xtra-cli 1.0.7 → 1.0.9

package/dist/commands/ci.js

@@ -1,6 +1,6 @@
-var S=Object.create;var y=Object.defineProperty;var U=Object.getOwnPropertyDescriptor;var $=Object.getOwnPropertyNames;var K=Object.getPrototypeOf,X=Object.prototype.hasOwnProperty;var P=(e,t)=>{for(var r in t)y(e,r,{get:t[r],enumerable:!0})},_=(e,t,r,a)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of $(t))!X.call(e,o)&&o!==r&&y(e,o,{get:()=>t[o],enumerable:!(a=U(t,o))||a.enumerable});return e};var v=(e,t,r)=>(r=e!=null?S(K(e)):{},_(t||!e||!e.__esModule?y(r,"default",{value:e,enumerable:!0}):r,e)),M=e=>_(y({},"__esModule",{value:!0}),e);var L={};P(L,{ciCommand:()=>h});module.exports=M(L);var T=require("commander"),I=require("child_process"),R=v(require("axios")),w=v(require("fs"));var C=v(require("conf")),A=v(require("fs")),O=v(require("path")),N="https://www.xtrasecurity.in/api",b=new C.default({projectName:"xtra-cli",defaults:{apiUrl:N}}),k=b.get("apiUrl");k&&!process.env.XTRA_API_URL&&k.includes("xtra-security.vercel.app")&&b.set("apiUrl",N);var d=()=>{let e={};try{let t=O.default.join(process.cwd(),".xtrarc");A.default.existsSync(t)&&(e=JSON.parse(A.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||b.get("project")||"",env:e.env||b.get("env")||"development",branch:e.branch||b.get("branch")||"main"}};function g(){let e=process.env.XTRA_MACHINE_TOKEN,t=process.env.XTRA_API_URL||"https://www.xtrasecurity.in/api";return e||c("XTRA_MACHINE_TOKEN environment variable is required for CI mode."),R.default.create({baseURL:t,headers:{"Content-Type":"application/json",Authorization:`Bearer ${e}`,"X-CI-Mode":"true"}})}function c(e,t){process.stderr.write(JSON.stringify({ok:!1,error:e,detail:t||null},null,2)+`
-`),process.exit(1)}function x(e){process.stdout.write(JSON.stringify(e,null,2)+`
-`)}function H(){process.env.XTRA_MACHINE_TOKEN||c("XTRA_MACHINE_TOKEN is not set. Export it before running CI commands.",{hint:"export XTRA_MACHINE_TOKEN=your_service_account_token"})}async function j(e){if(e)return e;try{let a=await g().get("/service-account/resolve");if(a.data&&a.data.project)return a.data.project.id}catch{}let t=d();if(t.project)return t.project;c("--project <id> is required. Set it explicitly or ensure your token is linked to a project.")}function E(e){return e||c("--env <environment> is required in CI mode."),e}var h=new T.Command("ci").description("CI/CD headless mode \u2014 JSON output, no prompts, XTRA_MACHINE_TOKEN auth").addHelpText("after",`
+var B=Object.create;var x=Object.defineProperty;var U=Object.getOwnPropertyDescriptor;var X=Object.getOwnPropertyNames;var H=Object.getPrototypeOf,M=Object.prototype.hasOwnProperty;var S=(e,t)=>()=>(e&&(t=e(e=0)),t);var L=(e,t)=>{for(var r in t)x(e,r,{get:t[r],enumerable:!0})},T=(e,t,r,a)=>{if(t&&typeof t=="object"||typeof t=="function")for(let s of X(t))!M.call(e,s)&&s!==r&&x(e,s,{get:()=>t[s],enumerable:!(a=U(t,s))||a.enumerable});return e};var h=(e,t,r)=>(r=e!=null?B(H(e)):{},T(t||!e||!e.__esModule?x(r,"default",{value:e,enumerable:!0}):r,e)),V=e=>T(x({},"__esModule",{value:!0}),e);var k,F,G,j=S(()=>{k=h(require("conf")),F=require("node-machine-id"),G=new k.default({projectName:"xtra-cli-crypto"})});var w,A,C,K,v,R,u,P=S(()=>{w=h(require("conf")),A=h(require("fs")),C=h(require("path"));j();K="https://www.xtrasecurity.in/api",v=new w.default({projectName:"xtra-cli",defaults:{apiUrl:K}}),R=v.get("apiUrl");R&&!process.env.XTRA_API_URL&&R.includes("xtra-security.vercel.app")&&v.set("apiUrl",K);u=()=>{let e={};try{let t=C.default.join(process.cwd(),".xtrarc");A.default.existsSync(t)&&(e=JSON.parse(A.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||v.get("project")||"",env:e.env||v.get("env")||"development",branch:e.branch||v.get("branch")||"main"}}});var D={};L(D,{ciCommand:()=>y});module.exports=V(D);var N=require("commander"),O=require("child_process"),I=h(require("axios")),$=h(require("fs"));P();function m(){let e=process.env.XTRA_MACHINE_TOKEN,t=process.env.XTRA_API_URL||"https://www.xtrasecurity.in/api";return e||i("XTRA_MACHINE_TOKEN environment variable is required for CI mode."),I.default.create({baseURL:t,headers:{"Content-Type":"application/json",Authorization:`Bearer ${e}`,"X-CI-Mode":"true"}})}function i(e,t){process.stderr.write(JSON.stringify({ok:!1,error:e,detail:t||null},null,2)+`
+`),process.exit(1)}function _(e){process.stdout.write(JSON.stringify(e,null,2)+`
+`)}function J(){process.env.XTRA_MACHINE_TOKEN||i("XTRA_MACHINE_TOKEN is not set. Export it before running CI commands.",{hint:"export XTRA_MACHINE_TOKEN=your_service_account_token"})}async function b(e){if(e)return e;try{let a=await m().get("/service-account/resolve");if(a.data&&a.data.project)return a.data.project.id}catch{}let t=u();if(t.project)return t.project;i("--project <id> is required. Set it explicitly or ensure your token is linked to a project.")}function E(e){return e||i("--env <environment> is required in CI mode."),e}var y=new N.Command("ci").description("CI/CD headless mode \u2014 JSON output, no prompts, XTRA_MACHINE_TOKEN auth").addHelpText("after",`
 Environment Variables:
   XTRA_MACHINE_TOKEN   Required. Service account token for authentication.
   XTRA_API_URL         Optional. Override the API base URL.
@@ -20,12 +20,12 @@ Examples:
   XTRA_MACHINE_TOKEN=tok_... xtra ci secrets -p proj123 -e production
   XTRA_MACHINE_TOKEN=tok_... xtra ci set -p proj123 -e staging DEPLOY_VERSION=1.2.3
   XTRA_MACHINE_TOKEN=tok_... xtra ci run -- node app.js
-`);h.command("secrets").description("Fetch secrets as JSON (pipe-friendly)").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment").option("-b, --branch <branch>","Branch name").option("--keys <keys>","Comma-separated list of keys to include (default: all)").action(async e=>{let t=await j(e.project),r=E(e.env||d().env),a=e.branch||d().branch||"main";try{let n=(await g().get(`/projects/${t}/envs/${r}/secrets?branch=${a}`)).data;if(e.keys){let i=e.keys.split(",").map(p=>p.trim()),l={};for(let p of i)n[p]!==void 0?l[p]=n[p]:process.stderr.write(`Warning: key '${p}' not found
-`);n=l}x({ok:!0,project:t,env:r,branch:e.branch,secrets:n})}catch(o){let s=o?.response?.status,n=o?.response?.data?.error||o?.response?.data?.error||"An unexpected error occurred";s===401&&c("Unauthorized. Check your XTRA_MACHINE_TOKEN.",{status:s}),s===403&&c("Forbidden. This token lacks permission to read secrets.",{status:s}),s===404&&c(`Project '${t}' or environment '${r}' not found.`,{status:s}),c(n,{status:s})}});h.command("set").description("Set one or more secrets in CI mode (KEY=VALUE ...)").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment").option("-b, --branch <branch>","Branch name").argument("<secrets...>","Secrets to set (format: KEY=VALUE)").action(async(e,t)=>{let r=await j(t.project),a=E(t.env||d().env),o=t.branch||d().branch||"main",s={};for(let n of e){let i=n.indexOf("=");i===-1&&c(`Invalid format: '${n}'. Expected KEY=VALUE`),s[n.substring(0,i)]=n.substring(i+1)}Object.keys(s).length===0&&c("No valid KEY=VALUE pairs provided.");try{await g().post(`/projects/${r}/envs/${a}/secrets`,{secrets:s,branch:o}),x({ok:!0,project:r,env:a,branch:o,updated:Object.keys(s),count:Object.keys(s).length})}catch(n){let i=n?.response?.status;c(n?.response?.data?.error||n?.response?.data?.error||"An unexpected error occurred",{status:i})}});h.command("export").description("Export secrets to a file (dotenv, json, or github-actions format)").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment").option("-b, --branch <branch>","Branch name").option("-f, --format <format>","Output format: dotenv | json | github","dotenv").option("-o, --output <file>","Output file path (default: stdout)").action(async e=>{let t=await j(e.project),r=E(e.env||d().env),a=e.branch||d().branch||"main",{format:o,output:s}=e,n=["dotenv","json","github"];n.includes(o)||c(`Invalid format '${o}'. Must be one of: ${n.join(", ")}`);try{let p=(await g().get(`/projects/${t}/envs/${r}/secrets?branch=${a}`)).data,u;switch(o){case"dotenv":u=Object.entries(p).map(([m,f])=>`${m}=${f}`).join(`
+`);y.command("secrets").description("Fetch secrets as JSON (pipe-friendly)").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment").option("-b, --branch <branch>","Branch name").option("--keys <keys>","Comma-separated list of keys to include (default: all)").action(async e=>{let t=await b(e.project),r=E(e.env||u().env),a=e.branch||u().branch||"main";try{let n=(await m().get(`/projects/${t}/envs/${r}/secrets?branch=${a}`)).data;if(e.keys){let c=e.keys.split(",").map(p=>p.trim()),f={};for(let p of c)n[p]!==void 0?f[p]=n[p]:process.stderr.write(`Warning: key '${p}' not found
+`);n=f}_({ok:!0,project:t,env:r,branch:e.branch,secrets:n})}catch(s){let o=s?.response?.status,n=s?.response?.data?.error||s?.response?.data?.error||"An unexpected error occurred";o===401&&i("Unauthorized. Check your XTRA_MACHINE_TOKEN.",{status:o}),o===403&&i("Forbidden. This token lacks permission to read secrets.",{status:o}),o===404&&i(`Project '${t}' or environment '${r}' not found.`,{status:o}),i(n,{status:o})}});y.command("set").description("Set one or more secrets in CI mode (KEY=VALUE ...)").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment").option("-b, --branch <branch>","Branch name").argument("<secrets...>","Secrets to set (format: KEY=VALUE)").action(async(e,t)=>{let r=await b(t.project),a=E(t.env||u().env),s=t.branch||u().branch||"main",o={};for(let n of e){let c=n.indexOf("=");c===-1&&i(`Invalid format: '${n}'. Expected KEY=VALUE`),o[n.substring(0,c)]=n.substring(c+1)}Object.keys(o).length===0&&i("No valid KEY=VALUE pairs provided.");try{await m().post(`/projects/${r}/envs/${a}/secrets`,{secrets:o,branch:s}),_({ok:!0,project:r,env:a,branch:s,updated:Object.keys(o),count:Object.keys(o).length})}catch(n){let c=n?.response?.status;i(n?.response?.data?.error||n?.response?.data?.error||"An unexpected error occurred",{status:c})}});y.command("export").description("Export secrets to a file (dotenv, json, or github-actions format)").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment").option("-b, --branch <branch>","Branch name").option("-f, --format <format>","Output format: dotenv | json | github","dotenv").option("-o, --output <file>","Output file path (default: stdout)").action(async e=>{let t=await b(e.project),r=E(e.env||u().env),a=e.branch||u().branch||"main",{format:s,output:o}=e,n=["dotenv","json","github"];n.includes(s)||i(`Invalid format '${s}'. Must be one of: ${n.join(", ")}`);try{let p=(await m().get(`/projects/${t}/envs/${r}/secrets?branch=${a}`)).data,d;switch(s){case"dotenv":d=Object.entries(p).map(([g,l])=>`${g}=${l}`).join(`
 `)+`
-`;break;case"json":u=JSON.stringify(p,null,2)+`
-`;break;case"github":u=Object.entries(p).map(([m,f])=>`${m}=${f}`).join(`
+`;break;case"json":d=JSON.stringify(p,null,2)+`
+`;break;case"github":d=Object.entries(p).map(([g,l])=>`${g}=${l}`).join(`
 `)+`
-`;break;default:c("Unreachable format error.")}s?(w.writeFileSync(s,u,"utf8"),process.stderr.write(JSON.stringify({ok:!0,file:s,keys:Object.keys(p).length})+`
-`)):process.stdout.write(u)}catch(i){let l=i?.response?.status;c(i?.response?.data?.error||i?.response?.data?.error||"An unexpected error occurred",{status:l})}});h.command("run").description("Run a command with secrets injected as environment variables").option("-p, --project <id>","Project ID").option("--env <environment>","Environment").option("-b, --branch <branch>","Branch name").option("--shell","Run command inside a shell (required for npm on Windows)").argument("<command>","Command to execute").argument("[args...]","Command arguments").action(async(e,t,r)=>{let a=await j(r.project),o=E(r.env||d().env),s=r.branch||d().branch||"main",n=/[;&|`$<>\\\n]/g;!r.shell&&n.test(e)&&c("Command contains unsafe characters. Aborting for security. Use --shell if intended.");try{let p=(await g().get(`/projects/${a}/envs/${o}/secrets?branch=${s}`)).data;process.stderr.write(`[xtra ci] Injecting ${Object.keys(p).length} secrets into process env
-`);let u={...process.env,...p},m=(0,I.spawn)(e,t,{env:u,stdio:"inherit",shell:r.shell||!1});m.on("exit",f=>process.exit(f??0)),m.on("error",f=>c(`Failed to start process: ${f.message}`))}catch(i){let l=i?.response?.status;c(i?.response?.data?.error||i?.response?.data?.error||"An unexpected error occurred",{status:l})}});h.command("validate").description("Validate that XTRA_MACHINE_TOKEN is set and working").action(async()=>{H();try{let t=await g().get("/project");x({ok:!0,authenticated:!0,projects:t.data.length,message:"XTRA_MACHINE_TOKEN is valid and working."})}catch(e){let t=e?.response?.status;t===401&&c("XTRA_MACHINE_TOKEN is invalid or expired.",{status:t}),c(e?.response?.data?.error||e?.response?.data?.error||"An unexpected error occurred",{status:t})}});0&&(module.exports={ciCommand});
+`;break;default:i("Unreachable format error.")}o?($.writeFileSync(o,d,"utf8"),process.stderr.write(JSON.stringify({ok:!0,file:o,keys:Object.keys(p).length})+`
+`)):process.stdout.write(d)}catch(c){let f=c?.response?.status;i(c?.response?.data?.error||c?.response?.data?.error||"An unexpected error occurred",{status:f})}});y.command("run").description("Run a command with secrets injected as environment variables").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment").option("-b, --branch <branch>","Branch name").option("--shell","Run command inside a shell (required for npm on Windows)").argument("<command>","Command to execute").argument("[args...]","Command arguments").action(async(e,t,r)=>{let a=await b(r.project),s=E(r.env||u().env),o=r.branch||u().branch||"main",n=/[;&|`$<>\\\n]/g;!r.shell&&n.test(e)&&i("Command contains unsafe characters. Aborting for security. Use --shell if intended.");try{let p=(await m().get(`/projects/${a}/envs/${s}/secrets?branch=${o}`)).data;process.stderr.write(`[xtra ci] Injecting ${Object.keys(p).length} secrets into process env
+`);let d={...process.env,...p},g=(0,O.spawn)(e,t,{env:d,stdio:"inherit",shell:r.shell||!1});g.on("exit",l=>process.exit(l??0)),g.on("error",l=>i(`Failed to start process: ${l.message}`))}catch(c){let f=c?.response?.status;i(c?.response?.data?.error||c?.response?.data?.error||"An unexpected error occurred",{status:f})}});y.command("validate").description("Validate that XTRA_MACHINE_TOKEN is set and working").action(async()=>{J();try{let t=await m().get("/project");_({ok:!0,authenticated:!0,projects:t.data.length,message:"XTRA_MACHINE_TOKEN is valid and working."})}catch(e){let t=e?.response?.status;t===401&&i("XTRA_MACHINE_TOKEN is invalid or expired.",{status:t}),i(e?.response?.data?.error||e?.response?.data?.error||"An unexpected error occurred",{status:t})}});0&&(module.exports={ciCommand});

