xtra-cli 1.0.8 → 1.0.9

package/dist/bin/xtra.js

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
-var ge=Object.create;var S=Object.defineProperty;var ue=Object.getOwnPropertyDescriptor;var le=Object.getOwnPropertyNames;var fe=Object.getPrototypeOf,ye=Object.prototype.hasOwnProperty;var x=(e,t)=>()=>(e&&(t=e(e=0)),t);var b=(e,t)=>{for(var s in t)S(e,s,{get:t[s],enumerable:!0})},E=(e,t,s,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of le(t))!ye.call(e,n)&&n!==s&&S(e,n,{get:()=>t[n],enumerable:!(r=ue(t,n))||r.enumerable});return e};var c=(e,t,s)=>(s=e!=null?ge(fe(e)):{},E(t||!e||!e.__esModule?S(s,"default",{value:e,enumerable:!0}):s,e)),C=e=>E(S({},"__esModule",{value:!0}),e);var B={};b(B,{createProfile:()=>xe,deleteProfile:()=>ve,getActiveProfile:()=>O,getActiveProfileName:()=>$,getProfileValue:()=>Se,listProfiles:()=>m,setActiveProfile:()=>he,setProfileValue:()=>we,useProfile:()=>Ce});function m(){return d.get("profiles")||{}}function $(){return process.env.XTRA_PROFILE||d.get("activeProfile")||"default"}function O(){let e=$();return m()[e]||{}}function he(e){if(!m()[e])throw new Error(`Profile '${e}' does not exist. Create it first with 'xtra profile create ${e}'.`);d.set("activeProfile",e)}function xe(e,t={}){let s=m();if(s[e])throw new Error(`Profile '${e}' already exists. Use 'xtra profile set' to edit it.`);s[e]={apiUrl:process.env.XTRA_API_URL||"https://www.xtrasecurity.in/api",...t},d.set("profiles",s)}function ve(e){if(e==="default")throw new Error("Cannot delete the 'default' profile.");let t=m();if(!t[e])throw new Error(`Profile '${e}' not found.`);delete t[e],d.set("profiles",t),$()===e&&d.set("activeProfile","default")}function we(e,t,s){let r=m();if(!r[e])throw new Error(`Profile '${e}' not found.`);r[e][t]=s,d.set("profiles",r)}function Se(e){return O()[e]}function Ce(e){if(!m()[e])throw new Error(`Profile '${e}' does not exist. Run 'xtra profile create ${e}' first.`);process.env.XTRA_PROFILE=e}var N,d,M=x(()=>{N=c(require("conf")),d=new N.default({projectName:"xtra-cli",defaults:{activeProfile:"default",profiles:{default:{apiUrl:process.env.XTRA_API_URL||"https://www.xtrasecurity.in/api"}}}})});var R={};b(R,{clearConfig:()=>be,deleteConfig:()=>$e,getAuthToken:()=>I,getBreakGlassSession:()=>Ae,getConfig:()=>u,getConfigValue:()=>je,getProjectConfig:()=>Pe,getRcConfig:()=>Re,setBreakGlassSession:()=>Ie,setConfig:()=>ke});var q,g,P,A,i,J,u,je,ke,be,$e,I,Ae,Ie,Pe,Re,v=x(()=>{q=c(require("conf")),g=c(require("fs")),P=c(require("path")),A="https://www.xtrasecurity.in/api",i=new q.default({projectName:"xtra-cli",defaults:{apiUrl:A}}),J=i.get("apiUrl");J&&!process.env.XTRA_API_URL&&J.includes("xtra-security.vercel.app")&&i.set("apiUrl",A);u=()=>({...i.store,apiUrl:process.env.XTRA_API_URL||i.get("apiUrl")||A}),je=e=>i.get(e),ke=(e,t)=>{if(i.set(e,t),e==="token"&&process.platform!=="win32"&&g.default.existsSync(i.path))try{g.default.chmodSync(i.path,384)}catch{}},be=()=>i.clear(),$e=e=>i.delete(e),I=()=>i.get("token"),Ae=()=>i.get("breakGlassSessionId"),Ie=e=>{e?i.set("breakGlassSessionId",e):i.delete("breakGlassSessionId")},Pe=async()=>{try{let e=P.default.join(process.cwd(),"xtra.json");if(g.default.existsSync(e)){let t=g.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},Re=()=>{let e={};try{let t=P.default.join(process.cwd(),".xtrarc");g.default.existsSync(t)&&(e=JSON.parse(g.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||i.get("project")||"",env:e.env||i.get("env")||"development",branch:e.branch||i.get("branch")||"main"}}});function X(){let e=G.get("masterKey");e||(e=l.default.randomBytes(32).toString("hex"),G.set("masterKey",e));let t=(0,K.machineIdSync)();return l.default.createHash("sha256").update(e+t).digest()}var l,F,K,V,G,z,H,W=x(()=>{l=c(require("crypto")),F=c(require("conf")),K=require("node-machine-id"),V="aes-256-gcm",G=new F.default({projectName:"xtra-cli-crypto"});z=e=>{let t=l.default.randomBytes(16),s=X(),r=l.default.createCipheriv(V,s,t),n=r.update(e,"utf8","hex");n+=r.final("hex");let a=r.getAuthTag();return{iv:t.toString("hex"),content:n,tag:a.toString("hex")}},H=e=>{let t=X(),s=Buffer.from(e.iv,"hex"),r=Buffer.from(e.tag,"hex"),n=l.default.createDecipheriv(V,t,s);n.setAuthTag(r);let a=n.update(e.content,"hex","utf8");return a+=n.final("utf8"),a}});var Y,Q,Z,Le,o,ee,te=x(()=>{Y=c(require("axios"));v();Q=c(require("fs")),Z=c(require("path")),Le=JSON.parse(Q.readFileSync(Z.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:e}=u(),t=I();return Y.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":Le.version,...t?{Authorization:`Bearer ${t}`}:{}}})},ee={login:async(e,t,s)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,r,n="main")=>(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:r,branch:n})).data,getSecretDetails:async(e,t,s,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${r}`)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,r,n,a)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:r,sourceEnv:n,sourceKey:a})).data,rotateSecret:async(e,t,s,r,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:r,parsedNewValue:n})).data,promoteSecret:async(e,t,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,r)=>{let n={format:e};return t&&(n.startDate=t),s&&(n.endDate=s),r&&(n.projectId=r),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,r)=>(await o().post("/access/request",{projectId:e,secretId:r,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=u(),s=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=u(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await o().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:r})).data,cloneEnvironment:async(e,t,s,r,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:r,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,s,r)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:s,expiresAt:r})).data,deleteServiceAccountKey:async(e,t,s)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${s}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});var ne={};b(ne,{loadAuditLogs:()=>j,logAudit:()=>Te,saveAuditLogs:()=>k,syncAuditLogs:()=>_e});function Ue(e){if(!e||typeof e!="object")return e;let t={...e},s=["password","token","secret","value","apiKey","secretValue"];for(let r of Object.keys(t))s.some(n=>r.toLowerCase().includes(n))&&(t[r]="[REDACTED]");return t}async function re(e){try{if(!u().token)return!1;let s={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:Ue(e.details),timestamp:e.timestamp,projectId:e.projectId};return await ee.post("/audit/cli-logs",{logs:[s]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function Te(e,t,s,r){let n={id:(0,se.v4)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:s,details:r,synced:!1},a=j();a.push(n),k(a),re(n).then(w=>{if(w){n.synced=!0;let h=j(),D=h.findIndex(me=>me.id===n.id);D!==-1&&(h[D].synced=!0,k(h))}}).catch(()=>{})}function j(){if(!f.default.existsSync(U))return[];try{let e=f.default.readFileSync(U,"utf-8"),t=JSON.parse(e),s=H(t);return JSON.parse(s)}catch{return[]}}function k(e){f.default.existsSync(L)||f.default.mkdirSync(L,{recursive:!0});let t=JSON.stringify(e),s=z(t);f.default.writeFileSync(U,JSON.stringify(s),"utf-8")}async function _e(){let e=j(),t=e.filter(r=>!r.synced);if(t.length===0)return 0;let s=0;for(let r of t)await re(r)&&(r.synced=!0,s++);return s>0&&k(e),s}var f,T,se,L,U,oe=x(()=>{f=c(require("fs")),T=c(require("path")),se=require("uuid");W();v();te();L=T.default.join(process.cwd(),".xtra"),U=T.default.join(L,"audit.enc")});var ie=require("commander"),ae=c(require("fs")),ce=c(require("path")),pe=c(require("update-notifier")),p=new ie.Command,de=JSON.parse(ae.readFileSync(ce.join(__dirname,"../../package.json"),"utf-8"));(0,pe.default)({pkg:de}).notify();p.name("xtra").description("XtraSync CLI - Secure Runtime Secret Injection").version(de.version).option("--profile <name>","Use a specific named profile for this command");var _={login:{module:"../commands/login",export:"loginCommand",desc:"Authenticate with XtraSecurity"},logout:{module:"../commands/logout",export:"logoutCommand",desc:"Logout and clear local token"},run:{module:"../commands/run",export:"runCommand",desc:"Run a command with injected secrets"},"jit-run":{module:"../commands/jit-run",export:"jitRunCommand",desc:"Run with temporary JIT access"},secrets:{module:"../commands/secrets",export:"secretsCommand",desc:"Manage secrets (List, Set, Delete)"},generate:{module:"../commands/generate",export:"generateCommand",desc:"Generate secret values"},status:{module:"../commands/status",export:"statusCommand",desc:"Check synchronization status"},diff:{module:"../commands/diff",export:"diffCommand",desc:"Show differences between environments"},rollback:{module:"../commands/rollback",export:"rollbackCommand",desc:"Rollback secrets to a previous version"},scan:{module:"../commands/scan",export:"scanCommand",desc:"Scan codebase for hardcoded secrets"},logs:{module:"../commands/logs",export:"logsCommand",desc:"View activity and audit logs"},export:{module:"../commands/export",export:"exportCommand",desc:"Export secrets to various formats"},import:{module:"../commands/import",export:"importCommand",desc:"Import secrets from files"},rotate:{module:"../commands/rotate",export:"rotateCommand",desc:"Trigger secret rotation"},audit:{module:"../commands/audit",export:"auditCommand",desc:"Manage audit configurations"},access:{module:"../commands/access",export:"accessCommand",desc:"Manage Just-in-Time access requests"},branch:{module:"../commands/branch",export:"branchCommand",desc:"Manage secret branches"},checkout:{module:"../commands/checkout",export:"checkoutCommand",desc:"Switch between branches"},project:{module:"../commands/project",export:"projectCommand",desc:"Manage project configuration"},admin:{module:"../commands/admin",export:"adminCommand",desc:"Administrative tasks (Roles, Teams)"},integration:{module:"../commands/integration",export:"integrationCommand",desc:"Sync secrets to external platforms"},kubernetes:{module:"../commands/integration",export:"kubernetesCommand",desc:"Kubernetes specific integrations"},history:{module:"../commands/history",export:"historyCommand",desc:"View secret version history"},env:{module:"../commands/env",export:"envCommand",desc:"Manage environments"},ui:{module:"../commands/ui",export:"uiCommand",desc:"Launch interactive TUI dashboard"},completion:{module:"../commands/completion",export:"completionCommand",desc:"Generate shell completion"},profile:{module:"../commands/profile",export:"profileCommand",desc:"Manage CLI profiles"},ci:{module:"../commands/ci",export:"ciCommand",desc:"CI/CD integration helpers"},"service-account":{module:"../commands/service-account",export:"serviceAccountCommand",desc:"Manage service accounts and machine tokens"},sa:{module:"../commands/service-account",export:"serviceAccountCommand",desc:"Manage service accounts and machine tokens"},template:{module:"../commands/template",export:"templateCommand",desc:"Manage secret templates"},doctor:{module:"../commands/doctor",export:"doctorCommand",desc:"Diagnose CLI configuration issues"},init:{module:"../commands/init",export:"initCommand",desc:"Initialize XtraSecurity in current directory"},watch:{module:"../commands/watch",export:"watchCommand",desc:"Watch for secret changes in real-time"},simulate:{module:"../commands/simulate",export:"simulateCommand",desc:"Simulate secret access behavior"},local:{module:"../commands/local",export:"localCommand",desc:"Manage local secret overrides"}},De=new Set(["login","logout","completion","doctor","help","jit-run","ci"]);p.hook("preSubcommand",(e,t)=>{let s=e.opts().profile;if(s){let{useProfile:w}=(M(),C(B));try{w(s)}catch(h){console.error(`\x1B[31mError: ${h?.response?.data?.error||"An unexpected error occurred"}\x1B[0m`),process.exit(1)}}let r=t.name();if(De.has(r))return;let{getAuthToken:n}=(v(),C(R));n()||(console.error(`\x1B[31m\u2716 You are not logged in.\x1B[0m
+var Pe=Object.create;var B=Object.defineProperty;var je=Object.getOwnPropertyDescriptor;var $e=Object.getOwnPropertyNames;var Te=Object.getPrototypeOf,Re=Object.prototype.hasOwnProperty;var $=(e,t)=>()=>(e&&(t=e(e=0)),t);var U=(e,t)=>{for(var r in t)B(e,r,{get:t[r],enumerable:!0})},Q=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of $e(t))!Re.call(e,n)&&n!==r&&B(e,n,{get:()=>t[n],enumerable:!(s=je(t,n))||s.enumerable});return e};var u=(e,t,r)=>(r=e!=null?Pe(Te(e)):{},Q(t||!e||!e.__esModule?B(r,"default",{value:e,enumerable:!0}):r,e)),x=e=>Q(B({},"__esModule",{value:!0}),e);var re={};U(re,{createProfile:()=>_e,deleteProfile:()=>Ee,getActiveProfile:()=>te,getActiveProfileName:()=>q,getProfileValue:()=>Le,listProfiles:()=>S,setActiveProfile:()=>Ie,setProfileValue:()=>Ke,useProfile:()=>Be});function S(){return w.get("profiles")||{}}function q(){return process.env.XTRA_PROFILE||w.get("activeProfile")||"default"}function te(){let e=q();return S()[e]||{}}function Ie(e){if(!S()[e])throw new Error(`Profile '${e}' does not exist. Create it first with 'xtra profile create ${e}'.`);w.set("activeProfile",e)}function _e(e,t={}){let r=S();if(r[e])throw new Error(`Profile '${e}' already exists. Use 'xtra profile set' to edit it.`);r[e]={apiUrl:process.env.XTRA_API_URL||"https://www.xtrasecurity.in/api",...t},w.set("profiles",r)}function Ee(e){if(e==="default")throw new Error("Cannot delete the 'default' profile.");let t=S();if(!t[e])throw new Error(`Profile '${e}' not found.`);delete t[e],w.set("profiles",t),q()===e&&w.set("activeProfile","default")}function Ke(e,t,r){let s=S();if(!s[e])throw new Error(`Profile '${e}' not found.`);s[e][t]=r,w.set("profiles",s)}function Le(e){return te()[e]}function Be(e){if(!S()[e])throw new Error(`Profile '${e}' does not exist. Run 'xtra profile create ${e}' first.`);process.env.XTRA_PROFILE=e}var ee,w,se=$(()=>{ee=u(require("conf")),w=new ee.default({projectName:"xtra-cli",defaults:{activeProfile:"default",profiles:{default:{apiUrl:process.env.XTRA_API_URL||"https://www.xtrasecurity.in/api"}}}})});var G={};U(G,{createWorkloadKeyEnvelope:()=>Me,decrypt:()=>N,decryptSecretValue:()=>Ve,decryptWorkloadKeyEnvelope:()=>Xe,deriveProjectKey:()=>Oe,encrypt:()=>V,encryptSecretValue:()=>De,hash:()=>Ue,resolveVaultPassphrase:()=>ce,saveVaultPassphrase:()=>Ne,secureRead:()=>I,secureSave:()=>R});function ae(){if(O)return O;let e=D.get("masterKey");e||(e=a.default.randomBytes(32).toString("hex"),D.set("masterKey",e));let t="";try{t=(0,oe.machineIdSync)()||""}catch{t=a.default.createHash("sha256").update(l.default.hostname()+(l.default.userInfo?.()?.username||"root")).digest("hex")}let r=l.default.platform(),s=l.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return O=a.default.createHash("sha256").update(n).digest(),O}function Oe(e,t){t||(t=ce(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=a.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function De(e,t){let r=a.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=a.default.createCipheriv("aes-256-gcm",s,r),i=n.update(e,"utf8","hex");i+=n.final("hex");let d=n.getAuthTag().toString("hex");return{ciphertext:i,iv:r.toString("hex"),authTag:d}}function Ve(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),i=a.default.createDecipheriv("aes-256-gcm",r,s);i.setAuthTag(n);let d=i.update(e.ciphertext,"hex","utf8");return d+=i.final("utf8"),d}function ce(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=I(`vault_${t}`);if(s)return s}let r=I("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(b(),x(M)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function Ne(e,t){t&&R(`vault_${t}`,e),R("vault_passphrase",e)}function Me(e,t){let{publicKey:r,privateKey:s}=a.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),i=a.default.createPublicKey(t),d=a.default.diffieHellman({privateKey:s,publicKey:i}),c=Buffer.from(a.default.hkdfSync("sha256",d,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),g=a.default.randomBytes(12),m=a.default.createCipheriv("aes-256-gcm",c,g),f=m.update(e,"utf8","hex");f+=m.final("hex");let K=m.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:f,iv:g.toString("hex"),authTag:K}}function Xe(e,t){let r=a.default.createPrivateKey(t),s=a.default.createPublicKey(e.ephemeralPublicKey),n=a.default.diffieHellman({privateKey:r,publicKey:s}),i=Buffer.from(a.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),d=Buffer.from(e.iv,"hex"),c=Buffer.from(e.authTag,"hex"),g=a.default.createDecipheriv("aes-256-gcm",i,d);g.setAuthTag(c);let m=g.update(e.encryptedProjectKey,"hex","utf8");return m+=g.final("utf8"),m}var a,l,ne,oe,T,ie,D,O,V,N,Ue,R,I,_=$(()=>{a=u(require("crypto")),l=u(require("os")),ne=u(require("conf")),oe=require("node-machine-id"),T=require("child_process"),ie="aes-256-gcm",D=new ne.default({projectName:"xtra-cli-crypto"}),O=null;V=e=>{let t=a.default.randomBytes(12),r=ae(),s=a.default.createCipheriv(ie,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let i=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:i.toString("hex")}},N=e=>{let t=ae(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=a.default.createDecipheriv(ie,t,r);n.setAuthTag(s);let i=n.update(e.content,"hex","utf8");return i+=n.final("utf8"),i},Ue=e=>a.default.createHash("sha256").update(e).digest("hex"),R=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(l.default.platform()==="darwin"){(0,T.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(l.default.platform()!=="win32"){if(l.default.platform()==="linux")try{(0,T.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=V(t);D.set(`secure_${e}`,JSON.stringify(r))},I=e=>{try{let t="XtraSecurityCLI",r=e;if(l.default.platform()==="darwin")return(0,T.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(l.default.platform()!=="win32"){if(l.default.platform()==="linux")try{return(0,T.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=D.