xtra-cli 1.0.4 → 1.0.6

package/dist/commands/ci.js

@@ -1,341 +1,31 @@
-"use strict";
-/**
- * ci.ts - CI/CD Machine User Mode for xtra-cli
- *
- * This command is designed for headless pipeline execution:
- *  - No interactive prompts
- *  - No colors or spinners
- *  - Output is pure clean JSON (pipe-friendly with `jq`)
- *  - Auth via XTRA_MACHINE_TOKEN env var (no stored token needed)
- *  - Non-zero exit codes on any failure
- *
- * Usage:
- *   XTRA_MACHINE_TOKEN=tok_... xtra ci secrets --project <id> --env production
- *   XTRA_MACHINE_TOKEN=tok_... xtra ci secrets --project <id> --env production | jq '.DATABASE_URL'
- *   XTRA_MACHINE_TOKEN=tok_... xtra ci set --project <id> --env production KEY=VALUE
- *   XTRA_MACHINE_TOKEN=tok_... xtra ci export --project <id> --env production --format dotenv > .env
- *   XTRA_MACHINE_TOKEN=tok_... xtra ci run --project <id> --env production node app.js
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ciCommand = void 0;
-const commander_1 = require("commander");
-const child_process_1 = require("child_process");
-const axios_1 = __importDefault(require("axios"));
-const fs = __importStar(require("fs"));
-const config_1 = require("../lib/config");
-// ─── CI API Client ─────────────────────────────────────────────────────────────
-// Standalone, no Conf dependency — reads everything from environment variables
-function getCiClient() {
-    const token = process.env.XTRA_MACHINE_TOKEN;
-    const apiUrl = process.env.XTRA_API_URL || "https://www.xtrasecurity.in/api";
-    if (!token) {
-        ciError("XTRA_MACHINE_TOKEN environment variable is required for CI mode.");
-    }
-    return axios_1.default.create({
-        baseURL: apiUrl,
-        headers: {
-            "Content-Type": "application/json",
-            Authorization: `Bearer ${token}`,
-            "X-CI-Mode": "true",
-        },
-    });
-}
-// ─── Helpers ──────────────────────────────────────────────────────────────────
-/** Emit a JSON error to stderr and exit 1 */
-function ciError(message, detail) {
-    process.stderr.write(JSON.stringify({ ok: false, error: message, detail: detail || null }, null, 2) + "\n");
-    process.exit(1);
-}
-/** Emit clean JSON to stdout */
-function ciOut(data) {
-    process.stdout.write(JSON.stringify(data, null, 2) + "\n");
-}
-/** Validate required CLI env vars and options */
-function requireMachineToken() {
-    if (!process.env.XTRA_MACHINE_TOKEN) {
-        ciError("XTRA_MACHINE_TOKEN is not set. Export it before running CI commands.", {
-            hint: "export XTRA_MACHINE_TOKEN=your_service_account_token"
-        });
-    }
-}
-function requireProject(project) {
-    if (!project) {
-        ciError("--project <id> is required in CI mode. Set it explicitly (no config fallback).");
-    }
-    return project;
-}
-function requireEnv(env) {
-    if (!env) {
-        ciError("--env <environment> is required in CI mode.");
-    }
-    return env;
-}
-// ─── xtra ci ──────────────────────────────────────────────────────────────────
-exports.ciCommand = new commander_1.Command("ci")
-    .description("CI/CD headless mode — JSON output, no prompts, XTRA_MACHINE_TOKEN auth")
-    .addHelpText("after", `
-Environment Variables:
-  XTRA_MACHINE_TOKEN   Required. Service account token for authentication.
-  XTRA_API_URL         Optional. Override the API base URL.
-  XTRA_PROFILE         Optional. Use a specific named profile.