package/dist/commands/diff.js

@@ -1,6 +1,6 @@
-var G=Object.create;var h=Object.defineProperty;var J=Object.getOwnPropertyDescriptor;var V=Object.getOwnPropertyNames;var H=Object.getPrototypeOf,M=Object.prototype.hasOwnProperty;var X=(e,t)=>{for(var s in t)h(e,s,{get:t[s],enumerable:!0})},A=(e,t,s,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of V(t))!M.call(e,o)&&o!==s&&h(e,o,{get:()=>t[o],enumerable:!(r=J(t,o))||r.enumerable});return e};var i=(e,t,s)=>(s=e!=null?G(H(e)):{},A(t||!e||!e.__esModule?h(s,"default",{value:e,enumerable:!0}):s,e)),z=e=>A(h({},"__esModule",{value:!0}),e);var ee={};X(ee,{diffCommand:()=>Z});module.exports=z(ee);var K=require("commander");var P=i(require("axios"));var C=i(require("conf")),S=i(require("fs")),B=i(require("path")),j="https://www.xtrasecurity.in/api",u=new C.default({projectName:"xtra-cli",defaults:{apiUrl:j}}),I=u.get("apiUrl");I&&!process.env.XTRA_API_URL&&I.includes("xtra-security.vercel.app")&&u.set("apiUrl",j);var v=()=>({...u.store,apiUrl:process.env.XTRA_API_URL||u.get("apiUrl")||j}),R=e=>u.get(e);var U=()=>u.get("token");var x=()=>{let e={};try{let t=B.default.join(process.cwd(),".xtrarc");S.default.existsSync(t)&&(e=JSON.parse(S.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||u.get("project")||"",env:e.env||u.get("env")||"development",branch:e.branch||u.get("branch")||"main"}};var L=i(require("fs")),T=i(require("path")),Q=JSON.parse(L.readFileSync(T.join(__dirname,"../../package.json"),"utf-8")),n=()=>{let{apiUrl:e}=v(),t=U();return P.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":Q.version,...t?{Authorization:`Bearer ${t}`}:{}}})},$={login:async(e,t,s)=>(await n().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await n().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await n().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,r,o="main")=>(await n().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:r,branch:o})).data,getSecretDetails:async(e,t,s,r="main")=>(await n().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${r}`)).data,syncLogs:async e=>(await n().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,r,o,a)=>(await n().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:r,sourceEnv:o,sourceKey:a})).data,rotateSecret:async(e,t,s,r,o)=>(await n().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:r,parsedNewValue:o})).data,promoteSecret:async(e,t,s)=>(await n().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await n().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,r)=>{let o={format:e};return t&&(o.startDate=t),s&&(o.endDate=s),r&&(o.projectId=r),(await n().post("/audit/export",o,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,r)=>(await n().post("/access/request",{projectId:e,secretId:r,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await n().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=v(),s=t?`&workspaceId=${t}`:"";return(await n().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await n().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=v(),t=e?`/project?workspaceId=${e}`:"/project";return(await n().get(t)).data},getBranches:async e=>(await n().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await n().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await n().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await n().put("/branch",{id:e,...t})).data,getRoles:async()=>(await n().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await n().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await n().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await n().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await n().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await n().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await n().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await n().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,r)=>(await n().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:r})).data,cloneEnvironment:async(e,t,s,r,o)=>(await n().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:r,branch:o})).data,generateJitLink:async e=>(await n().post("/jit/generate",e)).data,claimJitLink:async e=>(await n().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await n().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await n().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await n().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await n().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await n().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,s,r)=>(await n().post(`/projects/${e}/service-accounts/${t}/keys`,{label:s,expiresAt:r})).data,deleteServiceAccountKey:async(e,t,s)=>(await n().delete(`/projects/${e}/service-accounts/${t}/keys/${s}`)).data,post:async(e,t)=>(await n().post(e,t)).data};var c=i(require("chalk")),b=i(require("ora"));var w=i(require("crypto")),O=i(require("conf")),_=require("node-machine-id"),W="aes-256-gcm",N=new O.default({projectName:"xtra-cli-crypto"});function Y(){let e=N.get("masterKey");e||(e=w.default.randomBytes(32).toString("hex"),N.set("masterKey",e));let t=(0,_.machineIdSync)();return w.default.createHash("sha256").update(e+t).digest()}var D=e=>{let t=Y(),s=Buffer.from(e.iv,"hex"),r=Buffer.from(e.tag,"hex"),o=w.default.createDecipheriv(W,t,s);o.setAuthTag(r);let a=o.update(e.content,"hex","utf8");return a+=o.final("utf8"),a};var q=i(require("diff")),Z=new K.Command("diff").description("Show differences between local cache and remote secrets").argument("[env1]","Source Environment").argument("[env2]","Target Environment").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Environment (dev, stg, prod)","dev").option("-b, --branch <branchName>","Branch Name").option("--show","Show actual value differences (sensitive)",!1).action(async(e,t,s)=>{let{project:r,env:o,branch:a,show:l}=s;r||(r=x().project),a||(a=x().branch||"main"),r||(console.error(c.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let f={dev:"development",stg:"staging",prod:"production"};if(e&&t){let p=f[e]||e,d=f[t]||t,g=(0,b.default)(`Fetching secrets for ${p} and ${d} (branch: ${a})...`).start();try{let[m,y]=await Promise.all([$.getSecrets(r,p,a),$.getSecrets(r,d,a)]);g.stop(),console.log(c.default.bold(`
-Diff Report (${p} <-> ${d} @ ${a}):
-`)),E(m,y,l)}catch(m){g.fail("Failed to fetch secrets"),console.error(c.default.red(m?.response?.data?.error||"An unexpected error occurred"))}}else{let p=f[o]||o,d=(0,b.default)(`Fetching remote state for ${p} (branch: ${a})...`).start();try{let g=await $.getSecrets(r,p,a),m={};try{let y=`cache.${r}.${p}.${a}`,k=R(y);if(k){let F=D(k);m=JSON.parse(F)}}catch{}d.stop(),console.log(c.default.bold(`
-Diff Report (Remote ${p} vs Local Cache):
-`)),E(g,m,l)}catch(g){d.fail("Failed to run diff."),console.error(c.default.red(g?.response?.data?.error||"An unexpected error occurred"))}}});function E(e,t,s){let r=new Set([...Object.keys(e),...Object.keys(t)]),o=!1;r.forEach(a=>{let l=e[a],f=t[a];if(l!==f){if(o=!0,l===void 0)console.log(c.default.green(`+ ${a} (Only in Target)`)),s&&console.log(c.default.green(`  + "${f}"`));else if(f===void 0)console.log(c.default.red(`- ${a} (Only in Source)`)),s&&console.log(c.default.red(`  - "${l}"`));else if(console.log(c.default.yellow(`~ ${a} (Modified)`)),s){let p=q.diffChars(l,f),d="  ";p.forEach(g=>{let m=g.added?c.default.green:g.removed?c.default.red:c.default.gray;d+=m(g.value)}),console.log(d)}}}),o?s||console.log(c.default.gray(`
-(Use --show to reveal secret values)`)):console.log(c.default.green("\u2714 No differences found."))}0&&(module.exports={diffCommand});
+var ie=Object.create;var R=Object.defineProperty;var ce=Object.getOwnPropertyDescriptor;var pe=Object.getOwnPropertyNames;var ge=Object.getPrototypeOf,ue=Object.prototype.hasOwnProperty;var H=(e,t)=>()=>(e&&(t=e(e=0)),t);var U=(e,t)=>{for(var r in t)R(e,r,{get:t[r],enumerable:!0})},q=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of pe(t))!ue.call(e,n)&&n!==r&&R(e,n,{get:()=>t[n],enumerable:!(s=ce(t,n))||s.enumerable});return e};var h=(e,t,r)=>(r=e!=null?ie(ge(e)):{},q(t||!e||!e.__esModule?R(r,"default",{value:e,enumerable:!0}):r,e)),K=e=>q(R({},"__esModule",{value:!0}),e);var O={};U(O,{createWorkloadKeyEnvelope:()=>me,decrypt:()=>B,decryptSecretValue:()=>ye,decryptWorkloadKeyEnvelope:()=>ve,deriveProjectKey:()=>le,encrypt:()=>M,encryptSecretValue:()=>fe,hash:()=>de,resolveVaultPassphrase:()=>Y,saveVaultPassphrase:()=>he,secureRead:()=>k,secureSave:()=>j});function G(){if(_)return _;let e=E.get("masterKey");e||(e=c.default.randomBytes(32).toString("hex"),E.set("masterKey",e));let t="";try{t=(0,W.machineIdSync)()||""}catch{t=c.default.createHash("sha256").update(m.default.hostname()+(m.default.userInfo?.()?.username||"root")).digest("hex")}let r=m.default.platform(),s=m.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return _=c.default.createHash("sha256").update(n).digest(),_}function le(e,t){t||(t=Y(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=c.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function fe(e,t){let r=c.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=c.default.createCipheriv("aes-256-gcm",s,r),a=n.update(e,"utf8","hex");a+=n.final("hex");let p=n.getAuthTag().toString("hex");return{ciphertext:a,iv:r.toString("hex"),authTag:p}}function ye(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),a=c.default.createDecipheriv("aes-256-gcm",r,s);a.setAuthTag(n);let p=a.update(e.ciphertext,"hex","utf8");return p+=a.final("utf8"),p}function Y(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=k(`vault_${t}`);if(s)return s}let r=k("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(C(),K(Z)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function he(e,t){t&&j(`vault_${t}`,e),j("vault_passphrase",e)}function me(e,t){let{publicKey:r,privateKey:s}=c.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),a=c.default.createPublicKey(t),p=c.default.diffieHellman({privateKey:s,publicKey:a}),g=Buffer.from(c.default.hkdfSync("sha256",p,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),i=c.default.randomBytes(12),u=c.default.createCipheriv("aes-256-gcm",g,i),d=u.update(e,"utf8","hex");d+=u.final("hex");let y=u.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:d,iv:i.toString("hex"),authTag:y}}function ve(e,t){let r=c.default.createPrivateKey(t),s=c.default.createPublicKey(e.ephemeralPublicKey),n=c.default.diffieHellman({privateKey:r,publicKey:s}),a=Buffer.from(c.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),p=Buffer.from(e.iv,"hex"),g=Buffer.from(e.authTag,"hex"),i=c.default.createDecipheriv("aes-256-gcm",a,p);i.setAuthTag(g);let u=i.update(e.encryptedProjectKey,"hex","utf8");return u+=i.final("utf8"),u}var c,m,J,W,b,F,E,_,M,B,de,j,k,A=H(()=>{c=h(require("crypto")),m=h(require("os")),J=h(require("conf")),W=require("node-machine-id"),b=require("child_process"),F="aes-256-gcm",E=new J.default({projectName:"xtra-cli-crypto"}),_=null;M=e=>{let t=c.default.randomBytes(12),r=G(),s=c.default.createCipheriv(F,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let a=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:a.toString("hex")}},B=e=>{let t=G(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=c.default.createDecipheriv(F,t,r);n.setAuthTag(s);let a=n.update(e.content,"hex","utf8");return a+=n.final("utf8"),a},de=e=>c.default.createHash("sha256").update(e).digest("hex"),j=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(m.default.platform()==="darwin"){(0,b.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(m.default.platform()!=="win32"){if(m.default.platform()==="linux")try{(0,b.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=M(t);E.set(`secure_${e}`,JSON.stringify(r))},k=e=>{try{let t="XtraSecurityCLI",r=e;if(m.default.platform()==="darwin")return(0,b.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(m.default.platform()!=="win32"){if(m.default.platform()==="linux")try{return(0,b.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=E.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return B(r)}catch{return null}}});var Z={};U(Z,{clearConfig:()=>xe,deleteConfig:()=>we,getAuthToken:()=>T,getBreakGlassSession:()=>$e,getConfig:()=>P,getConfigValue:()=>D,getProjectConfig:()=>je,getRcConfig:()=>I,setBreakGlassSession:()=>be,setConfig:()=>Se});var Q,$,L,N,l,z,P,D,Se,xe,we,T,$e,be,je,I,C=H(()=>{Q=h(require("conf")),$=h(require("fs")),L=h(require("path"));A();N="https://www.xtrasecurity.in/api",l=new Q.default({projectName:"xtra-cli",defaults:{apiUrl:N}}),z=l.get("apiUrl");z&&!process.env.XTRA_API_URL&&z.includes("xtra-security.vercel.app")&&l.set("apiUrl",N);P=()=>({...l.store,token:T(),apiUrl:process.env.XTRA_API_URL||l.get("apiUrl")||N}),D=e=>e==="token"?T():l.get(e),Se=(e,t)=>{if(e==="token"&&t&&j("token",t),l.set(e,t),e==="token"&&process.platform!=="win32"&&$.default.existsSync(l.path))try{$.default.chmodSync(l.path,384)}catch{}},xe=()=>l.clear(),we=e=>l.delete(e),T=()=>k("token")||l.get("token"),$e=()=>l.get("breakGlassSessionId"),be=e=>{e?l.set("breakGlassSessionId",e):l.delete("breakGlassSessionId")},je=async()=>{try{let e=L.default.join(process.cwd(),"xtra.json");if($.default.existsSync(e)){let t=$.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},I=()=>{let e={};try{let t=L.default.join(process.cwd(),".xtrarc");$.default.existsSync(t)&&(e=JSON.parse($.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||l.get("project")||"",env:e.env||l.get("env")||"development",branch:e.branch||l.get("branch")||"main"}}});var Pe={};U(Pe,{diffCommand:()=>Ae});module.exports=K(Pe);var ne=require("commander");var ee=h(require("axios"));C();var te=h(require("fs")),re=h(require("path")),ke=JSON.parse(te.readFileSync(re.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=P(),r=e||T();return ee.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":ke.version,...r?{Authorization:`Bearer ${r}`}:{}}})},V={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,a)=>{let g=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(g&&typeof g=="object"){let i=null,{deriveProjectKey:u,decryptSecretValue:d,resolveVaultPassphrase:y,decryptWorkloadKeyEnvelope:S}=(A(),K(O));for(let[v,x]of Object.entries(g))if(typeof x=="string"&&x.startsWith("{"))try{let w=JSON.parse(x);if(w.ciphertext&&w.iv){if(!i)if(a&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)i=S(a,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let ae=y(s,e);i=u(e,ae)}g[v]=d(w,i)}}catch(w){if(w.message&&w.message.includes("Zero-Knowledge"))throw w}}return g},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:a,encryptSecretValue:p,resolveVaultPassphrase:g}=(A(),K(O)),i=g(void 0,e),u=a(e,i),d={};for(let[S,v]of Object.entries(r))if(typeof v=="string"&&v.startsWith("{")&&v.includes("ciphertext"))d[S]=v;else{let x=p(v,u);d[S]=JSON.stringify(x)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:d,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,a)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:a})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=P(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=P(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data};var f=h(require("chalk")),X=h(require("ora"));C();A();var oe=h(require("diff")),Ae=new ne.Command("diff").description("Show differences between local cache and remote secrets").argument("[env1]","Source Environment").argument("[env2]","Target Environment").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Environment (dev, stg, prod)","dev").option("-b, --branch <branchName>","Branch Name").option("--show","Show actual value differences (sensitive)",!1).action(async(e,t,r)=>{let{project:s,env:n,branch:a,show:p}=r;s||(s=I().project),a||(a=I().branch||"main"),s||(console.error(f.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let g={dev:"development",stg:"staging",prod:"production"};if(e&&t){let i=g[e]||e,u=g[t]||t,d=(0,X.default)(`Fetching secrets for ${i} and ${u} (branch: ${a})...`).start();try{let[y,S]=await Promise.all([V.getSecrets(s,i,a),V.getSecrets(s,u,a)]);d.stop(),console.log(f.default.bold(`