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return N(r)}catch{return null}}});var M={};U(M,{clearConfig:()=>Ge,deleteConfig:()=>Fe,getAuthToken:()=>E,getBreakGlassSession:()=>He,getConfig:()=>A,getConfigValue:()=>Je,getProjectConfig:()=>ze,getRcConfig:()=>Ye,setBreakGlassSession:()=>We,setConfig:()=>qe});var de,k,F,H,p,pe,A,Je,qe,Ge,Fe,E,He,We,ze,Ye,b=$(()=>{de=u(require("conf")),k=u(require("fs")),F=u(require("path"));_();H="https://www.xtrasecurity.in/api",p=new de.default({projectName:"xtra-cli",defaults:{apiUrl:H}}),pe=p.get("apiUrl");pe&&!process.env.XTRA_API_URL&&pe.includes("xtra-security.vercel.app")&&p.set("apiUrl",H);A=()=>({...p.store,token:E(),apiUrl:process.env.XTRA_API_URL||p.get("apiUrl")||H}),Je=e=>e==="token"?E():p.get(e),qe=(e,t)=>{if(e==="token"&&t&&R("token",t),p.set(e,t),e==="token"&&process.platform!=="win32"&&k.default.existsSync(p.path))try{k.default.chmodSync(p.path,384)}catch{}},Ge=()=>p.clear(),Fe=e=>p.delete(e),E=()=>I("token")||p.get("token"),He=()=>p.get("breakGlassSessionId"),We=e=>{e?p.set("breakGlassSessionId",e):p.delete("breakGlassSessionId")},ze=async()=>{try{let e=F.default.join(process.cwd(),"xtra.json");if(k.default.existsSync(e)){let t=k.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},Ye=()=>{let e={};try{let t=F.default.join(process.cwd(),".xtrarc");k.default.existsSync(t)&&(e=JSON.parse(k.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||p.get("project")||"",env:e.env||p.get("env")||"development",branch:e.branch||p.get("branch")||"main"}}});var ge,ue,me,Ze,o,le,fe=$(()=>{ge=u(require("axios"));b();ue=u(require("fs")),me=u(require("path")),Ze=JSON.parse(ue.readFileSync(me.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=A(),r=e||E();return ge.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":Ze.version,...r?{Authorization:`Bearer ${r}`}:{}}})},le={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,i)=>{let c=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(c&&typeof c=="object"){let g=null,{deriveProjectKey:m,decryptSecretValue:f,resolveVaultPassphrase:K,decryptWorkloadKeyEnvelope:L}=(_(),x(G));for(let[h,j]of Object.entries(c))if(typeof j=="string"&&j.startsWith("{"))try{let v=JSON.parse(j);if(v.ciphertext&&v.iv){if(!g)if(i&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)g=L(i,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let Ce=K(s,e);g=m(e,Ce)}c[h]=f(v,g)}}catch(v){if(v.message&&v.message.includes("Zero-Knowledge"))throw v}}return c},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:i,encryptSecretValue:d,resolveVaultPassphrase:c}=(_(),x(G)),g=c(void 0,e),m=i(e,g),f={};for(let[L,h]of Object.entries(r))if(typeof h=="string"&&h.startsWith("{")&&h.includes("ciphertext"))f[L]=h;else{let j=d(h,m);f[L]=JSON.stringify(j)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:f,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:i})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=A(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=A(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});var ve={};U(ve,{loadAuditLogs:()=>X,logAudit:()=>et,saveAuditLogs:()=>J,syncAuditLogs:()=>tt});function Qe(e){if(!e||typeof e!="object")return e;let t={...e},r=["password","token","secret","value","apiKey","secretValue"];for(let s of Object.keys(t))r.some(n=>s.toLowerCase().includes(n))&&(t[s]="[REDACTED]");return t}async function he(e){try{if(!A().token)return!1;let r={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:Qe(e.details),timestamp:e.timestamp,projectId:e.projectId};return await le.post("/audit/cli-logs",{logs:[r]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function et(e,t,r,s){let n={id:(0,ye.randomUUID)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:r,details:s,synced:!1},i=X();i.push(n),J(i),he(n).then(d=>{if(d){n.synced=!0;let c=X(),g=c.findIndex(m=>m.id===n.id);g!==-1&&(c[g].synced=!0,J(c))}}).catch(()=>{})}function X(){if(!C.default.existsSync(z))return[];try{let e=C.default.readFileSync(z,"utf-8"),t=JSON.parse(e),r=N(t);return JSON.parse(r)}catch{return[]}}function J(e){C.default.existsSync(W)||C.default.mkdirSync(W,{recursive:!0});let t=JSON.stringify(e),r=V(t);C.default.writeFileSync(z,JSON.stringify(r),"utf-8")}async function tt(){let e=X(),t=e.filter(s=>!s.synced);if(t.length===0)return 0;let r=0;for(let s of t)await he(s)&&(s.synced=!0,r++);return r>0&&J(e),r}var C,Y,ye,W,z,xe=$(()=>{C=u(require("fs")),Y=u(require("path")),ye=require("crypto");_();b();fe();W=Y.default.join(process.cwd(),".xtra"),z=Y.default.join(W,"audit.enc")});var we=require("commander"),Se=u(require("fs")),ke=u(require("path")),Ae=u(require("update-notifier")),y=new we.Command,be=JSON.parse(Se.readFileSync(ke.join(__dirname,"../../package.json"),"utf-8"));(0,Ae.default)({pkg:be}).notify();y.name("xtra").description("XtraSync CLI - Secure Runtime Secret Injection").version(be.version).option("--profile <name>","Use a specific named profile for this command");var Z={login:{module:"../commands/login",export:"loginCommand",desc:"Authenticate with XtraSecurity"},logout:{module:"../commands/logout",export:"logoutCommand",desc:"Logout and clear local token"},run:{module:"../commands/run",export:"runCommand",desc:"Run a command with injected secrets"},"jit-run":{module:"../commands/jit-run",export:"jitRunCommand",desc:"Run with temporary JIT access"},secrets:{module:"../commands/secrets",export:"secretsCommand",desc:"Manage secrets (List, Set, Delete)"},generate:{module:"../commands/generate",export:"generateCommand",desc:"Generate secret values"},status:{module:"../commands/status",export:"statusCommand",desc:"Check synchronization status"},diff:{module:"../commands/diff",export:"diffCommand",desc:"Show differences between environments"},rollback:{module:"../commands/rollback",export:"rollbackCommand",desc:"Rollback secrets to a previous version"},scan:{module:"../commands/scan",export:"scanCommand",desc:"Scan codebase for hardcoded secrets"},logs:{module:"../commands/logs",export:"logsCommand",desc:"View activity and audit logs"},export:{module:"../commands/export",export:"exportCommand",desc:"Export secrets to various formats"},import:{module:"../commands/import",export:"importCommand",desc:"Import secrets from files"},rotate:{module:"../commands/rotate",export:"rotateCommand",desc:"Trigger secret rotation"},audit:{module:"../commands/audit",export:"auditCommand",desc:"Manage audit configurations"},access:{module:"../commands/access",export:"accessCommand",desc:"Manage Just-in-Time access requests"},branch:{module:"../commands/branch",export:"branchCommand",desc:"Manage secret branches"},checkout:{module:"../commands/checkout",export:"checkoutCommand",desc:"Switch between branches"},project:{module:"../commands/project",export:"projectCommand",desc:"Manage project configuration"},admin:{module:"../commands/admin",export:"adminCommand",desc:"Administrative tasks (Roles, Teams)"},integration:{module:"../commands/integration",export:"integrationCommand",desc:"Sync secrets to external platforms"},kubernetes:{module:"../commands/integration",export:"kubernetesCommand",desc:"Kubernetes specific integrations"},history:{module:"../commands/history",export:"historyCommand",desc:"View secret version history"},env:{module:"../commands/env",export:"envCommand",desc:"Manage environments"},ui:{module:"../commands/ui",export:"uiCommand",desc:"Launch interactive TUI dashboard"},completion:{module:"../commands/completion",export:"completionCommand",desc:"Generate shell completion"},profile:{module:"../commands/profile",export:"profileCommand",desc:"Manage CLI profiles"},ci:{module:"../commands/ci",export:"ciCommand",desc:"CI/CD integration helpers"},"service-account":{module:"../commands/service-account",export:"serviceAccountCommand",desc:"Manage service accounts and machine tokens"},sa:{module:"../commands/service-account",export:"serviceAccountCommand",desc:"Manage service accounts and machine tokens"},template:{module:"../commands/template",export:"templateCommand",desc:"Manage secret templates"},doctor:{module:"../commands/doctor",export:"doctorCommand",desc:"Diagnose CLI configuration issues"},init:{module:"../commands/init",export:"initCommand",desc:"Initialize XtraSecurity in current directory"},watch:{module:"../commands/watch",export:"watchCommand",desc:"Watch for secret changes in real-time"},simulate:{module:"../commands/simulate",export:"simulateCommand",desc:"Simulate secret access behavior"},local:{module:"../commands/local",export:"localCommand",desc:"Manage local secret overrides"},"oidc-link":{module:"../commands/oidc-link",export:"oidcLinkCommand",desc:"Link a CI/CD workload via OIDC and generate an Envelope"},agent:{module:"../commands/agent",export:"agentCommand",desc:"Manage AI Agent Ephemeral Contexts"}},rt=new Set(["login","logout","completion","doctor","help","jit-run","ci"]);y.hook("preSubcommand",(e,t)=>{let r=e.opts().profile;if(r){let{useProfile:d}=(se(),x(re));try{d(r)}catch(c){console.error(`\x1B[31mError: ${c?.response?.data?.error||"An unexpected error occurred"}\x1B[0m`),process.exit(1)}}let s=t.name();if(rt.has(s))return;let{getAuthToken:n}=(b(),x(M));n()||(console.error(`\x1B[31m\u2716 You are not logged in.\x1B[0m
   Run \x1B[36mxtra login\x1B[0m to authenticate before using this command.
-`),process.exit(1))});p.hook("postAction",(e,t)=>{let{getBreakGlassSession:s}=(v(),C(R)),r=s();if(r){let{logAudit:n}=(oe(),C(ne));n("BREAK_GLASS_CLI_ACTIVITY",null,null,{command:t.name(),args:t.args,options:t.opts(),sessionId:r})}});var Ee=process.argv.slice(2),y=Ee.find(e=>!e.startsWith("-"));if(y&&_[y]){let e=_[y];try{let s=require(e.module)[e.export||`${y}Command`];s?p.addCommand(s):p.command(y).description(e.desc||"")}catch{p.command(y).description(e.desc||"")}}else Object.entries(_).forEach(([e,t])=>{p.command(e).description(t.desc||"")});p.parse(process.argv);
+`),process.exit(1))});y.hook("postAction",(e,t)=>{let{getBreakGlassSession:r}=(b(),x(M)),s=r();if(s){let{logAudit:n}=(xe(),x(ve));n("BREAK_GLASS_CLI_ACTIVITY",null,null,{command:t.name(),args:t.args,options:t.opts(),sessionId:s})}});var st=process.argv.slice(2),P=st.find(e=>!e.startsWith("-"));if(P&&Z[P]){let e=Z[P];try{let r=require(e.module)[e.export||`${P}Command`];r?y.addCommand(r):y.command(P).description(e.desc||"")}catch{y.command(P).description(e.desc||"")}}else Object.entries(Z).forEach(([e,t])=>{y.command(e).description(t.desc||"")});y.parse(process.argv);

package/dist/commands/access.js

@@ -1 +1 @@
-var ce=Object.create;var A=Object.defineProperty;var pe=Object.getOwnPropertyDescriptor;var de=Object.getOwnPropertyNames;var ge=Object.getPrototypeOf,le=Object.prototype.hasOwnProperty;var C=(e,t)=>()=>(e&&(t=e(e=0)),t);var D=(e,t)=>{for(var s in t)A(e,s,{get:t[s],enumerable:!0})},_=(e,t,s,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of de(t))!le.call(e,r)&&r!==s&&A(e,r,{get:()=>t[r],enumerable:!(n=pe(t,r))||n.enumerable});return e};var p=(e,t,s)=>(s=e!=null?ce(ge(e)):{},_(t||!e||!e.__esModule?A(s,"default",{value:e,enumerable:!0}):s,e)),R=e=>_(A({},"__esModule",{value:!0}),e);var K={};D(K,{clearConfig:()=>ye,deleteConfig:()=>fe,getAuthToken:()=>U,getBreakGlassSession:()=>he,getConfig:()=>y,getConfigValue:()=>ue,getProjectConfig:()=>we,getRcConfig:()=>w,setBreakGlassSession:()=>b,setConfig:()=>me});var F,m,J,T,c,G,y,ue,me,ye,fe,U,he,b,we,w,x=C(()=>{F=p(require("conf")),m=p(require("fs")),J=p(require("path")),T="https://www.xtrasecurity.in/api",c=new F.default({projectName:"xtra-cli",defaults:{apiUrl:T}}),G=c.get("apiUrl");G&&!process.env.XTRA_API_URL&&G.includes("xtra-security.vercel.app")&&c.set("apiUrl",T);y=()=>({...c.store,apiUrl:process.env.XTRA_API_URL||c.get("apiUrl")||T}),ue=e=>c.get(e),me=(e,t)=>{if(c.set(e,t),e==="token"&&process.platform!=="win32"&&m.default.existsSync(c.path))try{m.default.chmodSync(c.path,384)}catch{}},ye=()=>c.clear(),fe=e=>c.delete(e),U=()=>c.get("token"),he=()=>c.get("breakGlassSessionId"),b=e=>{e?c.set("breakGlassSessionId",e):c.delete("breakGlassSessionId")},we=async()=>{try{let e=J.default.join(process.cwd(),"xtra.json");if(m.default.existsSync(e)){let t=m.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},w=()=>{let e={};try{let t=J.default.join(process.cwd(),".xtrarc");m.default.existsSync(t)&&(e=JSON.parse(m.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||c.get("project")||"",env:e.env||c.get("env")||"development",branch:e.branch||c.get("branch")||"main"}}});var V,M,H,ve,i,g,P=C(()=>{V=p(require("axios"));x();M=p(require("fs")),H=p(require("path")),ve=JSON.parse(M.readFileSync(H.join(__dirname,"../../package.json"),"utf-8")),i=()=>{let{apiUrl:e}=y(),t=U();return V.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":ve.version,...t?{Authorization:`Bearer ${t}`}:{}}})},g={login:async(e,t,s)=>(await i().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await i().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await i().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,n,r="main")=>(await i().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:n,branch:r})).data,getSecretDetails:async(e,t,s,n="main")=>(await i().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${n}`)).data,syncLogs:async e=>(await i().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,n,r,a)=>(await i().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:n,sourceEnv:r,sourceKey:a})).data,rotateSecret:async(e,t,s,n,r)=>(await i().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:n,parsedNewValue:r})).data,promoteSecret:async(e,t,s)=>(await i().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await i().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,n)=>{let r={format:e};return t&&(r.startDate=t),s&&(r.endDate=s),n&&(r.projectId=n),(await i().post("/audit/export",r,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,n)=>(await i().post("/access/request",{projectId:e,secretId:n,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await i().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=y(),s=t?`&workspaceId=${t}`:"";return(await i().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await i().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=y(),t=e?`/project?workspaceId=${e}`:"/project";return(await i().get(t)).data},getBranches:async e=>(await i().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await i().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await i().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await i().put("/branch",{id:e,...t})).data,getRoles:async()=>(await i().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await i().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await i().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await i().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await i().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await i().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await i().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await i().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,n)=>(await i().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:n})).data,cloneEnvironment:async(e,t,s,n,r)=>(await i().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:n,branch:r})).data,generateJitLink:async e=>(await i().post("/jit/generate",e)).data,claimJitLink:async e=>(await i().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await i().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await i().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await i().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await i().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await i().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,s,n)=>(await i().post(`/projects/${e}/service-accounts/${t}/keys`,{label:s,expiresAt:n})).data,deleteServiceAccountKey:async(e,t,s)=>(await i().delete(`/projects/${e}/service-accounts/${t}/keys/${s}`)).data,post:async(e,t)=>(await i().post(e,t)).data}});function W(){let e=z.get("masterKey");e||(e=v.default.randomBytes(32).toString("hex"),z.set("masterKey",e));let t=(0,Y.machineIdSync)();return v.default.createHash("sha256").update(e+t).digest()}var v,X,Y,Q,z,Z,ee,te=C(()=>{v=p(require("crypto")),X=p(require("conf")),Y=require("node-machine-id"),Q="aes-256-gcm",z=new X.default({projectName:"xtra-cli-crypto"});Z=e=>{let t=v.default.randomBytes(16),s=W(),n=v.default.createCipheriv(Q,s,t),r=n.update(e,"utf8","hex");r+=n.final("hex");let a=n.getAuthTag();return{iv:t.toString("hex"),content:r,tag:a.toString("hex")}},ee=e=>{let t=W(),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.tag,"hex"),r=v.default.createDecipheriv(Q,t,s);r.setAuthTag(n);let a=r.update(e.content,"hex","utf8");return a+=r.final("utf8"),a}});var re={};D(re,{loadAuditLogs:()=>L,logAudit:()=>je,saveAuditLogs:()=>E,syncAuditLogs:()=>Se});function Ie(e){if(!e||typeof e!="object")return e;let t={...e},s=["password","token","secret","value","apiKey","secretValue"];for(let n of Object.keys(t))s.some(r=>n.toLowerCase().includes(r))&&(t[n]="[REDACTED]");return t}async function ne(e){try{if(!y().token)return!1;let s={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:Ie(e.details),timestamp:e.timestamp,projectId:e.projectId};return await g.post("/audit/cli-logs",{logs:[s]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function je(e,t,s,n){let r={id:(0,se.v4)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:s,details:n,synced:!1},a=L();a.push(r),E(a),ne(r).then(d=>{if(d){r.synced=!0;let S=L(),k=S.findIndex($=>$.id===r.id);k!==-1&&(S[k].synced=!0,E(S))}}).catch(()=>{})}function L(){if(!I.default.existsSync(N))return[];try{let e=I.default.readFileSync(N,"utf-8"),t=JSON.parse(e),s=ee(t);return JSON.parse(s)}catch{return[]}}function E(e){I.default.existsSync(O)||I.default.mkdirSync(O,{recursive:!0});let t=JSON.stringify(e),s=Z(t);I.default.writeFileSync(N,JSON.stringify(s),"utf-8")}async function Se(){let e=L(),t=e.filter(n=>!n.synced);if(t.length===0)return 0;let s=0;for(let n of t)await ne(n)&&(n.synced=!0,s++);return s>0&&E(e),s}var I,B,se,O,N,oe=C(()=>{I=p(require("fs")),B=p(require("path")),se=require("uuid");te();x();P();O=B.default.join(process.cwd(),".xtra"),N=B.default.join(O,"audit.enc")});var xe={};D(xe,{accessCommand:()=>be});module.exports=R(xe);var l=require("commander");P();var o=p(require("chalk")),f=p(require("ora")),ie=require("table");x();var q=(e,t,s)=>{try{let{logAudit:n}=(oe(),R(re));n(e,t,null,s)}catch{}},j=e=>e?.response?.data?.error||e?.message||"Unknown error",be=new l.Command("access").description("Manage Just-in-Time access requests").addCommand(new l.Command("request").description("Request access to a secret or project").option("-p, --project <projectId>","Project ID").option("-s, --secret <secretId>","Specific Secret ID (optional)").requiredOption("-d, --duration <minutes>","Duration in minutes").requiredOption("-r, --reason <text>","Reason for access").action(async e=>{let{project:t,secret:s,duration:n,reason:r}=e;t||(t=w().project),t||(console.error(o.