xtra-cli 1.0.8 → 1.0.9

package/dist/commands/import.js

@@ -1 +1 @@
-var ge=Object.create;var S=Object.defineProperty;var de=Object.getOwnPropertyDescriptor;var ue=Object.getOwnPropertyNames;var fe=Object.getPrototypeOf,le=Object.prototype.hasOwnProperty;var $=(e,t)=>()=>(e&&(t=e(e=0)),t);var _=(e,t)=>{for(var s in t)S(e,s,{get:t[s],enumerable:!0})},D=(e,t,s,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of ue(t))!le.call(e,n)&&n!==s&&S(e,n,{get:()=>t[n],enumerable:!(r=de(t,n))||r.enumerable});return e};var a=(e,t,s)=>(s=e!=null?ge(fe(e)):{},D(t||!e||!e.__esModule?S(s,"default",{value:e,enumerable:!0}):s,e)),J=e=>D(S({},"__esModule",{value:!0}),e);var K,O,V,U,f,F,l,q,E,b=$(()=>{K=a(require("conf")),O=a(require("fs")),V=a(require("path")),U="https://www.xtrasecurity.in/api",f=new K.default({projectName:"xtra-cli",defaults:{apiUrl:U}}),F=f.get("apiUrl");F&&!process.env.XTRA_API_URL&&F.includes("xtra-security.vercel.app")&&f.set("apiUrl",U);l=()=>({...f.store,apiUrl:process.env.XTRA_API_URL||f.get("apiUrl")||U}),q=()=>f.get("token"),E=()=>{let e={};try{let t=V.default.join(process.cwd(),".xtrarc");O.default.existsSync(t)&&(e=JSON.parse(O.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||f.get("project")||"",env:e.env||f.get("env")||"development",branch:e.branch||f.get("branch")||"main"}}});var G,M,z,me,o,k,L=$(()=>{G=a(require("axios"));b();M=a(require("fs")),z=a(require("path")),me=JSON.parse(M.readFileSync(z.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:e}=l(),t=q();return G.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":me.version,...t?{Authorization:`Bearer ${t}`}:{}}})},k={login:async(e,t,s)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,r,n="main")=>(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:r,branch:n})).data,getSecretDetails:async(e,t,s,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${r}`)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,r,n,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:r,sourceEnv:n,sourceKey:i})).data,rotateSecret:async(e,t,s,r,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:r,parsedNewValue:n})).data,promoteSecret:async(e,t,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,r)=>{let n={format:e};return t&&(n.startDate=t),s&&(n.endDate=s),r&&(n.projectId=r),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,r)=>(await o().post("/access/request",{projectId:e,secretId:r,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=l(),s=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=l(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await o().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:r})).data,cloneEnvironment:async(e,t,s,r,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:r,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,s,r)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:s,expiresAt:r})).data,deleteServiceAccountKey:async(e,t,s)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${s}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});function W(){let e=H.get("masterKey");e||(e=m.default.randomBytes(32).toString("hex"),H.set("masterKey",e));let t=(0,Y.machineIdSync)();return m.default.createHash("sha256").update(e+t).digest()}var m,X,Y,Q,H,Z,ee,te=$(()=>{m=a(require("crypto")),X=a(require("conf")),Y=require("node-machine-id"),Q="aes-256-gcm",H=new X.default({projectName:"xtra-cli-crypto"});Z=e=>{let t=m.default.randomBytes(16),s=W(),r=m.default.createCipheriv(Q,s,t),n=r.update(e,"utf8","hex");n+=r.final("hex");let i=r.getAuthTag();return{iv:t.toString("hex"),content:n,tag:i.toString("hex")}},ee=e=>{let t=W(),s=Buffer.from(e.iv,"hex"),r=Buffer.from(e.tag,"hex"),n=m.default.createDecipheriv(Q,t,s);n.setAuthTag(r);let i=n.update(e.content,"hex","utf8");return i+=n.final("utf8"),i}});var ne={};_(ne,{loadAuditLogs:()=>I,logAudit:()=>he,saveAuditLogs:()=>A,syncAuditLogs:()=>ve});function ye(e){if(!e||typeof e!="object")return e;let t={...e},s=["password","token","secret","value","apiKey","secretValue"];for(let r of Object.keys(t))s.some(n=>r.toLowerCase().includes(n))&&(t[r]="[REDACTED]");return t}async function re(e){try{if(!l().token)return!1;let s={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:ye(e.details),timestamp:e.timestamp,projectId:e.projectId};return await k.post("/audit/cli-logs",{logs:[s]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function he(e,t,s,r){let n={id:(0,se.v4)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:s,details:r,synced:!1},i=I();i.push(n),A(i),re(n).then(h=>{if(h){n.synced=!0;let j=I(),d=j.findIndex(p=>p.id===n.id);d!==-1&&(j[d].synced=!0,A(j))}}).catch(()=>{})}function I(){if(!y.default.existsSync(N))return[];try{let e=y.default.readFileSync(N,"utf-8"),t=JSON.parse(e),s=ee(t);return JSON.parse(s)}catch{return[]}}function A(e){y.default.existsSync(P)||y.default.mkdirSync(P,{recursive:!0});let t=JSON.stringify(e),s=Z(t);y.default.writeFileSync(N,JSON.stringify(s),"utf-8")}async function ve(){let e=I(),t=e.filter(r=>!r.synced);if(t.length===0)return 0;let s=0;for(let r of t)await re(r)&&(r.synced=!0,s++);return s>0&&A(e),s}var y,B,se,P,N,oe=$(()=>{y=a(require("fs")),B=a(require("path")),se=require("uuid");te();b();L();P=B.default.join(process.cwd(),".xtra"),N=B.default.join(P,"audit.enc")});var je={};_(je,{importCommand:()=>we});module.exports=J(je);var ie=require("commander");L();var w=a(require("chalk")),T=a(require("fs")),C=a(require("path")),ae=a(require("dotenv")),ce=require("csv-parse/sync");b();var we=new ie.Command("import").description("Import secrets from a file (JSON, Dotenv, CSV)").argument("<file>","Path to the file to import").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Environment (development, staging, production)","development").option("-b, --branch <branchName>","Branch Name").option("-f, --format <format>","Input format (json, dotenv, csv). Auto-detected if omitted.").option("--prefix <prefix>","Add prefix to all imported keys").option("--overwrite","Overwrite existing secrets (default: merged, but API usually upserts)",!0).action(async(e,t)=>{let{project:s,env:r,branch:n,format:i,prefix:h}=t;s||(s=E().project),n||(n=E().branch||"main"),r={dev:"development",stg:"staging",prod:"production"}[r]||r,s||(console.error(w.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let d=C.default.resolve(process.cwd(),e);T.default.existsSync(d)||(console.error(w.default.red(`Error: File not found: ${d}`)),process.exit(1));let p=i;if(!p){let c=C.default.extname(d).toLowerCase();c===".json"?p="json":c===".env"?p="dotenv":c===".csv"?p="csv":(console.error(w.default.red("Error: Could not detect format. Please specify -f <format>")),process.exit(1))}let v=require("ora")(`Reading ${p} file...`).start(),R=T.default.readFileSync(d,"utf-8"),g={};try{switch(p.toLowerCase()){case"json":g=JSON.parse(R);break;case"dotenv":g=ae.default.parse(R);break;case"csv":(0,ce.parse)(R,{columns:!0,skip_empty_lines:!0}).forEach(u=>{let x=u.key||u.Key||u.KEY,pe=u.value||u.Value||u.VALUE;x&&(g[x]=pe||"")});break;default:v.fail(`Unsupported format: ${p}`),process.exit(1)}if(Object.keys(g).length===0){v.fail("No valid secrets found in file.");return}if(h){let c={};Object.entries(g).forEach(([u,x])=>{c[`${h}${u}`]=x}),g=c}v.text=`Importing ${Object.keys(g).length} secrets to ${r} (branch: ${n})...`,await k.setSecrets(s,r,g,void 0,n),v.succeed(`Successfully imported ${Object.keys(g).length} secrets.`);try{let{logAudit:c}=(oe(),J(ne));c("SECRET_IMPORT",s,r,{file:C.default.basename(d),format:p,count:Object.keys(g).length,branch:n})}catch{}}catch(c){v.fail("Import failed."),console.error(w.default.red(c?.response?.data?.error||"An unexpected error occurred")),process.exit(1)}});0&&(module.exports={importCommand});
+var ve=Object.create;var E=Object.defineProperty;var xe=Object.getOwnPropertyDescriptor;var Se=Object.getOwnPropertyNames;var we=Object.getPrototypeOf,je=Object.prototype.hasOwnProperty;var _=(e,t)=>()=>(e&&(t=e(e=0)),t);var C=(e,t)=>{for(var r in t)E(e,r,{get:t[r],enumerable:!0})},Q=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of Se(t))!je.call(e,n)&&n!==r&&E(e,n,{get:()=>t[n],enumerable:!(s=xe(t,n))||s.enumerable});return e};var y=(e,t,r)=>(r=e!=null?ve(we(e)):{},Q(t||!e||!e.__esModule?E(r,"default",{value:e,enumerable:!0}):r,e)),k=e=>Q(E({},"__esModule",{value:!0}),e);var F={};C(F,{createWorkloadKeyEnvelope:()=>Te,decrypt:()=>V,decryptSecretValue:()=>Ae,decryptWorkloadKeyEnvelope:()=>Re,deriveProjectKey:()=>ke,encrypt:()=>U,encryptSecretValue:()=>$e,hash:()=>be,resolveVaultPassphrase:()=>ne,saveVaultPassphrase:()=>Pe,secureRead:()=>P,secureSave:()=>A});function se(){if(B)return B;let e=O.get("masterKey");e||(e=a.default.randomBytes(32).toString("hex"),O.set("masterKey",e));let t="";try{t=(0,te.machineIdSync)()||""}catch{t=a.default.createHash("sha256").update(x.default.hostname()+(x.default.userInfo?.()?.username||"root")).digest("hex")}let r=x.default.platform(),s=x.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return B=a.default.createHash("sha256").update(n).digest(),B}function ke(e,t){t||(t=ne(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=a.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function $e(e,t){let r=a.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=a.default.createCipheriv("aes-256-gcm",s,r),i=n.update(e,"utf8","hex");i+=n.final("hex");let u=n.getAuthTag().toString("hex");return{ciphertext:i,iv:r.toString("hex"),authTag:u}}function Ae(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),i=a.default.createDecipheriv("aes-256-gcm",r,s);i.setAuthTag(n);let u=i.update(e.ciphertext,"hex","utf8");return u+=i.final("utf8"),u}function ne(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=P(`vault_${t}`);if(s)return s}let r=P("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(R(),k(oe)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function Pe(e,t){t&&A(`vault_${t}`,e),A("vault_passphrase",e)}function Te(e,t){let{publicKey:r,privateKey:s}=a.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),i=a.default.createPublicKey(t),u=a.default.diffieHellman({privateKey:s,publicKey:i}),f=Buffer.from(a.default.hkdfSync("sha256",u,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),c=a.default.randomBytes(12),p=a.default.createCipheriv("aes-256-gcm",f,c),m=p.update(e,"utf8","hex");m+=p.final("hex");let S=p.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:m,iv:c.toString("hex"),authTag:S}}function Re(e,t){let r=a.default.createPrivateKey(t),s=a.default.createPublicKey(e.ephemeralPublicKey),n=a.default.diffieHellman({privateKey:r,publicKey:s}),i=Buffer.from(a.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),u=Buffer.from(e.iv,"hex"),f=Buffer.from(e.authTag,"hex"),c=a.default.createDecipheriv("aes-256-gcm",i,u);c.setAuthTag(f);let p=c.update(e.encryptedProjectKey,"hex","utf8");return p+=c.final("utf8"),p}var a,x,ee,te,$,re,O,B,U,V,be,A,P,T=_(()=>{a=y(require("crypto")),x=y(require("os")),ee=y(require("conf")),te=require("node-machine-id"),$=require("child_process"),re="aes-256-gcm",O=new ee.default({projectName:"xtra-cli-crypto"}),B=null;U=e=>{let t=a.default.randomBytes(12),r=se(),s=a.default.createCipheriv(re,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let i=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:i.toString("hex")}},V=e=>{let t=se(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=a.default.createDecipheriv(re,t,r);n.setAuthTag(s);let i=n.update(e.content,"hex","utf8");return i+=n.final("utf8"),i},be=e=>a.default.createHash("sha256").update(e).digest("hex"),A=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(x.default.platform()==="darwin"){(0,$.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(x.default.platform()!=="win32"){if(x.default.platform()==="linux")try{(0,$.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=U(t);O.set(`secure_${e}`,JSON.stringify(r))},P=e=>{try{let t="XtraSecurityCLI",r=e;if(x.default.platform()==="darwin")return(0,$.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(x.default.platform()!=="win32"){if(x.default.platform()==="linux")try{return(0,$.