).start(),m;try{m=await _.getSecrets(s,n,a),S.stop()}catch(l){S.fail("Failed to fetch secrets."),console.error(o.default.red(l?.response?.data?.error||l.message)),process.exit(1)}let f=Object.keys(m).length,h=process.stdout.columns||100,O=Math.floor(h*.25),V=Math.floor(h*.4),N=Math.floor(h*.15);if(console.log(o.default.bold.cyan(`
+\u25CF Simulation`)+o.default.bold(` \u2014 xtra run ${e?o.default.cyan(e):"(no command specified)"}
+`)),console.log(o.default.gray(`   Project : ${o.default.white(s)}`)),console.log(o.default.gray(`   Env     : ${o.default.white(n)}`)),console.log(o.default.gray(`   Branch  : ${o.default.white(a)}`)),console.log(o.default.gray(`   Secrets : ${o.default.white(f)} would be injected
+`)),f===0){console.log(o.default.yellow("  No secrets found for this environment/branch."));return}let x=[[o.default.bold("Key"),o.default.bold("Injected Value"),o.default.bold("Local .env"),o.default.bold("Status")]];for(let[l,k]of Object.entries(m)){let w=process.env[l],q=i?o.default.cyan(k):o.default.gray("\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022"),d=o.default.green("Injected"),b="-";g&&w!==void 0?(b=i?o.default.yellow(w):o.default.gray("\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022"),w===k?d=o.default.gray("Same"):d=o.default.yellow("\u26A1 Override")):g&&(d=o.default.blue("New"),b=o.default.gray("(not set)")),x.push([o.default.white(l),q,g?b:"-",d])}console.log((0,D.table)(x,{columns:[{width:O,wrapWord:!0},{width:V,wrapWord:!0},{width:N,wrapWord:!0},{width:10}],border:{topBody:"\u2500",topJoin:"\u252C",topLeft:"\u250C",topRight:"\u2510",bottomBody:"\u2500",bottomJoin:"\u2534",bottomLeft:"\u2514",bottomRight:"\u2518",bodyLeft:"\u2502",bodyRight:"\u2502",bodyJoin:"\u2502",joinBody:"\u2500",joinLeft:"\u251C",joinRight:"\u2524",joinJoin:"\u253C"}})),i||console.log(o.default.gray("  Tip: use --show-values to reveal actual secret values")),g||console.log(o.default.gray("  Tip: use --diff to compare against your local process.env")),console.log(o.default.bold.green(`
+  \u2714 Simulation complete.`)+o.default.bold(` ${f} secret(s) would be injected.`)),console.log(o.default.gray(`  Run without 'simulate' to actually execute the command.
+`))});0&&(module.exports={simulateCommand});

package/dist/commands/status.js

@@ -1,93 +1,2 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.statusCommand = void 0;
-const commander_1 = require("commander");
-const api_1 = require("../lib/api");
-const chalk_1 = __importDefault(require("chalk"));
-const ora_1 = __importDefault(require("ora"));
-const table_1 = require("table");
-const manifest_1 = require("../lib/manifest");
-const crypto_1 = require("../lib/crypto");
-const config_1 = require("../lib/config");
-exports.statusCommand = new commander_1.Command("status")
-    .description("Check synchronization status with XtraSync platform")
-    .option("-p, --project <projectId>", "Project ID")
-    .option("-e, --env <environment>", "Environment (dev, stg, prod)", "dev")
-    .option("-b, --branch <branchName>", "Branch Name")
-    .action(async (options) => {
-    let { project, env, branch } = options;
-    // Use config fallback
-    if (!project)
-        project = (0, config_1.getRcConfig)().project;
-    if (!branch) {
-        branch = (0, config_1.getRcConfig)().branch || "main";
-    }
-    if (!project) {
-        console.error(chalk_1.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first."));
-        process.exit(1);
-    }
-    // Normalize Env
-    const envMap = { dev: "development", stg: "staging", prod: "production" };