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let a=(0,f.default)("Submitting access request...").start();try{let d=await g.requestAccess(t,r,parseInt(n),s);a.succeed(o.default.green(`Access request submitted! (ID: ${d.requestId})`)),console.log(o.default.yellow(`Status: ${d.status}`)),q("ACCESS_REQUESTED",t,{requestId:d.requestId,secretId:s,duration:n,reason:r})}catch(d){a.fail("Request failed"),console.error(o.default.red(j(d)))}})).addCommand(new l.Command("list").description("List access requests").option("--pending","Show pending approvals (for admins)",!1).action(async e=>{try{let t=e.pending?"pending":"my",s=await g.listAccessRequests(t);if(s.length===0){console.log(o.default.yellow("No requests found."));return}let n=[[o.default.bold("ID"),o.default.bold("User"),o.default.bold("Target"),o.default.bold("Duration"),o.default.bold("Reason"),o.default.bold("Status")]];s.forEach(r=>{let a=r.secret?`Secret: ${r.secret.key}`:`Project: ${r.projectId}`;n.push([r.id,r.user.email,a,`${r.duration}m`,r.reason,r.status==="pending"?o.default.yellow(r.status):r.status==="approved"?o.default.green(r.status):o.default.red(r.status)])}),console.log((0,ie.table)(n))}catch(t){console.error(o.default.red("Failed to list requests: "+j(t)))}})).addCommand(new l.Command("approve").description("Approve or reject a request").argument("<requestId>","Request ID").requiredOption("--decision <decision>","approved or rejected").action(async(e,t)=>{["approved","rejected"].includes(t.decision.toLowerCase())||(console.error(o.default.red(`Invalid decision: '${t.decision}'. Must be 'approved' or 'rejected'.`)),process.exit(1));let n=(0,f.default)("Processing decision...").start();try{let r=await g.approveAccess(e,t.decision);n.succeed(o.default.green(`Request ${t.decision}!`)),r.expiresAt&&console.log(o.default.blue(`Access granted until: ${new Date(r.expiresAt).toLocaleString()}`)),q(t.decision==="approved"?"ACCESS_APPROVED":"ACCESS_REJECTED",null,{requestId:e,decision:t.decision,expiresAt:r.expiresAt})}catch(r){n.fail("Operation failed"),console.error(o.default.red(j(r)))}})).addCommand(new l.Command("jit-generate").description("Generate a shareable JIT access link for a project").option("-p, --project <projectId>","Project ID").requiredOption("-d, --duration <minutes>","Access duration in minutes").option("-b, --branch <branchId>","Scope to branch ID").option("-e, --env <environment>","Scope to environment (production, staging, development)").option("-s, --secrets <ids>","Comma-separated secret IDs to scope access").option("--label <text>","Label for the JIT link").option("--max-uses <count>","Maximum number of uses","1").option("--expires <hours>","Link expiry in hours","24").action(async e=>{let{project:t,duration:s,branch:n,env:r,secrets:a,label:d,maxUses:S,expires:k}=e;t||(t=w().project),t||(console.error(o.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let $=(0,f.default)("Generating JIT link...").start();try{let u={projectId:t,duration:parseInt(s),maxUses:parseInt(S),expiresInHours:parseInt(k)};n&&(u.branchId=n),r&&(u.environment=r),a&&(u.secretIds=a.split(",").map(ae=>ae.trim())),d&&(u.label=d);let h=await g.generateJitLink(u);$.succeed(o.default.green("JIT link generated!")),console.log(),console.log(o.default.bold("  Shareable URL:")),console.log(o.default.cyan(`  ${h.url}`)),console.log(),console.log(o.default.bold("  CLI Command:")),console.log(o.default.yellow(`  ${h.cliCommand}`)),console.log(),console.log(o.default.dim(`  Expires: ${new Date(h.expiresAt).toLocaleString()}`)),console.log(o.default.dim(`  Duration: ${h.duration} minutes | Access: ${h.accessLevel}-only`)),q("JIT_LINK_GENERATED",t,{token:h.token,duration:s,env:r,branch:n})}catch(u){$.fail("Failed to generate JIT link"),console.error(o.default.red(j(u)))}})).addCommand(new l.Command("jit").description("Claim a JIT access link (request read-only access)").argument("<token>","JIT link token").action(async e=>{let t=(0,f.default)("Claiming JIT link...").start();try{let s=await g.getJitInfo(e);t.text=`Requesting access to "${s.projectName}"...`;let n=await g.claimJitLink(e);t.succeed(o.default.green("Access request submitted!")),console.log(),console.log(o.default.yellow("  Status: Pending admin/owner approval")),console.log(o.default.dim(`  Request ID: ${n.requestId}`)),console.log(o.default.dim(`  Access: ${n.accessLevel}-only for ${n.duration} minutes`)),console.log(),console.log(o.default.dim("  Run 'xtra access list' to check request status.")),q("JIT_LINK_CLAIMED",null,{token:e,requestId:n.requestId})}catch(s){t.fail("Failed to claim JIT link"),console.error(o.default.red(j(s)))}})).addCommand(new l.Command("break-glass").description("Emergency break-glass access management").addCommand(new l.Command("link").description("Link an active break-glass session from the dashboard to this CLI").requiredOption("--id <sessionId>","Active Break Glass Session ID").action(async e=>{let{id:t}=e,s=(0,f.default)("Verifying session...").start();try{let n=await g.post("/access/break-glass",{projectId:w().project,reason:"CLI Link Verification"});(n.session||n.success)&&(b(t),s.succeed(o.default.red.bold("\u{1F6A8} EMERGENCY ACCESS LINKED")),console.log(),console.log(o.default.yellow(`  Session ID: ${t}`)),console.log(o.default.dim("  Permissions: Full Administrative (Root)")),console.log(o.default.dim("  Audit Status: FULL VERBOSE LOGGING ENABLED")),console.log(),console.log(o.default.cyan("  You can now run any command with elevated permissions.")),console.log(o.default.cyan("  Example: 'xtra secrets list' will now show all secrets in the project.")))}catch(n){s.fail("Link failed"),console.error(o.default.red(j(n)))}})).addCommand(new l.Command("deactivate").description("End the current break-glass session").action(async()=>{let{getBreakGlassSession:e}=(x(),R(K));if(!e()){console.log(o.default.blue("No active break-glass session found locally."));return}let s=(0,f.default)("Deactivating session...").start();try{await g.post("/access/break-glass",{projectId:w().project,deactivate:!0}),b(null),s.succeed(o.default.green("Break-glass session ended."))}catch{b(null),s.warn("Local session cleared. (API might have already expired it)")}})));0&&(module.exports={accessCommand});
+var Se=Object.create;var B=Object.defineProperty;var we=Object.getOwnPropertyDescriptor;var xe=Object.getOwnPropertyNames;var be=Object.getPrototypeOf,ke=Object.prototype.hasOwnProperty;var O=(e,t)=>()=>(e&&(t=e(e=0)),t);var U=(e,t)=>{for(var s in t)B(e,s,{get:t[s],enumerable:!0})},se=(e,t,s,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of xe(t))!ke.call(e,n)&&n!==s&&B(e,n,{get:()=>t[n],enumerable:!(r=we(t,n))||r.enumerable});return e};var y=(e,t,s)=>(s=e!=null?Se(be(e)):{},se(t||!e||!e.__esModule?B(s,"default",{value:e,enumerable:!0}):s,e)),A=e=>se(B({},"__esModule",{value:!0}),e);var M={};U(M,{createWorkloadKeyEnvelope:()=>Te,decrypt:()=>G,decryptSecretValue:()=>$e,decryptWorkloadKeyEnvelope:()=>Ce,deriveProjectKey:()=>je,encrypt:()=>N,encryptSecretValue:()=>Ae,hash:()=>Ie,resolveVaultPassphrase:()=>ae,saveVaultPassphrase:()=>Ee,secureRead:()=>_,secureSave:()=>K});function ie(){if(J)return J;let e=V.get("masterKey");e||(e=p.default.randomBytes(32).toString("hex"),V.set("masterKey",e));let t="";try{t=(0,ne.machineIdSync)()||""}catch{t=p.default.createHash("sha256").update(h.default.hostname()+(h.default.userInfo?.()?.username||"root")).digest("hex")}let s=h.default.platform(),r=h.default.userInfo?.()?.username||"default_user",n=`${s}:${r}:${t}:${e}`;return J=p.default.createHash("sha256").update(n).digest(),J}function je(e,t){t||(t=ae(void 0,e));let s=Buffer.from(`project_salt_${e}`),r=Buffer.from("xtra-e2ee-project-key-v2"),n=p.default.hkdfSync("sha256",Buffer.from(t),s,r,32);return Buffer.from(n).toString("hex")}function Ae(e,t){let s=p.default.randomBytes(12),r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=p.default.createCipheriv("aes-256-gcm",r,s),a=n.update(e,"utf8","hex");a+=n.final("hex");let c=n.getAuthTag().toString("hex");return{ciphertext:a,iv:s.toString("hex"),authTag:c}}function $e(e,t){let s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),r=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),a=p.default.createDecipheriv("aes-256-gcm",s,r);a.setAuthTag(n);let c=a.update(e.ciphertext,"hex","utf8");return c+=a.final("utf8"),c}function ae(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let r=_(`vault_${t}`);if(r)return r}let s=_("vault_passphrase");if(s)return s}catch{}try{let{getRcConfig:s}=($(),A(W)),r=s();if(r&&r.passphrase)return r.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function Ee(e,t){t&&K(`vault_${t}`,e),K("vault_passphrase",e)}function Te(e,t){let{publicKey:s,privateKey:r}=p.default.generateKeyPairSync("x25519"),n=s.export({type:"spki",format:"pem"}).toString(),a=p.default.createPublicKey(t),c=p.default.diffieHellman({privateKey:r,publicKey:a}),d=Buffer.from(p.default.hkdfSync("sha256",c,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),g=p.default.randomBytes(12),f=p.default.createCipheriv("aes-256-gcm",d,g),l=f.update(e,"utf8","hex");l+=f.final("hex");let m=f.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:l,iv:g.toString("hex"),authTag:m}}function Ce(e,t){let s=p.default.createPrivateKey(t),r=p.default.createPublicKey(e.ephemeralPublicKey),n=p.default.diffieHellman({privateKey:s,publicKey:r}),a=Buffer.from(p.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),c=Buffer.from(e.iv,"hex"),d=Buffer.from(e.authTag,"hex"),g=p.default.createDecipheriv("aes-256-gcm",a,c);g.setAuthTag(d);let f=g.update(e.encryptedProjectKey,"hex","utf8");return f+=g.final("utf8"),f}var p,h,re,ne,P,oe,V,J,N,G,Ie,K,_,L=O(()=>{p=y(require("crypto")),h=y(require("os")),re=y(require("conf")),ne=require("node-machine-id"),P=require("child_process"),oe="aes-256-gcm",V=new re.default({projectName:"xtra-cli-crypto"}),J=null;N=e=>{let t=p.default.randomBytes(12),s=ie(),r=p.default.createCipheriv(oe,s,t),n=r.update(e,"utf8","hex");n+=r.final("hex");let a=r.getAuthTag();return{iv:t.toString("hex"),content:n,tag:a.toString("hex")}},G=e=>{let t=ie(),s=Buffer.from(e.iv,"hex"),r=Buffer.from(e.tag,"hex"),n=p.default.createDecipheriv(oe,t,s);n.setAuthTag(r);let a=n.update(e.content,"hex","utf8");return a+=n.final("utf8"),a},Ie=e=>p.default.createHash("sha256").update(e).digest("hex"),K=(e,t)=>{try{let r="XtraSecurityCLI",n=e;if(h.default.platform()==="darwin"){(0,P.execFileSync)("security",["add-generic-password","-s",r,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(h.default.platform()!=="win32"){if(h.default.platform()==="linux")try{(0,P.execFileSync)("secret-tool",["store","--label",r,"service",r,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let s=N(t);V.set(`secure_${e}`,JSON.stringify(s))},_=e=>{try{let t="XtraSecurityCLI",s=e;if(h.default.platform()==="darwin")return(0,P.execFileSync)("security",["find-generic-password","-s",t,"-a",s,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(h.default.platform()!=="win32"){if(h.default.platform()==="linux")try{return(0,P.execFileSync)("secret-tool",["lookup","service",t,"account",s],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=V.get(`secure_${e}`);if(!t)return null;let s=JSON.parse(t);return G(s)}catch{return null}}});var W={};U(W,{clearConfig:()=>Ke,deleteConfig:()=>_e,getAuthToken:()=>q,getBreakGlassSession:()=>Le,getConfig:()=>k,getConfigValue:()=>Re,getProjectConfig:()=>qe,getRcConfig:()=>E,setBreakGlassSession:()=>D,setConfig:()=>Pe});var pe,b,z,Y,u,ce,k,Re,Pe,Ke,_e,q,Le,D,qe,E,$=O(()=>{pe=y(require("conf")),b=y(require("fs")),z=y(require("path"));L();Y="https://www.xtrasecurity.in/api",u=new pe.default({projectName:"xtra-cli",defaults:{apiUrl:Y}}),ce=u.get("apiUrl");ce&&!process.env.XTRA_API_URL&&ce.includes("xtra-security.vercel.app")&&u.set("apiUrl",Y);k=()=>({...u.store,token:q(),apiUrl:process.env.XTRA_API_URL||u.get("apiUrl")||Y}),Re=e=>e==="token"?q():u.get(e),Pe=(e,t)=>{if(e==="token"&&t&&K("token",t),u.set(e,t),e==="token"&&process.platform!=="win32"&&b.default.existsSync(u.path))try{b.default.chmodSync(u.path,384)}catch{}},Ke=()=>u.clear(),_e=e=>u.delete(e),q=()=>_("token")||u.get("token"),Le=()=>u.get("breakGlassSessionId"),D=e=>{e?u.set("breakGlassSessionId",e):u.delete("breakGlassSessionId")},qe=async()=>{try{let e=z.default.join(process.cwd(),"xtra.json");if(b.default.existsSync(e)){let t=b.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},E=()=>{let e={};try{let t=z.default.join(process.cwd(),".xtrarc");b.default.existsSync(t)&&(e=JSON.parse(b.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||u.get("project")||"",env:e.env||u.get("env")||"development",branch:e.branch||u.get("branch")||"main"}}});var ge,de,ue,De,o,v,Z=O(()=>{ge=y(require("axios"));$();de=y(require("fs")),ue=y(require("path")),De=JSON.parse(de.readFileSync(ue.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=k(),s=e||q();return ge.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":De.version,...s?{Authorization:`Bearer ${s}`}:{}}})},v={login:async(e,t,s)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,exchangeOidcToken:async(e,t)=>{let s=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:s.data.access_token,envelope:s.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,s="main",r,n,a)=>{let d=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data;if(d&&typeof d=="object"){let g=null,{deriveProjectKey:f,decryptSecretValue:l,resolveVaultPassphrase:m,decryptWorkloadKeyEnvelope:j}=(L(),A(M));for(let[w,R]of Object.entries(d))if(typeof R=="string"&&R.startsWith("{"))try{let x=JSON.parse(R);if(x.ciphertext&&x.iv){if(!g)if(a&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)g=j(a,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let ve=m(r,e);g=f(e,ve)}d[w]=l(x,g)}}catch(x){if(x.message&&x.message.includes("Zero-Knowledge"))throw x}}return d},getSecretVersions:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,r,n="main")=>{let{deriveProjectKey:a,encryptSecretValue:c,resolveVaultPassphrase:d}=(L(),A(M)),g=d(void 0,e),f=a(e,g),l={};for(let[j,w]of Object.entries(s))if(typeof w=="string"&&w.startsWith("{")&&w.includes("ciphertext"))l[j]=w;else{let R=c(w,f);l[j]=JSON.stringify(R)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:l,expectedVersions:r,branch:n})).data},getSecretDetails:async(e,t,s,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${r}`)).data,getSecretsV2:async(e,t)=>{let s=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${s}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,r,n,a)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:r,sourceEnv:n,sourceKey:a})).data,rotateSecret:async(e,t,s,r,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:r,parsedNewValue:n})).data,promoteSecret:async(e,t,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,r)=>{let n={format:e};return t&&(n.startDate=t),s&&(n.endDate=s),r&&(n.projectId=r),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,r)=>(await o().post("/access/request",{projectId:e,secretId:r,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=k(),s=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=k(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await o().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:r})).data,cloneEnvironment:async(e,t,s,r,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:r,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,s,r)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:s,expiresAt:r})).data,deleteServiceAccountKey:async(e,t,s)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${s}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});var ye={};U(ye,{loadAuditLogs:()=>F,logAudit:()=>Oe,saveAuditLogs:()=>H,syncAuditLogs:()=>Ue});function Be(e){if(!e||typeof e!="object")return e;let t={...e},s=["password","token","secret","value","apiKey","secretValue"];for(let r of Object.keys(t))s.some(n=>r.toLowerCase().includes(n))&&(t[r]="[REDACTED]");return t}async function fe(e){try{if(!k().token)return!1;let s={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:Be(e.details),timestamp:e.timestamp,projectId:e.projectId};return await v.post("/audit/cli-logs",{logs:[s]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function Oe(e,t,s,r){let n={id:(0,le.randomUUID)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:s,details:r,synced:!1},a=F();a.push(n),H(a),fe(n).then(c=>{if(c){n.synced=!0;let d=F(),g=d.findIndex(f=>f.id===n.id);g!==-1&&(d[g].synced=!0,H(d))}}).catch(()=>{})}function F(){if(!T.default.existsSync(ee))return[];try{let e=T.default.readFileSync(ee,"utf-8"),t=JSON.parse(e),s=G(t);return JSON.parse(s)}catch{return[]}}function H(e){T.default.existsSync(Q)||T.default.mkdirSync(Q,{recursive:!0});let t=JSON.stringify(e),s=N(t);T.default.writeFileSync(ee,JSON.stringify(s),"utf-8")}async function Ue(){let e=F(),t=e.filter(r=>!r.synced);if(t.length===0)return 0;let s=0;for(let r of t)await fe(r)&&(r.synced=!0,s++);return s>0&&H(e),s}var T,te,le,Q,ee,me=O(()=>{T=y(require("fs")),te=y(require("path")),le=require("crypto");L();$();Z();Q=te.default.join(process.cwd(),".xtra"),ee=te.default.join(Q,"audit.enc")});var Ve={};U(Ve,{accessCommand:()=>Je});module.exports=A(Ve);var S=require("commander");Z();var i=y(require("chalk")),I=y(require("ora")),he=require("table");$();var X=(e,t,s)=>{try{let{logAudit:r}=(me(),A(ye));r(e,t,null,s)}catch{}},C=e=>e?.response?.data?.error||e?.message||"Unknown error",Je=new S.Command("access").description("Manage Just-in-Time access requests").addCommand(new S.Command("request").description("Request access to a secret or project").option("-p, --project <projectId>","Project ID").option("-s, --secret <secretId>","Specific Secret ID (optional)").requiredOption("-d, --duration <minutes>","Duration in minutes").requiredOption("-r, --reason <text>","Reason for access").action(async e=>{let{project:t,secret:s,duration:r,reason:n}=e;t||(t=E().project),t||(console.error(i.