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=O.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return V(r)}catch{return null}}});var oe={};C(oe,{clearConfig:()=>Ee,deleteConfig:()=>_e,getAuthToken:()=>K,getBreakGlassSession:()=>Ce,getConfig:()=>j,getConfigValue:()=>Ke,getProjectConfig:()=>Oe,getRcConfig:()=>L,setBreakGlassSession:()=>Be,setConfig:()=>Ie});var ae,w,H,W,d,ie,j,Ke,Ie,Ee,_e,K,Ce,Be,Oe,L,R=_(()=>{ae=y(require("conf")),w=y(require("fs")),H=y(require("path"));T();W="https://www.xtrasecurity.in/api",d=new ae.default({projectName:"xtra-cli",defaults:{apiUrl:W}}),ie=d.get("apiUrl");ie&&!process.env.XTRA_API_URL&&ie.includes("xtra-security.vercel.app")&&d.set("apiUrl",W);j=()=>({...d.store,token:K(),apiUrl:process.env.XTRA_API_URL||d.get("apiUrl")||W}),Ke=e=>e==="token"?K():d.get(e),Ie=(e,t)=>{if(e==="token"&&t&&A("token",t),d.set(e,t),e==="token"&&process.platform!=="win32"&&w.default.existsSync(d.path))try{w.default.chmodSync(d.path,384)}catch{}},Ee=()=>d.clear(),_e=e=>d.delete(e),K=()=>P("token")||d.get("token"),Ce=()=>d.get("breakGlassSessionId"),Be=e=>{e?d.set("breakGlassSessionId",e):d.delete("breakGlassSessionId")},Oe=async()=>{try{let e=H.default.join(process.cwd(),"xtra.json");if(w.default.existsSync(e)){let t=w.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},L=()=>{let e={};try{let t=H.default.join(process.cwd(),".xtrarc");w.default.existsSync(t)&&(e=JSON.parse(w.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||d.get("project")||"",env:e.env||d.get("env")||"development",branch:e.branch||d.get("branch")||"main"}}});var ce,pe,ge,Ue,o,N,G=_(()=>{ce=y(require("axios"));R();pe=y(require("fs")),ge=y(require("path")),Ue=JSON.parse(pe.readFileSync(ge.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=j(),r=e||K();return ce.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":Ue.version,...r?{Authorization:`Bearer ${r}`}:{}}})},N={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,i)=>{let f=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(f&&typeof f=="object"){let c=null,{deriveProjectKey:p,decryptSecretValue:m,resolveVaultPassphrase:S,decryptWorkloadKeyEnvelope:l}=(T(),k(F));for(let[g,h]of Object.entries(f))if(typeof h=="string"&&h.startsWith("{"))try{let v=JSON.parse(h);if(v.ciphertext&&v.iv){if(!c)if(i&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)c=l(i,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let X=S(s,e);c=p(e,X)}f[g]=m(v,c)}}catch(v){if(v.message&&v.message.includes("Zero-Knowledge"))throw v}}return f},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:i,encryptSecretValue:u,resolveVaultPassphrase:f}=(T(),k(F)),c=f(void 0,e),p=i(e,c),m={};for(let[l,g]of Object.entries(r))if(typeof g=="string"&&g.startsWith("{")&&g.includes("ciphertext"))m[l]=g;else{let h=u(g,p);m[l]=JSON.stringify(h)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:m,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:i})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=j(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=j(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});var fe={};C(fe,{loadAuditLogs:()=>D,logAudit:()=>Le,saveAuditLogs:()=>J,syncAuditLogs:()=>Ne});function Ve(e){if(!e||typeof e!="object")return e;let t={...e},r=["password","token","secret","value","apiKey","secretValue"];for(let s of Object.keys(t))r.some(n=>s.toLowerCase().includes(n))&&(t[s]="[REDACTED]");return t}async function de(e){try{if(!j().token)return!1;let r={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:Ve(e.details),timestamp:e.timestamp,projectId:e.projectId};return await N.post("/audit/cli-logs",{logs:[r]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function Le(e,t,r,s){let n={id:(0,ue.randomUUID)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:r,details:s,synced:!1},i=D();i.push(n),J(i),de(n).then(u=>{if(u){n.synced=!0;let f=D(),c=f.findIndex(p=>p.id===n.id);c!==-1&&(f[c].synced=!0,J(f))}}).catch(()=>{})}function D(){if(!b.default.existsSync(z))return[];try{let e=b.default.readFileSync(z,"utf-8"),t=JSON.parse(e),r=V(t);return JSON.parse(r)}catch{return[]}}function J(e){b.default.existsSync(M)||b.default.mkdirSync(M,{recursive:!0});let t=JSON.stringify(e),r=U(t);b.default.writeFileSync(z,JSON.stringify(r),"utf-8")}async function Ne(){let e=D(),t=e.filter(s=>!s.synced);if(t.length===0)return 0;let r=0;for(let s of t)await de(s)&&(s.synced=!0,r++);return r>0&&J(e),r}var b,Y,ue,M,z,le=_(()=>{b=y(require("fs")),Y=y(require("path")),ue=require("crypto");T();R();G();M=Y.default.join(process.cwd(),".xtra"),z=Y.default.join(M,"audit.enc")});var Je={};C(Je,{importCommand:()=>De});module.exports=k(Je);var ye=require("commander");G();var I=y(require("chalk")),Z=y(require("fs")),q=y(require("path")),me=y(require("dotenv")),he=require("csv-parse/sync");R();var De=new ye.Command("import").description("Import secrets from a file (JSON, Dotenv, CSV)").argument("<file>","Path to the file to import").option("-p, --project <projectId>","Project ID").option("-e, --env <environment>","Environment (development, staging, production)","development").option("-b, --branch <branchName>","Branch Name").option("-f, --format <format>","Input format (json, dotenv, csv). Auto-detected if omitted.").option("--prefix <prefix>","Add prefix to all imported keys").option("--overwrite","Overwrite existing secrets (default: merged, but API usually upserts)",!0).action(async(e,t)=>{let{project:r,env:s,branch:n,format:i,prefix:u}=t;r||(r=L().project),n||(n=L().branch||"main"),s={dev:"development",stg:"staging",prod:"production"}[s]||s,r||(console.error(I.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1));let c=q.default.resolve(process.cwd(),e);Z.default.existsSync(c)||(console.error(I.default.red(`Error: File not found: ${c}`)),process.exit(1));let p=i;if(!p){let g=q.default.extname(c).toLowerCase();g===".json"?p="json":g===".env"?p="dotenv":g===".csv"?p="csv":(console.error(I.default.red("Error: Could not detect format. Please specify -f <format>")),process.exit(1))}let m=require("ora")(`Reading ${p} file...`).start(),S=Z.default.readFileSync(c,"utf-8"),l={};try{switch(p.toLowerCase()){case"json":l=JSON.parse(S);break;case"dotenv":l=me.default.parse(S);break;case"csv":(0,he.parse)(S,{columns:!0,skip_empty_lines:!0}).forEach(h=>{let v=h.key||h.Key||h.KEY,X=h.value||h.Value||h.VALUE;v&&(l[v]=X||"")});break;default:m.fail(`Unsupported format: ${p}`),process.exit(1)}if(Object.keys(l).length===0){m.fail("No valid secrets found in file.");return}if(u){let g={};Object.entries(l).forEach(([h,v])=>{g[`${u}${h}`]=v}),l=g}m.text=`Importing ${Object.keys(l).length} secrets to ${s} (branch: ${n})...`,await N.setSecrets(r,s,l,void 0,n),m.succeed(`Successfully imported ${Object.keys(l).length} secrets.`);try{let{logAudit:g}=(le(),k(fe));g("SECRET_IMPORT",r,s,{file:q.default.basename(c),format:p,count:Object.keys(l).length,branch:n})}catch{}}catch(g){m.fail("Import failed."),console.error(I.default.red(g?.response?.data?.error||"An unexpected error occurred")),process.exit(1)}});0&&(module.exports={importCommand});

package/dist/commands/init.js

@@ -1,7 +1,7 @@
-var lt=Object.create;var A=Object.defineProperty;var yt=Object.getOwnPropertyDescriptor;var mt=Object.getOwnPropertyNames;var ft=Object.getPrototypeOf,ht=Object.prototype.hasOwnProperty;var I=(t,e)=>()=>(t&&(e=t(t=0)),e);var C=(t,e)=>{for(var s in e)A(t,s,{get:e[s],enumerable:!0})},V=(t,e,s,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of mt(e))!ht.call(t,r)&&r!==s&&A(t,r,{get:()=>e[r],enumerable:!(n=yt(e,r))||n.enumerable});return t};var g=(t,e,s)=>(s=t!=null?lt(ft(t)):{},V(e||!t||!t.__esModule?A(s,"default",{value:t,enumerable:!0}):s,t)),wt=t=>V(A({},"__esModule",{value:!0}),t);var H={};C(H,{clearConfig:()=>jt,deleteConfig:()=>vt,getAuthToken:()=>T,getBreakGlassSession:()=>xt,getConfig:()=>h,getConfigValue:()=>O,getProjectConfig:()=>$t,getRcConfig:()=>bt,setBreakGlassSession:()=>St,setConfig:()=>x});var z,f,_,L,p,X,h,O,x,jt,vt,T,xt,St,$t,bt,S=I(()=>{z=g(require("conf")),f=g(require("fs")),_=g(require("path")),L="https://www.xtrasecurity.in/api",p=new z.default({projectName:"xtra-cli",defaults:{apiUrl:L}}),X=p.get("apiUrl");X&&!process.env.XTRA_API_URL&&X.includes("xtra-security.vercel.app")&&p.set("apiUrl",L);h=()=>({...p.store,apiUrl:process.env.XTRA_API_URL||p.get("apiUrl")||L}),O=t=>p.get(t),x=(t,e)=>{if(p.set(t,e),t==="token"&&process.platform!=="win32"&&f.default.existsSync(p.path))try{f.default.chmodSync(p.path,384)}catch{}},jt=()=>p.clear(),vt=t=>p.delete(t),T=()=>p.get("token"),xt=()=>p.get("breakGlassSessionId"),St=t=>{t?p.set("breakGlassSessionId",t):p.delete("breakGlassSessionId")},$t=async()=>{try{let t=_.default.join(process.cwd(),"xtra.json");if(f.default.existsSync(t)){let e=f.default.readFileSync(t,"utf-8");return JSON.parse(e)}return null}catch{return null}},bt=()=>{let t={};try{let e=_.default.join(process.cwd(),".xtrarc");f.default.existsSync(e)&&(t=JSON.parse(f.default.readFileSync(e,"utf-8")))}catch{}return{project:t.project||p.get("project")||"",env:t.env||p.get("env")||"development",branch:t.branch||p.get("branch")||"main"}}});var E={};C(E,{api:()=>N});var M,Y,Q,kt,o,N,P=I(()=>{M=g(require("axios"));S();Y=g(require("fs")),Q=g(require("path")),kt=JSON.parse(Y.readFileSync(Q.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:t}=h(),e=T();return M.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":kt.version,...e?{Authorization:`Bearer ${e}`}:{}}})},N={login:async(t,e,s)=>(await o().post("/auth/cli-login",{email:t,password:e,apiKey:s})).data,getSecrets:async(t,e,s="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets?branch=${s}`)).data,getSecretVersions:async(t,e,s="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(t,e,s,n,r="main")=>(await o().post(`/projects/${t}/envs/${e}/secrets`,{secrets:s,expectedVersions:n,branch:r})).data,getSecretDetails:async(t,e,s,n="main")=>(await o().get(`/projects/${t}/envs/${e}/secrets/${s}?branch=${n}`)).data,syncLogs:async t=>(await o().post("/audit/cli-logs",{logs:t})).data,linkSecret:async(t,e,s,n,r,a)=>(await o().post(`/projects/${t}/envs/${e}/secrets/link`,{key:s,sourceProjectId:n,sourceEnv:r,sourceKey:a})).data,rotateSecret:async(t,e,s,n,r)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/rotate`,{strategy:n,parsedNewValue:r})).data,promoteSecret:async(t,e,s)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(t,e,s,n)=>{let r={format:t};return e&&(r.startDate=e),s&&(r.endDate=s),n&&(r.projectId=n),(await o().post("/audit/export",r,{responseType:t==="csv"?"text":"json"})).data},requestAccess:async(t,e,s,n)=>(await o().post("/access/request",{projectId:t,secretId:n,reason:e,duration:s})).data,approveAccess:async(t,e)=>(await o().post("/access/approve",{requestId:t,decision:e})).data,listAccessRequests:async t=>{let{workspace:e}=h(),s=e?`&workspaceId=${e}`:"";return(await o().get(`/access/list?mode=${t}${s}`)).data},getAccessRequestStatus:async t=>(await o().get(`/access/request?id=${t}`)).data,getProjects:async()=>{let{workspace:t}=h(),e=t?`/project?workspaceId=${t}`:"/project";return(await o().get(e)).data},getBranches:async t=>(await o().get(`/branch?projectId=${t}`)).data,createBranch:async(t,e,s)=>(await o().post("/branch",{projectId:t,name:e,description:s})).data,deleteBranch:async t=>(await o().delete(`/branch/${t}`)).data,updateBranch:async(t,e)=>(await o().put("/branch",{id:t,...e})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async t=>{let e=t?`?teamId=${t}`:"";return(await o().get(`/admin/users${e}`)).data},setUserRole:async(t,e,s)=>(await o().put("/admin/users/role",{email:t,role:e,teamId:s})).data,getIntegrationStatus:async t=>(await o().get(`/integrations/${t}`)).data,getIntegrationRepos:async t=>(await o().get(`/integrations/${t}/sync`)).data.repos,syncSecretsToGithub:async t=>(await o().post("/integrations/github/sync",t)).data,exportKubernetesSecret:async(t,e)=>{let s=new URLSearchParams(e).toString();return(await o().get(`/projects/${t}/kubernetes?