+Diff Report (${i} <-> ${u} @ ${a}):
+`)),se(y,S,p)}catch(y){d.fail("Failed to fetch secrets"),console.error(f.default.red(y?.response?.data?.error||"An unexpected error occurred"))}}else{let i=g[n]||n,u=(0,X.default)(`Fetching remote state for ${i} (branch: ${a})...`).start();try{let d=await V.getSecrets(s,i,a),y={};try{let S=`cache.${s}.${i}.${a}`,v=D(S);if(v){let x=B(v);y=JSON.parse(x)}}catch{}u.stop(),console.log(f.default.bold(`
+Diff Report (Remote ${i} vs Local Cache):
+`)),se(d,y,p)}catch(d){u.fail("Failed to run diff."),console.error(f.default.red(d?.response?.data?.error||"An unexpected error occurred"))}}});function se(e,t,r){let s=new Set([...Object.keys(e),...Object.keys(t)]),n=!1;s.forEach(a=>{let p=e[a],g=t[a];if(p!==g){if(n=!0,p===void 0)console.log(f.default.green(`+ ${a} (Only in Target)`)),r&&console.log(f.default.green(`  + "${g}"`));else if(g===void 0)console.log(f.default.red(`- ${a} (Only in Source)`)),r&&console.log(f.default.red(`  - "${p}"`));else if(console.log(f.default.yellow(`~ ${a} (Modified)`)),r){let i=oe.diffChars(p,g),u="  ";i.forEach(d=>{let y=d.added?f.default.green:d.removed?f.default.red:f.default.gray;u+=y(d.value)}),console.log(u)}}}),n?r||console.log(f.default.gray(`
+(Use --show to reveal secret values)`)):console.log(f.default.green("\u2714 No differences found."))}0&&(module.exports={diffCommand});

package/dist/commands/doctor.js

@@ -1,2 +1,2 @@
-var _=Object.create;var u=Object.defineProperty;var $=Object.getOwnPropertyDescriptor;var O=Object.getOwnPropertyNames;var L=Object.getPrototypeOf,E=Object.prototype.hasOwnProperty;var G=(s,e)=>{for(var o in e)u(s,o,{get:e[o],enumerable:!0})},S=(s,e,o,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let t of O(e))!E.call(s,t)&&t!==o&&u(s,t,{get:()=>e[t],enumerable:!(r=$(e,t))||r.enumerable});return s};var i=(s,e,o)=>(o=s!=null?_(L(s)):{},S(e||!s||!s.__esModule?u(o,"default",{value:s,enumerable:!0}):o,s)),D=s=>S(u({},"__esModule",{value:!0}),s);var V={};G(V,{doctorCommand:()=>M});module.exports=D(V);var P=require("commander"),n=i(require("chalk")),f=i(require("fs")),w=i(require("path")),U=i(require("axios"));var A=i(require("conf")),m=i(require("fs")),v=i(require("path")),d="https://www.xtrasecurity.in/api",c=new A.default({projectName:"xtra-cli",defaults:{apiUrl:d}}),j=c.get("apiUrl");j&&!process.env.XTRA_API_URL&&j.includes("xtra-security.vercel.app")&&c.set("apiUrl",d);var b=()=>({...c.store,apiUrl:process.env.XTRA_API_URL||c.get("apiUrl")||d});var k=()=>c.get("token");var x=()=>{let s={};try{let e=v.default.join(process.cwd(),".xtrarc");m.default.existsSync(e)&&(s=JSON.parse(m.default.readFileSync(e,"utf-8")))}catch{}return{project:s.project||c.get("project")||"",env:s.env||c.get("env")||"development",branch:s.branch||c.get("branch")||"main"}};var y=65,p={tl:"\u256D",tr:"\u256E",bl:"\u2570",br:"\u256F",h:"\u2500",v:"\u2502"};function I(s){return p.h.repeat(s)}var F=n.default.green("\u2713  "),X=n.default.red("\u2717  "),B=n.default.yellow("\u26A0  ");async function J(){let s=[],e=b(),o=parseInt(process.versions.node.split(".")[0]);s.push({name:"Node.js Version",status:o>=18?"pass":"fail",message:`v${process.versions.node} ${o>=18?"(OK)":"(requires >=18)"}`});let r=k();s.push({name:"Auth Token",status:r?"pass":"fail",message:r?`Set (${r.substring(0,8)}...)`:"Not set \u2014 run 'xtra login'"});let t=e.apiUrl||process.env.XTRA_API_URL||"https://www.xtrasecurity.in/api";s.push({name:"API URL",status:e.apiUrl||process.env.XTRA_API_URL?"pass":"warn",message:t});try{let a=await U.default.get(`${t}/health`,{timeout:4e3});s.push({name:"API Connectivity",status:a.status===200?"pass":"warn",message:`${a.status} ${a.statusText}`})}catch(a){let N=a.code==="ECONNREFUSED"?"Connection refused (offline?)":a.code==="ETIMEDOUT"?"Timed out (unreachable)":a.response?.status===404?"API reachable (health endpoint missing)":a?.response?.data?.error||"An unexpected error occurred",T=a.response?.status===404?"pass":"fail";s.push({name:"API Connectivity",status:T,message:N})}let l=x().project;s.push({name:"Active Project",status:l?"pass":"warn",message:l||"Not set \u2014 run 'xtra project set <id>'"});let h=x().branch||"main";s.push({name:"Active Branch",status:"pass",message:h});let g=w.join(process.cwd(),".xtrarc"),R=w.join(process.cwd(),"xtra.json"),C=f.existsSync(g)||f.existsSync(R);return s.push({name:"Project Config",status:C?"pass":"warn",message:C?f.existsSync(g)?".xtrarc found":"xtra.json found":"Not found (run 'xtra init')"}),s}var M=new P.Command("doctor").description("Diagnose CLI configuration and API connectivity").option("--json","Output results as JSON",!1).action(async s=>{s.json||(console.log(),console.log(n.default.bold.cyan("  \u2695 XtraSecurity Diagnostics")),console.log(n.default.hex("#4a5568")("  "+p.tl+I(y)+p.tr)));let e=await J();if(s.json){process.stdout.write(JSON.stringify(e,null,2)+`
-`);return}let o=0,r=0;for(let t of e){t.status==="fail"&&o++,t.status==="warn"&&r++;let l=t.status==="pass"?F:t.status==="warn"?B:X,h=n.default.bold(n.default.white(t.name.padEnd(20))),g=t.status==="pass"?n.default.hex("#94a3b8")(t.message):t.status==="warn"?n.default.yellow(t.message):n.default.red(t.message);console.log(n.default.hex("#4a5568")("  "+p.v)+` ${l}${h}  ${g}`.padEnd(y)+n.default.hex("#4a5568")(p.v))}if(console.log(n.default.hex("#4a5568")("  "+p.bl+I(y)+p.br)),console.log(),o===0&&r===0)console.log(n.default.green("  \u2713 All systems operational. The CLI is ready to use."));else{let t=[];o>0&&t.push(n.default.red(`${o} error(s)`)),r>0&&t.push(n.default.yellow(`${r} warning(s)`)),console.log(`  Found ${t.join(" and ")}.`)}console.log()});0&&(module.exports={doctorCommand});
+var G=Object.create;var h=Object.defineProperty;var W=Object.getOwnPropertyDescriptor;var F=Object.getOwnPropertyNames;var J=Object.getPrototypeOf,M=Object.prototype.hasOwnProperty;var b=(e,t)=>()=>(e&&(t=e(e=0)),t);var q=(e,t)=>{for(var s in t)h(e,s,{get:t[s],enumerable:!0})},_=(e,t,s,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of F(t))!M.call(e,r)&&r!==s&&h(e,r,{get:()=>t[r],enumerable:!(n=W(t,r))||n.enumerable});return e};var a=(e,t,s)=>(s=e!=null?G(J(e)):{},_(t||!e||!e.__esModule?h(s,"default",{value:e,enumerable:!0}):s,e)),Z=e=>_(h({},"__esModule",{value:!0}),e);function Q(){if(m)return m;let e=x.get("masterKey");e||(e=g.default.randomBytes(32).toString("hex"),x.set("masterKey",e));let t="";try{t=(0,R.machineIdSync)()||""}catch{t=g.default.createHash("sha256").update(p.default.hostname()+(p.default.userInfo?.()?.username||"root")).digest("hex")}let s=p.default.platform(),n=p.default.userInfo?.()?.username||"default_user",r=`${s}:${n}:${t}:${e}`;return m=g.default.createHash("sha256").update(r).digest(),m}var g,p,K,R,v,z,x,m,Y,j,E=b(()=>{g=a(require("crypto")),p=a(require("os")),K=a(require("conf")),R=require("node-machine-id"),v=require("child_process"),z="aes-256-gcm",x=new K.default({projectName:"xtra-cli-crypto"}),m=null;Y=e=>{let t=Q(),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.tag,"hex"),r=g.default.createDecipheriv(z,t,s);r.setAuthTag(n);let i=r.update(e.content,"hex","utf8");return i+=r.final("utf8"),i},j=e=>{try{let t="XtraSecurityCLI",s=e;if(p.default.platform()==="darwin")return(0,v.execFileSync)("security",["find-generic-password","-s",t,"-a",s,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(p.default.platform()!=="win32"){if(p.default.platform()==="linux")try{return(0,v.execFileSync)("secret-tool",["lookup","service",t,"account",s],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=x.get(`secure_${e}`);if(!t)return null;let s=JSON.parse(t);return Y(s)}catch{return null}}});var I,S,U,A,u,B,$,P,w,N=b(()=>{I=a(require("conf")),S=a(require("fs")),U=a(require("path"));E();A="https://www.xtrasecurity.in/api",u=new I.default({projectName:"xtra-cli",defaults:{apiUrl:A}}),B=u.get("apiUrl");B&&!process.env.XTRA_API_URL&&B.includes("xtra-security.vercel.app")&&u.set("apiUrl",A);$=()=>({...u.store,token:P(),apiUrl:process.env.XTRA_API_URL||u.get("apiUrl")||A}),P=()=>j("token")||u.get("token"),w=()=>{let e={};try{let t=U.default.join(process.cwd(),".xtrarc");S.default.existsSync(t)&&(e=JSON.parse(S.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||u.get("project")||"",env:e.env||u.get("env")||"development",branch:e.branch||u.get("branch")||"main"}}});var oe={};q(oe,{doctorCommand:()=>ne});module.exports=Z(oe);var X=require("commander"),o=a(require("chalk")),d=a(require("fs")),T=a(require("path")),O=a(require("axios"));N();var k=65,f={tl:"\u256D",tr:"\u256E",bl:"\u2570",br:"\u256F",h:"\u2500",v:"\u2502"};function L(e){return f.h.repeat(e)}var ee=o.default.green("\u2713  "),te=o.default.red("\u2717  "),re=o.default.yellow("\u26A0  ");async function se(){let e=[],t=$(),s=parseInt(process.versions.node.split(".")[0]);e.push({name:"Node.js Version",status:s>=18?"pass":"fail",message:`v${process.versions.node} ${s>=18?"(OK)":"(requires >=18)"}`});let n=P();e.push({name:"Auth Token",status:n?"pass":"fail",message:n?`Set (${n.substring(0,8)}...)`:"Not set \u2014 run 'xtra login'"});let r=t.apiUrl||process.env.XTRA_API_URL||"https://www.xtrasecurity.in/api";e.push({name:"API URL",status:t.apiUrl||process.env.XTRA_API_URL?"pass":"warn",message:r});try{let c=await O.default.get(`${r}/health`,{timeout:4e3});e.push({name:"API Connectivity",status:c.status===200?"pass":"warn",message:`${c.status} ${c.statusText}`})}catch(c){let V=c.code==="ECONNREFUSED"?"Connection refused (offline?)":c.code==="ETIMEDOUT"?"Timed out (unreachable)":c.response?.status===404?"API reachable (health endpoint missing)":c?.response?.data?.error||"An unexpected error occurred",D=c.response?.status===404?"pass":"fail";e.push({name:"API Connectivity",status:D,message:V})}let i=w().project;e.push({name:"Active Project",status:i?"pass":"warn",message:i||"Not set \u2014 run 'xtra project set <id>'"});let y=w().branch||"main";e.push({name:"Active Branch",status:"pass",message:y});let l=T.join(process.cwd(),".xtrarc"),H=T.join(process.cwd(),"xtra.json"),C=d.existsSync(l)||d.existsSync(H);return e.push({name:"Project Config",status:C?"pass":"warn",message:C?d.existsSync(l)?".xtrarc found":"xtra.json found":"Not found (run 'xtra init')"}),e}var ne=new X.Command("doctor").description("Diagnose CLI configuration and API connectivity").option("--json","Output results as JSON",!1).action(async e=>{e.json||(console.log(),console.log(o.default.bold.cyan("  \u2695 XtraSecurity Diagnostics")),console.log(o.default.hex("#4a5568")("  "+f.tl+L(k)+f.tr)));let t=await se();if(e.json){process.stdout.write(JSON.stringify(t,null,2)+`
+`);return}let s=0,n=0;for(let r of t){r.status==="fail"&&s++,r.status==="warn"&&n++;let i=r.status==="pass"?ee:r.status==="warn"?re:te,y=o.default.bold(o.default.white(r.name.padEnd(20))),l=r.status==="pass"?o.default.hex("#94a3b8")(r.message):r.status==="warn"?o.default.yellow(r.message):o.default.red(r.message);console.log(o.default.hex("#4a5568")("  "+f.v)+` ${i}${y}  ${l}`.padEnd(k)+o.default.hex("#4a5568")(f.v))}if(console.log(o.default.hex("#4a5568")("  "+f.bl+L(k)+f.br)),console.log(),s===0&&n===0)console.log(o.default.green("  \u2713 All systems operational. The CLI is ready to use."));else{let r=[];s>0&&r.push(o.default.red(`${s} error(s)`)),n>0&&r.push(o.default.yellow(`${n} warning(s)`)),console.log(`  Found ${r.join(" and ")}.`)}console.log()});0&&(module.exports={doctorCommand});

package/dist/commands/env.js

@@ -1,2 +1,2 @@