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let a=(0,I.default)("Submitting access request...").start();try{let c=await v.requestAccess(t,n,parseInt(r),s);a.succeed(i.default.green(`Access request submitted! (ID: ${c.requestId})`)),console.log(i.default.yellow(`Status: ${c.status}`)),X("ACCESS_REQUESTED",t,{requestId:c.requestId,secretId:s,duration:r,reason:n})}catch(c){a.fail("Request failed"),console.error(i.default.red(C(c)))}})).addCommand(new S.Command("list").description("List access requests").option("--pending","Show pending approvals (for admins)",!1).action(async e=>{try{let t=e.pending?"pending":"my",s=await v.listAccessRequests(t);if(s.length===0){console.log(i.default.yellow("No requests found."));return}let r=[[i.default.bold("ID"),i.default.bold("User"),i.default.bold("Target"),i.default.bold("Duration"),i.default.bold("Reason"),i.default.bold("Status")]];s.forEach(n=>{let a=n.secret?`Secret: ${n.secret.key}`:`Project: ${n.projectId}`;r.push([n.id,n.user?.email||n.userEmail||n.userId||"-",a,`${n.duration}m`,n.reason,n.status==="pending"?i.default.yellow(n.status):n.status==="approved"?i.default.green(n.status):i.default.red(n.status)])}),console.log((0,he.table)(r))}catch(t){console.error(i.default.red("Failed to list requests: "+C(t)))}})).addCommand(new S.Command("approve").description("Approve or reject a request").argument("<requestId>","Request ID").requiredOption("--decision <decision>","approved or rejected").action(async(e,t)=>{["approved","rejected"].includes(t.decision.toLowerCase())||(console.error(i.default.red(`Invalid decision: '${t.decision}'. Must be 'approved' or 'rejected'.`)),process.exit(1));let r=(0,I.default)("Processing decision...").start();try{let n=await v.approveAccess(e,t.decision);r.succeed(i.default.green(`Request ${t.decision}!`)),n.expiresAt&&console.log(i.default.blue(`Access granted until: ${new Date(n.expiresAt).toLocaleString()}`)),X(t.decision==="approved"?"ACCESS_APPROVED":"ACCESS_REJECTED",null,{requestId:e,decision:t.decision,expiresAt:n.expiresAt})}catch(n){r.fail("Operation failed"),console.error(i.default.red(C(n)))}})).addCommand(new S.Command("jit-generate").description("Generate a shareable JIT access link for a project").option("-p, --project <projectId>","Project ID").requiredOption("-d, --duration <minutes>","Access duration in minutes").option("-b, --branch <branchId>","Scope to branch ID").option("-e, --env <environment>","Scope to environment (production, staging, development)").option("-s, --secrets <ids>","Comma-separated secret IDs to scope access").option("--label <text>","Label for the JIT link").option("--max-uses <count>","Maximum number of uses","1").option("--expires <hours>","Link expiry in hours","24").action(async e=>{let{project:t,duration:s,branch:r,env:n,secrets:a,label:c,maxUses:d,expires:g}=e;t||(t=E().project),t||(console.error(i.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let f=(0,I.default)("Generating JIT link...").start();try{let l={projectId:t,duration:parseInt(s),maxUses:parseInt(d),expiresInHours:parseInt(g)};r&&(l.branchId=r),n&&(l.environment=n),a&&(l.secretIds=a.split(",").map(j=>j.trim())),c&&(l.label=c);let m=await v.generateJitLink(l);f.succeed(i.default.green("JIT link generated!")),console.log(),console.log(i.default.bold("  Shareable URL:")),console.log(i.default.cyan(`  ${m.url}`)),console.log(),console.log(i.default.bold("  CLI Command:")),console.log(i.default.yellow(`  ${m.cliCommand}`)),console.log(),console.log(i.default.dim(`  Expires: ${new Date(m.expiresAt).toLocaleString()}`)),console.log(i.default.dim(`  Duration: ${m.duration} minutes | Access: ${m.accessLevel}-only`)),X("JIT_LINK_GENERATED",t,{token:m.token,duration:s,env:n,branch:r})}catch(l){f.fail("Failed to generate JIT link"),console.error(i.default.red(C(l)))}})).addCommand(new S.Command("jit").description("Claim a JIT access link (request read-only access)").argument("<token>","JIT link token").action(async e=>{let t=(0,I.default)("Claiming JIT link...").start();try{let s=await v.getJitInfo(e);t.text=`Requesting access to "${s.projectName}"...`;let r=await v.claimJitLink(e);t.succeed(i.default.green("Access request submitted!")),console.log(),console.log(i.default.yellow("  Status: Pending admin/owner approval")),console.log(i.default.dim(`  Request ID: ${r.requestId}`)),console.log(i.default.dim(`  Access: ${r.accessLevel}-only for ${r.duration} minutes`)),console.log(),console.log(i.default.dim("  Run 'xtra access list' to check request status.")),X("JIT_LINK_CLAIMED",null,{token:e,requestId:r.requestId})}catch(s){t.fail("Failed to claim JIT link"),console.error(i.default.red(C(s)))}})).addCommand(new S.Command("break-glass").description("Emergency break-glass access management").addCommand(new S.Command("link").description("Link an active break-glass session from the dashboard to this CLI").requiredOption("--id <sessionId>","Active Break Glass Session ID").action(async e=>{let{id:t}=e,s=(0,I.default)("Verifying session...").start();try{let r=await v.post("/access/break-glass",{projectId:E().project,reason:"CLI Link Verification"});(r.session||r.success)&&(D(t),s.succeed(i.default.red.bold("\u{1F6A8} EMERGENCY ACCESS LINKED")),console.log(),console.log(i.default.yellow(`  Session ID: ${t}`)),console.log(i.default.dim("  Permissions: Full Administrative (Root)")),console.log(i.default.dim("  Audit Status: FULL VERBOSE LOGGING ENABLED")),console.log(),console.log(i.default.cyan("  You can now run any command with elevated permissions.")),console.log(i.default.cyan("  Example: 'xtra secrets list' will now show all secrets in the project.")))}catch(r){s.fail("Link failed"),console.error(i.default.red(C(r)))}})).addCommand(new S.Command("deactivate").description("End the current break-glass session").action(async()=>{let{getBreakGlassSession:e}=($(),A(W));if(!e()){console.log(i.default.blue("No active break-glass session found locally."));return}let s=(0,I.default)("Deactivating session...").start();try{await v.post("/access/break-glass",{projectId:E().project,deactivate:!0}),D(null),s.succeed(i.default.green("Break-glass session ended."))}catch{D(null),s.warn("Local session cleared. (API might have already expired it)")}})));0&&(module.exports={accessCommand});

package/dist/commands/admin.js

@@ -1,5 +1,5 @@
-var te=Object.create;var f=Object.defineProperty;var se=Object.getOwnPropertyDescriptor;var re=Object.getOwnPropertyNames;var ne=Object.getPrototypeOf,oe=Object.prototype.hasOwnProperty;var h=(e,t)=>()=>(e&&(t=e(e=0)),t);var L=(e,t)=>{for(var s in t)f(e,s,{get:t[s],enumerable:!0})},D=(e,t,s,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of re(t))!oe.call(e,n)&&n!==s&&f(e,n,{get:()=>t[n],enumerable:!(r=se(t,n))||r.enumerable});return e};var c=(e,t,s)=>(s=e!=null?te(ne(e)):{},D(t||!e||!e.__esModule?f(s,"default",{value:e,enumerable:!0}):s,e)),E=e=>D(f({},"__esModule",{value:!0}),e);var B,j,u,N,p,O,b=h(()=>{B=c(require("conf")),j="https://www.xtrasecurity.in/api",u=new B.default({projectName:"xtra-cli",defaults:{apiUrl:j}}),N=u.get("apiUrl");N&&!process.env.XTRA_API_URL&&N.includes("xtra-security.vercel.app")&&u.set("apiUrl",j);p=()=>({...u.store,apiUrl:process.env.XTRA_API_URL||u.get("apiUrl")||j}),O=()=>u.get("token")});var T,_,F,ae,o,g,x=h(()=>{T=c(require("axios"));b();_=c(require("fs")),F=c(require("path")),ae=JSON.parse(_.readFileSync(F.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:e}=p(),t=O();return T.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":ae.version,...t?{Authorization:`Bearer ${t}`}:{}}})},g={login:async(e,t,s)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,r,n="main")=>(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:r,branch:n})).data,getSecretDetails:async(e,t,s,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${r}`)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,r,n,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:r,sourceEnv:n,sourceKey:i})).data,rotateSecret:async(e,t,s,r,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:r,parsedNewValue:n})).data,promoteSecret:async(e,t,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,r)=>{let n={format:e};return t&&(n.startDate=t),s&&(n.endDate=s),r&&(n.projectId=r),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,r)=>(await o().post("/access/request",{projectId:e,secretId:r,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=p(),s=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=p(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await o().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:r})).data,cloneEnvironment:async(e,t,s,r,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:r,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,s,r)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:s,expiresAt:r})).data,deleteServiceAccountKey:async(e,t,s)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${s}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});function q(){let e=P.get("masterKey");e||(e=d.default.randomBytes(32).toString("hex"),P.set("masterKey",e));let t=(0,G.machineIdSync)();return d.default.createHash("sha256").update(e+t).digest()}var d,J,G,K,P,V,H,z=h(()=>{d=c(require("crypto")),J=c(require("conf")),G=require("node-machine-id"),K="aes-256-gcm",P=new J.default({projectName:"xtra-cli-crypto"});V=e=>{let t=d.default.randomBytes(16),s=q(),r=d.default.createCipheriv(K,s,t),n=r.update(e,"utf8","hex");n+=r.final("hex");let i=r.getAuthTag();return{iv:t.toString("hex"),content:n,tag:i.toString("hex")}},H=e=>{let t=q(),s=Buffer.from(e.iv,"hex"),r=Buffer.from(e.tag,"hex"),n=d.default.createDecipheriv(K,t,s);n.setAuthTag(r);let i=n.update(e.content,"hex","utf8");return i+=n.final("utf8"),i}});var Q={};L(Q,{loadAuditLogs:()=>w,logAudit:()=>ce,saveAuditLogs:()=>v,syncAuditLogs:()=>pe});function ie(e){if(!e||typeof e!="object")return e;let t={...e},s=["password","token","secret","value","apiKey","secretValue"];for(let r of Object.keys(t))s.some(n=>r.toLowerCase().includes(n))&&(t[r]="[REDACTED]");return t}async function X(e){try{if(!p().token)return!1;let s={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:ie(e.details),timestamp:e.timestamp,projectId:e.projectId};return await g.post("/audit/cli-logs",{logs:[s]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function ce(e,t,s,r){let n={id:(0,M.v4)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:s,details:r,synced:!1},i=w();i.push(n),v(i),X(n).then(y=>{if(y){n.synced=!0;let $=w(),U=$.findIndex(ee=>ee.id===n.id);U!==-1&&($[U].synced=!0,v($))}}).catch(()=>{})}function w(){if(!l.default.existsSync(k))return[];try{let e=l.default.readFileSync(k,"utf-8"),t=JSON.parse(e),s=H(t);return JSON.parse(s)}catch{return[]}}function v(e){l.default.existsSync(A)||l.default.mkdirSync(A,{recursive:!0});let t=JSON.stringify(e),s=V(t);l.default.writeFileSync(k,JSON.stringify(s),"utf-8")}async function pe(){let e=w(),t=e.filter(r=>!r.synced);if(t.length===0)return 0;let s=0;for(let r of t)await X(r)&&(r.synced=!0,s++);return s>0&&v(e),s}var l,I,M,A,k,W=h(()=>{l=c(require("fs")),I=c(require("path")),M=require("uuid");z();b();x();A=I.default.join(process.cwd(),".xtra"),k=I.default.join(A,"audit.enc")});var ge={};L(ge,{adminCommand:()=>m});module.exports=E(ge);var C=require("commander");x();var a=c(require("chalk")),S=c(require("ora")),R=require("table"),m=new C.Command("admin").description("Admin commands for user and role management"),Y=new C.Command("role").description("Manage user roles and permissions"),Z=async()=>{let e=(0,S.default)("Fetching roles from server...").start();try{let t=await g.getRoles();e.stop(),console.log(a.default.bold(`
+var ve=Object.create;var E=Object.defineProperty;var we=Object.getOwnPropertyDescriptor;var Se=Object.getOwnPropertyNames;var xe=Object.getPrototypeOf,be=Object.prototype.hasOwnProperty;var C=(e,t)=>()=>(e&&(t=e(e=0)),t);var B=(e,t)=>{for(var r in t)E(e,r,{get:t[r],enumerable:!0})},Q=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of Se(t))!be.call(e,n)&&n!==r&&E(e,n,{get:()=>t[n],enumerable:!(s=we(t,n))||s.enumerable});return e};var l=(e,t,r)=>(r=e!=null?ve(xe(e)):{},Q(t||!e||!e.__esModule?E(r,"default",{value:e,enumerable:!0}):r,e)),$=e=>Q(E({},"__esModule",{value:!0}),e);var H={};B(H,{createWorkloadKeyEnvelope:()=>Re,decrypt:()=>V,decryptSecretValue:()=>je,decryptWorkloadKeyEnvelope:()=>Pe,deriveProjectKey:()=>$e,encrypt:()=>O,encryptSecretValue:()=>ke,hash:()=>Ae,resolveVaultPassphrase:()=>ne,saveVaultPassphrase:()=>Te,secureRead:()=>T,secureSave:()=>j});function se(){if(U)return U;let e=L.get("masterKey");e||(e=a.default.randomBytes(32).toString("hex"),L.set("masterKey",e));let t="";try{t=(0,te.machineIdSync)()||""}catch{t=a.default.createHash("sha256").update(y.default.hostname()+(y.default.userInfo?.()?.username||"root")).digest("hex")}let r=y.default.platform(),s=y.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return U=a.default.createHash("sha256").update(n).digest(),U}function $e(e,t){t||(t=ne(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=a.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function ke(e,t){let r=a.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=a.default.createCipheriv("aes-256-gcm",s,r),i=n.update(e,"utf8","hex");i+=n.final("hex");let g=n.getAuthTag().toString("hex");return{ciphertext:i,iv:r.toString("hex"),authTag:g}}function je(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),i=a.default.createDecipheriv("aes-256-gcm",r,s);i.setAuthTag(n);let g=i.update(e.ciphertext,"hex","utf8");return g+=i.final("utf8"),g}function ne(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=T(`vault_${t}`);if(s)return s}let r=T("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(D(),$(oe)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function Te(e,t){t&&j(`vault_${t}`,e),j("vault_passphrase",e)}function Re(e,t){let{publicKey:r,privateKey:s}=a.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),i=a.default.createPublicKey(t),g=a.default.diffieHellman({privateKey:s,publicKey:i}),d=Buffer.from(a.default.hkdfSync("sha256",g,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),u=a.default.randomBytes(12),f=a.default.createCipheriv("aes-256-gcm",d,u),m=f.update(e,"utf8","hex");m+=f.final("hex");let I=f.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:m,iv:u.toString("hex"),authTag:I}}function Pe(e,t){let r=a.default.createPrivateKey(t),s=a.default.createPublicKey(e.ephemeralPublicKey),n=a.default.diffieHellman({privateKey:r,publicKey:s}),i=Buffer.from(a.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),g=Buffer.from(e.iv,"hex"),d=Buffer.from(e.authTag,"hex"),u=a.default.createDecipheriv("aes-256-gcm",i,g);u.setAuthTag(d);let f=u.update(e.encryptedProjectKey,"hex","utf8");return f+=u.final("utf8"),f}var a,y,ee,te,k,re,L,U,O,V,Ae,j,T,R=C(()=>{a=l(require("crypto")),y=l(require("os")),ee=l(require("conf")),te=require("node-machine-id"),k=require("child_process"),re="aes-256-gcm",L=new ee.default({projectName:"xtra-cli-crypto"}),U=null;O=e=>{let t=a.default.randomBytes(12),r=se(),s=a.default.createCipheriv(re,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let i=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:i.toString("hex")}},V=e=>{let t=se(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=a.default.createDecipheriv(re,t,r);n.setAuthTag(s);let i=n.update(e.content,"hex","utf8");return i+=n.final("utf8"),i},Ae=e=>a.default.createHash("sha256").update(e).digest("hex"),j=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(y.default.platform()==="darwin"){(0,k.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(y.default.platform()!=="win32"){if(y.default.platform()==="linux")try{(0,k.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=O(t);L.set(`secure_${e}`,JSON.stringify(r))},T=e=>{try{let t="XtraSecurityCLI",r=e;if(y.default.platform()==="darwin")return(0,k.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(y.default.platform()!=="win32"){if(y.default.platform()==="linux")try{return(0,k.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=L.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return V(r)}catch{return null}}});var oe={};B(oe,{clearConfig:()=>_e,deleteConfig:()=>Ee,getAuthToken:()=>P,getBreakGlassSession:()=>Ce,getConfig:()=>S,getConfigValue:()=>Ke,getProjectConfig:()=>Ue,getRcConfig:()=>Le,setBreakGlassSession:()=>Be,setConfig:()=>Ie});var ae,w,X,q,p,ie,S,Ke,Ie,_e,Ee,P,Ce,Be,Ue,Le,D=C(()=>{ae=l(require("conf")),w=l(require("fs")),X=l(require("path"));R();q="https://www.xtrasecurity.in/api",p=new ae.default({projectName:"xtra-cli",defaults:{apiUrl:q}}),ie=p.get("apiUrl");ie&&!process.env.XTRA_API_URL&&ie.includes("xtra-security.vercel.app")&&p.set("apiUrl",q);S=()=>({...p.store,token:P(),apiUrl:process.env.XTRA_API_URL||p.get("apiUrl")||q}),Ke=e=>e==="token"?P():p.get(e),Ie=(e,t)=>{if(e==="token"&&t&&j("token",t),p.set(e,t),e==="token"&&process.platform!=="win32"&&w.default.existsSync(p.path))try{w.default.chmodSync(p.path,384)}catch{}},_e=()=>p.clear(),Ee=e=>p.delete(e),P=()=>T("token")||p.get("token"),Ce=()=>p.get("breakGlassSessionId"),Be=e=>{e?p.set("breakGlassSessionId",e):p.delete("breakGlassSessionId")},Ue=async()=>{try{let e=X.default.join(process.cwd(),"xtra.json");if(w.default.existsSync(e)){let t=w.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},Le=()=>{let e={};try{let t=X.default.join(process.cwd(),".xtrarc");w.default.existsSync(t)&&(e=JSON.parse(w.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||p.get("project")||"",env:e.env||p.get("env")||"development",branch:e.branch||p.get("branch")||"main"}}});var ce,pe,ge,Oe,o,x,G=C(()=>{ce=l(require("axios"));D();pe=l(require("fs")),ge=l(require("path")),Oe=JSON.parse(pe.readFileSync(ge.