${s}`)).data},getSecretHistory:async(t,e,s)=>(await o().get(`/projects/${t}/envs/${e}/secrets/${s}/history`)).data,rollbackSecret:async(t,e,s,n)=>(await o().post(`/projects/${t}/envs/${e}/secrets/${s}/history`,{version:n})).data,cloneEnvironment:async(t,e,s,n,r)=>(await o().post(`/projects/${t}/envs/clone`,{fromEnv:e,toEnv:s,overwrite:n,branch:r})).data,generateJitLink:async t=>(await o().post("/jit/generate",t)).data,claimJitLink:async t=>(await o().post("/jit/claim",{token:t})).data,getJitInfo:async t=>(await o().get(`/jit/${t}`)).data,getServiceAccounts:async t=>(await o().get(`/projects/${t}/service-accounts`)).data,createServiceAccount:async(t,e)=>(await o().post(`/projects/${t}/service-accounts`,e)).data,deleteServiceAccount:async(t,e)=>(await o().delete(`/projects/${t}/service-accounts/${e}`)).data,getServiceAccountKeys:async(t,e)=>(await o().get(`/projects/${t}/service-accounts/${e}/keys`)).data,createServiceAccountKey:async(t,e,s,n)=>(await o().post(`/projects/${t}/service-accounts/${e}/keys`,{label:s,expiresAt:n})).data,deleteServiceAccountKey:async(t,e,s)=>(await o().delete(`/projects/${t}/service-accounts/${e}/keys/${s}`)).data,post:async(t,e)=>(await o().post(t,e)).data}});function st(){let t=W.get("masterKey");t||(t=j.default.randomBytes(32).toString("hex"),W.set("masterKey",t));let e=(0,tt.machineIdSync)();return j.default.createHash("sha256").update(t+e).digest()}var j,Z,tt,et,W,nt,rt,ot=I(()=>{j=g(require("crypto")),Z=g(require("conf")),tt=require("node-machine-id"),et="aes-256-gcm",W=new Z.default({projectName:"xtra-cli-crypto"});nt=t=>{let e=j.default.randomBytes(16),s=st(),n=j.default.createCipheriv(et,s,e),r=n.update(t,"utf8","hex");r+=n.final("hex");let a=n.getAuthTag();return{iv:e.toString("hex"),content:r,tag:a.toString("hex")}},rt=t=>{let e=st(),s=Buffer.from(t.iv,"hex"),n=Buffer.from(t.tag,"hex"),r=j.default.createDecipheriv(et,e,s);r.setAuthTag(n);let a=r.update(t.content,"hex","utf8");return a+=r.final("utf8"),a}});var ct={};C(ct,{loadAuditLogs:()=>D,logAudit:()=>It,saveAuditLogs:()=>R,syncAuditLogs:()=>Ct});function At(t){if(!t||typeof t!="object")return t;let e={...t},s=["password","token","secret","value","apiKey","secretValue"];for(let n of Object.keys(e))s.some(r=>n.toLowerCase().includes(r))&&(e[n]="[REDACTED]");return e}async function it(t){try{if(!h().token)return!1;let s={action:t.action,entity:"cli-project",entityId:t.projectId||"global",details:At(t.details),timestamp:t.timestamp,projectId:t.projectId};return await N.post("/audit/cli-logs",{logs:[s]}),!0}catch(e){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",e),!1}}function It(t,e,s,n){let r={id:(0,at.v4)(),timestamp:new Date().toISOString(),action:t,projectId:e,environment:s,details:n,synced:!1},a=D();a.push(r),R(a),it(r).then($=>{if($){r.synced=!0;let d=D(),b=d.findIndex(k=>k.id===r.id);b!==-1&&(d[b].synced=!0,R(d))}}).catch(()=>{})}function D(){if(!v.default.existsSync(J))return[];try{let t=v.default.readFileSync(J,"utf-8"),e=JSON.parse(t),s=rt(e);return JSON.parse(s)}catch{return[]}}function R(t){v.default.existsSync(F)||v.default.mkdirSync(F,{recursive:!0});let e=JSON.stringify(t),s=nt(e);v.default.writeFileSync(J,JSON.stringify(s),"utf-8")}async function Ct(){let t=D(),e=t.filter(n=>!n.synced);if(e.length===0)return 0;let s=0;for(let n of e)await it(n)&&(n.synced=!0,s++);return s>0&&R(t),s}var v,G,at,F,J,pt=I(()=>{v=g(require("fs")),G=g(require("path")),at=require("uuid");ot();S();P();F=G.default.join(process.cwd(),".xtra"),J=G.default.join(F,"audit.enc")});var Rt={};C(Rt,{initCommand:()=>Dt});module.exports=wt(Rt);var gt=require("commander"),c=g(require("chalk")),U=g(require("inquirer")),y=g(require("fs")),q=g(require("path"));S();var Pt=".xtrarc",Dt=new gt.Command("init").description("Bootstrap a new project \u2014 creates .xtrarc and recommended structure").option("--project <id>","Project ID (skip prompt)").option("--env <env>","Default environment","development").option("--branch <branch>","Default branch","main").option("-y, --yes","Accept all defaults without prompting",!1).action(async t=>{let e=process.cwd(),s=q.join(e,Pt);if(console.log(c.default.bold(`
+var Se=Object.create;var O=Object.defineProperty;var je=Object.getOwnPropertyDescriptor;var be=Object.getOwnPropertyNames;var ke=Object.getPrototypeOf,Ae=Object.prototype.hasOwnProperty;var U=(e,t)=>()=>(e&&(t=e(e=0)),t);var R=(e,t)=>{for(var r in t)O(e,r,{get:t[r],enumerable:!0})},oe=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let s of be(t))!Ae.call(e,s)&&s!==r&&O(e,s,{get:()=>t[s],enumerable:!(n=je(t,s))||n.enumerable});return e};var y=(e,t,r)=>(r=e!=null?Se(ke(e)):{},oe(t||!e||!e.__esModule?O(r,"default",{value:e,enumerable:!0}):r,e)),L=e=>oe(O({},"__esModule",{value:!0}),e);var W={};R(W,{createWorkloadKeyEnvelope:()=>_e,decrypt:()=>J,decryptSecretValue:()=>Ie,decryptWorkloadKeyEnvelope:()=>Ke,deriveProjectKey:()=>Pe,encrypt:()=>F,encryptSecretValue:()=>Te,hash:()=>$e,resolveVaultPassphrase:()=>ge,saveVaultPassphrase:()=>Re,secureRead:()=>E,secureSave:()=>K});function pe(){if(V)return V;let e=N.get("masterKey");e||(e=a.default.randomBytes(32).toString("hex"),N.set("masterKey",e));let t="";try{t=(0,ae.machineIdSync)()||""}catch{t=a.default.createHash("sha256").update(w.default.hostname()+(w.default.userInfo?.()?.username||"root")).digest("hex")}let r=w.default.platform(),n=w.default.userInfo?.()?.username||"default_user",s=`${r}:${n}:${t}:${e}`;return V=a.default.createHash("sha256").update(s).digest(),V}function Pe(e,t){t||(t=ge(void 0,e));let r=Buffer.from(`project_salt_${e}`),n=Buffer.from("xtra-e2ee-project-key-v2"),s=a.default.hkdfSync("sha256",Buffer.from(t),r,n,32);return Buffer.from(s).toString("hex")}function Te(e,t){let r=a.default.randomBytes(12),n=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=a.default.createCipheriv("aes-256-gcm",n,r),i=s.update(e,"utf8","hex");i+=s.final("hex");let f=s.getAuthTag().toString("hex");return{ciphertext:i,iv:r.toString("hex"),authTag:f}}function Ie(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=Buffer.from(e.iv,"hex"),s=Buffer.from(e.authTag,"hex"),i=a.default.createDecipheriv("aes-256-gcm",r,n);i.setAuthTag(s);let f=i.update(e.ciphertext,"hex","utf8");return f+=i.final("utf8"),f}function ge(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let n=E(`vault_${t}`);if(n)return n}let r=E("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(T(),L(M)),n=r();if(n&&n.passphrase)return n.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function Re(e,t){t&&K(`vault_${t}`,e),K("vault_passphrase",e)}function _e(e,t){let{publicKey:r,privateKey:n}=a.default.generateKeyPairSync("x25519"),s=r.export({type:"spki",format:"pem"}).toString(),i=a.default.createPublicKey(t),f=a.default.diffieHellman({privateKey:n,publicKey:i}),c=Buffer.from(a.default.hkdfSync("sha256",f,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),g=a.default.randomBytes(12),m=a.default.createCipheriv("aes-256-gcm",c,g),l=m.update(e,"utf8","hex");l+=m.final("hex");let A=m.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:s,encryptedProjectKey:l,iv:g.toString("hex"),authTag:A}}function Ke(e,t){let r=a.default.createPrivateKey(t),n=a.default.createPublicKey(e.ephemeralPublicKey),s=a.default.diffieHellman({privateKey:r,publicKey:n}),i=Buffer.from(a.default.hkdfSync("sha256",s,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),f=Buffer.from(e.iv,"hex"),c=Buffer.from(e.authTag,"hex"),g=a.default.createDecipheriv("aes-256-gcm",i,f);g.setAuthTag(c);let m=g.update(e.encryptedProjectKey,"hex","utf8");return m+=g.final("utf8"),m}var a,w,ie,ae,_,ce,N,V,F,J,$e,K,E,C=U(()=>{a=y(require("crypto")),w=y(require("os")),ie=y(require("conf")),ae=require("node-machine-id"),_=require("child_process"),ce="aes-256-gcm",N=new ie.default({projectName:"xtra-cli-crypto"}),V=null;F=e=>{let t=a.default.randomBytes(12),r=pe(),n=a.default.createCipheriv(ce,r,t),s=n.update(e,"utf8","hex");s+=n.final("hex");let i=n.getAuthTag();return{iv:t.toString("hex"),content:s,tag:i.toString("hex")}},J=e=>{let t=pe(),r=Buffer.from(e.iv,"hex"),n=Buffer.from(e.tag,"hex"),s=a.default.createDecipheriv(ce,t,r);s.setAuthTag(n);let i=s.update(e.content,"hex","utf8");return i+=s.final("utf8"),i},$e=e=>a.default.createHash("sha256").update(e).digest("hex"),K=(e,t)=>{try{let n="XtraSecurityCLI",s=e;if(w.default.platform()==="darwin"){(0,_.execFileSync)("security",["add-generic-password","-s",n,"-a",s,"-w",t,"-U"],{stdio:"ignore"});return}else if(w.default.platform()!=="win32"){if(w.default.platform()==="linux")try{(0,_.execFileSync)("secret-tool",["store","--label",n,"service",n,"account",s],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=F(t);N.set(`secure_${e}`,JSON.stringify(r))},E=e=>{try{let t="XtraSecurityCLI",r=e;if(w.default.platform()==="darwin")return(0,_.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(w.default.platform()!=="win32"){if(w.default.platform()==="linux")try{return(0,_.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=N.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return J(r)}catch{return null}}});var M={};R(M,{clearConfig:()=>Ee,deleteConfig:()=>Ce,getAuthToken:()=>D,getBreakGlassSession:()=>Be,getConfig:()=>k,getConfigValue:()=>Z,getProjectConfig:()=>Oe,getRcConfig:()=>Ue,setBreakGlassSession:()=>De,setConfig:()=>B});var le,b,z,Y,d,ue,k,Z,B,Ee,Ce,D,Be,De,Oe,Ue,T=U(()=>{le=y(require("conf")),b=y(require("fs")),z=y(require("path"));C();Y="https://www.xtrasecurity.in/api",d=new le.default({projectName:"xtra-cli",defaults:{apiUrl:Y}}),ue=d.get("apiUrl");ue&&!process.env.XTRA_API_URL&&ue.includes("xtra-security.vercel.app")&&d.set("apiUrl",Y);k=()=>({...d.store,token:D(),apiUrl:process.env.XTRA_API_URL||d.get("apiUrl")||Y}),Z=e=>e==="token"?D():d.get(e),B=(e,t)=>{if(e==="token"&&t&&K("token",t),d.set(e,t),e==="token"&&process.platform!=="win32"&&b.default.existsSync(d.path))try{b.default.chmodSync(d.path,384)}catch{}},Ee=()=>d.clear(),Ce=e=>d.delete(e),D=()=>E("token")||d.get("token"),Be=()=>d.get("breakGlassSessionId"),De=e=>{e?d.set("breakGlassSessionId",e):d.delete("breakGlassSessionId")},Oe=async()=>{try{let e=z.default.join(process.cwd(),"xtra.json");if(b.default.existsSync(e)){let t=b.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},Ue=()=>{let e={};try{let t=z.default.join(process.cwd(),".xtrarc");b.default.existsSync(t)&&(e=JSON.parse(b.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||d.get("project")||"",env:e.env||d.get("env")||"development",branch:e.branch||d.get("branch")||"main"}}});var ee={};R(ee,{api:()=>Q});var de,fe,ye,Le,o,Q,X=U(()=>{de=y(require("axios"));T();fe=y(require("fs")),ye=y(require("path")),Le=JSON.parse(fe.readFileSync(ye.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=k(),r=e||D();return de.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":Le.version,...r?{Authorization:`Bearer ${r}`}:{}}})},Q={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",n,s,i)=>{let c=(await o(s).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(c&&typeof c=="object"){let g=null,{deriveProjectKey:m,decryptSecretValue:l,resolveVaultPassphrase:A,decryptWorkloadKeyEnvelope:$}=(C(),L(W));for(let[h,x]of Object.entries(c))if(typeof x=="string"&&x.startsWith("{"))try{let v=JSON.parse(x);if(v.ciphertext&&v.iv){if(!g)if(i&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)g=$(i,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let p=A(n,e);g=m(e,p)}c[h]=l(v,g)}}catch(v){if(v.message&&v.message.includes("Zero-Knowledge"))throw v}}return c},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,n,s="main")=>{let{deriveProjectKey:i,encryptSecretValue:f,resolveVaultPassphrase:c}=(C(),L(W)),g=c(void 0,e),m=i(e,g),l={};for(let[$,h]of Object.entries(r))if(typeof h=="string"&&h.startsWith("{")&&h.includes("ciphertext"))l[$]=h;else{let x=f(h,m);l[$]=JSON.stringify(x)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:l,expectedVersions:n,branch:s})).data},getSecretDetails:async(e,t,r,n="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${n}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,n,s,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:n,sourceEnv:s,sourceKey:i})).data,rotateSecret:async(e,t,r,n,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:n,parsedNewValue:s})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,n)=>{let s={format:e};return t&&(s.startDate=t),r&&(s.endDate=r),n&&(s.projectId=n),(await o().post("/audit/export",s,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,n)=>(await o().post("/access/request",{projectId:e,secretId:n,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=k(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=k(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:n})).data,cloneEnvironment:async(e,t,r,n,s)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:n,branch:s})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,n)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:n})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});var ve={};R(ve,{loadAuditLogs:()=>q,logAudit:()=>Ne,saveAuditLogs:()=>H,syncAuditLogs:()=>Fe});function Ve(e){if(!e||typeof e!