-    env = envMap[env] || env;
-    // Load Manifest
-    const manifest = (0, manifest_1.loadManifest)();
-    if (!manifest) {
-        console.log(chalk_1.default.yellow("No local manifest found. Run 'xtra run' or 'xtra generate' first."));
-        return;
-    }
-    if (manifest.projectId !== project || manifest.environment !== env) {
-        console.log(chalk_1.default.yellow(`Manifest found for DIFFERENT project/env (${manifest.projectId}/${manifest.environment}).`));
-        console.log("Checking status against requested target anyway...");
-    }
-    const spinner = (0, ora_1.default)(`Fetching remote state for ${env} (branch: ${branch})...`).start();
-    try {
-        const secrets = await api_1.api.getSecrets(project, env, branch);
-        spinner.stop();
-        // Compare
-        const rows = [[chalk_1.default.bold("Secret Key"), chalk_1.default.bold("Status"), chalk_1.default.bold("Local Last Updated")]];
-        let diffCount = 0;
-        // Check Remote vs Local
-        Object.entries(secrets).forEach(([key, value]) => {
-            const remoteHash = (0, crypto_1.hash)(value);
-            const localEntry = manifest.secrets[key];
-            if (!localEntry) {
-                rows.push([key, chalk_1.default.green("NEW (Remote)"), "-"]);
-                diffCount++;
-            }
-            else if (localEntry.hash !== remoteHash) {
-                rows.push([key, chalk_1.default.yellow("MODIFIED"), localEntry.updatedAt]);
-                diffCount++;
-            }
-            else {
-                rows.push([key, chalk_1.default.cyan("Synced"), localEntry.updatedAt]);
-            }
-        });
-        // Check Local vs Remote (Deleted keys)
-        Object.keys(manifest.secrets).forEach(key => {
-            if (!secrets[key]) {
-                rows.push([key, chalk_1.default.red("DELETED (Remote)"), manifest.secrets[key].updatedAt]);
-                diffCount++;
-            }
-        });
-        console.log("");
-        console.log((0, table_1.table)(rows));
-        if (diffCount === 0) {
-            console.log(chalk_1.default.green("✔ Everything is in sync."));
-        }
-        else {
-            console.log(chalk_1.default.yellow(`⚠ Found ${diffCount} difference(s).\n`));
-            console.log(chalk_1.default.bold("  Next steps:"));
-            console.log(chalk_1.default.gray("    xtra generate              ") + chalk_1.default.white("# pull cloud secrets → .env (merge)"));
-            console.log(chalk_1.default.gray("    xtra generate -f json      ") + chalk_1.default.white("# pull cloud secrets → secrets.json"));
-            console.log(chalk_1.default.gray("    xtra run node app.js       ") + chalk_1.default.white("# inject secrets at runtime (no file)"));
-            console.log(chalk_1.default.gray("    xtra local sync            ") + chalk_1.default.white("# pull cloud secrets → .env.local (offline mode)"));
-        }
-    }
-    catch (error) {
-        spinner.fail("Failed to fetch remote secrets.");
-        console.error(chalk_1.default.red(error.message));
-    }
-});