-var A=Object.create;var d=Object.defineProperty;var U=Object.getOwnPropertyDescriptor;var R=Object.getOwnPropertyNames;var L=Object.getPrototypeOf,P=Object.prototype.hasOwnProperty;var _=(e,s)=>{for(var t in s)d(e,t,{get:s[t],enumerable:!0})},f=(e,s,t,n)=>{if(s&&typeof s=="object"||typeof s=="function")for(let o of R(s))!P.call(e,o)&&o!==t&&d(e,o,{get:()=>s[o],enumerable:!(n=U(s,o))||n.enumerable});return e};var a=(e,s,t)=>(t=e!=null?A(L(e)):{},f(s||!e||!e.__esModule?d(t,"default",{value:e,enumerable:!0}):t,e)),q=e=>f(d({},"__esModule",{value:!0}),e);var B={};_(B,{envCommand:()=>I});module.exports=q(B);var x=require("commander"),c=a(require("chalk"));var j=a(require("axios"));var v=a(require("conf")),l=a(require("fs")),h=a(require("path")),m="https://www.xtrasecurity.in/api",i=new v.default({projectName:"xtra-cli",defaults:{apiUrl:m}}),w=i.get("apiUrl");w&&!process.env.XTRA_API_URL&&w.includes("xtra-security.vercel.app")&&i.set("apiUrl",m);var u=()=>({...i.store,apiUrl:process.env.XTRA_API_URL||i.get("apiUrl")||m});var $=()=>i.get("token");var y=()=>{let e={};try{let s=h.default.join(process.cwd(),".xtrarc");l.default.existsSync(s)&&(e=JSON.parse(l.default.readFileSync(s,"utf-8")))}catch{}return{project:e.project||i.get("project")||"",env:e.env||i.get("env")||"development",branch:e.branch||i.get("branch")||"main"}};var S=a(require("fs")),b=a(require("path")),O=JSON.parse(S.readFileSync(b.join(__dirname,"../../package.json"),"utf-8")),r=()=>{let{apiUrl:e}=u(),s=$();return j.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":O.version,...s?{Authorization:`Bearer ${s}`}:{}}})},k={login:async(e,s,t)=>(await r().post("/auth/cli-login",{email:e,password:s,apiKey:t})).data,getSecrets:async(e,s,t="main")=>(await r().get(`/projects/${e}/envs/${s}/secrets?branch=${t}`)).data,getSecretVersions:async(e,s,t="main")=>(await r().get(`/projects/${e}/envs/${s}/secrets?includeVersions=true&branch=${t}`)).data,setSecrets:async(e,s,t,n,o="main")=>(await r().post(`/projects/${e}/envs/${s}/secrets`,{secrets:t,expectedVersions:n,branch:o})).data,getSecretDetails:async(e,s,t,n="main")=>(await r().get(`/projects/${e}/envs/${s}/secrets/${t}?branch=${n}`)).data,syncLogs:async e=>(await r().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,s,t,n,o,p)=>(await r().post(`/projects/${e}/envs/${s}/secrets/link`,{key:t,sourceProjectId:n,sourceEnv:o,sourceKey:p})).data,rotateSecret:async(e,s,t,n,o)=>(await r().post(`/projects/${e}/envs/${s}/secrets/${t}/rotate`,{strategy:n,parsedNewValue:o})).data,promoteSecret:async(e,s,t)=>(await r().post(`/projects/${e}/envs/${s}/secrets/${t}/promote`,{})).data,verifyAuditLogs:async()=>(await r().get("/audit/verify")).data,exportAuditLogs:async(e,s,t,n)=>{let o={format:e};return s&&(o.startDate=s),t&&(o.endDate=t),n&&(o.projectId=n),(await r().post("/audit/export",o,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,s,t,n)=>(await r().post("/access/request",{projectId:e,secretId:n,reason:s,duration:t})).data,approveAccess:async(e,s)=>(await r().post("/access/approve",{requestId:e,decision:s})).data,listAccessRequests:async e=>{let{workspace:s}=u(),t=s?`&workspaceId=${s}`:"";return(await r().get(`/access/list?mode=${e}${t}`)).data},getAccessRequestStatus:async e=>(await r().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=u(),s=e?`/project?workspaceId=${e}`:"/project";return(await r().get(s)).data},getBranches:async e=>(await r().get(`/branch?projectId=${e}`)).data,createBranch:async(e,s,t)=>(await r().post("/branch",{projectId:e,name:s,description:t})).data,deleteBranch:async e=>(await r().delete(`/branch/${e}`)).data,updateBranch:async(e,s)=>(await r().put("/branch",{id:e,...s})).data,getRoles:async()=>(await r().get("/admin/roles")).data,getUsers:async e=>{let s=e?`?teamId=${e}`:"";return(await r().get(`/admin/users${s}`)).data},setUserRole:async(e,s,t)=>(await r().put("/admin/users/role",{email:e,role:s,teamId:t})).data,getIntegrationStatus:async e=>(await r().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await r().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await r().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,s)=>{let t=new URLSearchParams(s).toString();return(await r().get(`/projects/${e}/kubernetes?${t}`)).data},getSecretHistory:async(e,s,t)=>(await r().get(`/projects/${e}/envs/${s}/secrets/${t}/history`)).data,rollbackSecret:async(e,s,t,n)=>(await r().post(`/projects/${e}/envs/${s}/secrets/${t}/history`,{version:n})).data,cloneEnvironment:async(e,s,t,n,o)=>(await r().post(`/projects/${e}/envs/clone`,{fromEnv:s,toEnv:t,overwrite:n,branch:o})).data,generateJitLink:async e=>(await r().post("/jit/generate",e)).data,claimJitLink:async e=>(await r().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await r().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await r().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,s)=>(await r().post(`/projects/${e}/service-accounts`,s)).data,deleteServiceAccount:async(e,s)=>(await r().delete(`/projects/${e}/service-accounts/${s}`)).data,getServiceAccountKeys:async(e,s)=>(await r().get(`/projects/${e}/service-accounts/${s}/keys`)).data,createServiceAccountKey:async(e,s,t,n)=>(await r().post(`/projects/${e}/service-accounts/${s}/keys`,{label:t,expiresAt:n})).data,deleteServiceAccountKey:async(e,s,t)=>(await r().delete(`/projects/${e}/service-accounts/${s}/keys/${t}`)).data,post:async(e,s)=>(await r().post(e,s)).data};var C=a(require("inquirer")),I=new x.Command("env");I.command("clone").description("Clone secrets from one environment to another").requiredOption("--from <env>","Source environment (e.g. production)").requiredOption("--to <env>","Destination environment (e.g. staging)").option("-p, --project <id>","Project ID").option("-b, --branch <name>","Branch Name").option("--overwrite","Overwrite existing secrets",!1).action(async e=>{try{let s=e.project,t=e.branch||y().branch||"main";s||(s=y().project,s||(console.error(c.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1)));let n=e.from.toLowerCase(),o=e.to.toLowerCase();if(n===o&&(console.error(c.default.red("Source and destination must be different.")),process.exit(1)),console.log(c.default.blue(`Cloning secrets from ${n} to ${o} (branch: ${t})...`)),e.overwrite&&console.log(c.default.yellow("Warning: Existing secrets in destination will be overwritten!")),!(await C.default.prompt([{type:"confirm",name:"proceed",message:"Are you sure you want to proceed?",default:!1}])).proceed){console.log("Operation cancelled.");return}let g=await k.cloneEnvironment(s,n,o,e.overwrite,t);g.success&&(console.log(c.default.green(`
-Clone successful!`)),console.log(`Copied: ${g.summary.copied}`),console.log(`Updated: ${g.summary.updated} (overwrite: ${e.overwrite})`),console.log(`Skipped: ${g.summary.skipped}`))}catch(s){s.response&&s.response.data&&s.response.data.error?console.error(c.default.red("Error cloning environment:"),s.response.data.error):console.error(c.default.red("Error cloning environment:"),s?.response?.data?.error||"Unknown error")}});0&&(module.exports={envCommand});
+var oe=Object.create;var T=Object.defineProperty;var ie=Object.getOwnPropertyDescriptor;var ae=Object.getOwnPropertyNames;var ce=Object.getPrototypeOf,pe=Object.prototype.hasOwnProperty;var L=(e,t)=>()=>(e&&(t=e(e=0)),t);var I=(e,t)=>{for(var r in t)T(e,r,{get:t[r],enumerable:!0})},q=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of ae(t))!pe.call(e,n)&&n!==r&&T(e,n,{get:()=>t[n],enumerable:!(s=ie(t,n))||s.enumerable});return e};var d=(e,t,r)=>(r=e!=null?oe(ce(e)):{},q(t||!e||!e.__esModule?T(r,"default",{value:e,enumerable:!0}):r,e)),K=e=>q(T({},"__esModule",{value:!0}),e);var U={};I(U,{createWorkloadKeyEnvelope:()=>ye,decrypt:()=>J,decryptSecretValue:()=>le,decryptWorkloadKeyEnvelope:()=>me,deriveProjectKey:()=>ue,encrypt:()=>W,encryptSecretValue:()=>de,hash:()=>ge,resolveVaultPassphrase:()=>G,saveVaultPassphrase:()=>fe,secureRead:()=>k,secureSave:()=>$});function H(){if(R)return R;let e=_.get("masterKey");e||(e=a.default.randomBytes(32).toString("hex"),_.set("masterKey",e));let t="";try{t=(0,X.machineIdSync)()||""}catch{t=a.default.createHash("sha256").update(l.default.hostname()+(l.default.userInfo?.()?.username||"root")).digest("hex")}let r=l.default.platform(),s=l.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return R=a.default.createHash("sha256").update(n).digest(),R}function ue(e,t){t||(t=G(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=a.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function de(e,t){let r=a.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=a.default.createCipheriv("aes-256-gcm",s,r),i=n.update(e,"utf8","hex");i+=n.final("hex");let c=n.getAuthTag().toString("hex");return{ciphertext:i,iv:r.toString("hex"),authTag:c}}function le(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),i=a.default.createDecipheriv("aes-256-gcm",r,s);i.setAuthTag(n);let c=i.update(e.ciphertext,"hex","utf8");return c+=i.final("utf8"),c}function G(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=k(`vault_${t}`);if(s)return s}let r=k("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(E(),K(M)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function fe(e,t){t&&$(`vault_${t}`,e),$("vault_passphrase",e)}function ye(e,t){let{publicKey:r,privateKey:s}=a.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),i=a.default.createPublicKey(t),c=a.default.diffieHellman({privateKey:s,publicKey:i}),u=Buffer.from(a.default.hkdfSync("sha256",c,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),g=a.default.randomBytes(12),f=a.default.createCipheriv("aes-256-gcm",u,g),y=f.update(e,"utf8","hex");y+=f.final("hex");let A=f.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:y,iv:g.toString("hex"),authTag:A}}function me(e,t){let r=a.default.createPrivateKey(t),s=a.default.createPublicKey(e.ephemeralPublicKey),n=a.default.diffieHellman({privateKey:r,publicKey:s}),i=Buffer.from(a.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),c=Buffer.from(e.iv,"hex"),u=Buffer.from(e.authTag,"hex"),g=a.default.createDecipheriv("aes-256-gcm",i,c);g.setAuthTag(u);let f=g.update(e.encryptedProjectKey,"hex","utf8");return f+=g.final("utf8"),f}var a,l,N,X,x,D,_,R,W,J,ge,$,k,C=L(()=>{a=d(require("crypto")),l=d(require("os")),N=d(require("conf")),X=require("node-machine-id"),x=require("child_process"),D="aes-256-gcm",_=new N.default({projectName:"xtra-cli-crypto"}),R=null;W=e=>{let t=a.default.randomBytes(12),r=H(),s=a.default.createCipheriv(D,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let i=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:i.toString("hex")}},J=e=>{let t=H(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=a.default.createDecipheriv(D,t,r);n.setAuthTag(s);let i=n.update(e.content,"hex","utf8");return i+=n.final("utf8"),i},ge=e=>a.default.createHash("sha256").update(e).digest("hex"),$=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(l.default.platform()==="darwin"){(0,x.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(l.default.platform()!=="win32"){if(l.default.platform()==="linux")try{(0,x.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=W(t);_.set(`secure_${e}`,JSON.stringify(r))},k=e=>{try{let t="XtraSecurityCLI",r=e;if(l.default.platform()==="darwin")return(0,x.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(l.default.platform()!=="win32"){if(l.default.platform()==="linux")try{return(0,x.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=_.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return J(r)}catch{return null}}});var M={};I(M,{clearConfig:()=>we,deleteConfig:()=>Se,getAuthToken:()=>j,getBreakGlassSession:()=>xe,getConfig:()=>b,getConfigValue:()=>he,getProjectConfig:()=>ke,getRcConfig:()=>B,setBreakGlassSession:()=>$e,setConfig:()=>ve});var Y,w,V,O,p,F,b,he,ve,we,Se,j,xe,$e,ke,B,E=L(()=>{Y=d(require("conf")),w=d(require("fs")),V=d(require("path"));C();O="https://www.xtrasecurity.in/api",p=new Y.default({projectName:"xtra-cli",defaults:{apiUrl:O}}),F=p.get("apiUrl");F&&!process.env.XTRA_API_URL&&F.includes("xtra-security.vercel.app")&&p.set("apiUrl",O);b=()=>({...p.store,token:j(),apiUrl:process.env.XTRA_API_URL||p.get("apiUrl")||O}),he=e=>e==="token"?j():p.get(e),ve=(e,t)=>{if(e==="token"&&t&&$("token",t),p.set(e,t),e==="token"&&process.platform!=="win32"&&w.default.existsSync(p.path))try{w.default.chmodSync(p.path,384)}catch{}},we=()=>p.clear(),Se=e=>p.delete(e),j=()=>k("token")||p.get("token"),xe=()=>p.get("breakGlassSessionId"),$e=e=>{e?p.set("breakGlassSessionId",e):p.delete("breakGlassSessionId")},ke=async()=>{try{let e=V.default.join(process.cwd(),"xtra.json");if(w.default.existsSync(e)){let t=w.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},B=()=>{let e={};try{let t=V.default.join(process.cwd(),".xtrarc");w.default.existsSync(t)&&(e=JSON.parse(w.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||p.get("project")||"",env:e.env||p.get("env")||"development",branch:e.branch||p.get("branch")||"main"}}});var je={};I(je,{envCommand:()=>se});module.exports=K(je);var te=require("commander"),m=d(require("chalk"));var Z=d(require("axios"));E();var z=d(require("fs")),Q=d(require("path")),be=JSON.parse(z.readFileSync(Q.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=b(),r=e||j();return Z.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":be.version,...r?{Authorization:`Bearer ${r}`}:{}}})},ee={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,i)=>{let u=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(u&&typeof u=="object"){let g=null,{deriveProjectKey:f,decryptSecretValue:y,resolveVaultPassphrase:A,decryptWorkloadKeyEnvelope:P}=(C(),K(U));for(let[h,S]of Object.entries(u))if(typeof S=="string"&&S.startsWith("{"))try{let v=JSON.parse(S);if(v.ciphertext&&v.iv){if(!g)if(i&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)g=P(i,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let ne=A(s,e);g=f(e,ne)}u[h]=y(v,g)}}catch(v){if(v.message&&v.message.includes("Zero-Knowledge"))throw v}}return u},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:i,encryptSecretValue:c,resolveVaultPassphrase:u}=(C(),K(U)),g=u(void 0,e),f=i(e,g),y={};for(let[P,h]of Object.entries(r))if(typeof h=="string"&&h.startsWith("{")&&h.includes("ciphertext"))y[P]=h;else{let S=c(h,f);y[P]=JSON.stringify(S)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:y,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:i})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=b(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=b(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data};E();var re=d(require("inquirer")),se=new te.Command("env");se.command("clone").description("Clone secrets from one environment to another").requiredOption("--from <env>","Source environment (e.g. production)").requiredOption("--to <env>","Destination environment (e.g. staging)").option("-p, --project <id>","Project ID").option("-b, --branch <name>","Branch Name").option("--overwrite","Overwrite existing secrets",!1).action(async e=>{try{let t=e.project,r=e.branch||B().branch||"main";t||(t=B().project,t||(console.error(m.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1)));let s=e.from.toLowerCase(),n=e.to.toLowerCase();if(s===n&&(console.error(m.default.red("Source and destination must be different.")),process.exit(1)),console.log(m.default.blue(`Cloning secrets from ${s} to ${n} (branch: ${r})...`)),e.overwrite&&console.log(m.default.yellow("Warning: Existing secrets in destination will be overwritten!")),!(await re.default.prompt([{type:"confirm",name:"proceed",message:"Are you sure you want to proceed?",default:!1}])).proceed){console.log("Operation cancelled.");return}let c=await ee.cloneEnvironment(t,s,n,e.overwrite,r);c.success&&(console.log(m.default.green(`
+Clone successful!`)),console.log(`Copied: ${c.summary.copied}`),console.log(`Updated: ${c.summary.updated} (overwrite: ${e.overwrite})`),console.log(`Skipped: ${c.summary.skipped}`))}catch(t){t.response&&t.response.data&&t.response.data.error?console.error(m.default.red("Error cloning environment:"),t.response.data.error):console.error(m.default.red("Error cloning environment:"),t?.response?.data?.error||"Unknown error")}});0&&(module.exports={envCommand});