="object")return e;let t={...e},r=["password","token","secret","value","apiKey","secretValue"];for(let n of Object.keys(t))r.some(s=>n.toLowerCase().includes(s))&&(t[n]="[REDACTED]");return t}async function he(e){try{if(!k().token)return!1;let r={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:Ve(e.details),timestamp:e.timestamp,projectId:e.projectId};return await Q.post("/audit/cli-logs",{logs:[r]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function Ne(e,t,r,n){let s={id:(0,me.randomUUID)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:r,details:n,synced:!1},i=q();i.push(s),H(i),he(s).then(f=>{if(f){s.synced=!0;let c=q(),g=c.findIndex(m=>m.id===s.id);g!==-1&&(c[g].synced=!0,H(c))}}).catch(()=>{})}function q(){if(!I.default.existsSync(re))return[];try{let e=I.default.readFileSync(re,"utf-8"),t=JSON.parse(e),r=J(t);return JSON.parse(r)}catch{return[]}}function H(e){I.default.existsSync(te)||I.default.mkdirSync(te,{recursive:!0});let t=JSON.stringify(e),r=F(t);I.default.writeFileSync(re,JSON.stringify(r),"utf-8")}async function Fe(){let e=q(),t=e.filter(n=>!n.synced);if(t.length===0)return 0;let r=0;for(let n of t)await he(n)&&(n.synced=!0,r++);return r>0&&H(e),r}var I,ne,me,te,re,we=U(()=>{I=y(require("fs")),ne=y(require("path")),me=require("crypto");C();T();X();te=ne.default.join(process.cwd(),".xtra"),re=ne.default.join(te,"audit.enc")});var qe={};R(qe,{initCommand:()=>Xe});module.exports=L(qe);var xe=require("commander"),u=y(require("chalk")),G=y(require("inquirer")),j=y(require("fs")),se=y(require("path"));T();var Je=".xtrarc",Xe=new xe.Command("init").description("Bootstrap a new project \u2014 creates .xtrarc and recommended structure").option("--project <id>","Project ID (skip prompt)").option("--env <env>","Default environment","development").option("--branch <branch>","Default branch","main").option("-y, --yes","Accept all defaults without prompting",!1).action(async e=>{let t=process.cwd(),r=se.join(t,Je);if(console.log(u.default.bold(`
 \u{1F680} xtra init \u2014 setting up your project
-`)),y.existsSync(s)){let{overwrite:d}=await U.default.prompt([{type:"confirm",name:"overwrite",message:c.default.yellow(".xtrarc already exists. Overwrite it?"),default:!1}]);if(!d){console.log(c.default.gray("Aborted."));return}}let{project:n,env:r,branch:a}=t;if(!t.yes){let{getAuthToken:d}=await Promise.resolve().then(()=>(S(),H)),b=d(),k=(await import("ora")).default,u=[];if(!b)console.log(c.default.yellow("  \u2139  Not logged in \u2014 project list unavailable. Run `xtra login` first.")),console.log(c.default.yellow(`     You can still enter a Project ID manually below.
-`));else{let i=k("Fetching your projects...").start();try{let{api:l}=await Promise.resolve().then(()=>(P(),E)),w=await l.getProjects();u=Array.isArray(w)?w:w.projects??[],u.length===0?i.warn(c.default.yellow("No projects found in your workspace. Create one at www.xtrasecurity.in first.")):i.succeed(`Found ${u.length} project${u.length>1?"s":""}`)}catch(l){let w=l?.response?.status===401?"session expired \u2014 run `xtra login` again":l?.response?.data?.error||l?.message||"network error";i.warn(c.default.yellow(`Could not fetch projects (${w}). Enter the Project ID manually.`))}}let dt=n||O("project")||"",{project:ut}=await U.default.prompt([{type:u.length>0?"list":"input",name:"project",message:u.length>0?"Select a project:":"Project ID:",choices:u.length>0?u.map(i=>({name:`${i.name} (${i.id})`,value:i.id})):void 0,default:dt,validate:i=>i.trim()?!0:"Project ID is required"}]);n=ut.trim();let m=[],K=k("Fetching branches...").start();try{let{api:i}=await Promise.resolve().then(()=>(P(),E));m=await i.getBranches(n),K.stop()}catch{K.warn(c.default.yellow("Could not fetch branches."))}let B=await U.default.prompt([{type:"list",name:"env",message:"Default environment:",choices:["development","staging","production"],default:r||"development"},{type:m.length>0?"list":"input",name:"branch",message:m.length>0?"Default branch:":"Default branch name:",choices:m.length>0?m.map(i=>({name:i.name,value:i.name})):void 0,default:a||(m.length>0?m[0].name:"main")},{type:"confirm",name:"addGitignore",message:"Add .xtrarc to .gitignore? (recommended)",default:!0}]);if(r=B.env,a=B.branch,B.addGitignore){let i=q.join(e,".gitignore"),l="";try{l=y.readFileSync(i,"utf8")}catch{}l.includes(".xtrarc")||(y.appendFileSync(i,`
+`)),j.existsSync(r)){let{overwrite:c}=await G.default.prompt([{type:"confirm",name:"overwrite",message:u.default.yellow(".xtrarc already exists. Overwrite it?"),default:!1}]);if(!c){console.log(u.default.gray("Aborted."));return}}let{project:n,env:s,branch:i}=e;if(!e.yes){let{getAuthToken:c}=await Promise.resolve().then(()=>(T(),M)),g=c(),m=(await import("ora")).default,l=[];if(!g)console.log(u.default.yellow("  \u2139  Not logged in \u2014 project list unavailable. Run `xtra login` first.")),console.log(u.default.yellow(`     You can still enter a Project ID manually below.
+`));else{let p=m("Fetching your projects...").start();try{let{api:S}=await Promise.resolve().then(()=>(X(),ee)),P=await S.getProjects();l=Array.isArray(P)?P:P.projects??[],l.length===0?p.warn(u.default.yellow("No projects found in your workspace. Create one at www.xtrasecurity.in first.")):p.succeed(`Found ${l.length} project${l.length>1?"s":""}`)}catch(S){let P=S?.response?.status===401?"session expired \u2014 run `xtra login` again":S?.response?.data?.error||S?.message||"network error";p.warn(u.default.yellow(`Could not fetch projects (${P}). Enter the Project ID manually.`))}}let A=n||Z("project")||"",{project:$}=await G.default.prompt([{type:l.length>0?"list":"input",name:"project",message:l.length>0?"Select a project:":"Project ID:",choices:l.length>0?l.map(p=>({name:`${p.name} (${p.id})`,value:p.id})):void 0,default:A,validate:p=>p.trim()?!0:"Project ID is required"}]);n=$.trim();let h=[],x=m("Fetching branches...").start();try{let{api:p}=await Promise.resolve().then(()=>(X(),ee));h=await p.getBranches(n),x.stop()}catch{x.warn(u.default.yellow("Could not fetch branches."))}let v=await G.default.prompt([{type:"list",name:"env",message:"Default environment:",choices:["development","staging","production"],default:s||"development"},{type:h.length>0?"list":"input",name:"branch",message:h.length>0?"Default branch:":"Default branch name:",choices:h.length>0?h.map(p=>({name:p.name,value:p.name})):void 0,default:i||(h.length>0?h[0].name:"main")},{type:"confirm",name:"addGitignore",message:"Add .xtrarc to .gitignore? (recommended)",default:!0}]);if(s=v.env,i=v.branch,v.addGitignore){let p=se.join(t,".gitignore"),S="";try{S=j.readFileSync(p,"utf8")}catch{}S.includes(".xtrarc")||(j.appendFileSync(p,`
 # XtraSecurity config
 .xtrarc
-`),console.log(c.default.gray("  \u2714 Added .xtrarc to .gitignore")))}}n||(console.error(c.default.red("Error: Project ID is required.")),process.exit(1));let $={project:n,env:r,branch:a,apiUrl:process.env.XTRA_API_URL||"https://www.xtrasecurity.in/api",createdAt:new Date().toISOString()};y.writeFileSync(s,JSON.stringify($,null,2),"utf8"),x("project",n),x("env",r),x("branch",a),console.log(c.default.gray(`     Branch   : ${c.default.white(a)}`)),console.log();try{let{logAudit:d}=await Promise.resolve().then(()=>(pt(),ct));d("PROJECT_INIT",n,r,{branch:a,rcPath:s})}catch{}console.log(c.default.bold("  Next steps:")),console.log(c.default.gray("    xtra login                   # authenticate")),console.log(c.default.gray("    xtra secrets list            # view secrets")),console.log(c.default.gray("    xtra run node app.js         # inject and run")),console.log(c.default.gray("    xtra doctor                  # verify everything works")),console.log()});0&&(module.exports={initCommand});
+`),console.log(u.default.gray("  \u2714 Added .xtrarc to .gitignore")))}}n||(console.error(u.default.red("Error: Project ID is required.")),process.exit(1));let f={project:n,env:s,branch:i,apiUrl:process.env.XTRA_API_URL||"https://www.xtrasecurity.in/api",createdAt:new Date().toISOString()};j.writeFileSync(r,JSON.stringify(f,null,2),"utf8"),B("project",n),B("env",s),B("branch",i),console.log(u.default.gray(`     Branch   : ${u.default.white(i)}`)),console.log();try{let{logAudit:c}=await Promise.resolve().then(()=>(we(),ve));c("PROJECT_INIT",n,s,{branch:i,rcPath:r})}catch{}console.log(u.default.bold("  Next steps:")),console.log(u.default.gray("    xtra login                   # authenticate")),console.log(u.default.gray("    xtra secrets list            # view secrets")),console.log(u.default.gray("    xtra run node app.js         # inject and run")),console.log(u.default.gray("    xtra doctor                  # verify everything works")),console.log()});0&&(module.exports={initCommand});

package/dist/commands/integration.js

@@ -1,11 +1,11 @@
-var E=Object.create;var d=Object.defineProperty;var G=Object.getOwnPropertyDescriptor;var q=Object.getOwnPropertyNames;var K=Object.getPrototypeOf,L=Object.prototype.hasOwnProperty;var _=(e,t)=>{for(var r in t)d(e,r,{get:t[r],enumerable:!0})},j=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of q(t))!L.call(e,o)&&o!==r&&d(e,o,{get:()=>t[o],enumerable:!(s=G(t,o))||s.enumerable});return e};var i=(e,t,r)=>(r=e!=null?E(K(e)):{},j(t||!e||!e.__esModule?d(r,"default",{value:e,enumerable:!0}):r,e)),D=e=>j(d({},"__esModule",{value:!0}),e);var T={};_(T,{integrationCommand:()=>R,kubernetesCommand:()=>h});module.exports=D(T);var $=require("commander"),a=i(require("chalk"));var I=i(require("axios"));var S=i(require("conf")),w=i(require("fs")),k=i(require("path")),v="https://www.xtrasecurity.in/api",p=new S.default({projectName:"xtra-cli",defaults:{apiUrl:v}}),b=p.get("apiUrl");b&&!process.env.XTRA_API_URL&&b.includes("xtra-security.vercel.app")&&p.set("apiUrl",v);var m=()=>({...p.store,apiUrl:process.env.XTRA_API_URL||p.get("apiUrl")||v});var x=()=>p.get("token");var y=()=>{let e={};try{let t=k.default.join(process.cwd(),".xtrarc");w.default.existsSync(t)&&(e=JSON.parse(w.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||p.get("project")||"",env:e.env||p.get("env")||"development",branch:e.branch||p.get("branch")||"main"}};var A=i(require("fs")),U=i(require("path")),N=JSON.parse(A.readFileSync(U.join(__dirname,"../../package.json"),"utf-8")),n=()=>{let{apiUrl:e}=m(),t=x();return I.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":N.version,...t?{Authorization:`Bearer ${t}`}:{}}})},u={login:async(e,t,r)=>(await n().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,getSecrets:async(e,t,r="main")=>(await n().get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data,getSecretVersions:async(e,t,r="main")=>(await n().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,o="main")=>(await n().post(`/projects/${e}/envs/${t}/secrets`,{secrets:r,expectedVersions:s,branch:o})).data,getSecretDetails:async(e,t,r,s="main")=>(await n().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,syncLogs:async e=>(await n().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,o,c)=>(await n().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:o,sourceKey:c})).data,rotateSecret:async(e,t,r,s,o)=>(await n().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:o})).data,promoteSecret:async(e,t,r)=>(await n().