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=S(),r=e||P();return ce.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":Oe.version,...r?{Authorization:`Bearer ${r}`}:{}}})},x={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,i)=>{let d=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(d&&typeof d=="object"){let u=null,{deriveProjectKey:f,decryptSecretValue:m,resolveVaultPassphrase:I,decryptWorkloadKeyEnvelope:_}=(R(),$(H));for(let[h,A]of Object.entries(d))if(typeof A=="string"&&A.startsWith("{"))try{let v=JSON.parse(A);if(v.ciphertext&&v.iv){if(!u)if(i&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)u=_(i,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let he=I(s,e);u=f(e,he)}d[h]=m(v,u)}}catch(v){if(v.message&&v.message.includes("Zero-Knowledge"))throw v}}return d},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:i,encryptSecretValue:g,resolveVaultPassphrase:d}=(R(),$(H)),u=d(void 0,e),f=i(e,u),m={};for(let[_,h]of Object.entries(r))if(typeof h=="string"&&h.startsWith("{")&&h.includes("ciphertext"))m[_]=h;else{let A=g(h,f);m[_]=JSON.stringify(A)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:m,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:i})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=S(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=S(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});var le={};B(le,{loadAuditLogs:()=>N,logAudit:()=>De,saveAuditLogs:()=>F,syncAuditLogs:()=>Ne});function Ve(e){if(!e||typeof e!="object")return e;let t={...e},r=["password","token","secret","value","apiKey","secretValue"];for(let s of Object.keys(t))r.some(n=>s.toLowerCase().includes(n))&&(t[s]="[REDACTED]");return t}async function de(e){try{if(!S().token)return!1;let r={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:Ve(e.details),timestamp:e.timestamp,projectId:e.projectId};return await x.post("/audit/cli-logs",{logs:[r]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function De(e,t,r,s){let n={id:(0,ue.randomUUID)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:r,details:s,synced:!1},i=N();i.push(n),F(i),de(n).then(g=>{if(g){n.synced=!0;let d=N(),u=d.findIndex(f=>f.id===n.id);u!==-1&&(d[u].synced=!0,F(d))}}).catch(()=>{})}function N(){if(!b.default.existsSync(M))return[];try{let e=b.default.readFileSync(M,"utf-8"),t=JSON.parse(e),r=V(t);return JSON.parse(r)}catch{return[]}}function F(e){b.default.existsSync(W)||b.default.mkdirSync(W,{recursive:!0});let t=JSON.stringify(e),r=O(t);b.default.writeFileSync(M,JSON.stringify(r),"utf-8")}async function Ne(){let e=N(),t=e.filter(s=>!s.synced);if(t.length===0)return 0;let r=0;for(let s of t)await de(s)&&(s.synced=!0,r++);return r>0&&F(e),r}var b,z,ue,W,M,fe=C(()=>{b=l(require("fs")),z=l(require("path")),ue=require("crypto");R();D();G();W=z.default.join(process.cwd(),".xtra"),M=z.default.join(W,"audit.enc")});var Fe={};B(Fe,{adminCommand:()=>K});module.exports=$(Fe);var Y=require("commander");G();var c=l(require("chalk")),J=l(require("ora")),Z=require("table"),K=new Y.Command("admin").description("Admin commands for user and role management"),ye=new Y.Command("role").description("Manage user roles and permissions"),me=async()=>{let e=(0,J.default)("Fetching roles from server...").start();try{let t=await x.getRoles();e.stop(),console.log(c.default.bold(`
 Available Roles:
-`));let s=[[a.default.bold("Role"),a.default.bold("Description"),a.default.bold("Permissions")]];t.forEach(r=>{s.push([a.default.cyan(r.name),r.description||"-",Array.isArray(r.permissions)?r.permissions.join(", "):r.permissions||"-"])}),console.log((0,R.table)(s))}catch(t){e.fail("Failed to fetch roles");let s=t.response?.data?.error||"Unknown error";console.error(a.default.red(s))}};Y.command("list").description("List all available roles").alias("ls").action(Z);m.addCommand(Y);m.command("roles").description("Alias for 'role list'").action(Z);m.command("users").description("List all users with their roles").option("-t, --team <teamId>","Filter by team ID").action(async e=>{let t=(0,S.default)("Fetching users...").start();try{let s=await g.getUsers(e.team);if(t.stop(),!s||s.length===0){console.log(a.default.yellow("No users found."));return}console.log(a.default.bold(`
+`));let r=[[c.default.bold("Role"),c.default.bold("Description"),c.default.bold("Permissions")]];t.forEach(s=>{r.push([c.default.cyan(s.name),s.description||"-",Array.isArray(s.permissions)?s.permissions.join(", "):s.permissions||"-"])}),console.log((0,Z.table)(r))}catch(t){e.fail("Failed to fetch roles");let r=t.response?.data?.error||"Unknown error";console.error(c.default.red(r))}};ye.command("list").description("List all available roles").alias("ls").action(me);K.addCommand(ye);K.command("roles").description("Alias for 'role list'").action(me);K.command("users").description("List all users with their roles").option("-t, --team <teamId>","Filter by team ID").action(async e=>{let t=(0,J.default)("Fetching users...").start();try{let r=await x.getUsers(e.team);if(t.stop(),!r||r.length===0){console.log(c.default.yellow("No users found."));return}console.log(c.default.bold(`
 Users:
-`));let r=[[a.default.bold("Email"),a.default.bold("Name"),a.default.bold("Role"),a.default.bold("Status")]];s.forEach(n=>{let i=n.role==="owner"||n.role==="admin"?a.default.magenta:n.role==="viewer"?a.default.gray:a.default.cyan;r.push([n.email,n.name||"-",i(n.role),n.status||"active"])}),console.log((0,R.table)(r))}catch(s){t.fail("Failed to fetch users"),console.error(a.default.red(s?.response?.data?.error||"An unexpected error occurred"))}});m.command("set-role <email> <role>").description("Change a user's role (owner, admin, developer, viewer, guest)").option("-t, --team <teamId>","Team ID (for team-specific role)").action(async(e,t,s)=>{let r=["owner","admin","developer","viewer","guest"];r.includes(t.toLowerCase())||(console.error(a.default.red(`Invalid role: ${t}`)),console.log(a.default.yellow(`Valid roles: ${r.join(", ")}`)),process.exit(1));let n=(0,S.default)(`Updating role for ${e}...`).start();try{await g.setUserRole(e,t.toLowerCase(),s.team),n.succeed(a.default.green(`Role updated: ${e} \u2192 ${t}`));try{let{logAudit:i}=(W(),E(Q));i("ADMIN_ROLE_CHANGE",null,null,{email:e,newRole:t,teamId:s.team})}catch{}}catch(i){n.fail("Failed to update role");let y=i.response?.data?.error||"Unknown error";console.error(a.default.red(y))}});0&&(module.exports={adminCommand});
+`));let s=[[c.default.bold("Email"),c.default.bold("Name"),c.default.bold("Role"),c.default.bold("Status")]];r.forEach(n=>{let i=n.role==="owner"||n.role==="admin"?c.default.magenta:n.role==="viewer"?c.default.gray:c.default.cyan;s.push([n.email,n.name||"-",i(n.role),n.status||"active"])}),console.log((0,Z.table)(s))}catch(r){t.fail("Failed to fetch users"),console.error(c.default.red(r?.response?.data?.error||"An unexpected error occurred"))}});K.command("set-role <email> <role>").description("Change a user's role (owner, admin, developer, viewer, guest)").option("-t, --team <teamId>","Team ID (for team-specific role)").action(async(e,t,r)=>{let s=["owner","admin","developer","viewer","guest"];s.includes(t.toLowerCase())||(console.error(c.default.red(`Invalid role: ${t}`)),console.log(c.default.yellow(`Valid roles: ${s.join(", ")}`)),process.exit(1));let n=(0,J.default)(`Updating role for ${e}...`).start();try{await x.setUserRole(e,t.toLowerCase(),r.team),n.succeed(c.default.green(`Role updated: ${e} \u2192 ${t}`));try{let{logAudit:i}=(fe(),$(le));i("ADMIN_ROLE_CHANGE",null,null,{email:e,newRole:t,teamId:r.team})}catch{}}catch(i){n.fail("Failed to update role");let g=i.response?.data?.error||"Unknown error";console.error(c.default.red(g))}});0&&(module.exports={adminCommand});

package/dist/commands/agent.js

@@ -0,0 +1,4 @@
+var oe=Object.create;var P=Object.defineProperty;var ae=Object.getOwnPropertyDescriptor;var ie=Object.getOwnPropertyNames;var ce=Object.getPrototypeOf,pe=Object.prototype.hasOwnProperty;var O=(e,t)=>()=>(e&&(t=e(e=0)),t);var E=(e,t)=>{for(var r in t)P(e,r,{get:t[r],enumerable:!0})},N=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of ie(t))!pe.call(e,n)&&n!==r&&P(e,n,{get:()=>t[n],enumerable:!(s=ae(t,n))||s.enumerable});return e};var d=(e,t,r)=>(r=e!=null?oe(ce(e)):{},N(t||!e||!e.__esModule?P(r,"default",{value:e,enumerable:!0}):r,e)),K=e=>N(P({},"__esModule",{value:!0}),e);var B={};E(B,{createWorkloadKeyEnvelope:()=>ye,decrypt:()=>W,decryptSecretValue:()=>de,decryptWorkloadKeyEnvelope:()=>me,deriveProjectKey:()=>ue,encrypt:()=>J,encryptSecretValue:()=>le,hash:()=>ge,resolveVaultPassphrase:()=>G,saveVaultPassphrase:()=>fe,secureRead:()=>A,secureSave:()=>$});function q(){if(_)return _;let e=R.get("masterKey");e||(e=i.default.randomBytes(32).toString("hex"),R.set("masterKey",e));let t="";try{t=(0,D.machineIdSync)()||""}catch{t=i.default.createHash("sha256").update(f.default.hostname()+(f.default.userInfo?.()?.username||"root")).digest("hex")}let r=f.default.platform(),s=f.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return _=i.default.createHash("sha256").update(n).digest(),_}function ue(e,t){t||(t=G(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=i.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function le(e,t){let r=i.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=i.default.createCipheriv("aes-256-gcm",s,r),a=n.update(e,"utf8","hex");a+=n.final("hex");let c=n.getAuthTag().toString("hex");return{ciphertext:a,iv:r.toString("hex"),authTag:c}}function de(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),a=i.default.createDecipheriv("aes-256-gcm",r,s);a.setAuthTag(n);let c=a.update(e.ciphertext,"hex","utf8");return c+=a.final("utf8"),c}function G(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=A(`vault_${t}`);if(s)return s}let r=A("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(C(),K(M)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function fe(e,t){t&&$(`vault_${t}`,e),$("vault_passphrase",e)}function ye(e,t){let{publicKey:r,privateKey:s}=i.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),a=i.default.createPublicKey(t),c=i.default.diffieHellman({privateKey:s,publicKey:a}),l=Buffer.from(i.default.hkdfSync("sha256",c,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),g=i.default.randomBytes(12),y=i.default.createCipheriv("aes-256-gcm",l,g),m=y.update(e,"utf8","hex");m+=y.final("hex");let b=y.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:m,iv:g.toString("hex"),authTag:b}}function me(e,t){let r=i.default.createPrivateKey(t),s=i.default.createPublicKey(e.ephemeralPublicKey),n=i.default.diffieHellman({privateKey:r,publicKey:s}),a=Buffer.from(i.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),c=Buffer.from(e.iv,"hex"),l=Buffer.from(e.authTag,"hex"),g=i.default.createDecipheriv("aes-256-gcm",a,c);g.setAuthTag(l);let y=g.update(e.encryptedProjectKey,"hex","utf8");return y+=g.final("utf8"),y}var i,f,X,D,w,H,R,_,J,W,ge,$,A,I=O(()=>{i=d(require("crypto")),f=d(require("os")),X=d(require("conf")),D=require("node-machine-id"),w=require("child_process"),H="aes-256-gcm",R=new X.default({projectName:"xtra-cli-crypto"}),_=null;J=e=>{let t=i.default.randomBytes(12),r=q(),s=i.default.createCipheriv(H,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let a=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:a.toString("hex")}},W=e=>{let t=q(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=i.default.createDecipheriv(H,t,r);n.setAuthTag(s);let a=n.update(e.content,"hex","utf8");return a+=n.final("utf8"),a},ge=e=>i.default.createHash("sha256").update(e).digest("hex"),$=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(f.default.platform()==="darwin"){(0,w.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(f.default.platform()!=="win32"){if(f.default.platform()==="linux")try{(0,w.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=J(t);R.set(`secure_${e}`,JSON.stringify(r))},A=e=>{try{let t="XtraSecurityCLI",r=e;if(f.default.platform()==="darwin")return(0,w.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(f.default.platform()!=="win32"){if(f.default.platform()==="linux")try{return(0,w.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=R.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return W(r)}catch{return null}}});var M={};E(M,{clearConfig:()=>ve,deleteConfig:()=>xe,getAuthToken:()=>j,getBreakGlassSession:()=>Se,getConfig:()=>k,getConfigValue:()=>L,getProjectConfig:()=>$e,getRcConfig:()=>Ae,setBreakGlassSession:()=>we,setConfig:()=>he});var Y,x,V,U,p,F,k,L,he,ve,xe,j,Se,we,$e,Ae,C=O(()=>{Y=d(require("conf")),x=d(require("fs")),V=d(require("path"));I();U="https://www.xtrasecurity.in/api",p=new Y.default({projectName:"xtra-cli",defaults:{apiUrl:U}}),F=p.get("apiUrl");F&&!process.env.XTRA_API_URL&&F.includes("xtra-security.vercel.app")&&p.set("apiUrl",U);k=()=>({...p.store,token:j(),apiUrl:process.env.XTRA_API_URL||p.get("apiUrl")||U}),L=e=>e==="token"?j():p.get(e),he=(e,t)=>{if(e==="token"&&t&&$("token",t),p.set(e,t),e==="token"&&process.platform!=="win32"&&x.default.existsSync(p.path))try{x.default.chmodSync(p.path,384)}catch{}},ve=()=>p.clear(),xe=e=>p.delete(e),j=()=>A("token")||p.get("token"),Se=()=>p.get("breakGlassSessionId"),we=e=>{e?p.set("breakGlassSessionId",e):p.delete("breakGlassSessionId")},$e=async()=>{try{let e=V.default.join(process.cwd(),"xtra.json");if(x.default.existsSync(e)){let t=x.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},Ae=()=>{let e={};try{let t=V.default.join(process.cwd(),".xtrarc");x.default.existsSync(t)&&(e=JSON.parse(x.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||p.get("project")||"",env:e.env||p.get("env")||"development",branch:e.branch||p.get("branch")||"main"}}});var be={};E(be,{agentCommand:()=>se});module.exports=K(be);var te=require("commander");var Z=d(require("axios"));C();var z=d(require("fs")),Q=d(require("path")),ke=JSON.parse(z.readFileSync(Q.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=k(),r=e||j();return Z.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":ke.version,...r?{Authorization:`Bearer ${r}`}:{}}})},ee={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,a)=>{let l=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(l&&typeof l=="object"){let g=null,{deriveProjectKey:y,decryptSecretValue:m,resolveVaultPassphrase:b,decryptWorkloadKeyEnvelope:T}=(I(),K(B));for(let[h,S]of Object.entries(l))if(typeof S=="string"&&S.startsWith("{"))try{let v=JSON.parse(S);if(v.ciphertext&&v.iv){if(!g)if(a&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)g=T(a,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let ne=b(s,e);g=y(e,ne)}l[h]=m(v,g)}}catch(v){if(v.message&&v.message.includes("Zero-Knowledge"))throw v}}return l},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:a,encryptSecretValue:c,resolveVaultPassphrase:l}=(I(),K(B)),g=l(void 0,e),y=a(e,g),m={};for(let[T,h]of Object.entries(r))if(typeof h=="string"&&h.startsWith("{")&&h.includes("ciphertext"))m[T]=h;else{let S=c(h,y);m[T]=JSON.stringify(S)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:m,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,a)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:a})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=k(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=k(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data};var u=d(require("chalk")),re=d(require("ora"));C();var se=new te.Command("agent").description("Manage AI Agent Ephemeral Contexts"),je=e=>{let t=e.project||L("project");return t||(console.error(u.default.red("\u2716 Error: No project specified.")),console.log(u.default.yellow("  Use --project <id> or run 'xtra project set' first.")),process.exit(1)),t};se.command("spawn <name>").description("Spawn an ephemeral context API key for an AI Agent").option("-p, --project <id>","Project ID").option("-s, --scopes <scopes>","Comma-separated permissions (default: read:secrets)","read:secrets").option("-t, --ttl <minutes>","Time to live in minutes (max: 60)","15").action(async(e,t)=>{let r=je(t),s=t.scopes.split(",").map(c=>c.trim()),n=parseInt(t.ttl,10),a=(0,re.default)(`Spawning ephemeral agent context for '${e}'...`).start();try{let c=await ee.spawnAgentContext({projectId:r,agentName:e,scopes:s,durationMinutes:n});a.succeed(u.default.green("Agent Context successfully spawned!")),console.log(u.default.cyan(`
+Service Account ID: ${c.serviceAccountId}`)),console.log(u.default.cyan(`Scopes: ${c.scopes.join(", ")}`)),console.log(u.default.cyan(`Expires At: ${new Date(c.expiresAt).toLocaleString()}`)),console.log(u.default.bold.yellow(`
+Agent Ephemeral Token (Keep Secret):`)),console.log(u.default.white.bgBlack(` ${c.agentToken} `)),console.log(u.default.gray(`
+Provide this token to your AI Agent environment as XTRA_AGENT_TOKEN.`)),console.log(u.default.gray(`It will mathematically expire and become useless in ${n} minutes.`))}catch(c){a.fail("Failed to spawn agent context"),console.error(u.default.red(c.response?.data?.error||"Unknown error"))}});0&&(module.exports={agentCommand});

package/dist/commands/audit.js

@@ -1 +1 @@