package/dist/commands/export.js

@@ -1,2 +1,3 @@
-var ot=Object.create;var h=Object.defineProperty;var at=Object.getOwnPropertyDescriptor;var it=Object.getOwnPropertyNames;var ct=Object.getPrototypeOf,pt=Object.prototype.hasOwnProperty;var v=(t,e)=>()=>(t&&(e=t(t=0)),e);var L=(t,e)=>{for(var s in e)h(t,s,{get:e[s],enumerable:!0})},N=(t,e,s,r)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of it(e))!pt.call(t,n)&&n!==s&&h(t,n,{get:()=>e[n],enumerable:!(r=at(e,n))||r.enumerable});return t};var i=(t,e,s)=>(s=t!=null?ot(ct(t)):{},N(e||!t||!t.__esModule?h(s,"default",{value:t,enumerable:!0}):s,t)),P=t=>N(h({},"__esModule",{value:!0}),t);var T,A,_,I,g,B,f,D,C,w=v(()=>{T=i(require("conf")),A=i(require("fs")),_=i(require("path")),I="https://www.xtrasecurity.in/api",g=new T.default({projectName:"xtra-cli",defaults:{apiUrl:I}}),B=g.get("apiUrl");B&&!process.env.XTRA_API_URL&&B.includes("xtra-security.vercel.app")&&g.set("apiUrl",I);f=()=>({...g.store,apiUrl:process.env.XTRA_API_URL||g.get("apiUrl")||I}),D=()=>g.get("token"),C=()=>{let t={};try{let e=_.default.join(process.cwd(),".xtrarc");A.default.existsSync(e)&&(t=JSON.parse(A.default.readFileSync(e,"utf-8")))}catch{}return{project:t.project||g.get("project")||"",env:t.env||g.get("env")||"development",branch:t.branch||g.get("branch")||"main"}}});var J,F,q,gt,o,j,U=v(()=>{J=i(require("axios"));w();F=i(require("fs")),q=i(require("path")),gt=JSON.parse(F.readFileSync(q.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:t}=f(),e=D();return J.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":gt.version,...e?{Authorization:`Bearer ${e}`}:{}}})},j={login:async(t,e,s)=>(await o().post("/auth/cli-login",{email:t,password:e,apiKey:s})).data,getSecrets:async(t,e,s="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets?branch=${s}`)).data,getSecretVersions:async(t,e,s="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(t,e,s,r,n="main")=>(await o().post(`/projects/${t}/envs/${e}/secrets`,{secrets:s,expectedVersions:r,branch:n})).data,getSecretDetails:async(t,e,s,r="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets/${s}?branch=${r}`)).data,syncLogs:async t=>(await o().post("/audit/cli-logs",{logs:t})).data,linkSecret:async(t,e,s,r,n,a)=>(await o().post(`/projects/${t}/envs/${e}/secrets/link`,{key:s,sourceProjectId:r,sourceEnv:n,sourceKey:a})).data,rotateSecret:async(t,e,s,r,n)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/rotate`,{strategy:r,parsedNewValue:n})).data,promoteSecret:async(t,e,s)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(t,e,s,r)=>{let n={format:t};return e&&(n.startDate=e),s&&(n.endDate=s),r&&(n.projectId=r),(await o().post("/audit/export",n,{responseType:t==="csv"?"text":"json"})).data},requestAccess:async(t,e,s,r)=>(await o().post("/access/request",{projectId:t,secretId:r,reason:e,duration:s})).data,approveAccess:async(t,e)=>(await o().post("/access/approve",{requestId:t,decision:e})).data,listAccessRequests:async t=>{let{workspace:e}=f(),s=e?`&workspaceId=${e}`:"";return(await o().get(`/access/list?mode=${t}${s}`)).data},getAccessRequestStatus:async t=>(await o().get(`/access/request?id=${t}`)).data,getProjects:async()=>{let{workspace:t}=f(),e=t?`/project?workspaceId=${t}`:"/project";return(await o().get(e)).data},getBranches:async t=>(await o().get(`/branch?projectId=${t}`)).data,createBranch:async(t,e,s)=>(await o().post("/branch",{projectId:t,name:e,description:s})).data,deleteBranch:async t=>(await o().delete(`/branch/${t}`)).data,updateBranch:async(t,e)=>(await o().put("/branch",{id:t,...e})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async t=>{let e=t?`?teamId=${t}`:"";return(await o().get(`/admin/users${e}`)).data},setUserRole:async(t,e,s)=>(await o().put("/admin/users/role",{email:t,role:e,teamId:s})).data,getIntegrationStatus:async t=>(await o().get(`/integrations/${t}`)).data,getIntegrationRepos:async t=>(await o().get(`/integrations/${t}/sync`)).data.repos,syncSecretsToGithub:async t=>(await o().post("/integrations/github/sync",t)).data,exportKubernetesSecret:async(t,e)=>{let s=new URLSearchParams(e).toString();return(await o().get(`/projects/${t}/kubernetes?${s}`)).data},getSecretHistory:async(t,e,s)=>(await o().get(`/projects/${t}/envs/${e}/secrets/${s}/history`)).data,rollbackSecret:async(t,e,s,r)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/history`,{version:r})).data,cloneEnvironment:async(t,e,s,r,n)=>(await o().post(`/projects/${t}/envs/clone`,{fromEnv:e,toEnv:s,overwrite:r,branch:n})).data,generateJitLink:async t=>(await o().post("/jit/generate",t)).data,claimJitLink:async t=>(await o().post("/jit/claim",{token:t})).data,getJitInfo:async t=>(await o().get(`/jit/${t}`)).data,getServiceAccounts:async t=>(await o().get(`/projects/${t}/service-accounts`)).data,createServiceAccount:async(t,e)=>(await o().post(`/projects/${t}/service-accounts`,e)).data,deleteServiceAccount:async(t,e)=>(await o().delete(`/projects/${t}/service-accounts/${e}`)).data,getServiceAccountKeys:async(t,e)=>(await o().get(`/projects/${t}/service-accounts/${e}/keys`)).data,createServiceAccountKey:async(t,e,s,r)=>(await o().post(`/projects/${t}/service-accounts/${e}/keys`,{label:s,expiresAt:r})).data,deleteServiceAccountKey:async(t,e,s)=>(await o().delete(`/projects/${t}/service-accounts/${e}/keys/${s}`)).data,post:async(t,e)=>(await o().post(t,e)).data}});function H(){let t=K.get("masterKey");t||(t=y.default.randomBytes(32).toString("hex"),K.set("masterKey",t));let e=(0,V.machineIdSync)();return y.default.createHash("sha256").update(t+e).digest()}var y,G,V,z,K,M,X,Q=v(()=>{y=i(require("crypto")),G=i(require("conf")),V=require("node-machine-id"),z="aes-256-gcm",K=new G.default({projectName:"xtra-cli-crypto"});M=t=>{let e=y.default.randomBytes(16),s=H(),r=y.default.createCipheriv(z,s,e),n=r.update(t,"utf8","hex");n+=r.final("hex");let a=r.getAuthTag();return{iv:e.toString("hex"),content:n,tag:a.toString("hex")}},X=t=>{let e=H(),s=Buffer.from(t.iv,"hex"),r=Buffer.from(t.tag,"hex"),n=y.default.createDecipheriv(z,e,s);n.setAuthTag(r);let a=n.update(t.content,"hex","utf8");return a+=n.final("utf8"),a}});var Z={};L(Z,{loadAuditLogs:()=>S,logAudit:()=>ut,saveAuditLogs:()=>x,syncAuditLogs:()=>ft});function dt(t){if(!t||typeof t!="object")return t;let e={...t},s=["password","token","secret","value","apiKey","secretValue"];for(let r of Object.keys(e))s.some(n=>r.toLowerCase().includes(n))&&(e[r]="[REDACTED]");return e}async function Y(t){try{if(!f().token)return!1;let s={action:t.action,entity:"cli-project",entityId:t.projectId||"global",details:dt(t.details),timestamp:t.timestamp,projectId:t.projectId};return await j.post("/audit/cli-logs",{logs:[s]}),!0}catch(e){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",e),!1}}function ut(t,e,s,r){let n={id:(0,W.v4)(),timestamp:new Date().toISOString(),action:t,projectId:e,environment:s,details:r,synced:!1},a=S();a.push(n),x(a),Y(n).then($=>{if($){n.synced=!0;let u=S(),c=u.findIndex(p=>p.id===n.id);c!==-1&&(u[c].synced=!0,x(u))}}).catch(()=>{})}function S(){if(!l.default.existsSync(R))return[];try{let t=l.default.readFileSync(R,"utf-8"),e=JSON.parse(t),s=X(e);return JSON.parse(s)}catch{return[]}}function x(t){l.default.existsSync(O)||l.default.mkdirSync(O,{recursive:!0});let e=JSON.stringify(t),s=M(e);l.default.writeFileSync(R,JSON.stringify(s),"utf-8")}async function ft(){let t=S(),e=t.filter(r=>!r.synced);if(e.length===0)return 0;let s=0;for(let r of e)await Y(r)&&(r.synced=!0,s++);return s>0&&x(t),s}var l,E,W,O,R,tt=v(()=>{l=i(require("fs")),E=i(require("path")),W=require("uuid");Q();w();U();O=E.default.join(process.cwd(),".xtra"),R=E.default.join(O,"audit.enc")});var lt={};L(lt,{exportCommand:()=>yt});module.exports=P(lt);var et=require("commander");U();var m=i(require("chalk")),st=i(require("fs")),rt=i(require("path")),nt=require("csv-stringify/sync");w();var yt=new et.Command("export").description("Export secrets to a file (JSON, Dotenv, CSV)").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Environment (development, staging, production)","development").option("-b, --branch <branchName>","Branch Name").option("-f, --format <format>","Output format (json, dotenv, csv)","json").option("-o, --output <file>","Output file path (default: stdout)").action(async t=>{let{project:e,env:s,branch:r,format:n,output:a}=t;e||(e=C().project),r||(r=C().branch||"main"),s={dev:"development",stg:"staging",prod:"production"}[s]||s,e||(console.error(m.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let u=require("ora")(`Fetching secrets for export (${s} @ ${r})...`).start();try{let c=await j.getSecrets(e,s,r);if(u.stop(),!c||Object.keys(c).length===0){console.warn(m.default.yellow("No secrets found to export."));return}let p="";switch(n.toLowerCase()){case"json":p=JSON.stringify(c,null,2);break;case"dotenv":p=Object.entries(c).map(([b,k])=>`${b}="${String(k).replace(/"/g,'\\"')}"`).join(`
-`);break;case"csv":let d=Object.entries(c).map(([b,k])=>({key:b,value:k}));p=(0,nt.stringify)(d,{header:!0});break;default:console.error(m.default.red(`Error: Unsupported format '${n}'. Use json, dotenv, or csv.`)),process.exit(1)}if(a){let d=rt.default.resolve(process.cwd(),a);st.default.writeFileSync(d,p,"utf-8"),console.log(m.default.green(`\u2714 Secrets exported to ${d}`))}else console.log(p);try{let{logAudit:d}=(tt(),P(Z));d("SECRET_EXPORT",e,s,{format:n,destination:a||"stdout",branch:r})}catch{}}catch(c){u.fail("Export failed.");let p=c?.response?.data?.error||c?.response?.data?.error||"An unexpected error occurred";console.error(m.default.red(p)),process.exit(1)}});0&&(module.exports={exportCommand});
+var he=Object.create;var _=Object.defineProperty;var ve=Object.getOwnPropertyDescriptor;var xe=Object.getOwnPropertyNames;var Se=Object.getPrototypeOf,we=Object.prototype.hasOwnProperty;var I=(e,t)=>()=>(e&&(t=e(e=0)),t);var C=(e,t)=>{for(var r in t)_(e,r,{get:t[r],enumerable:!0})},z=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of xe(t))!we.call(e,n)&&n!==r&&_(e,n,{get:()=>t[n],enumerable:!(s=ve(t,n))||s.enumerable});return e};var l=(e,t,r)=>(r=e!=null?he(Se(e)):{},z(t||!e||!e.__esModule?_(r,"default",{value:e,enumerable:!0}):r,e)),$=e=>z(_({},"__esModule",{value:!0}),e);var X={};C(X,{createWorkloadKeyEnvelope:()=>Te,decrypt:()=>V,decryptSecretValue:()=>$e,decryptWorkloadKeyEnvelope:()=>Pe,deriveProjectKey:()=>be,encrypt:()=>U,encryptSecretValue:()=>ke,hash:()=>je,resolveVaultPassphrase:()=>te,saveVaultPassphrase:()=>Ae,secureRead:()=>P,secureSave:()=>T});function ee(){if(B)return B;let e=O.get("masterKey");e||(e=c.default.randomBytes(32).toString("hex"),O.set("masterKey",e));let t="";try{t=(0,Y.machineIdSync)()||""}catch{t=c.default.createHash("sha256").update(y.default.hostname()+(y.default.userInfo?.()?.username||"root")).digest("hex")}let r=y.default.platform(),s=y.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return B=c.default.createHash("sha256").update(n).digest(),B}function be(e,t){t||(t=te(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=c.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function ke(e,t){let r=c.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=c.default.createCipheriv("aes-256-gcm",s,r),i=n.update(e,"utf8","hex");i+=n.final("hex");let f=n.getAuthTag().toString("hex");return{ciphertext:i,iv:r.toString("hex"),authTag:f}}function $e(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),i=c.default.createDecipheriv("aes-256-gcm",r,s);i.setAuthTag(n);let f=i.update(e.ciphertext,"hex","utf8");return f+=i.final("utf8"),f}function te(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=P(`vault_${t}`);if(s)return s}let r=P("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(E(),$(re)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function Ae(e,t){t&&T(`vault_${t}`,e),T("vault_passphrase",e)}function Te(e,t){let{publicKey:r,privateKey:s}=c.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),i=c.default.createPublicKey(t),f=c.default.diffieHellman({privateKey:s,publicKey:i}),g=Buffer.from(c.default.hkdfSync("sha256",f,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),a=c.default.randomBytes(12),p=c.default.createCipheriv("aes-256-gcm",g,a),d=p.update(e,"utf8","hex");d+=p.final("hex");let m=p.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:d,iv:a.toString("hex"),authTag:m}}function Pe(e,t){let r=c.default.createPrivateKey(t),s=c.default.createPublicKey(e.ephemeralPublicKey),n=c.default.diffieHellman({privateKey:r,publicKey:s}),i=Buffer.from(c.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),f=Buffer.from(e.iv,"hex"),g=Buffer.from(e.authTag,"hex"),a=c.default.createDecipheriv("aes-256-gcm",i,f);a.setAuthTag(g);let p=a.update(e.encryptedProjectKey,"hex","utf8");return p+=a.final("utf8"),p}var c,y,Z,Y,A,Q,O,B,U,V,je,T,P,K=I(()=>{c=l(require("crypto")),y=l(require("os")),Z=l(require("conf")),Y=require("node-machine-id"),A=require("child_process"),Q="aes-256-gcm",O=new Z.default({projectName:"xtra-cli-crypto"}),B=null;U=e=>{let t=c.default.randomBytes(12),r=ee(),s=c.default.createCipheriv(Q,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let i=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:i.toString("hex")}},V=e=>{let t=ee(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=c.default.createDecipheriv(Q,t,r);n.setAuthTag(s);let i=n.update(e.content,"hex","utf8");return i+=n.final("utf8"),i},je=e=>c.default.createHash("sha256").update(e).digest("hex"),T=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(y.default.platform()==="darwin"){(0,A.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(y.default.platform()!=="win32"){if(y.default.platform()==="linux")try{(0,A.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=U(t);O.set(`secure_${e}`,JSON.stringify(r))},P=e=>{try{let t="XtraSecurityCLI",r=e;if(y.default.platform()==="darwin")return(0,A.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(y.default.platform()!=="win32"){if(y.default.platform()==="linux")try{return(0,A.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=O.