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await n().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let o={format:e};return t&&(o.startDate=t),r&&(o.endDate=r),s&&(o.projectId=s),(await n().post("/audit/export",o,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await n().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await n().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=m(),r=t?`&workspaceId=${t}`:"";return(await n().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await n().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=m(),t=e?`/project?workspaceId=${e}`:"/project";return(await n().get(t)).data},getBranches:async e=>(await n().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await n().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await n().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await n().put("/branch",{id:e,...t})).data,getRoles:async()=>(await n().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await n().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await n().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await n().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await n().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await n().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await n().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await n().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await n().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,o)=>(await n().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:o})).data,generateJitLink:async e=>(await n().post("/jit/generate",e)).data,claimJitLink:async e=>(await n().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await n().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await n().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await n().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await n().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await n().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await n().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await n().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await n().post(e,t)).data};var C=i(require("inquirer")),P=i(require("fs")),R=new $.Command("integration");R.command("sync").description("Sync secrets to external integrations (GitHub)").option("-p, --project <id>","Project ID (defaults to current directory config)").option("-e, --env <environment>","Environment (development, staging, production)","development").option("--github","Sync to GitHub").option("--repo <owner/repo>","GitHub repository (e.g., owner/repo)").option("--prefix <prefix>","Prefix for secret keys").action(async e=>{try{let t=e.project;t||(t=y().project,t||(console.error(a.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1)));let r=await u.getIntegrationStatus("github");r.connected||(console.log(a.default.yellow(`
-GitHub not connected. Please connect via the web dashboard first.`)),console.log(a.default.blue(`Visit: https://www.xtrasecurity.in/integrations
-`)),process.exit(1)),console.log(a.default.green(`
-Connected as: ${r.username}`));let s=e.repo;if(s){let[c,l]=s.split("/");(!c||!l)&&(console.error(a.default.red("Error: Invalid repository format. Use owner/repo")),process.exit(1)),s={owner:c,name:l}}else{console.log("Fetching repositories...");let c=await u.getIntegrationRepos("github"),l=await C.default.prompt([{type:"list",name:"repo",message:"Select a repository to sync to:",choices:c.map(g=>({name:`${g.fullName} ${g.private?"(\u{1F512})":""}`,value:g.id.toString(),short:g.fullName}))}]),f=c.find(g=>g.id.toString()===l.repo);f&&(s={owner:f.owner,name:f.name})}console.log(a.default.blue(`
-Syncing secrets from ${e.env} to GitHub repo: ${s.owner}/${s.name}...`));let o=await u.syncSecretsToGithub({projectId:t,environment:e.env,repoOwner:s.owner,repoName:s.name,secretPrefix:e.prefix});console.log(a.default.green(`
-Successfully synced ${o.summary.synced} secrets!`)),o.summary.failed>0&&console.log(a.default.red(`${o.summary.failed} secrets failed to sync.`)),o.results.forEach(c=>{c.success?console.log(a.default.green(`\u2713 ${c.key}`)):console.log(a.default.red(`\u2717 ${c.key}: ${c.error}`))})}catch(t){console.error(a.default.red(`
-Error syncing secrets:`),t?.response?.data?.error||"Unknown error"),process.exit(1)}});var h=new $.Command("kubernetes");h.command("export").description("Export secrets as Kubernetes manifest").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment","development").option("-n, --namespace <namespace>","Kubernetes namespace","default").option("-o, --output <file>","Output file path").option("--name <name>","Secret resource name").action(async e=>{try{let t=e.project;t||(t=y().project,t||(console.error(a.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1))),console.log(a.default.blue(`Generating Kubernetes manifest for ${e.env}...`));let r=await u.exportKubernetesSecret(t,{environment:e.env,namespace:e.namespace,name:e.name});e.output?(P.default.writeFileSync(e.output,r),console.log(a.default.green(`
+var ae=Object.create;var R=Object.defineProperty;var ce=Object.getOwnPropertyDescriptor;var pe=Object.getOwnPropertyNames;var ge=Object.getPrototypeOf,ue=Object.prototype.hasOwnProperty;var D=(e,t)=>()=>(e&&(t=e(e=0)),t);var U=(e,t)=>{for(var r in t)R(e,r,{get:t[r],enumerable:!0})},G=(e,t,r,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let s of pe(t))!ue.call(e,s)&&s!==r&&R(e,s,{get:()=>t[s],enumerable:!(n=ce(t,s))||n.enumerable});return e};var d=(e,t,r)=>(r=e!=null?ae(ge(e)):{},G(t||!e||!e.__esModule?R(r,"default",{value:e,enumerable:!0}):r,e)),_=e=>G(R({},"__esModule",{value:!0}),e);var V={};U(V,{createWorkloadKeyEnvelope:()=>he,decrypt:()=>M,decryptSecretValue:()=>ye,decryptWorkloadKeyEnvelope:()=>ve,deriveProjectKey:()=>de,encrypt:()=>F,encryptSecretValue:()=>fe,hash:()=>le,resolveVaultPassphrase:()=>Y,saveVaultPassphrase:()=>me,secureRead:()=>j,secureSave:()=>$});function W(){if(E)return E;let e=I.get("masterKey");e||(e=a.default.randomBytes(32).toString("hex"),I.set("masterKey",e));let t="";try{t=(0,X.machineIdSync)()||""}catch{t=a.default.createHash("sha256").update(f.default.hostname()+(f.default.userInfo?.()?.username||"root")).digest("hex")}let r=f.default.platform(),n=f.default.userInfo?.()?.username||"default_user",s=`${r}:${n}:${t}:${e}`;return E=a.default.createHash("sha256").update(s).digest(),E}function de(e,t){t||(t=Y(void 0,e));let r=Buffer.from(`project_salt_${e}`),n=Buffer.from("xtra-e2ee-project-key-v2"),s=a.default.hkdfSync("sha256",Buffer.from(t),r,n,32);return Buffer.from(s).toString("hex")}function fe(e,t){let r=a.default.randomBytes(12),n=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=a.default.createCipheriv("aes-256-gcm",n,r),i=s.update(e,"utf8","hex");i+=s.final("hex");let g=s.getAuthTag().toString("hex");return{ciphertext:i,iv:r.toString("hex"),authTag:g}}function ye(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=Buffer.from(e.iv,"hex"),s=Buffer.from(e.authTag,"hex"),i=a.default.createDecipheriv("aes-256-gcm",r,n);i.setAuthTag(s);let g=i.update(e.ciphertext,"hex","utf8");return g+=i.final("utf8"),g}function Y(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let n=j(`vault_${t}`);if(n)return n}let r=j("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(B(),_(Z)),n=r();if(n&&n.passphrase)return n.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function me(e,t){t&&$(`vault_${t}`,e),$("vault_passphrase",e)}function he(e,t){let{publicKey:r,privateKey:n}=a.default.generateKeyPairSync("x25519"),s=r.export({type:"spki",format:"pem"}).toString(),i=a.default.createPublicKey(t),g=a.default.diffieHellman({privateKey:n,publicKey:i}),l=Buffer.from(a.default.hkdfSync("sha256",g,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),p=a.default.randomBytes(12),y=a.default.createCipheriv("aes-256-gcm",l,p),m=y.update(e,"utf8","hex");m+=y.final("hex");let K=y.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:s,encryptedProjectKey:m,iv:p.toString("hex"),authTag:K}}function ve(e,t){let r=a.default.createPrivateKey(t),n=a.default.createPublicKey(e.ephemeralPublicKey),s=a.default.diffieHellman({privateKey:r,publicKey:n}),i=Buffer.from(a.default.hkdfSync("sha256",s,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),g=Buffer.from(e.iv,"hex"),l=Buffer.from(e.authTag,"hex"),p=a.default.createDecipheriv("aes-256-gcm",i,g);p.setAuthTag(l);let y=p.update(e.encryptedProjectKey,"hex","utf8");return y+=p.final("utf8"),y}var a,f,N,X,b,J,I,E,F,M,le,$,j,C=D(()=>{a=d(require("crypto")),f=d(require("os")),N=d(require("conf")),X=require("node-machine-id"),b=require("child_process"),J="aes-256-gcm",I=new N.default({projectName:"xtra-cli-crypto"}),E=null;F=e=>{let t=a.default.randomBytes(12),r=W(),n=a.default.createCipheriv(J,r,t),s=n.update(e,"utf8","hex");s+=n.final("hex");let i=n.getAuthTag();return{iv:t.toString("hex"),content:s,tag:i.toString("hex")}},M=e=>{let t=W(),r=Buffer.from(e.iv,"hex"),n=Buffer.from(e.tag,"hex"),s=a.default.createDecipheriv(J,t,r);s.setAuthTag(n);let i=s.update(e.content,"hex","utf8");return i+=s.final("utf8"),i},le=e=>a.default.createHash("sha256").update(e).digest("hex"),$=(e,t)=>{try{let n="XtraSecurityCLI",s=e;if(f.default.platform()==="darwin"){(0,b.execFileSync)("security",["add-generic-password","-s",n,"-a",s,"-w",t,"-U"],{stdio:"ignore"});return}else if(f.default.platform()!=="win32"){if(f.default.platform()==="linux")try{(0,b.execFileSync)("secret-tool",["store","--label",n,"service",n,"account",s],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=F(t);I.set(`secure_${e}`,JSON.stringify(r))},j=e=>{try{let t="XtraSecurityCLI",r=e;if(f.default.platform()==="darwin")return(0,b.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(f.default.platform()!=="win32"){if(f.default.platform()==="linux")try{return(0,b.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=I.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return M(r)}catch{return null}}});var Z={};U(Z,{clearConfig:()=>Se,deleteConfig:()=>be,getAuthToken:()=>P,getBreakGlassSession:()=>$e,getConfig:()=>k,getConfigValue:()=>xe,getProjectConfig:()=>ke,getRcConfig:()=>A,setBreakGlassSession:()=>je,setConfig:()=>we});var Q,x,O,L,u,z,k,xe,we,Se,be,P,$e,je,ke,A,B=D(()=>{Q=d(require("conf")),x=d(require("fs")),O=d(require("path"));C();L="https://www.xtrasecurity.in/api",u=new Q.default({projectName:"xtra-cli",defaults:{apiUrl:L}}),z=u.get("apiUrl");z&&!process.env.XTRA_API_URL&&z.includes("xtra-security.vercel.app")&&u.set("apiUrl",L);k=()=>({...u.store,token:P(),apiUrl:process.env.XTRA_API_URL||u.get("apiUrl")||L}),xe=e=>e==="token"?P():u.get(e),we=(e,t)=>{if(e==="token"&&t&&$("token",t),u.set(e,t),e==="token"&&process.platform!=="win32"&&x.default.existsSync(u.path))try{x.default.chmodSync(u.path,384)}catch{}},Se=()=>u.clear(),be=e=>u.delete(e),P=()=>j("token")||u.get("token"),$e=()=>u.get("breakGlassSessionId"),je=e=>{e?u.set("breakGlassSessionId",e):u.delete("breakGlassSessionId")},ke=async()=>{try{let e=O.default.join(process.cwd(),"xtra.json");if(x.default.existsSync(e)){let t=x.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},A=()=>{let e={};try{let t=O.default.join(process.cwd(),".xtrarc");x.default.existsSync(t)&&(e=JSON.parse(x.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||u.get("project")||"",env:e.env||u.get("env")||"development",branch:e.branch||u.get("branch")||"main"}}});var Ae={};U(Ae,{integrationCommand:()=>oe,kubernetesCommand:()=>H});module.exports=_(Ae);var q=require("commander"),c=d(require("chalk"));var ee=d(require("axios"));B();var te=d(require("fs")),re=d(require("path")),Pe=JSON.parse(te.readFileSync(re.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=k(),r=e||P();return ee.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":Pe.version,...r?{Authorization:`Bearer ${r}`}:{}}})},w={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",n,s,i)=>{let l=(await o(s).