+var q=Object.create;var m=Object.defineProperty;var J=Object.getOwnPropertyDescriptor;var G=Object.getOwnPropertyNames;var H=Object.getPrototypeOf,K=Object.prototype.hasOwnProperty;var V=(t,e)=>{for(var s in e)m(t,s,{get:e[s],enumerable:!0})},b=(t,e,s,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let a of G(e))!K.call(t,a)&&a!==s&&m(t,a,{get:()=>e[a],enumerable:!(n=J(e,a))||n.enumerable});return t};var c=(t,e,s)=>(s=t!=null?q(H(t)):{},b(e||!t||!t.__esModule?m(s,"default",{value:t,enumerable:!0}):s,t)),X=t=>b(m({},"__esModule",{value:!0}),t);var Z={};V(Z,{statusCommand:()=>Y});module.exports=X(Z);var O=require("commander");var C=c(require("axios"));var I=c(require("conf")),v=c(require("fs")),A=c(require("path")),S="https://www.xtrasecurity.in/api",g=new I.default({projectName:"xtra-cli",defaults:{apiUrl:S}}),w=g.get("apiUrl");w&&!process.env.XTRA_API_URL&&(w.includes("localhost")||w.includes("xtra-security.vercel.app"))&&g.set("apiUrl",S);var y=()=>({...g.store,apiUrl:process.env.XTRA_API_URL||g.get("apiUrl")||S});var k=()=>g.get("token");var j=()=>{let t={};try{let e=A.default.join(process.cwd(),".xtrarc");v.default.existsSync(e)&&(t=JSON.parse(v.default.readFileSync(e,"utf-8")))}catch{}return{project:t.project||g.get("project")||"",env:t.env||g.get("env")||"development",branch:t.branch||g.get("branch")||"main"}};var R=c(require("fs")),U=c(require("path")),z=JSON.parse(R.readFileSync(U.join(__dirname,"../../package.json"),"utf-8")),r=()=>{let{apiUrl:t}=y(),e=k();return C.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":z.version,...e?{Authorization:`Bearer ${e}`}:{}}})},E={login:async(t,e,s)=>(await r().post("/auth/cli-login",{email:t,password:e,apiKey:s})).data,getSecrets:async(t,e,s="main")=>(await r().get(`/projects/${t}/envs/${e}/secrets?branch=${s}`)).data,getSecretVersions:async(t,e,s="main")=>(await r().get(`/projects/${t}/envs/${e}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(t,e,s,n,a="main")=>(await r().post(`/projects/${t}/envs/${e}/secrets`,{secrets:s,expectedVersions:n,branch:a})).data,getSecretDetails:async(t,e,s,n="main")=>(await r().get(`/projects/${t}/envs/${e}/secrets/${s}?branch=${n}`)).data,syncLogs:async t=>(await r().post("/audit/cli-logs",{logs:t})).data,linkSecret:async(t,e,s,n,a,i)=>(await r().post(`/projects/${t}/envs/${e}/secrets/link`,{key:s,sourceProjectId:n,sourceEnv:a,sourceKey:i})).data,rotateSecret:async(t,e,s,n,a)=>(await r().post(`/projects/${t}/envs/${e}/secrets/${s}/rotate`,{strategy:n,parsedNewValue:a})).data,promoteSecret:async(t,e,s)=>(await r().post(`/projects/${t}/envs/${e}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await r().get("/audit/verify")).data,exportAuditLogs:async(t,e,s,n)=>{let a={format:t};return e&&(a.startDate=e),s&&(a.endDate=s),n&&(a.projectId=n),(await r().post("/audit/export",a,{responseType:t==="csv"?"text":"json"})).data},requestAccess:async(t,e,s,n)=>(await r().post("/access/request",{projectId:t,secretId:n,reason:e,duration:s})).data,approveAccess:async(t,e)=>(await r().post("/access/approve",{requestId:t,decision:e})).data,listAccessRequests:async t=>{let{workspace:e}=y(),s=e?`&workspaceId=${e}`:"";return(await r().get(`/access/list?mode=${t}${s}`)).data},getAccessRequestStatus:async t=>(await r().get(`/access/request?id=${t}`)).data,getProjects:async()=>{let{workspace:t}=y(),e=t?`/project?workspaceId=${t}`:"/project";return(await r().get(e)).data},getBranches:async t=>(await r().get(`/branch?projectId=${t}`)).data,createBranch:async(t,e,s)=>(await r().post("/branch",{projectId:t,name:e,description:s})).data,deleteBranch:async t=>(await r().delete(`/branch/${t}`)).data,updateBranch:async(t,e)=>(await r().put("/branch",{id:t,...e})).data,getRoles:async()=>(await r().get("/admin/roles")).data,getUsers:async t=>{let e=t?`?teamId=${t}`:"";return(await r().get(`/admin/users${e}`)).data},setUserRole:async(t,e,s)=>(await r().put("/admin/users/role",{email:t,role:e,teamId:s})).data,getIntegrationStatus:async t=>(await r().get(`/integrations/${t}`)).data,getIntegrationRepos:async t=>(await r().get(`/integrations/${t}/sync`)).data.repos,syncSecretsToGithub:async t=>(await r().post("/integrations/github/sync",t)).data,exportKubernetesSecret:async(t,e)=>{let s=new URLSearchParams(e).toString();return(await r().get(`/projects/${t}/kubernetes?