-var A=Object.create;var d=Object.defineProperty;var I=Object.getOwnPropertyDescriptor;var C=Object.getOwnPropertyNames;var R=Object.getPrototypeOf,U=Object.prototype.hasOwnProperty;var L=(e,t)=>{for(var s in t)d(e,s,{get:t[s],enumerable:!0})},$=(e,t,s,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of C(t))!U.call(e,o)&&o!==s&&d(e,o,{get:()=>t[o],enumerable:!(n=I(t,o))||n.enumerable});return e};var c=(e,t,s)=>(s=e!=null?A(R(e)):{},$(t||!e||!e.__esModule?d(s,"default",{value:e,enumerable:!0}):s,e)),O=e=>$(d({},"__esModule",{value:!0}),e);var D={};L(D,{auditCommand:()=>_});module.exports=O(D);var l=require("commander");var j=c(require("axios"));var v=c(require("conf"));var y="https://www.xtrasecurity.in/api",g=new v.default({projectName:"xtra-cli",defaults:{apiUrl:y}}),h=g.get("apiUrl");h&&!process.env.XTRA_API_URL&&h.includes("xtra-security.vercel.app")&&g.set("apiUrl",y);var u=()=>({...g.store,apiUrl:process.env.XTRA_API_URL||g.get("apiUrl")||y});var S=()=>g.get("token");var x=c(require("fs")),k=c(require("path")),P=JSON.parse(x.readFileSync(k.join(__dirname,"../../package.json"),"utf-8")),r=()=>{let{apiUrl:e}=u(),t=S();return j.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":P.version,...t?{Authorization:`Bearer ${t}`}:{}}})},m={login:async(e,t,s)=>(await r().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,n,o="main")=>(await r().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:n,branch:o})).data,getSecretDetails:async(e,t,s,n="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${n}`)).data,syncLogs:async e=>(await r().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,n,o,i)=>(await r().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:n,sourceEnv:o,sourceKey:i})).data,rotateSecret:async(e,t,s,n,o)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:n,parsedNewValue:o})).data,promoteSecret:async(e,t,s)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await r().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,n)=>{let o={format:e};return t&&(o.startDate=t),s&&(o.endDate=s),n&&(o.projectId=n),(await r().post("/audit/export",o,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,n)=>(await r().post("/access/request",{projectId:e,secretId:n,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await r().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=u(),s=t?`&workspaceId=${t}`:"";return(await r().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await r().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=u(),t=e?`/project?workspaceId=${e}`:"/project";return(await r().get(t)).data},getBranches:async e=>(await r().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await r().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await r().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await r().put("/branch",{id:e,...t})).data,getRoles:async()=>(await r().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await r().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await r().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await r().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await r().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await r().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await r().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await r().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,n)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:n})).data,cloneEnvironment:async(e,t,s,n,o)=>(await r().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:n,branch:o})).data,generateJitLink:async e=>(await r().post("/jit/generate",e)).data,claimJitLink:async e=>(await r().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await r().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await r().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await r().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await r().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await r().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,s,n)=>(await r().post(`/projects/${e}/service-accounts/${t}/keys`,{label:s,expiresAt:n})).data,deleteServiceAccountKey:async(e,t,s)=>(await r().delete(`/projects/${e}/service-accounts/${t}/keys/${s}`)).data,post:async(e,t)=>(await r().post(e,t)).data};var a=c(require("chalk")),f=c(require("ora")),b=c(require("fs")),_=new l.Command("audit").description("Manage and verify audit logs").addCommand(new l.Command("verify").description("Verify the integrity of the audit log chain (Tamper-Evident)").action(async()=>{let e=(0,f.default)("Verifying audit chain integrity...").start();try{let t=await m.verifyAuditLogs();t.valid?e.succeed(a.default.green(t.message)):(e.fail(a.default.red("Verification Failed!")),console.error(a.default.red(`Broken at Log ID: ${t.details?.brokenAtId}`)),console.error(a.default.red(`Reason: ${t.details?.reason}`)))}catch(t){e.fail("Verification failed"),t.response?.data?.details?(console.error(a.default.red(`Chain Broken: ${t.response.data.message}`)),console.error(a.default.yellow(`Details: ${JSON.stringify(t.response.data.details,null,2)}`))):console.error(a.default.red(t?.response?.data?.error||"An unexpected error occurred"))}})).addCommand(new l.Command("export").description("Export audit logs for compliance (SOC2/ISO)").option("-f, --format <format>","Output format (json, csv)","json").option("--start <date>","Start date (YYYY-MM-DD)").option("--end <date>","End date (YYYY-MM-DD)").option("-o, --output <file>","Output file path").action(async e=>{let{format:t,start:s,end:n,output:o}=e,i=(0,f.default)(`Exporting audit logs (${t})...`).start();try{let p=await m.exportAuditLogs(t,s,n),w=typeof p=="object"?JSON.stringify(p,null,2):p;o?(b.default.writeFileSync(o,w),i.succeed(a.default.green(`Export saved to ${o}`))):(i.stop(),console.log(w))}catch(p){i.fail("Export failed"),console.error(a.default.red(p?.response?.data?.error||"An unexpected error occurred"))}}));0&&(module.exports={auditCommand});
+var ne=Object.create;var P=Object.defineProperty;var oe=Object.getOwnPropertyDescriptor;var ae=Object.getOwnPropertyNames;var ie=Object.getPrototypeOf,ce=Object.prototype.hasOwnProperty;var N=(e,t)=>()=>(e&&(t=e(e=0)),t);var C=(e,t)=>{for(var r in t)P(e,r,{get:t[r],enumerable:!0})},X=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of ae(t))!ce.call(e,n)&&n!==r&&P(e,n,{get:()=>t[n],enumerable:!(s=oe(t,n))||s.enumerable});return e};var d=(e,t,r)=>(r=e!=null?ne(ie(e)):{},X(t||!e||!e.__esModule?P(r,"default",{value:e,enumerable:!0}):r,e)),K=e=>X(P({},"__esModule",{value:!0}),e);var I={};C(I,{createWorkloadKeyEnvelope:()=>fe,decrypt:()=>Y,decryptSecretValue:()=>de,decryptWorkloadKeyEnvelope:()=>ye,deriveProjectKey:()=>ge,encrypt:()=>W,encryptSecretValue:()=>ue,hash:()=>pe,resolveVaultPassphrase:()=>G,saveVaultPassphrase:()=>le,secureRead:()=>k,secureSave:()=>$});function M(){if(R)return R;let e=_.get("masterKey");e||(e=i.default.randomBytes(32).toString("hex"),_.set("masterKey",e));let t="";try{t=(0,J.machineIdSync)()||""}catch{t=i.default.createHash("sha256").update(l.default.hostname()+(l.default.userInfo?.()?.username||"root")).digest("hex")}let r=l.default.platform(),s=l.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return R=i.default.createHash("sha256").update(n).digest(),R}function ge(e,t){t||(t=G(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=i.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function ue(e,t){let r=i.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=i.default.createCipheriv("aes-256-gcm",s,r),a=n.update(e,"utf8","hex");a+=n.final("hex");let c=n.getAuthTag().toString("hex");return{ciphertext:a,iv:r.toString("hex"),authTag:c}}function de(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),a=i.default.createDecipheriv("aes-256-gcm",r,s);a.setAuthTag(n);let c=a.update(e.ciphertext,"hex","utf8");return c+=a.final("utf8"),c}function G(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=k(`vault_${t}`);if(s)return s}let r=k("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(V(),K(F)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function le(e,t){t&&$(`vault_${t}`,e),$("vault_passphrase",e)}function fe(e,t){let{publicKey:r,privateKey:s}=i.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),a=i.default.createPublicKey(t),c=i.default.diffieHellman({privateKey:s,publicKey:a}),g=Buffer.from(i.default.hkdfSync("sha256",c,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),u=i.default.randomBytes(12),f=i.default.createCipheriv("aes-256-gcm",g,u),h=f.update(e,"utf8","hex");h+=f.final("hex");let b=f.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:h,iv:u.toString("hex"),authTag:b}}function ye(e,t){let r=i.default.createPrivateKey(t),s=i.default.createPublicKey(e.ephemeralPublicKey),n=i.default.diffieHellman({privateKey:r,publicKey:s}),a=Buffer.from(i.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),c=Buffer.from(e.iv,"hex"),g=Buffer.from(e.authTag,"hex"),u=i.default.createDecipheriv("aes-256-gcm",a,c);u.setAuthTag(g);let f=u.update(e.encryptedProjectKey,"hex","utf8");return f+=u.final("utf8"),f}var i,l,H,J,w,q,_,R,W,Y,pe,$,k,B=N(()=>{i=d(require("crypto")),l=d(require("os")),H=d(require("conf")),J=require("node-machine-id"),w=require("child_process"),q="aes-256-gcm",_=new H.default({projectName:"xtra-cli-crypto"}),R=null;W=e=>{let t=i.default.randomBytes(12),r=M(),s=i.default.createCipheriv(q,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let a=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:a.toString("hex")}},Y=e=>{let t=M(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=i.default.createDecipheriv(q,t,r);n.setAuthTag(s);let a=n.update(e.content,"hex","utf8");return a+=n.final("utf8"),a},pe=e=>i.default.createHash("sha256").update(e).digest("hex"),$=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(l.default.platform()==="darwin"){(0,w.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(l.default.platform()!=="win32"){if(l.default.platform()==="linux")try{(0,w.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=W(t);_.set(`secure_${e}`,JSON.stringify(r))},k=e=>{try{let t="XtraSecurityCLI",r=e;if(l.default.platform()==="darwin")return(0,w.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(l.default.platform()!=="win32"){if(l.default.platform()==="linux")try{return(0,w.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=_.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return Y(r)}catch{return null}}});var F={};C(F,{clearConfig:()=>ve,deleteConfig:()=>Se,getAuthToken:()=>A,getBreakGlassSession:()=>xe,getConfig:()=>j,getConfigValue:()=>he,getProjectConfig:()=>$e,getRcConfig:()=>ke,setBreakGlassSession:()=>we,setConfig:()=>me});var z,S,O,L,p,Z,j,he,me,ve,Se,A,xe,we,$e,ke,V=N(()=>{z=d(require("conf")),S=d(require("fs")),O=d(require("path"));B();L="https://www.xtrasecurity.in/api",p=new z.default({projectName:"xtra-cli",defaults:{apiUrl:L}}),Z=p.get("apiUrl");Z&&!process.env.XTRA_API_URL&&Z.includes("xtra-security.vercel.app")&&p.set("apiUrl",L);j=()=>({...p.store,token:A(),apiUrl:process.env.XTRA_API_URL||p.get("apiUrl")||L}),he=e=>e==="token"?A():p.get(e),me=(e,t)=>{if(e==="token"&&t&&$("token",t),p.set(e,t),e==="token"&&process.platform!=="win32"&&S.default.existsSync(p.path))try{S.default.chmodSync(p.path,384)}catch{}},ve=()=>p.clear(),Se=e=>p.delete(e),A=()=>k("token")||p.get("token"),xe=()=>p.get("breakGlassSessionId"),we=e=>{e?p.set("breakGlassSessionId",e):p.delete("breakGlassSessionId")},$e=async()=>{try{let e=O.default.join(process.cwd(),"xtra.json");if(S.default.existsSync(e)){let t=S.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},ke=()=>{let e={};try{let t=O.default.join(process.cwd(),".xtrarc");S.default.existsSync(t)&&(e=JSON.parse(S.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||p.get("project")||"",env:e.env||p.get("env")||"development",branch:e.branch||p.get("branch")||"main"}}});var be={};C(be,{auditCommand:()=>Ae});module.exports=K(be);var E=require("commander");var Q=d(require("axios"));V();var ee=d(require("fs")),te=d(require("path")),je=JSON.parse(ee.readFileSync(te.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=j(),r=e||A();return Q.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":je.version,...r?{Authorization:`Bearer ${r}`}:{}}})},U={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,a)=>{let g=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(g&&typeof g=="object"){let u=null,{deriveProjectKey:f,decryptSecretValue:h,resolveVaultPassphrase:b,decryptWorkloadKeyEnvelope:T}=(B(),K(I));for(let[m,x]of Object.entries(g))if(typeof x=="string"&&x.startsWith("{"))try{let v=JSON.parse(x);if(v.ciphertext&&v.iv){if(!u)if(a&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)u=T(a,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let se=b(s,e);u=f(e,se)}g[m]=h(v,u)}}catch(v){if(v.message&&v.message.includes("Zero-Knowledge"))throw v}}return g},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:a,encryptSecretValue:c,resolveVaultPassphrase:g}=(B(),K(I)),u=g(void 0,e),f=a(e,u),h={};for(let[T,m]of Object.entries(r))if(typeof m=="string"&&m.startsWith("{")&&m.includes("ciphertext"))h[T]=m;else{let x=c(m,f);h[T]=JSON.stringify(x)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:h,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,a)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:a})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=j(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=j(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data};var y=d(require("chalk")),D=d(require("ora")),re=d(require("fs")),Ae=new E.Command("audit").description("Manage and verify audit logs").addCommand(new E.Command("verify").description("Verify the integrity of the audit log chain (Tamper-Evident)").action(async()=>{let e=(0,D.default)("Verifying audit chain integrity...").start();try{let t=await U.verifyAuditLogs();t.valid?e.succeed(y.default.green(t.message)):(e.fail(y.default.red("Verification Failed!")),console.error(y.default.red(`Broken at Log ID: ${t.details?.brokenAtId}`)),console.error(y.default.red(`Reason: ${t.details?.reason}`)))}catch(t){e.fail("Verification failed"),t.response?.data?.details?(console.error(y.default.red(`Chain Broken: ${t.response.data.message}`)),console.error(y.default.yellow(`Details: ${JSON.stringify(t.response.data.details,null,2)}`))):console.error(y.default.red(t?.response?.data?.error||"An unexpected error occurred"))}})).addCommand(new E.Command("export").description("Export audit logs for compliance (SOC2/ISO)").option("-f, --format <format>","Output format (json, csv)","json").option("--start <date>","Start date (YYYY-MM-DD)").option("--end <date>","End date (YYYY-MM-DD)").option("-o, --output <file>","Output file path").action(async e=>{let{format:t,start:r,end:s,output:n}=e,a=(0,D.default)(`Exporting audit logs (${t})...`).start();try{let c=await U.exportAuditLogs(t,r,s),g=typeof c=="object"?JSON.stringify(c,null,2):c;n?(re.default.writeFileSync(n,g),a.succeed(y.default.green(`Export saved to ${n}`))):(a.stop(),console.log(g))}catch(c){a.fail("Export failed"),console.error(y.default.red(c?.response?.data?.error||"An unexpected error occurred"))}}));0&&(module.exports={auditCommand});

package/dist/commands/branch.js

@@ -1 +1 @@
-var se=Object.create;var j=Object.defineProperty;var ne=Object.getOwnPropertyDescriptor;var oe=Object.getOwnPropertyNames;var ae=Object.getPrototypeOf,ce=Object.prototype.hasOwnProperty;var v=(e,r)=>()=>(e&&(r=e(e=0)),r);var D=(e,r)=>{for(var t in r)j(e,t,{get:r[t],enumerable:!0})},N=(e,r,t,s)=>{if(r&&typeof r=="object"||typeof r=="function")for(let n of oe(r))!ce.call(e,n)&&n!==t&&j(e,n,{get:()=>r[n],enumerable:!(s=ne(r,n))||s.enumerable});return e};var g=(e,r,t)=>(t=e!=null?se(ae(e)):{},N(r||!e||!e.__esModule?j(t,"default",{value:e,enumerable:!0}):t,e)),R=e=>N(j({},"__esModule",{value:!0}),e);var O,k,T,I,f,L,y,P,w,x=v(()=>{O=g(require("conf")),k=g(require("fs")),T=g(require("path")),I="https://www.xtrasecurity.in/api",f=new O.default({projectName:"xtra-cli",defaults:{apiUrl:I}}),L=f.get("apiUrl");L&&!process.env.XTRA_API_URL&&L.includes("xtra-security.vercel.app")&&f.set("apiUrl",I);y=()=>({...f.store,apiUrl:process.env.XTRA_API_URL||f.get("apiUrl")||I}),P=()=>f.get("token"),w=()=>{let e={};try{let r=T.default.join(process.cwd(),".xtrarc");k.default.existsSync(r)&&(e=JSON.parse(k.default.readFileSync(r,"utf-8")))}catch{}return{project:e.project||f.get("project")||"",env:e.env||f.get("env")||"development",branch:e.branch||f.get("branch")||"main"}}});var _,F,q,ie,o,u,C=v(()=>{_=g(require("axios"));x();F=g(require("fs")),q=g(require("path")),ie=JSON.parse(F.readFileSync(q.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:e}=y(),r=P();return _.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":ie.version,...r?{Authorization:`Bearer ${r}`}:{}}})},u={login:async(e,r,t)=>(await o().post("/auth/cli-login",{email:e,password:r,apiKey:t})).data,getSecrets:async(e,r,t="main")=>(await o().get(`/projects/${e}/envs/${r}/secrets?branch=${t}`)).data,getSecretVersions:async(e,r,t="main")=>(await o().get(`/projects/${e}/envs/${r}/secrets?includeVersions=true&branch=${t}`)).data,setSecrets:async(e,r,t,s,n="main")=>(await o().post(`/projects/${e}/envs/${r}/secrets`,{secrets:t,expectedVersions:s,branch:n})).data,getSecretDetails:async(e,r,t,s="main")=>(await o().get(`/projects/${e}/envs/${r}/secrets/${t}?branch=${s}`)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,r,t,s,n,a)=>(await o().post(`/projects/${e}/envs/${r}/secrets/link`,{key:t,sourceProjectId:s,sourceEnv:n,sourceKey:a})).data,rotateSecret:async(e,r,t,s,n)=>(await o().post(`/projects/${e}/envs/${r}/secrets/${t}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,r,t)=>(await o().post(`/projects/${e}/envs/${r}/secrets/${t}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,r,t,s)=>{let n={format:e};return r&&(n.startDate=r),t&&(n.endDate=t),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,r,t,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:r,duration:t})).data,approveAccess:async(e,r)=>(await o().post("/access/approve",{requestId:e,decision:r})).data,listAccessRequests:async e=>{let{workspace:r}=y(),t=r?`&workspaceId=${r}`:"";return(await o().get(`/access/list?mode=${e}${t}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=y(),r=e?`/project?workspaceId=${e}`:"/project";return(await o().get(r)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,r,t)=>(await o().post("/branch",{projectId:e,name:r,description:t})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,r)=>(await o().put("/branch",{id:e,...r})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let r=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${r}`)).data},setUserRole:async(e,r,t)=>(await o().put("/admin/users/role",{email:e,role:r,teamId:t})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,r)=>{let t=new URLSearchParams(r).toString();return(await o().get(`/projects/${e}/kubernetes?