-
-Subcommands:
-  xtra ci secrets      Fetch secrets as JSON
-  xtra ci set          Set one or more secrets KEY=VALUE
-  xtra ci export       Export secrets in dotenv/json/yaml format to a file
-  xtra ci run          Run a command with secrets injected as env vars
-
-Examples:
-  # Uses project/env from .xtrarc if available
-  XTRA_MACHINE_TOKEN=tok_... xtra ci secrets 
-  
-  # Explicit flags (always prioritized)
-  XTRA_MACHINE_TOKEN=tok_... xtra ci secrets -p proj123 -e production
-  XTRA_MACHINE_TOKEN=tok_... xtra ci set -p proj123 -e staging DEPLOY_VERSION=1.2.3
-  XTRA_MACHINE_TOKEN=tok_... xtra ci run -- node app.js
-`);
-// ── ci secrets ────────────────────────────────────────────────────────────────
-exports.ciCommand
-    .command("secrets")
-    .description("Fetch secrets as JSON (pipe-friendly)")
-    .option("-p, --project <id>", "Project ID")
-    .option("-e, --env <environment>", "Environment")
-    .option("-b, --branch <branch>", "Branch name")
-    .option("--keys <keys>", "Comma-separated list of keys to include (default: all)")
-    .action(async (options) => {
-    requireMachineToken();
-    const rc = (0, config_1.getRcConfig)();
-    const project = requireProject(options.project || rc.project);
-    const env = requireEnv(options.env || rc.env);
-    const branch = options.branch || rc.branch || "main";
-    try {
-        const client = getCiClient();
-        const res = await client.get(`/projects/${project}/envs/${env}/secrets?branch=${branch}`);
-        let secrets = res.data;
-        // Filter to specific keys if requested
-        if (options.keys) {
-            const allowedKeys = options.keys.split(",").map((k) => k.trim());
-            const filtered = {};
-            for (const k of allowedKeys) {
-                if (secrets[k] !== undefined)
-                    filtered[k] = secrets[k];
-                else
-                    process.stderr.write(`Warning: key '${k}' not found\n`);
-            }
-            secrets = filtered;
-        }
-        ciOut({ ok: true, project, env, branch: options.branch, secrets });
-    }
-    catch (e) {
-        const status = e?.response?.status;
-        const message = e?.response?.data?.error || e.message;
-        if (status === 401)
-            ciError("Unauthorized. Check your XTRA_MACHINE_TOKEN.", { status });
-        if (status === 403)
-            ciError("Forbidden. This token lacks permission to read secrets.", { status });
-        if (status === 404)
-            ciError(`Project '${project}' or environment '${env}' not found.`, { status });
-        ciError(message, { status });
-    }
-});
-// ── ci set ────────────────────────────────────────────────────────────────────
-exports.ciCommand
-    .command("set")
-    .description("Set one or more secrets in CI mode (KEY=VALUE ...)")
-    .option("-p, --project <id>", "Project ID")
-    .option("-e, --env <environment>", "Environment")
-    .option("-b, --branch <branch>", "Branch name")
-    .argument("<secrets...>", "Secrets to set (format: KEY=VALUE)")
-    .action(async (args, options) => {
-    requireMachineToken();
-    const rc = (0, config_1.getRcConfig)();
-    const project = requireProject(options.project || rc.project);
-    const env = requireEnv(options.env || rc.env);
-    const branch = options.branch || rc.branch || "main";
-    const payload = {};
-    for (const arg of args) {
-        const idx = arg.indexOf("=");
-        if (idx === -1) {
-            ciError(`Invalid format: '${arg}'. Expected KEY=VALUE`);
-        }
-        payload[arg.substring(0, idx)] = arg.substring(idx + 1);
-    }
-    if (Object.keys(payload).length === 0) {
-        ciError("No valid KEY=VALUE pairs provided.");
-    }
-    try {
-        const client = getCiClient();
-        await client.post(`/projects/${project}/envs/${env}/secrets`, {
-            secrets: payload,
-            branch: branch,
-        });
-        ciOut({
-            ok: true,
-            project,
-            env,
-            branch: branch,
-            updated: Object.keys(payload),
-            count: Object.keys(payload).length,
-        });
-    }
-    catch (e) {
-        const status = e?.response?.status;
-        ciError(e?.response?.data?.error || e.message, { status });
-    }
-});
-// ── ci export ─────────────────────────────────────────────────────────────────