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(l&&typeof l=="object"){let p=null,{deriveProjectKey:y,decryptSecretValue:m,resolveVaultPassphrase:K,decryptWorkloadKeyEnvelope:T}=(C(),_(V));for(let[h,S]of Object.entries(l))if(typeof S=="string"&&S.startsWith("{"))try{let v=JSON.parse(S);if(v.ciphertext&&v.iv){if(!p)if(i&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)p=T(i,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let ie=K(n,e);p=y(e,ie)}l[h]=m(v,p)}}catch(v){if(v.message&&v.message.includes("Zero-Knowledge"))throw v}}return l},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,n,s="main")=>{let{deriveProjectKey:i,encryptSecretValue:g,resolveVaultPassphrase:l}=(C(),_(V)),p=l(void 0,e),y=i(e,p),m={};for(let[T,h]of Object.entries(r))if(typeof h=="string"&&h.startsWith("{")&&h.includes("ciphertext"))m[T]=h;else{let S=g(h,y);m[T]=JSON.stringify(S)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:m,expectedVersions:n,branch:s})).data},getSecretDetails:async(e,t,r,n="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${n}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,n,s,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:n,sourceEnv:s,sourceKey:i})).data,rotateSecret:async(e,t,r,n,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:n,parsedNewValue:s})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,n)=>{let s={format:e};return t&&(s.startDate=t),r&&(s.endDate=r),n&&(s.projectId=n),(await o().post("/audit/export",s,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,n)=>(await o().post("/access/request",{projectId:e,secretId:n,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=k(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=k(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:n})).data,cloneEnvironment:async(e,t,r,n,s)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:n,branch:s})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,n)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:n})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data};B();var ne=d(require("inquirer")),se=d(require("fs")),oe=new q.Command("integration");oe.command("sync").description("Sync secrets to external integrations (GitHub)").option("-p, --project <id>","Project ID (defaults to current directory config)").option("-e, --env <environment>","Environment (development, staging, production)","development").option("--github","Sync to GitHub").option("--repo <owner/repo>","GitHub repository (e.g., owner/repo)").option("--prefix <prefix>","Prefix for secret keys").action(async e=>{try{let t=e.project;t||(t=A().project,t||(console.error(c.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1)));let r=await w.getIntegrationStatus("github");r.connected||(console.log(c.default.yellow(`
+GitHub not connected. Please connect via the web dashboard first.`)),console.log(c.default.blue(`Visit: https://www.xtrasecurity.in/integrations
+`)),process.exit(1)),console.log(c.default.green(`
+Connected as: ${r.username}`));let n=e.repo;if(n){let[i,g]=n.split("/");(!i||!g)&&(console.error(c.default.red("Error: Invalid repository format. Use owner/repo")),process.exit(1)),n={owner:i,name:g}}else{console.log("Fetching repositories...");let i=await w.getIntegrationRepos("github"),g=await ne.default.prompt([{type:"list",name:"repo",message:"Select a repository to sync to:",choices:i.map(p=>({name:`${p.fullName} ${p.private?"(\u{1F512})":""}`,value:p.id.toString(),short:p.fullName}))}]),l=i.find(p=>p.id.toString()===g.repo);l&&(n={owner:l.owner,name:l.name})}console.log(c.default.blue(`
+Syncing secrets from ${e.env} to GitHub repo: ${n.owner}/${n.name}...`));let s=await w.syncSecretsToGithub({projectId:t,environment:e.env,repoOwner:n.owner,repoName:n.name,secretPrefix:e.prefix});console.log(c.default.green(`
+Successfully synced ${s.summary.synced} secrets!`)),s.summary.failed>0&&console.log(c.default.red(`${s.summary.failed} secrets failed to sync.`)),s.results.forEach(i=>{i.success?console.log(c.default.green(`\u2713 ${i.key}`)):console.log(c.default.red(`\u2717 ${i.key}: ${i.error}`))})}catch(t){console.error(c.default.red(`
+Error syncing secrets:`),t?.response?.data?.error||"Unknown error"),process.exit(1)}});var H=new q.Command("kubernetes");H.command("export").description("Export secrets as Kubernetes manifest").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment","development").option("-n, --namespace <namespace>","Kubernetes namespace","default").option("-o, --output <file>","Output file path").option("--name <name>","Secret resource name").action(async e=>{try{let t=e.project;t||(t=A().project,t||(console.error(c.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1))),console.log(c.default.blue(`Generating Kubernetes manifest for ${e.env}...`));let r=await w.exportKubernetesSecret(t,{environment:e.env,namespace:e.namespace,name:e.name});e.output?(se.default.writeFileSync(e.output,r),console.log(c.default.green(`
 Manifest saved to ${e.output}`))):console.log(`
-`+r)}catch(t){console.error(a.default.red(`
-Error generating manifest:`),t?.response?.data?.error||"Unknown error"),process.exit(1)}});h.command("apply").description("Apply secrets directly to Kubernetes cluster (requires kubectl)").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment","development").option("-n, --namespace <namespace>","Kubernetes namespace","default").action(async e=>{try{let{execSync:t}=require("child_process");try{t("kubectl version --client",{stdio:"ignore"})}catch{console.error(a.default.red("Error: kubectl not found or not configured.")),process.exit(1)}let r=e.project;r||(r=y().project,r||(console.error(a.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1))),console.log(a.default.blue(`Fetching secrets for ${e.env}...`));let s=await u.exportKubernetesSecret(r,{environment:e.env,namespace:e.namespace});console.log(a.default.blue("Applying to Kubernetes..."));try{let o=require("child_process").spawn("kubectl",["apply","-f","-"]);o.stdin.write(s),o.stdin.end(),o.stdout.on("data",c=>{console.log(c.toString())}),o.stderr.on("data",c=>{console.error(a.default.yellow(c.toString()))})}catch(o){console.error(a.default.red("Failed to apply manifest:"),o?.response?.data?.error||"An unexpected error occurred")}}catch(t){console.error(a.default.red(`
+`+r)}catch(t){console.error(c.default.red(`
+Error generating manifest:`),t?.response?.data?.error||"Unknown error"),process.exit(1)}});H.command("apply").description("Apply secrets directly to Kubernetes cluster (requires kubectl)").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment","development").option("-n, --namespace <namespace>","Kubernetes namespace","default").action(async e=>{try{let{execSync:t}=require("child_process");try{t("kubectl version --client",{stdio:"ignore"})}catch{console.error(c.default.red("Error: kubectl not found or not configured.")),process.exit(1)}let r=e.project;r||(r=A().project,r||(console.error(c.default.red("Error: Project ID is required. Use -p <id> or run 'xtra project set' first.")),process.exit(1))),console.log(c.default.blue(`Fetching secrets for ${e.env}...`));let n=await w.exportKubernetesSecret(r,{environment:e.env,namespace:e.namespace});console.log(c.default.blue("Applying to Kubernetes..."));try{let s=require("child_process").spawn("kubectl",["apply","-f","-"]);s.stdin.write(n),s.stdin.end(),s.stdout.on("data",i=>{console.log(i.toString())}),s.stderr.on("data",i=>{console.error(c.default.yellow(i.toString()))})}catch(s){console.error(c.default.red("Failed to apply manifest:"),s?.response?.data?.error||"An unexpected error occurred")}}catch(t){console.error(c.default.red(`
 Error:`),t?.response?.data?.error||"Unknown error"),process.exit(1)}});0&&(module.exports={integrationCommand,kubernetesCommand});

package/dist/commands/jit-run.js

@@ -1,5 +1,5 @@
-var _=Object.create;var f=Object.defineProperty;var O=Object.getOwnPropertyDescriptor;var B=Object.getOwnPropertyNames;var G=Object.getPrototypeOf,N=Object.prototype.hasOwnProperty;var D=(e,s)=>{for(var t in s)f(e,t,{get:s[t],enumerable:!0})},k=(e,s,t,n)=>{if(s&&typeof s=="object"||typeof s=="function")for(let o of B(s))!N.call(e,o)&&o!==t&&f(e,o,{get:()=>s[o],enumerable:!(n=O(s,o))||n.enumerable});return e};var c=(e,s,t)=>(t=e!=null?_(G(e)):{},k(s||!e||!e.__esModule?f(t,"default",{value:e,enumerable:!0}):t,e)),E=e=>k(f({},"__esModule",{value:!0}),e);var K={};D(K,{jitRunCommand:()=>F});module.exports=E(K);var U=require("commander");var C=c(require("axios"));var x=c(require("conf")),v=c(require("fs")),I=c(require("path")),h="https://www.xtrasecurity.in/api",i=new x.default({projectName:"xtra-cli",defaults:{apiUrl:h}}),S=i.get("apiUrl");S&&!process.env.XTRA_API_URL&&S.includes("xtra-security.vercel.app")&&i.set("apiUrl",h);var w=()=>({...i.store,apiUrl:process.env.XTRA_API_URL||i.get("apiUrl")||h});var b=()=>i.get("token");var A=()=>{let e={};try{let s=I.default.join(process.cwd(),".xtrarc");v.default.existsSync(s)&&(e=JSON.parse(v.default.readFileSync(s,"utf-8")))}catch{}return{project:e.project||i.get("project")||"",env:e.env||i.get("env")||"development",branch:e.branch||i.get("branch")||"main"}};var R=c(require("fs")),T=c(require("path")),V=JSON.parse(R.readFileSync(T.join(__dirname,"../../package.json"),"utf-8")),r=()=>{let{apiUrl:e}=w(),s=b();return C.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":V.version,...s?{Authorization:`Bearer ${s}`}:{}}})},$={login:async(e,s,t)=>(await r().post("/auth/cli-login",{email:e,password:s,apiKey:t})).data,getSecrets:async(e,s,t="main")=>(await r().get(`/projects/${e}/envs/${s}/secrets?branch=${t}`)).data,getSecretVersions:async(e,s,t="main")=>(await r().get(`/projects/${e}/envs/${s}/secrets?includeVersions=true&branch=${t}`)).data,setSecrets:async(e,s,t,n,o="main")=>(await r().post(`/projects/${e}/envs/${s}/secrets`,{secrets:t,expectedVersions:n,branch:o})).data,getSecretDetails:async(e,s,t,n="main")=>(await r().get(`/projects/${e}/envs/${s}/secrets/${t}?branch=${n}`)).data,syncLogs:async e=>(await r().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,s,t,n,o,p)=>(await r().post(`/projects/${e}/envs/${s}/secrets/link`,{key:t,sourceProjectId:n,sourceEnv:o,sourceKey:p})).data,rotateSecret:async(e,s,t,n,o)=>(await r().post(`/projects/${e}/envs/${s}/secrets/${t}/rotate`,{strategy:n,parsedNewValue:o})).data,promoteSecret:async(e,s,t)=>(await r().post(`/projects/${e}/envs/${s}/secrets/${t}/promote`,{})).data,verifyAuditLogs:async()=>(await r().get("/audit/verify")).data,exportAuditLogs:async(e,s,t,n)=>{let o={format:e};return s&&(o.startDate=s),t&&(o.endDate=t),n&&(o.projectId=n),(await r().post("/audit/export",o,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,s,t,n)=>(await r().post("/access/request",{projectId:e,secretId:n,reason:s,duration:t})).data,approveAccess:async(e,s)=>(await r().post("/access/approve",{requestId:e,decision:s})).data,listAccessRequests:async e=>{let{workspace:s}=w(),t=s?`&workspaceId=${s}`:"";return(await r().get(`/access/list?mode=${e}${t}`)).data},getAccessRequestStatus:async e=>(await r().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=w(),s=e?`/project?workspaceId=${e}`:"/project";return(await r().get(s)).data},getBranches:async e=>(await r().get(`/branch?projectId=${e}`)).data,createBranch:async(e,s,t)=>(await r().post("/branch",{projectId:e,name:s,description:t})).data,deleteBranch:async e=>(await r().delete(`/branch/${e}`)).data,updateBranch:async(e,s)=>(await r().put("/branch",{id:e,...s})).data,getRoles:async()=>(await r().get("/admin/roles")).data,getUsers:async e=>{let s=e?`?teamId=${e}`:"";return(await r().get(`/admin/users${s}`)).data},setUserRole:async(e,s,t)=>(await r().put("/admin/users/role",{email:e,role:s,teamId:t})).data,getIntegrationStatus:async e=>(await r().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await r().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await r().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,s)=>{let t=new URLSearchParams(s).toString();return(await r().get(`/projects/${e}/kubernetes?