${t}`)).data},getSecretHistory:async(e,r,t)=>(await o().get(`/projects/${e}/envs/${r}/secrets/${t}/history`)).data,rollbackSecret:async(e,r,t,s)=>(await o().post(`/projects/${e}/envs/${r}/secrets/${t}/history`,{version:s})).data,cloneEnvironment:async(e,r,t,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:r,toEnv:t,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,r)=>(await o().post(`/projects/${e}/service-accounts`,r)).data,deleteServiceAccount:async(e,r)=>(await o().delete(`/projects/${e}/service-accounts/${r}`)).data,getServiceAccountKeys:async(e,r)=>(await o().get(`/projects/${e}/service-accounts/${r}/keys`)).data,createServiceAccountKey:async(e,r,t,s)=>(await o().post(`/projects/${e}/service-accounts/${r}/keys`,{label:t,expiresAt:s})).data,deleteServiceAccountKey:async(e,r,t)=>(await o().delete(`/projects/${e}/service-accounts/${r}/keys/${t}`)).data,post:async(e,r)=>(await o().post(e,r)).data}});function H(){let e=J.get("masterKey");e||(e=m.default.randomBytes(32).toString("hex"),J.set("masterKey",e));let r=(0,G.machineIdSync)();return m.default.createHash("sha256").update(e+r).digest()}var m,K,G,V,J,z,M,X=v(()=>{m=g(require("crypto")),K=g(require("conf")),G=require("node-machine-id"),V="aes-256-gcm",J=new K.default({projectName:"xtra-cli-crypto"});z=e=>{let r=m.default.randomBytes(16),t=H(),s=m.default.createCipheriv(V,t,r),n=s.update(e,"utf8","hex");n+=s.final("hex");let a=s.getAuthTag();return{iv:r.toString("hex"),content:n,tag:a.toString("hex")}},M=e=>{let r=H(),t=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=m.default.createDecipheriv(V,r,t);n.setAuthTag(s);let a=n.update(e.content,"hex","utf8");return a+=n.final("utf8"),a}});var Y={};D(Y,{loadAuditLogs:()=>$,logAudit:()=>ge,saveAuditLogs:()=>S,syncAuditLogs:()=>de});function pe(e){if(!e||typeof e!="object")return e;let r={...e},t=["password","token","secret","value","apiKey","secretValue"];for(let s of Object.keys(r))t.some(n=>s.toLowerCase().includes(n))&&(r[s]="[REDACTED]");return r}async function W(e){try{if(!y().token)return!1;let t={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:pe(e.details),timestamp:e.timestamp,projectId:e.projectId};return await u.post("/audit/cli-logs",{logs:[t]}),!0}catch(r){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",r),!1}}function ge(e,r,t,s){let n={id:(0,Q.v4)(),timestamp:new Date().toISOString(),action:e,projectId:r,environment:t,details:s,synced:!1},a=$();a.push(n),S(a),W(n).then(c=>{if(c){n.synced=!0;let p=$(),d=p.findIndex(A=>A.id===n.id);d!==-1&&(p[d].synced=!0,S(p))}}).catch(()=>{})}function $(){if(!h.default.existsSync(E))return[];try{let e=h.default.readFileSync(E,"utf-8"),r=JSON.parse(e),t=M(r);return JSON.parse(t)}catch{return[]}}function S(e){h.default.existsSync(B)||h.default.mkdirSync(B,{recursive:!0});let r=JSON.stringify(e),t=z(r);h.default.writeFileSync(E,JSON.stringify(t),"utf-8")}async function de(){let e=$(),r=e.filter(s=>!s.synced);if(r.length===0)return 0;let t=0;for(let s of r)await W(s)&&(s.synced=!0,t++);return t>0&&S(e),t}var h,U,Q,B,E,Z=v(()=>{h=g(require("fs")),U=g(require("path")),Q=require("uuid");X();x();C();B=U.default.join(process.cwd(),".xtra"),E=U.default.join(B,"audit.enc")});var ue={};D(ue,{branchCommand:()=>l});module.exports=R(ue);var ee=require("commander");C();var i=g(require("chalk")),b=g(require("ora")),re=require("table");x();var te=g(require("inquirer")),l=new ee.Command("branch").description("Manage branches").option("-p, --project <projectId>","Project ID");l.command("list").description("List all branches").action(async e=>{let r=l.opts(),{project:t}=r;t||(t=w().project),t||(console.error(i.default.red("Error: Project ID is required. Use -p <id> or checkout a branch.")),process.exit(1));let s=(0,b.default)("Fetching branches...").start();try{let n=await u.getBranches(t);if(s.stop(),!n){console.log(i.default.yellow("No branches found."));return}if(!Array.isArray(n)){n.error?console.error(i.default.red(`Error: ${n.error}`)):console.error(i.default.red("Error: Unexpected API response format (not an array)."));return}if(n.length===0){console.log(i.default.yellow("No branches found."));return}let a=[[i.default.bold("Name"),i.default.bold("ID"),i.default.bold("Created By")]];n.forEach(c=>{let p=c.user?.email||c.user?.name||c.createdBy||"-";a.push([c.name,c.id,p])}),console.log((0,re.table)(a))}catch(n){s.fail("Failed to fetch branches"),n.response&&n.response.data&&n.response.data.error?console.error(i.default.red(`Server Error: ${n.response.data.error}`)):console.error(i.default.red(n?.response?.data?.error||"An unexpected error occurred"))}});l.command("create").description("Create a new branch").argument("<name>","Branch name").option("-d, --description <text>","Description").action(async(e,r)=>{let t=l.opts(),{project:s}=t,{description:n}=r;s||(s=w().project),s||(console.error(i.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let a=(0,b.default)(`Creating branch '${e}'...`).start();try{await u.createBranch(s,e,n),a.succeed(`Branch '${e}' created successfully.`)}catch(c){a.fail("Failed to create branch"),c.response&&c.response.data&&c.response.data.error?console.error(i.default.red(`Server Error: ${c.response.data.error}`)):console.error(i.default.red(c?.response?.data?.error||"An unexpected error occurred"))}});l.command("delete").description("Delete a branch").argument("<name>","Branch name").option("-y, --yes","Skip confirmation prompt",!1).action(async(e,r)=>{let t=l.opts(),{project:s}=t,{yes:n}=r;if(s||(s=w().project),s||(console.error(i.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1)),e==="main"){console.error(i.default.red("Error: Cannot delete the 'main' branch."));return}let a=(0,b.default)("Resolving branch...").start();try{let p=(await u.getBranches(s)).find(d=>d.name===e);if(!p){a.fail(`Branch '${e}' not found.`);return}if(a.stop(),!n){let{confirm:d}=await te.default.prompt([{type:"confirm",name:"confirm",message:`Are you sure you want to DELETE branch '${e}'? This action cannot be undone.`,default:!1}]);if(!d){console.log(i.default.gray("Operation cancelled."));return}}a.start("Deleting branch..."),await u.deleteBranch(p.id),a.succeed(`Branch '${e}' deleted successfully.`);try{let{logAudit:d}=(Z(),R(Y));d("BRANCH_DELETED",s,null,{branchName:e,branchId:p.id})}catch{}}catch(c){a.fail("Failed to delete branch"),c.response&&c.response.data&&c.response.data.error?console.error(i.default.red(`Server Error: ${c.response.data.error}`)):console.error(i.default.red(c?.response?.data?.error||"An unexpected error occurred"))}});l.command("update").description("Update a branch").argument("<name>","Current branch name").option("-n, --new-name <newName>","New branch name").option("-d, --description <description>","New description").action(async(e,r)=>{let t=l.opts(),{project:s}=t,{newName:n,description:a}=r;if(s||(s=w().project),s||(console.error(i.default.red("Error: Project ID is required. Use -p <id> or checkout a branch.")),process.exit(1)),!n&&!a){console.log(i.default.yellow("No updates specified. Use --new-name or --description."));return}let c=(0,b.default)("Resolving branch...").start();try{let d=(await u.getBranches(s)).find(A=>A.name===e);if(!d){c.fail(`Branch '${e}' not found.`);return}c.text="Updating branch...",await u.updateBranch(d.id,{name:n,description:a}),c.succeed("Branch updated successfully.")}catch(p){c.fail("Failed to update branch"),p.response&&p.response.data&&p.response.data.error?console.error(i.default.red(`Server Error: ${p.response.data.error}`)):console.error(i.default.red(p?.response?.data?.error||"An unexpected error occurred"))}});0&&(module.exports={branchCommand});
+var ve=Object.create;var U=Object.defineProperty;var xe=Object.getOwnPropertyDescriptor;var Se=Object.getOwnPropertyNames;var we=Object.getPrototypeOf,be=Object.prototype.hasOwnProperty;var O=(e,t)=>()=>(e&&(t=e(e=0)),t);var D=(e,t)=>{for(var r in t)U(e,r,{get:t[r],enumerable:!0})},Z=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of Se(t))!be.call(e,n)&&n!==r&&U(e,n,{get:()=>t[n],enumerable:!(s=xe(t,n))||s.enumerable});return e};var f=(e,t,r)=>(r=e!=null?ve(we(e)):{},Z(t||!e||!e.__esModule?U(r,"default",{value:e,enumerable:!0}):r,e)),k=e=>Z(U({},"__esModule",{value:!0}),e);var H={};D(H,{createWorkloadKeyEnvelope:()=>Te,decrypt:()=>q,decryptSecretValue:()=>ke,decryptWorkloadKeyEnvelope:()=>Ee,deriveProjectKey:()=>$e,encrypt:()=>V,encryptSecretValue:()=>Ae,hash:()=>je,resolveVaultPassphrase:()=>se,saveVaultPassphrase:()=>Pe,secureRead:()=>E,secureSave:()=>T});function re(){if(L)return L;let e=N.get("masterKey");e||(e=g.default.randomBytes(32).toString("hex"),N.set("masterKey",e));let t="";try{t=(0,ee.machineIdSync)()||""}catch{t=g.default.createHash("sha256").update(y.default.hostname()+(y.default.userInfo?.()?.username||"root")).digest("hex")}let r=y.default.platform(),s=y.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return L=g.default.createHash("sha256").update(n).digest(),L}function $e(e,t){t||(t=se(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=g.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function Ae(e,t){let r=g.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=g.default.createCipheriv("aes-256-gcm",s,r),a=n.update(e,"utf8","hex");a+=n.final("hex");let i=n.getAuthTag().toString("hex");return{ciphertext:a,iv:r.toString("hex"),authTag:i}}function ke(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),a=g.default.createDecipheriv("aes-256-gcm",r,s);a.setAuthTag(n);let i=a.update(e.ciphertext,"hex","utf8");return i+=a.final("utf8"),i}function se(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=E(`vault_${t}`);if(s)return s}let r=E("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(I(),k(ne)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function Pe(e,t){t&&T(`vault_${t}`,e),T("vault_passphrase",e)}function Te(e,t){let{publicKey:r,privateKey:s}=g.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),a=g.default.createPublicKey(t),i=g.default.diffieHellman({privateKey:s,publicKey:a}),c=Buffer.from(g.default.hkdfSync("sha256",i,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),p=g.default.randomBytes(12),l=g.default.createCipheriv("aes-256-gcm",c,p),v=l.update(e,"utf8","hex");v+=l.final("hex");let _=l.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:v,iv:p.toString("hex"),authTag:_}}function Ee(e,t){let r=g.default.createPrivateKey(t),s=g.default.createPublicKey(e.ephemeralPublicKey),n=g.default.diffieHellman({privateKey:r,publicKey:s}),a=Buffer.from(g.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),i=Buffer.from(e.iv,"hex"),c=Buffer.from(e.authTag,"hex"),p=g.default.createDecipheriv("aes-256-gcm",a,i);p.setAuthTag(c);let l=p.update(e.encryptedProjectKey,"hex","utf8");return l+=p.final("utf8"),l}var g,y,Q,ee,P,te,N,L,V,q,je,T,E,B=O(()=>{g=f(require("crypto")),y=f(require("os")),Q=f(require("conf")),ee=require("node-machine-id"),P=require("child_process"),te="aes-256-gcm",N=new Q.default({projectName:"xtra-cli-crypto"}),L=null;V=e=>{let t=g.default.randomBytes(12),r=re(),s=g.default.createCipheriv(te,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let a=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:a.toString("hex")}},q=e=>{let t=re(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=g.default.createDecipheriv(te,t,r);n.setAuthTag(s);let a=n.update(e.content,"hex","utf8");return a+=n.final("utf8"),a},je=e=>g.default.createHash("sha256").update(e).digest("hex"),T=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(y.default.platform()==="darwin"){(0,P.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(y.default.platform()!=="win32"){if(y.default.platform()==="linux")try{(0,P.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=V(t);N.set(`secure_${e}`,JSON.stringify(r))},E=e=>{try{let t="XtraSecurityCLI",r=e;if(y.default.platform()==="darwin")return(0,P.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(y.default.platform()!=="win32"){if(y.default.platform()==="linux")try{return(0,P.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=N.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return q(r)}catch{return null}}});var ne={};D(ne,{clearConfig:()=>Ke,deleteConfig:()=>Re,getAuthToken:()=>K,getBreakGlassSession:()=>_e,getConfig:()=>b,getConfigValue:()=>Be,getProjectConfig:()=>Ue,getRcConfig:()=>j,setBreakGlassSession:()=>Ce,setConfig:()=>Ie});var ae,w,X,W,d,oe,b,Be,Ie,Ke,Re,K,_e,Ce,Ue,j,I=O(()=>{ae=f(require("conf")),w=f(require("fs")),X=f(require("path"));B();W="https://www.xtrasecurity.in/api",d=new ae.default({projectName:"xtra-cli",defaults:{apiUrl:W}}),oe=d.get("apiUrl");oe&&!process.env.XTRA_API_URL&&oe.includes("xtra-security.vercel.app")&&d.set("apiUrl",W);b=()=>({...d.store,token:K(),apiUrl:process.env.XTRA_API_URL||d.get("apiUrl")||W}),Be=e=>e==="token"?K():d.get(e),Ie=(e,t)=>{if(e==="token"&&t&&T("token",t),d.set(e,t),e==="token"&&process.platform!=="win32"&&w.default.existsSync(d.path))try{w.default.chmodSync(d.path,384)}catch{}},Ke=()=>d.clear(),Re=e=>d.delete(e),K=()=>E("token")||d.get("token"),_e=()=>d.get("breakGlassSessionId"),Ce=e=>{e?d.set("breakGlassSessionId",e):d.delete("breakGlassSessionId")},Ue=async()=>{try{let e=X.default.join(process.cwd(),"xtra.json");if(w.default.existsSync(e)){let t=w.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},j=()=>{let e={};try{let t=X.default.join(process.cwd(),".xtrarc");w.default.existsSync(t)&&(e=JSON.parse(w.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||d.get("project")||"",env:e.env||d.get("env")||"development",branch:e.branch||d.get("branch")||"main"}}});var ie,ce,pe,Oe,o,h,G=O(()=>{ie=f(require("axios"));I();ce=f(require("fs")),pe=f(require("path")),Oe=JSON.parse(ce.readFileSync(pe.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=b(),r=e||K();return ie.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":Oe.version,...r?{Authorization:`Bearer ${r}`}:{}}})},h={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,a)=>{let c=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(c&&typeof c=="object"){let p=null,{deriveProjectKey:l,decryptSecretValue:v,resolveVaultPassphrase:_,decryptWorkloadKeyEnvelope:C}=(B(),k(H));for(let[x,A]of Object.entries(c))if(typeof A=="string"&&A.startsWith("{"))try{let S=JSON.parse(A);if(S.ciphertext&&S.iv){if(!p)if(a&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)p=C(a,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let me=_(s,e);p=l(e,me)}c[x]=v(S,p)}}catch(S){if(S.message&&S.message.includes("Zero-Knowledge"))throw S}}return c},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:a,encryptSecretValue:i,resolveVaultPassphrase:c}=(B(),k(H)),p=c(void 0,e),l=a(e,p),v={};for(let[C,x]of Object.entries(r))if(typeof x=="string"&&x.startsWith("{")&&x.includes("ciphertext"))v[C]=x;else{let A=i(x,l);v[C]=JSON.stringify(A)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:v,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,a)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:a})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=b(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=b(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});var de={};D(de,{loadAuditLogs:()=>F,logAudit:()=>Le,saveAuditLogs:()=>J,syncAuditLogs:()=>Ne});function De(e){if(!e||typeof e!="object")return e;let t={...e},r=["password","token","secret","value","apiKey","secretValue"];for(let s of Object.keys(t))r.some(n=>s.toLowerCase().includes(n))&&(t[s]="[REDACTED]");return t}async function ue(e){try{if(!b().token)return!1;let r={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:De(e.details),timestamp:e.timestamp,projectId:e.projectId};return await h.post("/audit/cli-logs",{logs:[r]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function Le(e,t,r,s){let n={id:(0,ge.randomUUID)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:r,details:s,synced:!1},a=F();a.push(n),J(a),ue(n).then(i=>{if(i){n.synced=!0;let c=F(),p=c.findIndex(l=>l.id===n.id);p!==-1&&(c[p].synced=!0,J(c))}}).catch(()=>{})}function F(){if(!$.default.existsSync(z))return[];try{let e=$.default.readFileSync(z,"utf-8"),t=JSON.parse(e),r=q(t);return JSON.parse(r)}catch{return[]}}function J(e){$.default.existsSync(M)||$.default.mkdirSync(M,{recursive:!0});let t=JSON.stringify(e),r=V(t);$.default.writeFileSync(z,JSON.stringify(r),"utf-8")}async function Ne(){let e=F(),t=e.filter(s=>!s.synced);if(t.length===0)return 0;let r=0;for(let s of t)await ue(s)&&(s.synced=!0,r++);return r>0&&J(e),r}var $,Y,ge,M,z,le=O(()=>{$=f(require("fs")),Y=f(require("path")),ge=require("crypto");B();I();G();M=Y.default.join(process.cwd(),".xtra"),z=Y.default.join(M,"audit.enc")});var Ve={};D(Ve,{branchCommand:()=>m});module.exports=k(Ve);var fe=require("commander");G();var u=f(require("chalk")),R=f(require("ora")),ye=require("table");I();var he=f(require("inquirer")),m=new fe.Command("branch").description("Manage branches").option("-p, --project <projectId>","Project ID");m.command("list").description("List all branches").action(async e=>{let t=m.opts(),{project:r}=t;r||(r=j().project),r||(console.error(u.default.red("Error: Project ID is required. Use -p <id> or checkout a branch.")),process.exit(1));let s=(0,R.default)("Fetching branches...").start();try{let n=await h.getBranches(r);if(s.stop(),!n){console.log(u.default.yellow("No branches found."));return}if(!Array.isArray(n)){n.error?console.error(u.default.red(`Error: ${n.error}`)):console.error(u.default.red("Error: Unexpected API response format (not an array)."));return}if(n.length===0){console.log(u.default.yellow("No branches found."));return}let a=[[u.default.bold("Name"),u.default.bold("ID"),u.default.bold("Created By")]];n.forEach(i=>{let c=i.user?.email||i.user?.name||i.createdBy||"-";a.push([i.name,i.id,c])}),console.log((0,ye.table)(a))}catch(n){s.fail("Failed to fetch branches"),n.response&&n.response.data&&n.response.data.error?console.error(u.default.red(`Server Error: ${n.response.data.error}`)):console.error(u.default.red(n?.response?.data?.error||"An unexpected error occurred"))}});m.command("create").description("Create a new branch").argument("<name>","Branch name").option("-d, --description <text>","Description").action(async(e,t)=>{let r=m.opts(),{project:s}=r,{description:n}=t;s||(s=j().project),s||(console.error(u.