-exports.ciCommand
-    .command("export")
-    .description("Export secrets to a file (dotenv, json, or github-actions format)")
-    .option("-p, --project <id>", "Project ID")
-    .option("-e, --env <environment>", "Environment")
-    .option("-b, --branch <branch>", "Branch name")
-    .option("-f, --format <format>", "Output format: dotenv | json | github", "dotenv")
-    .option("-o, --output <file>", "Output file path (default: stdout)")
-    .action(async (options) => {
-    requireMachineToken();
-    const rc = (0, config_1.getRcConfig)();
-    const project = requireProject(options.project || rc.project);
-    const env = requireEnv(options.env || rc.env);
-    const branch = options.branch || rc.branch || "main";
-    const { format, output } = options;
-    const validFormats = ["dotenv", "json", "github"];
-    if (!validFormats.includes(format)) {
-        ciError(`Invalid format '${format}'. Must be one of: ${validFormats.join(", ")}`);
-    }
-    try {
-        const client = getCiClient();
-        const res = await client.get(`/projects/${project}/envs/${env}/secrets?branch=${branch}`);
-        const secrets = res.data;
-        let content;
-        switch (format) {
-            case "dotenv":
-                content = Object.entries(secrets)
-                    .map(([k, v]) => `${k}=${v}`)
-                    .join("\n") + "\n";
-                break;
-            case "json":
-                content = JSON.stringify(secrets, null, 2) + "\n";
-                break;
-            case "github":
-                // Format for GitHub Actions $GITHUB_ENV / $GITHUB_OUTPUT
-                content = Object.entries(secrets)
-                    .map(([k, v]) => `${k}=${v}`)
-                    .join("\n") + "\n";
-                break;
-            default:
-                ciError("Unreachable format error.");
-        }
-        if (output) {
-            fs.writeFileSync(output, content, "utf8");
-            // Write metadata to stderr so it doesn't pollute file output
-            process.stderr.write(JSON.stringify({ ok: true, file: output, keys: Object.keys(secrets).length }) + "\n");
-        }
-        else {
-            // Write raw content to stdout (pipe-ready)
-            process.stdout.write(content);
-        }
-    }
-    catch (e) {
-        const status = e?.response?.status;
-        ciError(e?.response?.data?.error || e.message, { status });
-    }
-});
-// ── ci run ────────────────────────────────────────────────────────────────────
-exports.ciCommand
-    .command("run")
-    .description("Run a command with secrets injected as environment variables")
-    .option("-p, --project <id>", "Project ID")
-    .option("-e, --env <environment>", "Environment")
-    .option("-b, --branch <branch>", "Branch name")
-    .argument("<command>", "Command to execute")
-    .argument("[args...]", "Command arguments")
-    .action(async (command, args, options) => {
-    requireMachineToken();
-    const rc = (0, config_1.getRcConfig)();
-    const project = requireProject(options.project || rc.project);
-    const env = requireEnv(options.env || rc.env);
-    const branch = options.branch || rc.branch || "main";
-    // Security: prevent command injection
-    const SHELL_UNSAFE = /[;&|`$<>\\\n]/g;
-    if (SHELL_UNSAFE.test(command)) {
-        ciError("Command contains unsafe characters. Aborting for security.");
-    }
-    try {
-        const client = getCiClient();
-        const res = await client.get(`/projects/${project}/envs/${env}/secrets?branch=${branch}`);
-        const secrets = res.data;
-        process.stderr.write(`[xtra ci] Injecting ${Object.keys(secrets).length} secrets into process env\n`);
-        const envVars = { ...process.env, ...secrets };
-        const child = (0, child_process_1.spawn)(command, args, {
-            env: envVars,
-            stdio: "inherit",
-            shell: false, // NO shell:true — prevents injection
-        });
-        child.on("exit", (code) => process.exit(code ?? 0));
-        child.on("error", (err) => ciError(`Failed to start process: ${err.message}`));
-    }
-    catch (e) {
-        const status = e?.response?.status;
-        ciError(e?.response?.data?.error || e.message, { status });
-    }
-});