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return V(r)}catch{return null}}});var re={};C(re,{clearConfig:()=>Re,deleteConfig:()=>_e,getAuthToken:()=>R,getBreakGlassSession:()=>Ie,getConfig:()=>j,getConfigValue:()=>Ke,getProjectConfig:()=>Be,getRcConfig:()=>L,setBreakGlassSession:()=>Ce,setConfig:()=>Ee});var ne,w,q,H,u,se,j,Ke,Ee,Re,_e,R,Ie,Ce,Be,L,E=I(()=>{ne=l(require("conf")),w=l(require("fs")),q=l(require("path"));K();H="https://www.xtrasecurity.in/api",u=new ne.default({projectName:"xtra-cli",defaults:{apiUrl:H}}),se=u.get("apiUrl");se&&!process.env.XTRA_API_URL&&se.includes("xtra-security.vercel.app")&&u.set("apiUrl",H);j=()=>({...u.store,token:R(),apiUrl:process.env.XTRA_API_URL||u.get("apiUrl")||H}),Ke=e=>e==="token"?R():u.get(e),Ee=(e,t)=>{if(e==="token"&&t&&T("token",t),u.set(e,t),e==="token"&&process.platform!=="win32"&&w.default.existsSync(u.path))try{w.default.chmodSync(u.path,384)}catch{}},Re=()=>u.clear(),_e=e=>u.delete(e),R=()=>P("token")||u.get("token"),Ie=()=>u.get("breakGlassSessionId"),Ce=e=>{e?u.set("breakGlassSessionId",e):u.delete("breakGlassSessionId")},Be=async()=>{try{let e=q.default.join(process.cwd(),"xtra.json");if(w.default.existsSync(e)){let t=w.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},L=()=>{let e={};try{let t=q.default.join(process.cwd(),".xtrarc");w.default.existsSync(t)&&(e=JSON.parse(w.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||u.get("project")||"",env:e.env||u.get("env")||"development",branch:e.branch||u.get("branch")||"main"}}});var oe,ie,ae,Oe,o,N,F=I(()=>{oe=l(require("axios"));E();ie=l(require("fs")),ae=l(require("path")),Oe=JSON.parse(ie.readFileSync(ae.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=j(),r=e||R();return oe.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":Oe.version,...r?{Authorization:`Bearer ${r}`}:{}}})},N={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,i)=>{let g=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(g&&typeof g=="object"){let a=null,{deriveProjectKey:p,decryptSecretValue:d,resolveVaultPassphrase:m,decryptWorkloadKeyEnvelope:h}=(K(),$(X));for(let[x,k]of Object.entries(g))if(typeof k=="string"&&k.startsWith("{"))try{let S=JSON.parse(k);if(S.ciphertext&&S.iv){if(!a)if(i&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)a=h(i,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let me=m(s,e);a=p(e,me)}g[x]=d(S,a)}}catch(S){if(S.message&&S.message.includes("Zero-Knowledge"))throw S}}return g},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:i,encryptSecretValue:f,resolveVaultPassphrase:g}=(K(),$(X)),a=g(void 0,e),p=i(e,a),d={};for(let[h,x]of Object.entries(r))if(typeof x=="string"&&x.startsWith("{")&&x.includes("ciphertext"))d[h]=x;else{let k=f(x,p);d[h]=JSON.stringify(k)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:d,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:i})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=j(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=j(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});var ge={};C(ge,{loadAuditLogs:()=>D,logAudit:()=>Ve,saveAuditLogs:()=>J,syncAuditLogs:()=>Le});function Ue(e){if(!e||typeof e!="object")return e;let t={...e},r=["password","token","secret","value","apiKey","secretValue"];for(let s of Object.keys(t))r.some(n=>s.toLowerCase().includes(n))&&(t[s]="[REDACTED]");return t}async function pe(e){try{if(!j().token)return!1;let r={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:Ue(e.details),timestamp:e.timestamp,projectId:e.projectId};return await N.post("/audit/cli-logs",{logs:[r]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function Ve(e,t,r,s){let n={id:(0,ce.randomUUID)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:r,details:s,synced:!1},i=D();i.push(n),J(i),pe(n).then(f=>{if(f){n.synced=!0;let g=D(),a=g.findIndex(p=>p.id===n.id);a!==-1&&(g[a].synced=!0,J(g))}}).catch(()=>{})}function D(){if(!b.default.existsSync(G))return[];try{let e=b.default.readFileSync(G,"utf-8"),t=JSON.parse(e),r=V(t);return JSON.parse(r)}catch{return[]}}function J(e){b.default.existsSync(W)||b.default.mkdirSync(W,{recursive:!0});let t=JSON.stringify(e),r=U(t);b.default.writeFileSync(G,JSON.stringify(r),"utf-8")}async function Le(){let e=D(),t=e.filter(s=>!s.synced);if(t.length===0)return 0;let r=0;for(let s of t)await pe(s)&&(s.synced=!0,r++);return r>0&&J(e),r}var b,M,ce,W,G,ue=I(()=>{b=l(require("fs")),M=l(require("path")),ce=require("crypto");K();E();F();W=M.default.join(process.cwd(),".xtra"),G=M.default.join(W,"audit.enc")});var De={};C(De,{exportCommand:()=>Ne});module.exports=$(De);var de=require("commander");F();var v=l(require("chalk")),fe=l(require("fs")),le=l(require("path")),ye=require("csv-stringify/sync");E();var Ne=new de.Command("export").description("Export secrets to a file (JSON, Dotenv, CSV)").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Environment (development, staging, production)","development").option("-b, --branch <branchName>","Branch Name").option("-f, --format <format>","Output format (json, dotenv, csv)","json").option("-o, --output <file>","Output file path (default: stdout)").option("--passphrase <passphrase>","Vault passphrase for Level 3 Zero-Knowledge decryption").action(async e=>{let{project:t,env:r,branch:s,format:n,output:i}=e;t||(t=L().project),s||(s=L().branch||"main"),r={dev:"development",stg:"staging",prod:"production"}[r]||r,t||(console.error(v.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let g=require("ora")(`Fetching secrets for export (${r} @ ${s})...`).start();try{let a=await N.getSecrets(t,r,s,e.passphrase);if(g.stop(),!a||Object.keys(a).length===0){console.warn(v.default.yellow("No secrets found to export."));return}let p="";switch(n.toLowerCase()){case"json":p=JSON.stringify(a,null,2);break;case"dotenv":p=Object.entries(a).map(([m,h])=>`${m}="${String(h).replace(/"/g,'\\"')}"`).join(`
+`);break;case"csv":let d=Object.entries(a).map(([m,h])=>({key:m,value:h}));p=(0,ye.stringify)(d,{header:!0});break;default:console.error(v.default.red(`Error: Unsupported format '${n}'. Use json, dotenv, or csv.`)),process.exit(1)}if(i){let d=le.default.resolve(process.cwd(),i);fe.default.writeFileSync(d,p,"utf-8"),console.log(v.default.green(`\u2714 Secrets exported to ${d}`))}else console.log(p);try{let{logAudit:d}=(ue(),$(ge));d("SECRET_EXPORT",t,r,{format:n,destination:i||"stdout",branch:s})}catch{}}catch(a){g.fail("Export failed."),a.message&&a.message.includes("Zero-Knowledge")&&(console.error(v.default.red(`
+[Decryption Error] ${a.message}`)),console.log(v.default.yellow("Hint: Use 'xtra project set' to save your passphrase, or pass it using --passphrase")),process.exit(1));let p=a?.response?.data?.error||a?.response?.data?.error||"An unexpected error occurred";console.error(v.default.red(p)),process.exit(1)}});0&&(module.exports={exportCommand});

package/dist/commands/generate.js

@@ -1,3 +1,3 @@
-var pt=Object.create;var x=Object.defineProperty;var gt=Object.getOwnPropertyDescriptor;var dt=Object.getOwnPropertyNames;var ut=Object.getPrototypeOf,ft=Object.prototype.hasOwnProperty;var B=(t,e)=>()=>(t&&(e=t(t=0)),e);var O=(t,e)=>{for(var s in e)x(t,s,{get:e[s],enumerable:!0})},F=(t,e,s,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of dt(e))!ft.call(t,r)&&r!==s&&x(t,r,{get:()=>e[r],enumerable:!(n=gt(e,r))||n.enumerable});return t};var c=(t,e,s)=>(s=t!=null?pt(ut(t)):{},F(e||!t||!t.__esModule?x(s,"default",{value:t,enumerable:!0}):s,t)),U=t=>F(x({},"__esModule",{value:!0}),t);var Y={};O(Y,{decrypt:()=>yt,encrypt:()=>mt,hash:()=>ht});function z(){let t=V.get("masterKey");t||(t=y.default.randomBytes(32).toString("hex"),V.set("masterKey",t));let e=(0,H.machineIdSync)();return y.default.createHash("sha256").update(t+e).digest()}var y,W,H,X,V,mt,yt,ht,Q=B(()=>{y=c(require("crypto")),W=c(require("conf")),H=require("node-machine-id"),X="aes-256-gcm",V=new W.default({projectName:"xtra-cli-crypto"});mt=t=>{let e=y.default.randomBytes(16),s=z(),n=y.default.createCipheriv(X,s,e),r=n.update(t,"utf8","hex");r+=n.final("hex");let i=n.getAuthTag();return{iv:e.toString("hex"),content:r,tag:i.toString("hex")}},yt=t=>{let e=z(),s=Buffer.from(t.iv,"hex"),n=Buffer.from(t.tag,"hex"),r=y.default.createDecipheriv(X,e,s);r.setAuthTag(n);let i=r.update(t.content,"hex","utf8");return i+=r.final("utf8"),i},ht=t=>y.default.createHash("sha256").update(t).digest("hex")});var et={};O(et,{MANIFEST_DIR:()=>k,MANIFEST_FILE:()=>I,loadManifest:()=>Z,saveManifest:()=>tt,updateManifest:()=>vt});function Z(){if(!v.default.existsSync(I))return null;try{let t=v.default.readFileSync(I,"utf-8");return JSON.parse(t)}catch{return null}}function tt(t){v.default.existsSync(k)||v.default.mkdirSync(k,{recursive:!0}),v.default.writeFileSync(I,JSON.stringify(t,null,2),"utf-8")}function vt(t,e,s,n){let r=Z()||{projectId:t,environment:e,lastSyncedAt:new Date().toISOString(),secrets:{}};r.projectId=t,r.environment=e,r.lastSyncedAt=new Date().toISOString(),Object.entries(s).forEach(([i,f])=>{let a=n(f);r.secrets[i]={hash:a,updatedAt:new Date().toISOString()}}),tt(r)}var v,L,k,I,st=B(()=>{v=c(require("fs")),L=c(require("path")),k=L.default.join(process.cwd(),".xtra"),I=L.default.join(k,"manifest.json")});var $t={};O($t,{generateCommand:()=>St});module.exports=U($t);var nt=require("commander");var q=c(require("axios"));var T=c(require("conf")),P=c(require("fs")),E=c(require("path")),M="https://www.xtrasecurity.in/api",l=new T.default({projectName:"xtra-cli",defaults:{apiUrl:M}}),_=l.get("apiUrl");_&&!process.env.XTRA_API_URL&&_.includes("xtra-security.vercel.app")&&l.set("apiUrl",M);var b=()=>({...l.store,apiUrl:process.env.XTRA_API_URL||l.get("apiUrl")||M});var D=()=>l.get("token");var N=()=>{let t={};try{let e=E.default.join(process.cwd(),".xtrarc");P.default.existsSync(e)&&(t=JSON.parse(P.default.readFileSync(e,"utf-8")))}catch{}return{project:t.project||l.get("project")||"",env:t.env||l.get("env")||"development",branch:t.branch||l.get("branch")||"main"}};var G=c(require("fs")),J=c(require("path")),lt=JSON.parse(G.readFileSync(J.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:t}=b(),e=D();return q.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":lt.version,...e?{Authorization:`Bearer ${e}`}:{}}})},K={login:async(t,e,s)=>(await o().post("/auth/cli-login",{email:t,password:e,apiKey:s})).data,getSecrets:async(t,e,s="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets?branch=${s}`)).data,getSecretVersions:async(t,e,s="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(t,e,s,n,r="main")=>(await o().post(`/projects/${t}/envs/${e}/secrets`,{secrets:s,expectedVersions:n,branch:r})).data,getSecretDetails:async(t,e,s,n="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets/${s}?branch=${n}`)).data,syncLogs:async t=>(await o().post("/audit/cli-logs",{logs:t})).data,linkSecret:async(t,e,s,n,r,i)=>(await o().post(`/projects/${t}/envs/${e}/secrets/link`,{key:s,sourceProjectId:n,sourceEnv:r,sourceKey:i})).data,rotateSecret:async(t,e,s,n,r)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/rotate`,{strategy:n,parsedNewValue:r})).data,promoteSecret:async(t,e,s)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(t,e,s,n)=>{let r={format:t};return e&&(r.startDate=e),s&&(r.endDate=s),n&&(r.projectId=n),(await o().post("/audit/export",r,{responseType:t==="csv"?"text":"json"})).data},requestAccess:async(t,e,s,n)=>(await o().post("/access/request",{projectId:t,secretId:n,reason:e,duration:s})).data,approveAccess:async(t,e)=>(await o().post("/access/approve",{requestId:t,decision:e})).data,listAccessRequests:async t=>{let{workspace:e}=b(),s=e?`&workspaceId=${e}`:"";return(await o().get(`/access/list?mode=${t}${s}`)).data},getAccessRequestStatus:async t=>(await o().get(`/access/request?id=${t}`)).data,getProjects:async()=>{let{workspace:t}=b(),e=t?`/project?workspaceId=${t}`:"/project";return(await o().get(e)).data},getBranches:async t=>(await o().get(`/branch?projectId=${t}`)).data,createBranch:async(t,e,s)=>(await o().post("/branch",{projectId:t,name:e,description:s})).data,deleteBranch:async t=>(await o().delete(`/branch/${t}`)).data,updateBranch:async(t,e)=>(await o().put("/branch",{id:t,...e})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async t=>{let e=t?`?teamId=${t}`:"";return(await o().get(`/admin/users${e}`)).data},setUserRole:async(t,e,s)=>(await o().put("/admin/users/role",{email:t,role:e,teamId:s})).data,getIntegrationStatus:async t=>(await o().get(`/integrations/${t}`)).data,getIntegrationRepos:async t=>(await o().get(`/integrations/${t}/sync`)).data.repos,syncSecretsToGithub:async t=>(await o().post("/integrations/github/sync",t)).data,exportKubernetesSecret:async(t,e)=>{let s=new URLSearchParams(e).toString();return(await o().get(`/projects/${t}/kubernetes?${s}`)).data},getSecretHistory:async(t,e,s)=>(await o().get(`/projects/${t}/envs/${e}/secrets/${s}/history`)).data,rollbackSecret:async(t,e,s,n)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/history`,{version:n})).data,cloneEnvironment:async(t,e,s,n,r)=>(await o().post(`/projects/${t}/envs/clone`,{fromEnv:e,toEnv:s,overwrite:n,branch:r})).data,generateJitLink:async t=>(await o().post("/jit/generate",t)).data,claimJitLink:async t=>(await o().post("/jit/claim",{token:t})).data,getJitInfo:async t=>(await o().get(`/jit/${t}`)).data,getServiceAccounts:async t=>(await o().get(`/projects/${t}/service-accounts`)).data,createServiceAccount:async(t,e)=>(await o().post(`/projects/${t}/service-accounts`,e)).data,deleteServiceAccount:async(t,e)=>(await o().delete(`/projects/${t}/service-accounts/${e}`)).data,getServiceAccountKeys:async(t,e)=>(await o().get(`/projects/${t}/service-accounts/${e}/keys`)).data,createServiceAccountKey:async(t,e,s,n)=>(await o().post(`/projects/${t}/service-accounts/${e}/keys`,{label:s,expiresAt:n})).data,deleteServiceAccountKey:async(t,e,s)=>(await o().delete(`/projects/${t}/service-accounts/${e}/keys/${s}`)).data,post:async(t,e)=>(await o().post(t,e)).data};var m=c(require("chalk")),rt=c(require("ora")),A=c(require("fs")),ot=c(require("path")),it=c(require("yaml"));function wt(t){let e={},s=t.split(/\r?\n/);for(let n of s){let r=n.trim();if(!r||r.startsWith("#"))continue;let i=r.indexOf("=");if(i===-1)continue;let f=r.substring(0,i).trim(),a=r.substring(i+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),e[f]=a}return e}function jt(t,e){let s=t.split(/\r?\n/),n=new Set,r=[],i=[],f=s.map(a=>{let u=a.trim();if(!u||u.startsWith("#"))return a;let g=u.indexOf("=");if(g===-1)return a;let p=u.substring(0,g).trim();return n.add(p),p in e?(wt(a)[p]!==e[p]&&i.push(p),`${p}="${e[p]}"`):a});for(let[a,u]of Object.entries(e))n.has(a)||(f.push(`${a}="${u}"`),r.push(a));return{content:f.join(`