${s}`)).data},getSecretHistory:async(t,e,s)=>(await r().get(`/projects/${t}/envs/${e}/secrets/${s}/history`)).data,rollbackSecret:async(t,e,s,n)=>(await r().post(`/projects/${t}/envs/${e}/secrets/${s}/history`,{version:n})).data,cloneEnvironment:async(t,e,s,n,a)=>(await r().post(`/projects/${t}/envs/clone`,{fromEnv:e,toEnv:s,overwrite:n,branch:a})).data,generateJitLink:async t=>(await r().post("/jit/generate",t)).data,claimJitLink:async t=>(await r().post("/jit/claim",{token:t})).data,getJitInfo:async t=>(await r().get(`/jit/${t}`)).data,post:async(t,e)=>(await r().post(t,e)).data};var o=c(require("chalk")),B=c(require("ora")),F=require("table");var x=c(require("fs")),$=c(require("path")),W=$.default.join(process.cwd(),".xtra"),N=$.default.join(W,"manifest.json");function D(){if(!x.default.existsSync(N))return null;try{let t=x.default.readFileSync(N,"utf-8");return JSON.parse(t)}catch{return null}}var M=c(require("crypto")),P=c(require("conf")),Q=require("node-machine-id");var ot=new P.default({projectName:"xtra-cli-crypto"});var L=t=>M.default.createHash("sha256").update(t).digest("hex");var Y=new O.Command("status").description("Check synchronization status with XtraSync platform").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Environment (dev, stg, prod)","dev").option("-b, --branch <branchName>","Branch Name").action(async t=>{let{project:e,env:s,branch:n}=t;e||(e=j().project),n||(n=j().branch||"main"),e||(console.error(o.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1)),s={dev:"development",stg:"staging",prod:"production"}[s]||s;let i=D();if(!i){console.log(o.default.yellow("No local manifest found. Run 'xtra run' or 'xtra generate' first."));return}(i.projectId!==e||i.environment!==s)&&(console.log(o.default.yellow(`Manifest found for DIFFERENT project/env (${i.projectId}/${i.environment}).`)),console.log("Checking status against requested target anyway..."));let h=(0,B.default)(`Fetching remote state for ${s} (branch: ${n})...`).start();try{let u=await E.getSecrets(e,s,n);h.stop();let l=[[o.default.bold("Secret Key"),o.default.bold("Status"),o.default.bold("Local Last Updated")]],d=0;Object.entries(u).forEach(([p,T])=>{let _=L(T),f=i.secrets[p];f?f.hash!==_?(l.push([p,o.default.yellow("MODIFIED"),f.updatedAt]),d++):l.push([p,o.default.cyan("Synced"),f.updatedAt]):(l.push([p,o.default.green("NEW (Remote)"),"-"]),d++)}),Object.keys(i.secrets).forEach(p=>{u[p]||(l.push([p,o.default.red("DELETED (Remote)"),i.secrets[p].updatedAt]),d++)}),console.log(""),console.log((0,F.table)(l)),d===0?console.log(o.default.green("\u2714 Everything is in sync.")):(console.log(o.default.yellow(`\u26A0 Found ${d} difference(s).
+`)),console.log(o.default.bold("  Next steps:")),console.log(o.default.gray("    xtra generate              ")+o.default.white("# pull cloud secrets \xE2\u2020\u2019 .env (merge)")),console.log(o.default.gray("    xtra generate -f json      ")+o.default.white("# pull cloud secrets \xE2\u2020\u2019 secrets.json")),console.log(o.default.gray("    xtra run node app.js       ")+o.default.white("# inject secrets at runtime (no file)")),console.log(o.default.gray("    xtra local sync            ")+o.default.white("# pull cloud secrets \xE2\u2020\u2019 .env.local (offline mode)")))}catch(u){h.fail("Failed to fetch remote secrets."),console.error(o.default.red(u.message))}});0&&(module.exports={statusCommand});