${t}`)).data},getSecretHistory:async(e,s,t)=>(await r().get(`/projects/${e}/envs/${s}/secrets/${t}/history`)).data,rollbackSecret:async(e,s,t,n)=>(await r().post(`/projects/${e}/envs/${s}/secrets/${t}/history`,{version:n})).data,cloneEnvironment:async(e,s,t,n,o)=>(await r().post(`/projects/${e}/envs/clone`,{fromEnv:s,toEnv:t,overwrite:n,branch:o})).data,generateJitLink:async e=>(await r().post("/jit/generate",e)).data,claimJitLink:async e=>(await r().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await r().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await r().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,s)=>(await r().post(`/projects/${e}/service-accounts`,s)).data,deleteServiceAccount:async(e,s)=>(await r().delete(`/projects/${e}/service-accounts/${s}`)).data,getServiceAccountKeys:async(e,s)=>(await r().get(`/projects/${e}/service-accounts/${s}/keys`)).data,createServiceAccountKey:async(e,s,t,n)=>(await r().post(`/projects/${e}/service-accounts/${s}/keys`,{label:t,expiresAt:n})).data,deleteServiceAccountKey:async(e,s,t)=>(await r().delete(`/projects/${e}/service-accounts/${s}/keys/${t}`)).data,post:async(e,s)=>(await r().post(e,s)).data};var J=require("child_process"),a=c(require("chalk")),q=c(require("ora"));var F=new U.Command("jit-run").description("Claim a JIT link and run a command once approved").requiredOption("-t, --token <token>","JIT Access Token").option("-e, --env <environment>","Environment (development, staging, production)","development").argument("<command>","Command to run").argument("[args...]","Command arguments").action(async(e,s,t)=>{let{token:n,env:o}=t,p=A(),g=(0,q.default)("Claiming JIT link...").start();try{let d=await $.claimJitLink(n),j=d.requestId;g.text=`Access request submitted (ID: ${j}). Waiting for admin approval...`;let u=d.status||"pending",l="";for(;u==="pending";){await new Promise(P=>setTimeout(P,5e3));let y=await $.getAccessRequestStatus(j);u=y.status,l=y.projectId,u==="rejected"&&(g.fail(a.default.red("Access request rejected by admin.")),process.exit(1)),(u==="revoked"||u==="expired")&&(g.fail(a.default.red(`Access request ${u}.`)),process.exit(1))}g.succeed(a.default.green("Access approved! Fetching secrets...")),l||(l=p.project),l||(g.fail("Error: Could not determine project ID for JIT session."),process.exit(1));let m=await $.getSecrets(l,o);!m||Object.keys(m).length===0?console.warn(a.default.yellow(`
-Warning: No secrets returned. Ensure JIT link allowed specific secrets.`)):console.log(a.default.cyan(`
-\u221A Loaded ${Object.keys(m).length} JIT-authorized secrets.`));let L={...process.env,...m};console.log(a.default.gray(`> ${e} ${s.join(" ")}`)),(0,J.spawn)(e,s,{env:L,stdio:"inherit",shell:process.platform==="win32"}).on("exit",y=>{process.exit(y??0)})}catch(d){g.fail("JIT Run failed."),d.response?console.error(a.default.red(`
-Error: ${d.response.data.error||d?.response?.data?.error||"An unexpected error occurred"}`)):console.error(a.default.red(`
-Error: ${d?.response?.data?.error||"An unexpected error occurred"}`)),process.exit(1)}});0&&(module.exports={jitRunCommand});
+var oe=Object.create;var P=Object.defineProperty;var ie=Object.getOwnPropertyDescriptor;var ae=Object.getOwnPropertyNames;var ce=Object.getPrototypeOf,pe=Object.prototype.hasOwnProperty;var q=(e,t)=>()=>(e&&(t=e(e=0)),t);var V=(e,t)=>{for(var r in t)P(e,r,{get:t[r],enumerable:!0})},N=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of ae(t))!pe.call(e,n)&&n!==r&&P(e,n,{get:()=>t[n],enumerable:!(s=ie(t,n))||s.enumerable});return e};var y=(e,t,r)=>(r=e!=null?oe(ce(e)):{},N(t||!e||!e.__esModule?P(r,"default",{value:e,enumerable:!0}):r,e)),R=e=>N(P({},"__esModule",{value:!0}),e);var U={};V(U,{createWorkloadKeyEnvelope:()=>ye,decrypt:()=>F,decryptSecretValue:()=>le,decryptWorkloadKeyEnvelope:()=>me,deriveProjectKey:()=>ue,encrypt:()=>G,encryptSecretValue:()=>de,hash:()=>ge,resolveVaultPassphrase:()=>M,saveVaultPassphrase:()=>fe,secureRead:()=>A,secureSave:()=>j});function D(){if(K)return K;let e=_.get("masterKey");e||(e=a.default.randomBytes(32).toString("hex"),_.set("masterKey",e));let t="";try{t=(0,H.machineIdSync)()||""}catch{t=a.default.createHash("sha256").update(m.default.hostname()+(m.default.userInfo?.()?.username||"root")).digest("hex")}let r=m.default.platform(),s=m.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return K=a.default.createHash("sha256").update(n).digest(),K}function ue(e,t){t||(t=M(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=a.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function de(e,t){let r=a.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=a.default.createCipheriv("aes-256-gcm",s,r),i=n.update(e,"utf8","hex");i+=n.final("hex");let d=n.getAuthTag().toString("hex");return{ciphertext:i,iv:r.toString("hex"),authTag:d}}function le(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),i=a.default.createDecipheriv("aes-256-gcm",r,s);i.setAuthTag(n);let d=i.update(e.ciphertext,"hex","utf8");return d+=i.final("utf8"),d}function M(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=A(`vault_${t}`);if(s)return s}let r=A("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(C(),R(z)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function fe(e,t){t&&j(`vault_${t}`,e),j("vault_passphrase",e)}function ye(e,t){let{publicKey:r,privateKey:s}=a.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),i=a.default.createPublicKey(t),d=a.default.diffieHellman({privateKey:s,publicKey:i}),p=Buffer.from(a.default.hkdfSync("sha256",d,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),c=a.default.randomBytes(12),l=a.default.createCipheriv("aes-256-gcm",p,c),u=l.update(e,"utf8","hex");u+=l.final("hex");let h=l.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:u,iv:c.toString("hex"),authTag:h}}function me(e,t){let r=a.default.createPrivateKey(t),s=a.default.createPublicKey(e.ephemeralPublicKey),n=a.default.diffieHellman({privateKey:r,publicKey:s}),i=Buffer.from(a.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),d=Buffer.from(e.iv,"hex"),p=Buffer.from(e.authTag,"hex"),c=a.default.createDecipheriv("aes-256-gcm",i,d);c.setAuthTag(p);let l=c.update(e.encryptedProjectKey,"hex","utf8");return l+=c.final("utf8"),l}var a,m,X,H,$,W,_,K,G,F,ge,j,A,I=q(()=>{a=y(require("crypto")),m=y(require("os")),X=y(require("conf")),H=require("node-machine-id"),$=require("child_process"),W="aes-256-gcm",_=new X.default({projectName:"xtra-cli-crypto"}),K=null;G=e=>{let t=a.default.randomBytes(12),r=D(),s=a.default.createCipheriv(W,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let i=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:i.toString("hex")}},F=e=>{let t=D(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=a.default.createDecipheriv(W,t,r);n.setAuthTag(s);let i=n.update(e.content,"hex","utf8");return i+=n.final("utf8"),i},ge=e=>a.default.createHash("sha256").update(e).digest("hex"),j=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(m.default.platform()==="darwin"){(0,$.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(m.default.platform()!=="win32"){if(m.default.platform()==="linux")try{(0,$.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=G(t);_.set(`secure_${e}`,JSON.stringify(r))},A=e=>{try{let t="XtraSecurityCLI",r=e;if(m.default.platform()==="darwin")return(0,$.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(m.default.platform()!=="win32"){if(m.default.platform()==="linux")try{return(0,$.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=_.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return F(r)}catch{return null}}});var z={};V(z,{clearConfig:()=>xe,deleteConfig:()=>Se,getAuthToken:()=>T,getBreakGlassSession:()=>we,getConfig:()=>b,getConfigValue:()=>he,getProjectConfig:()=>$e,getRcConfig:()=>J,setBreakGlassSession:()=>ke,setConfig:()=>ve});var Z,w,L,O,g,Y,b,he,ve,xe,Se,T,we,ke,$e,J,C=q(()=>{Z=y(require("conf")),w=y(require("fs")),L=y(require("path"));I();O="https://www.xtrasecurity.in/api",g=new Z.default({projectName:"xtra-cli",defaults:{apiUrl:O}}),Y=g.get("apiUrl");Y&&!process.env.XTRA_API_URL&&Y.includes("xtra-security.vercel.app")&&g.set("apiUrl",O);b=()=>({...g.store,token:T(),apiUrl:process.env.XTRA_API_URL||g.get("apiUrl")||O}),he=e=>e==="token"?T():g.get(e),ve=(e,t)=>{if(e==="token"&&t&&j("token",t),g.set(e,t),e==="token"&&process.platform!=="win32"&&w.default.existsSync(g.path))try{w.default.chmodSync(g.path,384)}catch{}},xe=()=>g.clear(),Se=e=>g.delete(e),T=()=>A("token")||g.get("token"),we=()=>g.get("breakGlassSessionId"),ke=e=>{e?g.set("breakGlassSessionId",e):g.delete("breakGlassSessionId")},$e=async()=>{try{let e=L.default.join(process.cwd(),"xtra.json");if(w.default.existsSync(e)){let t=w.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},J=()=>{let e={};try{let t=L.default.join(process.cwd(),".xtrarc");w.default.existsSync(t)&&(e=JSON.parse(w.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||g.get("project")||"",env:e.env||g.get("env")||"development",branch:e.branch||g.get("branch")||"main"}}});var be={};V(be,{jitRunCommand:()=>Ae});module.exports=R(be);var re=require("commander");var Q=y(require("axios"));C();var ee=y(require("fs")),te=y(require("path")),je=JSON.parse(ee.readFileSync(te.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=b(),r=e||T();return Q.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":je.version,...r?{Authorization:`Bearer ${r}`}:{}}})},E={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,i)=>{let p=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(p&&typeof p=="object"){let c=null,{deriveProjectKey:l,decryptSecretValue:u,resolveVaultPassphrase:h,decryptWorkloadKeyEnvelope:v}=(I(),R(U));for(let[x,k]of Object.entries(p))if(typeof k=="string"&&k.startsWith("{"))try{let f=JSON.parse(k);if(f.ciphertext&&f.iv){if(!c)if(i&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)c=v(i,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let B=h(s,e);c=l(e,B)}p[x]=u(f,c)}}catch(f){if(f.message&&f.message.includes("Zero-Knowledge"))throw f}}return p},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:i,encryptSecretValue:d,resolveVaultPassphrase:p}=(I(),R(U)),c=p(void 0,e),l=i(e,c),u={};for(let[v,x]of Object.entries(r))if(typeof x=="string"&&x.startsWith("{")&&x.includes("ciphertext"))u[v]=x;else{let k=d(x,l);u[v]=JSON.stringify(k)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:u,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:i})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=b(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=b(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data};var se=require("child_process"),S=y(require("chalk")),ne=y(require("ora"));C();var Ae=new re.Command("jit-run").description("Claim a JIT link and run a command once approved").requiredOption("-t, --token <token>","JIT Access Token").option("-e, --env <environment>","Environment (development, staging, production)","development").option("--shell","Enable shell mode (needed for npm run, shell built-ins)",!1).argument("<command>","Command to run").argument("[args...]","Command arguments").action(async(e,t,r)=>{let{token:s,env:n,shell:i}=r,d=J(),p=(0,ne.default)("Claiming JIT link...").start();try{let c=await E.claimJitLink(s),l=c.requestId;p.text=`Access request submitted (ID: ${l}). Waiting for admin approval...`;let u=c.status||"pending",h="";for(;u==="pending";){await new Promise(B=>setTimeout(B,5e3));let f=await E.getAccessRequestStatus(l);u=f.status,h=f.projectId,u==="rejected"&&(p.fail(S.default.red("Access request rejected by admin.")),process.exit(1)),(u==="revoked"||u==="expired")&&(p.fail(S.default.red(`Access request ${u}.`)),process.exit(1))}p.succeed(S.default.green("Access approved! Fetching secrets...")),h||(h=d.project),h||(p.fail("Error: Could not determine project ID for JIT session."),process.exit(1));let v=await E.getSecrets(h,n);!v||Object.keys(v).length===0?console.warn(S.default.yellow(`
+Warning: No secrets returned. Ensure JIT link allowed specific secrets.`)):console.log(S.default.cyan(`
+\u221A Loaded ${Object.keys(v).length} JIT-authorized secrets.`));let x={...process.env,...v};console.log(S.default.gray(`> ${e} ${t.join(" ")}`)),(0,se.spawn)(e,t,{env:x,stdio:"inherit",shell:!!i}).on("exit",f=>{process.exit(f??0)})}catch(c){p.fail("JIT Run failed."),c.response?console.error(S.default.red(`