-// ── ci validate ───────────────────────────────────────────────────────────────
-exports.ciCommand
-    .command("validate")
-    .description("Validate that XTRA_MACHINE_TOKEN is set and working")
-    .action(async () => {
-    requireMachineToken();
-    try {
-        const client = getCiClient();
-        const res = await client.get("/project");
-        ciOut({
-            ok: true,
-            authenticated: true,
-            projects: res.data.length,
-            message: "XTRA_MACHINE_TOKEN is valid and working.",
-        });
-    }
-    catch (e) {
-        const status = e?.response?.status;
-        if (status === 401)
-            ciError("XTRA_MACHINE_TOKEN is invalid or expired.", { status });
-        ciError(e?.response?.data?.error || e.message, { status });
-    }
-});
+var S=Object.create;var y=Object.defineProperty;var U=Object.getOwnPropertyDescriptor;var $=Object.getOwnPropertyNames;var K=Object.getPrototypeOf,X=Object.prototype.hasOwnProperty;var P=(e,t)=>{for(var n in t)y(e,n,{get:t[n],enumerable:!0})},k=(e,t,n,a)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of $(t))!X.call(e,o)&&o!==n&&y(e,o,{get:()=>t[o],enumerable:!(a=U(t,o))||a.enumerable});return e};var v=(e,t,n)=>(n=e!=null?S(K(e)):{},k(t||!e||!e.__esModule?y(n,"default",{value:e,enumerable:!0}):n,e)),M=e=>k(y({},"__esModule",{value:!0}),e);var L={};P(L,{ciCommand:()=>h});module.exports=M(L);var T=require("commander"),I=require("child_process"),R=v(require("axios")),w=v(require("fs"));var C=v(require("conf")),x=v(require("fs")),O=v(require("path")),N="https://www.xtrasecurity.in/api",b=new C.default({projectName:"xtra-cli",defaults:{apiUrl:N}}),A=b.get("apiUrl");A&&!process.env.XTRA_API_URL&&(A.includes("localhost")||A.includes("xtra-security.vercel.app"))&&b.set("apiUrl",N);var d=()=>{let e={};try{let t=O.default.join(process.cwd(),".xtrarc");x.default.existsSync(t)&&(e=JSON.parse(x.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||b.get("project")||"",env:e.env||b.get("env")||"development",branch:e.branch||b.get("branch")||"main"}};function g(){let e=process.env.XTRA_MACHINE_TOKEN,t=process.env.XTRA_API_URL||"https://www.xtrasecurity.in/api";return e||c("XTRA_MACHINE_TOKEN environment variable is required for CI mode."),R.default.create({baseURL:t,headers:{"Content-Type":"application/json",Authorization:`Bearer ${e}`,"X-CI-Mode":"true"}})}function c(e,t){process.stderr.write(JSON.stringify({ok:!1,error:e,detail:t||null},null,2)+`
+`),process.exit(1)}function _(e){process.stdout.write(JSON.stringify(e,null,2)+`
+`)}function H(){process.env.XTRA_MACHINE_TOKEN||c("XTRA_MACHINE_TOKEN is not set. Export it before running CI commands.",{hint:"export XTRA_MACHINE_TOKEN=your_service_account_token"})}async function j(e){if(e)return e;try{let a=await g().get("/service-account/resolve");if(a.data&&a.data.project)return a.data.project.id}catch{}let t=d();if(t.project)return t.project;c("--project <id> is required. Set it explicitly or ensure your token is linked to a project.")}function E(e){return e||c("--env <environment> is required in CI mode."),e}var h=new T.Command("ci").description("CI/CD headless mode \u2014 JSON output, no prompts, XTRA_MACHINE_TOKEN auth").addHelpText("after",`
+Environment Variables:
+  XTRA_MACHINE_TOKEN   Required. Service account token for authentication.
+  XTRA_API_URL         Optional. Override the API base URL.
+  XTRA_PROFILE         Optional. Use a specific named profile.
+
+Subcommands:
+  xtra ci secrets      Fetch secrets as JSON
+  xtra ci set          Set one or more secrets KEY=VALUE
+  xtra ci export       Export secrets in dotenv/json/yaml format to a file
+  xtra ci run          Run a command with secrets injected as env vars
+
+Examples:
+  # Uses project/env from .xtrarc if available
+  XTRA_MACHINE_TOKEN=tok_... xtra ci secrets 
+  
+  # Explicit flags (always prioritized)
+  XTRA_MACHINE_TOKEN=tok_... xtra ci secrets -p proj123 -e production
+  XTRA_MACHINE_TOKEN=tok_... xtra ci set -p proj123 -e staging DEPLOY_VERSION=1.2.3
+  XTRA_MACHINE_TOKEN=tok_... xtra ci run -- node app.js