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let a=(0,R.default)(`Creating branch '${e}'...`).start();try{await h.createBranch(s,e,n),a.succeed(`Branch '${e}' created successfully.`)}catch(i){a.fail("Failed to create branch"),i.response&&i.response.data&&i.response.data.error?console.error(u.default.red(`Server Error: ${i.response.data.error}`)):console.error(u.default.red(i?.response?.data?.error||"An unexpected error occurred"))}});m.command("delete").description("Delete a branch").argument("<name>","Branch name").option("-y, --yes","Skip confirmation prompt",!1).action(async(e,t)=>{let r=m.opts(),{project:s}=r,{yes:n}=t;if(s||(s=j().project),s||(console.error(u.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1)),e==="main"){console.error(u.default.red("Error: Cannot delete the 'main' branch."));return}let a=(0,R.default)("Resolving branch...").start();try{let c=(await h.getBranches(s)).find(p=>p.name===e);if(!c){a.fail(`Branch '${e}' not found.`);return}if(a.stop(),!n){let{confirm:p}=await he.default.prompt([{type:"confirm",name:"confirm",message:`Are you sure you want to DELETE branch '${e}'? This action cannot be undone.`,default:!1}]);if(!p){console.log(u.default.gray("Operation cancelled."));return}}a.start("Deleting branch..."),await h.deleteBranch(c.id),a.succeed(`Branch '${e}' deleted successfully.`);try{let{logAudit:p}=(le(),k(de));p("BRANCH_DELETED",s,null,{branchName:e,branchId:c.id})}catch{}}catch(i){a.fail("Failed to delete branch"),i.response&&i.response.data&&i.response.data.error?console.error(u.default.red(`Server Error: ${i.response.data.error}`)):console.error(u.default.red(i?.response?.data?.error||"An unexpected error occurred"))}});m.command("update").description("Update a branch").argument("<name>","Current branch name").option("-n, --new-name <newName>","New branch name").option("-d, --description <description>","New description").action(async(e,t)=>{let r=m.opts(),{project:s}=r,{newName:n,description:a}=t;if(s||(s=j().project),s||(console.error(u.default.red("Error: Project ID is required. Use -p <id> or checkout a branch.")),process.exit(1)),!n&&!a){console.log(u.default.yellow("No updates specified. Use --new-name or --description."));return}let i=(0,R.default)("Resolving branch...").start();try{let p=(await h.getBranches(s)).find(l=>l.name===e);if(!p){i.fail(`Branch '${e}' not found.`);return}i.text="Updating branch...",await h.updateBranch(p.id,{name:n,description:a}),i.succeed("Branch updated successfully.")}catch(c){i.fail("Failed to update branch"),c.response&&c.response.data&&c.response.data.error?console.error(u.default.red(`Server Error: ${c.response.data.error}`)):console.error(u.default.red(c?.response?.data?.error||"An unexpected error occurred"))}});0&&(module.exports={branchCommand});

package/dist/commands/checkout.js

@@ -1 +1 @@
-var P=Object.create;var d=Object.defineProperty;var B=Object.getOwnPropertyDescriptor;var L=Object.getOwnPropertyNames;var _=Object.getPrototypeOf,q=Object.prototype.hasOwnProperty;var N=(e,t)=>{for(var s in t)d(e,s,{get:t[s],enumerable:!0})},w=(e,t,s,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of L(t))!q.call(e,o)&&o!==s&&d(e,o,{get:()=>t[o],enumerable:!(n=B(t,o))||n.enumerable});return e};var i=(e,t,s)=>(s=e!=null?P(_(e)):{},w(t||!e||!e.__esModule?d(s,"default",{value:e,enumerable:!0}):s,e)),T=e=>w(d({},"__esModule",{value:!0}),e);var J={};N(J,{checkoutCommand:()=>D});module.exports=T(J);var C=require("commander");var x=i(require("axios"));var v=i(require("conf")),g=i(require("fs")),S=i(require("path")),h="https://www.xtrasecurity.in/api",c=new v.default({projectName:"xtra-cli",defaults:{apiUrl:h}}),$=c.get("apiUrl");$&&!process.env.XTRA_API_URL&&$.includes("xtra-security.vercel.app")&&c.set("apiUrl",h);var u=()=>({...c.store,apiUrl:process.env.XTRA_API_URL||c.get("apiUrl")||h});var l=(e,t)=>{if(c.set(e,t),e==="token"&&process.platform!=="win32"&&g.default.existsSync(c.path))try{g.default.chmodSync(c.path,384)}catch{}};var j=()=>c.get("token");var b=()=>{let e={};try{let t=S.default.join(process.cwd(),".xtrarc");g.default.existsSync(t)&&(e=JSON.parse(g.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||c.get("project")||"",env:e.env||c.get("env")||"development",branch:e.branch||c.get("branch")||"main"}};var k=i(require("fs")),A=i(require("path")),G=JSON.parse(k.readFileSync(A.join(__dirname,"../../package.json"),"utf-8")),r=()=>{let{apiUrl:e}=u(),t=j();return x.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":G.version,...t?{Authorization:`Bearer ${t}`}:{}}})},I={login:async(e,t,s)=>(await r().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,n,o="main")=>(await r().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:n,branch:o})).data,getSecretDetails:async(e,t,s,n="main")=>(await r().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${n}`)).data,syncLogs:async e=>(await r().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,n,o,a)=>(await r().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:n,sourceEnv:o,sourceKey:a})).data,rotateSecret:async(e,t,s,n,o)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:n,parsedNewValue:o})).data,promoteSecret:async(e,t,s)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await r().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,n)=>{let o={format:e};return t&&(o.startDate=t),s&&(o.endDate=s),n&&(o.projectId=n),(await r().post("/audit/export",o,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,n)=>(await r().post("/access/request",{projectId:e,secretId:n,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await r().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=u(),s=t?`&workspaceId=${t}`:"";return(await r().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await r().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=u(),t=e?`/project?workspaceId=${e}`:"/project";return(await r().get(t)).data},getBranches:async e=>(await r().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await r().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await r().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await r().put("/branch",{id:e,...t})).data,getRoles:async()=>(await r().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await r().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await r().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await r().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await r().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await r().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await r().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await r().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,n)=>(await r().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:n})).data,cloneEnvironment:async(e,t,s,n,o)=>(await r().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:n,branch:o})).data,generateJitLink:async e=>(await r().post("/jit/generate",e)).data,claimJitLink:async e=>(await r().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await r().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await r().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await r().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await r().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await r().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,s,n)=>(await r().post(`/projects/${e}/service-accounts/${t}/keys`,{label:s,expiresAt:n})).data,deleteServiceAccountKey:async(e,t,s)=>(await r().delete(`/projects/${e}/service-accounts/${t}/keys/${s}`)).data,post:async(e,t)=>(await r().post(e,t)).data};var p=i(require("chalk")),U=i(require("ora")),R=i(require("inquirer")),D=new C.Command("checkout").description("Switch the active branch context").argument("[branchName]","Branch name to switch to (optional - will show list if not provided)").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Set the active environment (e.g. development, staging, production)").action(async(e,t)=>{let{project:s}=t;s||(s=b().project),s||(console.error(p.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let n=(0,U.default)("Fetching branches...").start();try{let o=await I.getBranches(s);if(n.stop(),!Array.isArray(o)||o.length===0){console.log(p.default.yellow("No branches found in this project."));return}let a=e;if(a){if(!o.find(m=>m.name===a)){console.error(p.default.red(`Branch '${a}' does not exist.`)),console.log(p.default.yellow(`Use 'xtra branch create ${a}' to create it.`));return}}else{let y=o.map(f=>({name:f.name,value:f.name})),{selected:m}=await R.default.prompt([{type:"list",name:"selected",message:"Select a branch:",choices:y}]);a=m}l("branch",a),l("project",s),t.env&&l("env",t.env),console.log(p.default.green(`\u2714 Switched to branch '${a}'`)),t.env&&console.log(p.default.green(`\u2714 Environment set to '${t.env}'`))}catch(o){n.fail("Failed to fetch branches"),o.response?.data?.error?console.error(p.default.red(`Error: ${o.response.data.error}`)):console.error(p.default.red(o?.response?.data?.error||"An unexpected error occurred"))}});0&&(module.exports={checkoutCommand});
+var ae=Object.create;var K=Object.defineProperty;var ie=Object.getOwnPropertyDescriptor;var ce=Object.getOwnPropertyNames;var pe=Object.getPrototypeOf,ge=Object.prototype.hasOwnProperty;var N=(e,t)=>()=>(e&&(t=e(e=0)),t);var I=(e,t)=>{for(var r in t)K(e,r,{get:t[r],enumerable:!0})},X=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of ce(t))!ge.call(e,n)&&n!==r&&K(e,n,{get:()=>t[n],enumerable:!(s=ie(t,n))||s.enumerable});return e};var l=(e,t,r)=>(r=e!=null?ae(pe(e)):{},X(t||!e||!e.__esModule?K(r,"default",{value:e,enumerable:!0}):r,e)),R=e=>X(K({},"__esModule",{value:!0}),e);var V={};I(V,{createWorkloadKeyEnvelope:()=>ye,decrypt:()=>G,decryptSecretValue:()=>fe,decryptWorkloadKeyEnvelope:()=>me,deriveProjectKey:()=>le,encrypt:()=>W,encryptSecretValue:()=>de,hash:()=>ue,resolveVaultPassphrase:()=>F,saveVaultPassphrase:()=>he,secureRead:()=>j,secureSave:()=>$});function J(){if(_)return _;let e=B.get("masterKey");e||(e=i.default.randomBytes(32).toString("hex"),B.set("masterKey",e));let t="";try{t=(0,H.machineIdSync)()||""}catch{t=i.default.createHash("sha256").update(d.default.hostname()+(d.default.userInfo?.()?.username||"root")).digest("hex")}let r=d.default.platform(),s=d.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return _=i.default.createHash("sha256").update(n).digest(),_}function le(e,t){t||(t=F(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=i.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function de(e,t){let r=i.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=i.default.createCipheriv("aes-256-gcm",s,r),a=n.update(e,"utf8","hex");a+=n.final("hex");let g=n.getAuthTag().toString("hex");return{ciphertext:a,iv:r.toString("hex"),authTag:g}}function fe(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),a=i.default.createDecipheriv("aes-256-gcm",r,s);a.setAuthTag(n);let g=a.update(e.ciphertext,"hex","utf8");return g+=a.final("utf8"),g}function F(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=j(`vault_${t}`);if(s)return s}let r=j("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(E(),R(M)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function he(e,t){t&&$(`vault_${t}`,e),$("vault_passphrase",e)}function ye(e,t){let{publicKey:r,privateKey:s}=i.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),a=i.default.createPublicKey(t),g=i.default.diffieHellman({privateKey:s,publicKey:a}),u=Buffer.from(i.default.hkdfSync("sha256",g,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),p=i.default.randomBytes(12),f=i.default.createCipheriv("aes-256-gcm",u,p),y=f.update(e,"utf8","hex");y+=f.final("hex");let P=f.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:y,iv:p.toString("hex"),authTag:P}}function me(e,t){let r=i.default.createPrivateKey(t),s=i.default.createPublicKey(e.ephemeralPublicKey),n=i.default.diffieHellman({privateKey:r,publicKey:s}),a=Buffer.from(i.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),g=Buffer.from(e.iv,"hex"),u=Buffer.from(e.authTag,"hex"),p=i.default.createDecipheriv("aes-256-gcm",a,g);p.setAuthTag(u);let f=p.update(e.encryptedProjectKey,"hex","utf8");return f+=p.final("utf8"),f}var i,d,q,H,w,D,B,_,W,G,ue,$,j,C=N(()=>{i=l(require("crypto")),d=l(require("os")),q=l(require("conf")),H=require("node-machine-id"),w=require("child_process"),D="aes-256-gcm",B=new q.default({projectName:"xtra-cli-crypto"}),_=null;W=e=>{let t=i.default.randomBytes(12),r=J(),s=i.default.createCipheriv(D,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let a=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:a.toString("hex")}},G=e=>{let t=J(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=i.default.createDecipheriv(D,t,r);n.setAuthTag(s);let a=n.update(e.content,"hex","utf8");return a+=n.final("utf8"),a},ue=e=>i.default.createHash("sha256").update(e).digest("hex"),$=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(d.default.platform()==="darwin"){(0,w.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(d.default.platform()!=="win32"){if(d.default.platform()==="linux")try{(0,w.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=W(t);B.set(`secure_${e}`,JSON.stringify(r))},j=e=>{try{let t="XtraSecurityCLI",r=e;if(d.default.platform()==="darwin")return(0,w.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(d.default.platform()!=="win32"){if(d.default.platform()==="linux")try{return(0,w.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=B.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return G(r)}catch{return null}}});var M={};I(M,{clearConfig:()=>xe,deleteConfig:()=>Se,getAuthToken:()=>A,getBreakGlassSession:()=>we,getConfig:()=>k,getConfigValue:()=>ve,getProjectConfig:()=>je,getRcConfig:()=>O,setBreakGlassSession:()=>$e,setConfig:()=>b});var Z,x,U,L,c,Y,k,ve,b,xe,Se,A,we,$e,je,O,E=N(()=>{Z=l(require("conf")),x=l(require("fs")),U=l(require("path"));C();L="https://www.xtrasecurity.in/api",c=new Z.default({projectName:"xtra-cli",defaults:{apiUrl:L}}),Y=c.get("apiUrl");Y&&!process.env.XTRA_API_URL&&Y.includes("xtra-security.vercel.app")&&c.set("apiUrl",L);k=()=>({...c.store,token:A(),apiUrl:process.env.XTRA_API_URL||c.get("apiUrl")||L}),ve=e=>e==="token"?A():c.get(e),b=(e,t)=>{if(e==="token"&&t&&$("token",t),c.set(e,t),e==="token"&&process.platform!=="win32"&&x.default.existsSync(c.path))try{x.default.chmodSync(c.path,384)}catch{}},xe=()=>c.clear(),Se=e=>c.delete(e),A=()=>j("token")||c.get("token"),we=()=>c.get("breakGlassSessionId"),$e=e=>{e?c.set("breakGlassSessionId",e):c.delete("breakGlassSessionId")},je=async()=>{try{let e=U.default.join(process.cwd(),"xtra.json");if(x.default.existsSync(e)){let t=x.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},O=()=>{let e={};try{let t=U.default.join(process.cwd(),".xtrarc");x.default.existsSync(t)&&(e=JSON.parse(x.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||c.get("project")||"",env:e.env||c.get("env")||"development",branch:e.branch||c.get("branch")||"main"}}});var Ae={};I(Ae,{checkoutCommand:()=>be});module.exports=R(Ae);var re=require("commander");var z=l(require("axios"));E();var Q=l(require("fs")),ee=l(require("path")),ke=JSON.parse(Q.readFileSync(ee.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=k(),r=e||A();return z.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":ke.version,...r?{Authorization:`Bearer ${r}`}:{}}})},te={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,a)=>{let u=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(u&&typeof u=="object"){let p=null,{deriveProjectKey:f,decryptSecretValue:y,resolveVaultPassphrase:P,decryptWorkloadKeyEnvelope:T}=(C(),R(V));for(let[m,S]of Object.entries(u))if(typeof S=="string"&&S.startsWith("{"))try{let v=JSON.parse(S);if(v.ciphertext&&v.iv){if(!p)if(a&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)p=T(a,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let oe=P(s,e);p=f(e,oe)}u[m]=y(v,p)}}catch(v){if(v.message&&v.message.includes("Zero-Knowledge"))throw v}}return u},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:a,encryptSecretValue:g,resolveVaultPassphrase:u}=(C(),R(V)),p=u(void 0,e),f=a(e,p),y={};for(let[T,m]of Object.entries(r))if(typeof m=="string"&&m.startsWith("{")&&m.includes("ciphertext"))y[T]=m;else{let S=g(m,f);y[T]=JSON.stringify(S)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:y,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,a)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:a})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=k(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=k(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data};E();var h=l(require("chalk")),se=l(require("ora")),ne=l(require("inquirer")),be=new re.Command("checkout").description("Switch the active branch context").argument("[branchName]","Branch name to switch to (optional - will show list if not provided)").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Set the active environment (e.g. development, staging, production)").action(async(e,t)=>{let{project:r}=t;r||(r=O().project),r||(console.error(h.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let s=(0,se.default)("Fetching branches...").start();try{let n=await te.getBranches(r);if(s.stop(),!Array.isArray(n)||n.length===0){console.log(h.default.yellow("No branches found in this project."));return}let a=e;if(a){if(!n.find(u=>u.name===a)){console.error(h.default.red(`Branch '${a}' does not exist.`)),console.log(h.default.yellow(`Use 'xtra branch create ${a}' to create it.`));return}}else{let g=n.map(p=>({name:p.name,value:p.name})),{selected:u}=await ne.default.prompt([{type:"list",name:"selected",message:"Select a branch:",choices:g}]);a=u}b("branch",a),b("project",r),t.env&&b("env",t.env),console.log(h.default.green(`\u2714 Switched to branch '${a}'`)),t.env&&console.log(h.default.green(`\u2714 Environment set to '${t.env}'`))}catch(n){s.fail("Failed to fetch branches"),n.response?.data?.error?console.error(h.default.red(`Error: ${n.response.data.error}`)):console.error(h.default.red(n?.response?.data?.error||"An unexpected error occurred"))}});0&&(module.exports={checkoutCommand});