-`),added:r,updated:i}}var St=new nt.Command("generate").description("Generate local configuration files from secrets").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Environment (dev, stg, prod)","dev").option("-b, --branch <branchName>","Branch Name").option("-o, --output <path>","Output file path (forces complete overwrite)").option("-f, --format <format>","Output format (env, json, yaml)","env").option("--force","Skip confirmation prompts",!1).action(async t=>{let{project:e,env:s,branch:n,output:r,format:i,force:f}=t;e||(e=N().project),n||(n=N().branch||"main"),s={dev:"development",stg:"staging",prod:"production"}[s]||s,e||(console.error(m.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let u=!r&&i==="env",g=r;if(!g)switch(i){case"json":g="secrets.json";break;case"yaml":g="secrets.yaml";break;default:g=".env";break}let p=ot.default.resolve(process.cwd(),g),C=A.default.existsSync(p),h=(0,rt.default)(`Fetching secrets for ${s} (branch: ${n})...`).start();try{let d=await K.getSecrets(e,s,n);if(!d||Object.keys(d).length===0){h.warn(m.default.yellow("No secrets found. File not modified."));return}let w="",S=[],$=[];if(u&&C){h.text="Merging with existing .env file...";let R=A.default.readFileSync(p,"utf-8"),j=jt(R,d);if(w=j.content,S=j.added,$=j.updated,S.length===0&&$.length===0){h.succeed(m.default.green("No changes needed - .env is already up to date."));return}}else switch(i.toLowerCase()){case"json":w=JSON.stringify(d,null,2);break;case"yaml":w=it.default.stringify(d);break;default:w=Object.entries(d).map(([R,j])=>`${R}="${j}"`).join(`
-`);break}A.default.writeFileSync(p,w,"utf-8");let{hash:at}=(Q(),U(Y)),{updateManifest:ct}=(st(),U(et));ct(e,s,d,at),u&&C?(h.succeed(m.default.green(`Updated ${g}`)),S.length>0&&console.log(m.default.cyan(`  + Added: ${S.join(", ")}`)),$.length>0&&console.log(m.default.yellow(`  ~ Updated: ${$.join(", ")}`))):h.succeed(`Generated ${g} (${Object.keys(d).length} secrets)`)}catch(d){h.fail("Failed to generate file."),console.error(m.default.red(d?.response?.data?.error||"An unexpected error occurred")),process.exit(1)}});0&&(module.exports={generateCommand});
+var Se=Object.create;var E=Object.defineProperty;var xe=Object.getOwnPropertyDescriptor;var we=Object.getOwnPropertyNames;var je=Object.getPrototypeOf,$e=Object.prototype.hasOwnProperty;var F=(e,t)=>()=>(e&&(t=e(e=0)),t);var C=(e,t)=>{for(var r in t)E(e,r,{get:t[r],enumerable:!0})},H=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of we(t))!$e.call(e,n)&&n!==r&&E(e,n,{get:()=>t[n],enumerable:!(s=xe(t,n))||s.enumerable});return e};var y=(e,t,r)=>(r=e!=null?Se(je(e)):{},H(t||!e||!e.__esModule?E(r,"default",{value:e,enumerable:!0}):r,e)),k=e=>H(E({},"__esModule",{value:!0}),e);var V={};C(V,{createWorkloadKeyEnvelope:()=>Re,decrypt:()=>ee,decryptSecretValue:()=>Pe,decryptWorkloadKeyEnvelope:()=>Ke,deriveProjectKey:()=>be,encrypt:()=>Q,encryptSecretValue:()=>Ae,hash:()=>ke,resolveVaultPassphrase:()=>te,saveVaultPassphrase:()=>Te,secureRead:()=>R,secureSave:()=>T});function z(){if(B)return B;let e=O.get("masterKey");e||(e=p.default.randomBytes(32).toString("hex"),O.set("masterKey",e));let t="";try{t=(0,Y.machineIdSync)()||""}catch{t=p.default.createHash("sha256").update(S.default.hostname()+(S.default.userInfo?.()?.username||"root")).digest("hex")}let r=S.default.platform(),s=S.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return B=p.default.createHash("sha256").update(n).digest(),B}function be(e,t){t||(t=te(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=p.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function Ae(e,t){let r=p.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=p.default.createCipheriv("aes-256-gcm",s,r),i=n.update(e,"utf8","hex");i+=n.final("hex");let u=n.getAuthTag().toString("hex");return{ciphertext:i,iv:r.toString("hex"),authTag:u}}function Pe(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),i=p.default.createDecipheriv("aes-256-gcm",r,s);i.setAuthTag(n);let u=i.update(e.ciphertext,"hex","utf8");return u+=i.final("utf8"),u}function te(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=R(`vault_${t}`);if(s)return s}let r=R("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(U(),k(re)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function Te(e,t){t&&T(`vault_${t}`,e),T("vault_passphrase",e)}function Re(e,t){let{publicKey:r,privateKey:s}=p.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),i=p.default.createPublicKey(t),u=p.default.diffieHellman({privateKey:s,publicKey:i}),a=Buffer.from(p.default.hkdfSync("sha256",u,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),c=p.default.randomBytes(12),g=p.default.createCipheriv("aes-256-gcm",a,c),d=g.update(e,"utf8","hex");d+=g.final("hex");let x=g.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:d,iv:c.toString("hex"),authTag:x}}function Ke(e,t){let r=p.default.createPrivateKey(t),s=p.default.createPublicKey(e.ephemeralPublicKey),n=p.default.diffieHellman({privateKey:r,publicKey:s}),i=Buffer.from(p.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),u=Buffer.from(e.iv,"hex"),a=Buffer.from(e.authTag,"hex"),c=p.default.createDecipheriv("aes-256-gcm",i,u);c.setAuthTag(a);let g=c.update(e.encryptedProjectKey,"hex","utf8");return g+=c.final("utf8"),g}var p,S,G,Y,P,Z,O,B,Q,ee,ke,T,R,K=F(()=>{p=y(require("crypto")),S=y(require("os")),G=y(require("conf")),Y=require("node-machine-id"),P=require("child_process"),Z="aes-256-gcm",O=new G.default({projectName:"xtra-cli-crypto"}),B=null;Q=e=>{let t=p.default.randomBytes(12),r=z(),s=p.default.createCipheriv(Z,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let i=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:i.toString("hex")}},ee=e=>{let t=z(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=p.default.createDecipheriv(Z,t,r);n.setAuthTag(s);let i=n.update(e.content,"hex","utf8");return i+=n.final("utf8"),i},ke=e=>p.default.createHash("sha256").update(e).digest("hex"),T=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(S.default.platform()==="darwin"){(0,P.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(S.default.platform()!=="win32"){if(S.default.platform()==="linux")try{(0,P.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=Q(t);O.set(`secure_${e}`,JSON.stringify(r))},R=e=>{try{let t="XtraSecurityCLI",r=e;if(S.default.platform()==="darwin")return(0,P.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(S.default.platform()!=="win32"){if(S.default.platform()==="linux")try{return(0,P.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=O.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return ee(r)}catch{return null}}});var re={};C(re,{clearConfig:()=>Ee,deleteConfig:()=>Ce,getAuthToken:()=>I,getBreakGlassSession:()=>Be,getConfig:()=>_,getConfigValue:()=>_e,getProjectConfig:()=>Ve,getRcConfig:()=>L,setBreakGlassSession:()=>Oe,setConfig:()=>Ie});var ne,j,q,J,l,se,_,_e,Ie,Ee,Ce,I,Be,Oe,Ve,L,U=F(()=>{ne=y(require("conf")),j=y(require("fs")),q=y(require("path"));K();J="https://www.xtrasecurity.in/api",l=new ne.default({projectName:"xtra-cli",defaults:{apiUrl:J}}),se=l.get("apiUrl");se&&!process.env.XTRA_API_URL&&se.includes("xtra-security.vercel.app")&&l.set("apiUrl",J);_=()=>({...l.store,token:I(),apiUrl:process.env.XTRA_API_URL||l.get("apiUrl")||J}),_e=e=>e==="token"?I():l.get(e),Ie=(e,t)=>{if(e==="token"&&t&&T("token",t),l.set(e,t),e==="token"&&process.platform!=="win32"&&j.default.existsSync(l.path))try{j.default.chmodSync(l.path,384)}catch{}},Ee=()=>l.clear(),Ce=e=>l.delete(e),I=()=>R("token")||l.get("token"),Be=()=>l.get("breakGlassSessionId"),Oe=e=>{e?l.set("breakGlassSessionId",e):l.delete("breakGlassSessionId")},Ve=async()=>{try{let e=q.default.join(process.cwd(),"xtra.json");if(j.default.existsSync(e)){let t=j.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},L=()=>{let e={};try{let t=q.default.join(process.cwd(),".xtrarc");j.default.existsSync(t)&&(e=JSON.parse(j.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||l.get("project")||"",env:e.env||l.get("env")||"development",branch:e.branch||l.get("branch")||"main"}}});var ue={};C(ue,{MANIFEST_DIR:()=>M,MANIFEST_FILE:()=>N,loadManifest:()=>pe,saveManifest:()=>ge,updateManifest:()=>Le});function pe(){if(!b.default.existsSync(N))return null;try{let e=b.default.readFileSync(N,"utf-8");return JSON.parse(e)}catch{return null}}function ge(e){b.default.existsSync(M)||b.default.mkdirSync(M,{recursive:!0}),b.default.writeFileSync(N,JSON.stringify(e,null,2),"utf-8")}function Le(e,t,r,s){let n=pe()||{projectId:e,environment:t,lastSyncedAt:new Date().toISOString(),secrets:{}};n.projectId=e,n.environment=t,n.lastSyncedAt=new Date().toISOString(),Object.entries(r).forEach(([i,u])=>{let a=s(u);n.secrets[i]={hash:a,updatedAt:new Date().toISOString()}}),ge(n)}var b,X,M,N,de=F(()=>{b=y(require("fs")),X=y(require("path")),M=X.default.join(process.cwd(),".xtra"),N=X.default.join(M,"manifest.json")});var De={};C(De,{generateCommand:()=>We});module.exports=k(De);var fe=require("commander");var oe=y(require("axios"));U();var ie=y(require("fs")),ae=y(require("path")),Ue=JSON.parse(ie.readFileSync(ae.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=_(),r=e||I();return oe.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":Ue.version,...r?{Authorization:`Bearer ${r}`}:{}}})},ce={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,i)=>{let a=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(a&&typeof a=="object"){let c=null,{deriveProjectKey:g,decryptSecretValue:d,resolveVaultPassphrase:x,decryptWorkloadKeyEnvelope:m}=(K(),k(V));for(let[f,v]of Object.entries(a))if(typeof v=="string"&&v.startsWith("{"))try{let h=JSON.parse(v);if(h.ciphertext&&h.iv){if(!c)if(i&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)c=m(i,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let $=x(s,e);c=g(e,$)}a[f]=d(h,c)}}catch(h){if(h.message&&h.message.includes("Zero-Knowledge"))throw h}}return a},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:i,encryptSecretValue:u,resolveVaultPassphrase:a}=(K(),k(V)),c=a(void 0,e),g=i(e,c),d={};for(let[m,f]of Object.entries(r))if(typeof f=="string"&&f.startsWith("{")&&f.includes("ciphertext"))d[m]=f;else{let v=u(f,g);d[m]=JSON.stringify(v)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:d,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:i})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=_(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=_(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data};var w=y(require("chalk")),le=y(require("ora")),W=y(require("fs")),ye=y(require("path")),he=y(require("yaml"));U();function Me(e){let t={},r=e.split(/\r?\n/);for(let s of r){let n=s.trim();if(!n||n.startsWith("#"))continue;let i=n.indexOf("=");if(i===-1)continue;let u=n.substring(0,i).trim(),a=n.substring(i+1).trim();(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))&&(a=a.slice(1,-1)),t[u]=a}return t}function Ne(e,t){let r=e.split(/\r?\n/),s=new Set,n=[],i=[],u=r.map(a=>{let c=a.trim();if(!c||c.startsWith("#"))return a;let g=c.indexOf("=");if(g===-1)return a;let d=c.substring(0,g).trim();return s.add(d),d in t?(Me(a)[d]!==t[d]&&i.push(d),`${d}="${t[d]}"`):a});for(let[a,c]of Object.entries(t))s.has(a)||(u.push(`${a}="${c}"`),n.push(a));return{content:u.join(`
+`),added:n,updated:i}}var We=new fe.Command("generate").description("Generate local configuration files from secrets").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Environment (dev, stg, prod)","dev").option("-b, --branch <branchName>","Branch Name").option("-o, --output <path>","Output file path (forces complete overwrite)").option("-f, --format <format>","Output format (env, json, yaml)","env").option("--force","Skip confirmation prompts",!1).action(async e=>{let{project:t,env:r,branch:s,output:n,format:i,force:u}=e;t||(t=L().project),s||(s=L().branch||"main"),r={dev:"development",stg:"staging",prod:"production"}[r]||r,t||(console.error(w.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let c=!n&&i==="env",g=n;if(!g)switch(i){case"json":g="secrets.json";break;case"yaml":g="secrets.yaml";break;default:g=".env";break}let d=ye.default.resolve(process.cwd(),g),x=W.default.existsSync(d),m=(0,le.default)(`Fetching secrets for ${r} (branch: ${s})...`).start();try{let f=await ce.getSecrets(t,r,s);if(!f||Object.keys(f).length===0){m.warn(w.default.yellow("No secrets found. File not modified."));return}let v="",h=[],$=[];if(c&&x){m.text="Merging with existing .env file...";let D=W.default.readFileSync(d,"utf-8"),A=Ne(D,f);if(v=A.content,h=A.added,$=A.updated,h.length===0&&$.length===0){m.succeed(w.default.green("No changes needed - .env is already up to date."));return}}else switch(i.toLowerCase()){case"json":v=JSON.stringify(f,null,2);break;case"yaml":v=he.default.stringify(f);break;default:v=Object.entries(f).map(([D,A])=>`${D}="${A}"`).join(`
+`);break}W.default.writeFileSync(d,v,"utf-8");let{hash:me}=(K(),k(V)),{updateManifest:ve}=(de(),k(ue));ve(t,r,f,me),c&&x?(m.succeed(w.default.green(`Updated ${g}`)),h.length>0&&console.log(w.default.cyan(`  + Added: ${h.join(", ")}`)),$.length>0&&console.log(w.default.yellow(`  ~ Updated: ${$.join(", ")}`))):m.succeed(`Generated ${g} (${Object.keys(f).length} secrets)`)}catch(f){m.fail("Failed to generate file."),console.error(w.default.red(f?.response?.data?.error||"An unexpected error occurred")),process.exit(1)}});0&&(module.exports={generateCommand});

package/dist/commands/history.js

@@ -1,4 +1,4 @@