+`);h.command("secrets").description("Fetch secrets as JSON (pipe-friendly)").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment").option("-b, --branch <branch>","Branch name").option("--keys <keys>","Comma-separated list of keys to include (default: all)").action(async e=>{let t=await j(e.project),n=E(e.env||d().env),a=e.branch||d().branch||"main";try{let r=(await g().get(`/projects/${t}/envs/${n}/secrets?branch=${a}`)).data;if(e.keys){let i=e.keys.split(",").map(p=>p.trim()),l={};for(let p of i)r[p]!==void 0?l[p]=r[p]:process.stderr.write(`Warning: key '${p}' not found
+`);r=l}_({ok:!0,project:t,env:n,branch:e.branch,secrets:r})}catch(o){let s=o?.response?.status,r=o?.response?.data?.error||o?.response?.data?.error||"An unexpected error occurred";s===401&&c("Unauthorized. Check your XTRA_MACHINE_TOKEN.",{status:s}),s===403&&c("Forbidden. This token lacks permission to read secrets.",{status:s}),s===404&&c(`Project '${t}' or environment '${n}' not found.`,{status:s}),c(r,{status:s})}});h.command("set").description("Set one or more secrets in CI mode (KEY=VALUE ...)").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment").option("-b, --branch <branch>","Branch name").argument("<secrets...>","Secrets to set (format: KEY=VALUE)").action(async(e,t)=>{let n=await j(t.project),a=E(t.env||d().env),o=t.branch||d().branch||"main",s={};for(let r of e){let i=r.indexOf("=");i===-1&&c(`Invalid format: '${r}'. Expected KEY=VALUE`),s[r.substring(0,i)]=r.substring(i+1)}Object.keys(s).length===0&&c("No valid KEY=VALUE pairs provided.");try{await g().post(`/projects/${n}/envs/${a}/secrets`,{secrets:s,branch:o}),_({ok:!0,project:n,env:a,branch:o,updated:Object.keys(s),count:Object.keys(s).length})}catch(r){let i=r?.response?.status;c(r?.response?.data?.error||r?.response?.data?.error||"An unexpected error occurred",{status:i})}});h.command("export").description("Export secrets to a file (dotenv, json, or github-actions format)").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment").option("-b, --branch <branch>","Branch name").option("-f, --format <format>","Output format: dotenv | json | github","dotenv").option("-o, --output <file>","Output file path (default: stdout)").action(async e=>{let t=await j(e.project),n=E(e.env||d().env),a=e.branch||d().branch||"main",{format:o,output:s}=e,r=["dotenv","json","github"];r.includes(o)||c(`Invalid format '${o}'. Must be one of: ${r.join(", ")}`);try{let p=(await g().get(`/projects/${t}/envs/${n}/secrets?branch=${a}`)).data,u;switch(o){case"dotenv":u=Object.entries(p).map(([m,f])=>`${m}=${f}`).join(`
+`)+`
+`;break;case"json":u=JSON.stringify(p,null,2)+`
+`;break;case"github":u=Object.entries(p).map(([m,f])=>`${m}=${f}`).join(`
+`)+`
+`;break;default:c("Unreachable format error.")}s?(w.writeFileSync(s,u,"utf8"),process.stderr.write(JSON.stringify({ok:!0,file:s,keys:Object.keys(p).length})+`
+`)):process.stdout.write(u)}catch(i){let l=i?.response?.status;c(i?.response?.data?.error||i?.response?.data?.error||"An unexpected error occurred",{status:l})}});h.command("run").description("Run a command with secrets injected as environment variables").option("-p, --project <id>","Project ID").option("--env <environment>","Environment").option("-b, --branch <branch>","Branch name").option("--shell","Run command inside a shell (required for npm on Windows)").argument("<command>","Command to execute").argument("[args...]","Command arguments").action(async(e,t,n)=>{let a=await j(n.project),o=E(n.env||d().env),s=n.branch||d().branch||"main",r=/[;&|`$<>\\\n]/g;!n.shell&&r.test(e)&&c("Command contains unsafe characters. Aborting for security. Use --shell if intended.");try{let p=(await g().get(`/projects/${a}/envs/${o}/secrets?branch=${s}`)).data;process.stderr.write(`[xtra ci] Injecting ${Object.keys(p).length} secrets into process env
+`);let u={...process.env,...p},m=(0,I.spawn)(e,t,{env:u,stdio:"inherit",shell:n.shell||!1});m.on("exit",f=>process.exit(f??0)),m.on("error",f=>c(`Failed to start process: ${f.message}`))}catch(i){let l=i?.response?.status;c(i?.response?.data?.error||i?.response?.data?.error||"An unexpected error occurred",{status:l})}});h.command("validate").description("Validate that XTRA_MACHINE_TOKEN is set and working").action(async()=>{H();try{let t=await g().get("/project");_({ok:!0,authenticated:!0,projects:t.data.length,message:"XTRA_MACHINE_TOKEN is valid and working."})}catch(e){let t=e?.response?.status;t===401&&c("XTRA_MACHINE_TOKEN is invalid or expired.",{status:t}),c(e?.response?.data?.error||e?.response?.data?.error||"An unexpected error occurred",{status:t})}});0&&(module.exports={ciCommand});