-var C=Object.create;var g=Object.defineProperty;var U=Object.getOwnPropertyDescriptor;var R=Object.getOwnPropertyNames;var P=Object.getPrototypeOf,L=Object.prototype.hasOwnProperty;var _=(e,t)=>{for(var s in t)g(e,s,{get:t[s],enumerable:!0})},$=(e,t,s,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of R(t))!L.call(e,o)&&o!==s&&g(e,o,{get:()=>t[o],enumerable:!(r=U(t,o))||r.enumerable});return e};var p=(e,t,s)=>(s=e!=null?C(P(e)):{},$(t||!e||!e.__esModule?g(s,"default",{value:e,enumerable:!0}):s,e)),D=e=>$(g({},"__esModule",{value:!0}),e);var B={};_(B,{historyCommand:()=>I,rollbackCommand:()=>A});module.exports=D(B);var f=require("commander"),a=p(require("chalk"));var k=p(require("axios"));var j=p(require("conf")),d=p(require("fs")),S=p(require("path")),u="https://www.xtrasecurity.in/api",i=new j.default({projectName:"xtra-cli",defaults:{apiUrl:u}}),v=i.get("apiUrl");v&&!process.env.XTRA_API_URL&&v.includes("xtra-security.vercel.app")&&i.set("apiUrl",u);var l=()=>({...i.store,apiUrl:process.env.XTRA_API_URL||i.get("apiUrl")||u});var h=()=>i.get("token");var y=()=>{let e={};try{let t=S.default.join(process.cwd(),".xtrarc");d.default.existsSync(t)&&(e=JSON.parse(d.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||i.get("project")||"",env:e.env||i.get("env")||"development",branch:e.branch||i.get("branch")||"main"}};var b=p(require("fs")),x=p(require("path")),V=JSON.parse(b.readFileSync(x.join(__dirname,"../../package.json"),"utf-8")),n=()=>{let{apiUrl:e}=l(),t=h();return k.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":V.version,...t?{Authorization:`Bearer ${t}`}:{}}})},m={login:async(e,t,s)=>(await n().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await n().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await n().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,r,o="main")=>(await n().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:r,branch:o})).data,getSecretDetails:async(e,t,s,r="main")=>(await n().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${r}`)).data,syncLogs:async e=>(await n().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,r,o,c)=>(await n().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:r,sourceEnv:o,sourceKey:c})).data,rotateSecret:async(e,t,s,r,o)=>(await n().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:r,parsedNewValue:o})).data,promoteSecret:async(e,t,s)=>(await n().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await n().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,r)=>{let o={format:e};return t&&(o.startDate=t),s&&(o.endDate=s),r&&(o.projectId=r),(await n().post("/audit/export",o,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,r)=>(await n().post("/access/request",{projectId:e,secretId:r,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await n().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=l(),s=t?`&workspaceId=${t}`:"";return(await n().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await n().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=l(),t=e?`/project?workspaceId=${e}`:"/project";return(await n().get(t)).data},getBranches:async e=>(await n().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await n().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await n().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await n().put("/branch",{id:e,...t})).data,getRoles:async()=>(await n().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await n().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await n().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await n().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await n().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await n().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await n().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await n().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,r)=>(await n().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:r})).data,cloneEnvironment:async(e,t,s,r,o)=>(await n().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:r,branch:o})).data,generateJitLink:async e=>(await n().post("/jit/generate",e)).data,claimJitLink:async e=>(await n().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await n().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await n().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await n().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await n().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await n().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,s,r)=>(await n().post(`/projects/${e}/service-accounts/${t}/keys`,{label:s,expiresAt:r})).data,deleteServiceAccountKey:async(e,t,s)=>(await n().delete(`/projects/${e}/service-accounts/${t}/keys/${s}`)).data,post:async(e,t)=>(await n().post(e,t)).data};var I=new f.Command("history");I.argument("<key>","Secret key").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment","development").description("View version history of a secret").action(async(e,t)=>{try{let s=t.project;s||(s=y().project,s||(console.error(a.default.red("Error: Project ID not found. Use -p <id> or run 'xtra project set' first.")),process.exit(1)));let r=await m.getSecretHistory(s,t.env,e);console.log(a.default.bold(`
-History for ${e} (${t.env})`)),console.log(a.default.gray(`Current Version: ${r.currentVersion}
-`));let o=r.history||[];o.length===0?console.log("No history found."):o.forEach(c=>{let w=new Date(c.updatedAt).toLocaleString();console.log(a.default.blue(`v${c.version}`)+` - ${w} by ${c.updatedBy}`),c.description&&console.log(a.default.gray(`  ${c.description}`)),console.log("")})}catch(s){console.error(a.default.red("Error fetching history:"),s?.response?.data?.error||"Unknown error")}});var A=new f.Command("rollback");A.argument("<key>","Secret key").argument("<version>","Version to rollback to").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment","development").description("Rollback a secret to a previous version").action(async(e,t,s)=>{try{let r=s.project;r||(r=y().project,r||(console.error(a.default.red("Error: Project ID not found. Use -p <id> or run 'xtra project set' first.")),process.exit(1))),console.log(a.default.yellow(`Rolling back ${e} to v${t}...`));let o=await m.rollbackSecret(r,s.env,e,t);o.success?console.log(a.default.green(`
-Successfully rolled back to v${t} (New current version: v${o.version})`)):console.log(a.default.red("Rollback failed."))}catch(r){console.error(a.default.red("Error rolling back:"),r?.response?.data?.error||"Unknown error")}});0&&(module.exports={historyCommand,rollbackCommand});
+var oe=Object.create;var T=Object.defineProperty;var ie=Object.getOwnPropertyDescriptor;var ae=Object.getOwnPropertyNames;var ce=Object.getPrototypeOf,pe=Object.prototype.hasOwnProperty;var H=(e,t)=>()=>(e&&(t=e(e=0)),t);var C=(e,t)=>{for(var r in t)T(e,r,{get:t[r],enumerable:!0})},N=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of ae(t))!pe.call(e,n)&&n!==r&&T(e,n,{get:()=>t[n],enumerable:!(s=ie(t,n))||s.enumerable});return e};var y=(e,t,r)=>(r=e!=null?oe(ce(e)):{},N(t||!e||!e.__esModule?T(r,"default",{value:e,enumerable:!0}):r,e)),K=e=>N(T({},"__esModule",{value:!0}),e);var V={};C(V,{createWorkloadKeyEnvelope:()=>ye,decrypt:()=>M,decryptSecretValue:()=>de,decryptWorkloadKeyEnvelope:()=>he,deriveProjectKey:()=>ue,encrypt:()=>G,encryptSecretValue:()=>le,hash:()=>ge,resolveVaultPassphrase:()=>F,saveVaultPassphrase:()=>fe,secureRead:()=>k,secureSave:()=>$});function W(){if(R)return R;let e=_.get("masterKey");e||(e=a.default.randomBytes(32).toString("hex"),_.set("masterKey",e));let t="";try{t=(0,q.machineIdSync)()||""}catch{t=a.default.createHash("sha256").update(d.default.hostname()+(d.default.userInfo?.()?.username||"root")).digest("hex")}let r=d.default.platform(),s=d.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return R=a.default.createHash("sha256").update(n).digest(),R}function ue(e,t){t||(t=F(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=a.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function le(e,t){let r=a.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=a.default.createCipheriv("aes-256-gcm",s,r),i=n.update(e,"utf8","hex");i+=n.final("hex");let p=n.getAuthTag().toString("hex");return{ciphertext:i,iv:r.toString("hex"),authTag:p}}function de(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),i=a.default.createDecipheriv("aes-256-gcm",r,s);i.setAuthTag(n);let p=i.update(e.ciphertext,"hex","utf8");return p+=i.final("utf8"),p}function F(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=k(`vault_${t}`);if(s)return s}let r=k("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(I(),K(Y)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function fe(e,t){t&&$(`vault_${t}`,e),$("vault_passphrase",e)}function ye(e,t){let{publicKey:r,privateKey:s}=a.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),i=a.default.createPublicKey(t),p=a.default.diffieHellman({privateKey:s,publicKey:i}),l=Buffer.from(a.default.hkdfSync("sha256",p,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),g=a.default.randomBytes(12),f=a.default.createCipheriv("aes-256-gcm",l,g),h=f.update(e,"utf8","hex");h+=f.final("hex");let A=f.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:h,iv:g.toString("hex"),authTag:A}}function he(e,t){let r=a.default.createPrivateKey(t),s=a.default.createPublicKey(e.ephemeralPublicKey),n=a.default.diffieHellman({privateKey:r,publicKey:s}),i=Buffer.from(a.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),p=Buffer.from(e.iv,"hex"),l=Buffer.from(e.authTag,"hex"),g=a.default.createDecipheriv("aes-256-gcm",i,p);g.setAuthTag(l);let f=g.update(e.encryptedProjectKey,"hex","utf8");return f+=g.final("utf8"),f}var a,d,X,q,w,J,_,R,G,M,ge,$,k,E=H(()=>{a=y(require("crypto")),d=y(require("os")),X=y(require("conf")),q=require("node-machine-id"),w=require("child_process"),J="aes-256-gcm",_=new X.default({projectName:"xtra-cli-crypto"}),R=null;G=e=>{let t=a.default.randomBytes(12),r=W(),s=a.default.createCipheriv(J,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let i=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:i.toString("hex")}},M=e=>{let t=W(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=a.default.createDecipheriv(J,t,r);n.setAuthTag(s);let i=n.update(e.content,"hex","utf8");return i+=n.final("utf8"),i},ge=e=>a.default.createHash("sha256").update(e).digest("hex"),$=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(d.default.platform()==="darwin"){(0,w.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(d.default.platform()!=="win32"){if(d.default.platform()==="linux")try{(0,w.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=G(t);_.set(`secure_${e}`,JSON.stringify(r))},k=e=>{try{let t="XtraSecurityCLI",r=e;if(d.default.platform()==="darwin")return(0,w.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(d.default.platform()!=="win32"){if(d.default.platform()==="linux")try{return(0,w.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=_.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return M(r)}catch{return null}}});var Y={};C(Y,{clearConfig:()=>Se,deleteConfig:()=>xe,getAuthToken:()=>b,getBreakGlassSession:()=>we,getConfig:()=>j,getConfigValue:()=>me,getProjectConfig:()=>ke,getRcConfig:()=>B,setBreakGlassSession:()=>$e,setConfig:()=>ve});var z,S,U,L,c,Z,j,me,ve,Se,xe,b,we,$e,ke,B,I=H(()=>{z=y(require("conf")),S=y(require("fs")),U=y(require("path"));E();L="https://www.xtrasecurity.in/api",c=new z.default({projectName:"xtra-cli",defaults:{apiUrl:L}}),Z=c.get("apiUrl");Z&&!process.env.XTRA_API_URL&&Z.includes("xtra-security.vercel.app")&&c.set("apiUrl",L);j=()=>({...c.store,token:b(),apiUrl:process.env.XTRA_API_URL||c.get("apiUrl")||L}),me=e=>e==="token"?b():c.get(e),ve=(e,t)=>{if(e==="token"&&t&&$("token",t),c.set(e,t),e==="token"&&process.platform!=="win32"&&S.default.existsSync(c.path))try{S.default.chmodSync(c.path,384)}catch{}},Se=()=>c.clear(),xe=e=>c.delete(e),b=()=>k("token")||c.get("token"),we=()=>c.get("breakGlassSessionId"),$e=e=>{e?c.set("breakGlassSessionId",e):c.delete("breakGlassSessionId")},ke=async()=>{try{let e=U.default.join(process.cwd(),"xtra.json");if(S.default.existsSync(e)){let t=S.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},B=()=>{let e={};try{let t=U.default.join(process.cwd(),".xtrarc");S.default.existsSync(t)&&(e=JSON.parse(S.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||c.get("project")||"",env:e.env||c.get("env")||"development",branch:e.branch||c.get("branch")||"main"}}});var be={};C(be,{historyCommand:()=>re,rollbackCommand:()=>se});module.exports=K(be);var D=require("commander"),u=y(require("chalk"));var Q=y(require("axios"));I();var ee=y(require("fs")),te=y(require("path")),je=JSON.parse(ee.readFileSync(te.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=j(),r=e||b();return Q.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":je.version,...r?{Authorization:`Bearer ${r}`}:{}}})},O={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,i)=>{let l=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(l&&typeof l=="object"){let g=null,{deriveProjectKey:f,decryptSecretValue:h,resolveVaultPassphrase:A,decryptWorkloadKeyEnvelope:P}=(E(),K(V));for(let[m,x]of Object.entries(l))if(typeof x=="string"&&x.startsWith("{"))try{let v=JSON.parse(x);if(v.ciphertext&&v.iv){if(!g)if(i&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)g=P(i,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let ne=A(s,e);g=f(e,ne)}l[m]=h(v,g)}}catch(v){if(v.message&&v.message.includes("Zero-Knowledge"))throw v}}return l},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:i,encryptSecretValue:p,resolveVaultPassphrase:l}=(E(),K(V)),g=l(void 0,e),f=i(e,g),h={};for(let[P,m]of Object.entries(r))if(typeof m=="string"&&m.startsWith("{")&&m.includes("ciphertext"))h[P]=m;else{let x=p(m,f);h[P]=JSON.stringify(x)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:h,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:i})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=j(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=j(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data};I();var re=new D.Command("history");re.argument("<key>","Secret key").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment","development").description("View version history of a secret").action(async(e,t)=>{try{let r=t.project;r||(r=B().project,r||(console.error(u.default.red("Error: Project ID not found. Use -p <id> or run 'xtra project set' first.")),process.exit(1)));let s=await O.getSecretHistory(r,t.env,e);console.log(u.default.bold(`
+History for ${e} (${t.env})`)),console.log(u.default.gray(`Current Version: ${s.currentVersion}
+`));let n=s.history||[];n.length===0?console.log("No history found."):n.forEach(i=>{let p=new Date(i.updatedAt).toLocaleString();console.log(u.default.blue(`v${i.version}`)+` - ${p} by ${i.updatedBy}`),i.description&&console.log(u.default.gray(`  ${i.description}`)),console.log("")})}catch(r){console.error(u.default.red("Error fetching history:"),r?.response?.data?.error||"Unknown error")}});var se=new D.Command("rollback");se.argument("<key>","Secret key").argument("<version>","Version to rollback to").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment","development").description("Rollback a secret to a previous version").action(async(e,t,r)=>{try{let s=r.project;s||(s=B().project,s||(console.error(u.default.red("Error: Project ID not found. Use -p <id> or run 'xtra project set' first.")),process.exit(1))),console.log(u.default.yellow(`Rolling back ${e} to v${t}...`));let n=await O.rollbackSecret(s,r.env,e,t);n.success?console.log(u.default.green(`
+Successfully rolled back to v${t} (New current version: v${n.version})`)):console.log(u.default.red("Rollback failed."))}catch(s){console.error(u.default.red("Error rolling back:"),s?.response?.data?.error||"Unknown error")}});0&&(module.exports={historyCommand,rollbackCommand});