+Error: ${c.response.data.error||c?.response?.data?.error||"An unexpected error occurred"}`)):console.error(S.default.red(`
+Error: ${c?.response?.data?.error||"An unexpected error occurred"}`)),process.exit(1)}});0&&(module.exports={jitRunCommand});

package/dist/commands/local.js

@@ -1,4 +1,4 @@
-var G=Object.create;var f=Object.defineProperty;var J=Object.getOwnPropertyDescriptor;var V=Object.getOwnPropertyNames;var X=Object.getPrototypeOf,H=Object.prototype.hasOwnProperty;var K=(e,t)=>{for(var s in t)f(e,s,{get:t[s],enumerable:!0})},A=(e,t,s,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of V(t))!H.call(e,o)&&o!==s&&f(e,o,{get:()=>t[o],enumerable:!(r=J(t,o))||r.enumerable});return e};var i=(e,t,s)=>(s=e!=null?G(X(e)):{},A(t||!e||!e.__esModule?f(s,"default",{value:e,enumerable:!0}):s,e)),z=e=>A(f({},"__esModule",{value:!0}),e);var W={};K(W,{localCommand:()=>y});module.exports=z(W);var E=require("commander");var U=i(require("axios"));var L=i(require("conf")),u=i(require("fs")),P=i(require("path")),$="https://www.xtrasecurity.in/api",c=new L.default({projectName:"xtra-cli",defaults:{apiUrl:$}}),I=c.get("apiUrl");I&&!process.env.XTRA_API_URL&&I.includes("xtra-security.vercel.app")&&c.set("apiUrl",$);var m=()=>({...c.store,apiUrl:process.env.XTRA_API_URL||c.get("apiUrl")||$}),j=e=>c.get(e),S=(e,t)=>{if(c.set(e,t),e==="token"&&process.platform!=="win32"&&u.default.existsSync(c.path))try{u.default.chmodSync(c.path,384)}catch{}};var R=()=>c.get("token");var O=()=>{let e={};try{let t=P.default.join(process.cwd(),".xtrarc");u.default.existsSync(t)&&(e=JSON.parse(u.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||c.get("project")||"",env:e.env||c.get("env")||"development",branch:e.branch||c.get("branch")||"main"}};var T=i(require("fs")),_=i(require("path")),Y=JSON.parse(T.readFileSync(_.join(__dirname,"../../package.json"),"utf-8")),n=()=>{let{apiUrl:e}=m(),t=R();return U.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":Y.version,...t?{Authorization:`Bearer ${t}`}:{}}})},D={login:async(e,t,s)=>(await n().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await n().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await n().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,r,o="main")=>(await n().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:r,branch:o})).data,getSecretDetails:async(e,t,s,r="main")=>(await n().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${r}`)).data,syncLogs:async e=>(await n().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,r,o,p)=>(await n().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:r,sourceEnv:o,sourceKey:p})).data,rotateSecret:async(e,t,s,r,o)=>(await n().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:r,parsedNewValue:o})).data,promoteSecret:async(e,t,s)=>(await n().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await n().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,r)=>{let o={format:e};return t&&(o.startDate=t),s&&(o.endDate=s),r&&(o.projectId=r),(await n().post("/audit/export",o,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,r)=>(await n().post("/access/request",{projectId:e,secretId:r,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await n().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=m(),s=t?`&workspaceId=${t}`:"";return(await n().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await n().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=m(),t=e?`/project?workspaceId=${e}`:"/project";return(await n().get(t)).data},getBranches:async e=>(await n().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await n().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await n().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await n().put("/branch",{id:e,...t})).data,getRoles:async()=>(await n().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await n().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await n().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await n().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await n().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await n().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await n().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await n().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,r)=>(await n().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:r})).data,cloneEnvironment:async(e,t,s,r,o)=>(await n().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:r,branch:o})).data,generateJitLink:async e=>(await n().post("/jit/generate",e)).data,claimJitLink:async e=>(await n().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await n().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await n().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await n().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await n().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await n().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,s,r)=>(await n().post(`/projects/${e}/service-accounts/${t}/keys`,{label:s,expiresAt:r})).data,deleteServiceAccountKey:async(e,t,s)=>(await n().delete(`/projects/${e}/service-accounts/${t}/keys/${s}`)).data,post:async(e,t)=>(await n().post(e,t)).data};var a=i(require("chalk")),N=i(require("ora")),g=i(require("fs")),d=i(require("path")),M=i(require("readline")),x=".env.local";function Q(){return j("localMode")===!0||process.env.XTRA_LOCAL_MODE==="true"}var y=new E.Command("local").description("Toggle cloud/local mode for offline development").addHelpText("after",`
+var le=Object.create;var K=Object.defineProperty;var ue=Object.getOwnPropertyDescriptor;var de=Object.getOwnPropertyNames;var fe=Object.getPrototypeOf,ye=Object.prototype.hasOwnProperty;var F=(e,t)=>()=>(e&&(t=e(e=0)),t);var U=(e,t)=>{for(var r in t)K(e,r,{get:t[r],enumerable:!0})},q=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of de(t))!ye.call(e,n)&&n!==r&&K(e,n,{get:()=>t[n],enumerable:!(s=ue(t,n))||s.enumerable});return e};var u=(e,t,r)=>(r=e!=null?le(fe(e)):{},q(t||!e||!e.__esModule?K(r,"default",{value:e,enumerable:!0}):r,e)),C=e=>q(K({},"__esModule",{value:!0}),e);var D={};U(D,{createWorkloadKeyEnvelope:()=>Se,decrypt:()=>z,decryptSecretValue:()=>we,decryptWorkloadKeyEnvelope:()=>$e,deriveProjectKey:()=>he,encrypt:()=>Z,encryptSecretValue:()=>ve,hash:()=>me,resolveVaultPassphrase:()=>Q,saveVaultPassphrase:()=>xe,secureRead:()=>P,secureSave:()=>A});function Y(){if(E)return E;let e=I.get("masterKey");e||(e=i.default.randomBytes(32).toString("hex"),I.set("masterKey",e));let t="";try{t=(0,W.machineIdSync)()||""}catch{t=i.default.createHash("sha256").update(m.default.hostname()+(m.default.userInfo?.()?.username||"root")).digest("hex")}let r=m.default.platform(),s=m.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return E=i.default.createHash("sha256").update(n).digest(),E}function he(e,t){t||(t=Q(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=i.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function ve(e,t){let r=i.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=i.default.createCipheriv("aes-256-gcm",s,r),a=n.update(e,"utf8","hex");a+=n.final("hex");let d=n.getAuthTag().toString("hex");return{ciphertext:a,iv:r.toString("hex"),authTag:d}}function we(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),a=i.default.createDecipheriv("aes-256-gcm",r,s);a.setAuthTag(n);let d=a.update(e.ciphertext,"hex","utf8");return d+=a.final("utf8"),d}function Q(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=P(`vault_${t}`);if(s)return s}let r=P("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(L(),C(ee)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function xe(e,t){t&&A(`vault_${t}`,e),A("vault_passphrase",e)}function Se(e,t){let{publicKey:r,privateKey:s}=i.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),a=i.default.createPublicKey(t),d=i.default.diffieHellman({privateKey:s,publicKey:a}),f=Buffer.from(i.default.hkdfSync("sha256",d,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),l=i.default.randomBytes(12),p=i.default.createCipheriv("aes-256-gcm",f,l),y=p.update(e,"utf8","hex");y+=p.final("hex");let w=p.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:y,iv:l.toString("hex"),authTag:w}}function $e(e,t){let r=i.default.createPrivateKey(t),s=i.default.createPublicKey(e.ephemeralPublicKey),n=i.default.diffieHellman({privateKey:r,publicKey:s}),a=Buffer.from(i.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),d=Buffer.from(e.iv,"hex"),f=Buffer.from(e.authTag,"hex"),l=i.default.createDecipheriv("aes-256-gcm",a,d);l.setAuthTag(f);let p=l.update(e.encryptedProjectKey,"hex","utf8");return p+=l.final("utf8"),p}var i,m,J,W,k,G,I,E,Z,z,me,A,P,B=F(()=>{i=u(require("crypto")),m=u(require("os")),J=u(require("conf")),W=require("node-machine-id"),k=require("child_process"),G="aes-256-gcm",I=new J.default({projectName:"xtra-cli-crypto"}),E=null;Z=e=>{let t=i.default.randomBytes(12),r=Y(),s=i.default.createCipheriv(G,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let a=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:a.toString("hex")}},z=e=>{let t=Y(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=i.default.createDecipheriv(G,t,r);n.setAuthTag(s);let a=n.update(e.content,"hex","utf8");return a+=n.final("utf8"),a},me=e=>i.default.createHash("sha256").update(e).digest("hex"),A=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(m.default.platform()==="darwin"){(0,k.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(m.default.platform()!=="win32"){if(m.default.platform()==="linux")try{(0,k.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=Z(t);I.set(`secure_${e}`,JSON.stringify(r))},P=e=>{try{let t="XtraSecurityCLI",r=e;if(m.default.platform()==="darwin")return(0,k.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(m.default.platform()!=="win32"){if(m.default.platform()==="linux")try{return(0,k.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=I.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return z(r)}catch{return null}}});var ee={};U(ee,{clearConfig:()=>be,deleteConfig:()=>je,getAuthToken:()=>R,getBreakGlassSession:()=>ke,getConfig:()=>T,getConfigValue:()=>O,getProjectConfig:()=>Pe,getRcConfig:()=>X,setBreakGlassSession:()=>Ae,setConfig:()=>V});var re,$,N,M,g,te,T,O,V,be,je,R,ke,Ae,Pe,X,L=F(()=>{re=u(require("conf")),$=u(require("fs")),N=u(require("path"));B();M="https://www.xtrasecurity.in/api",g=new re.default({projectName:"xtra-cli",defaults:{apiUrl:M}}),te=g.get("apiUrl");te&&!process.env.XTRA_API_URL&&te.includes("xtra-security.vercel.app")&&g.set("apiUrl",M);T=()=>({...g.store,token:R(),apiUrl:process.env.XTRA_API_URL||g.get("apiUrl")||M}),O=e=>e==="token"?R():g.get(e),V=(e,t)=>{if(e==="token"&&t&&A("token",t),g.set(e,t),e==="token"&&process.platform!=="win32"&&$.default.existsSync(g.path))try{$.default.chmodSync(g.path,384)}catch{}},be=()=>g.clear(),je=e=>g.delete(e),R=()=>P("token")||g.get("token"),ke=()=>g.get("breakGlassSessionId"),Ae=e=>{e?g.set("breakGlassSessionId",e):g.delete("breakGlassSessionId")},Pe=async()=>{try{let e=N.default.join(process.cwd(),"xtra.json");if($.default.existsSync(e)){let t=$.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},X=()=>{let e={};try{let t=N.default.join(process.cwd(),".xtrarc");$.default.existsSync(t)&&(e=JSON.parse($.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||g.get("project")||"",env:e.env||g.get("env")||"development",branch:e.branch||g.get("branch")||"main"}}});var _e={};U(_e,{localCommand:()=>_});module.exports=C(_e);var ce=require("commander");var se=u(require("axios"));L();var ne=u(require("fs")),oe=u(require("path")),Te=JSON.parse(ne.readFileSync(oe.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=T(),r=e||R();return se.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":Te.version,...r?{Authorization:`Bearer ${r}`}:{}}})},ae={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,a)=>{let f=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(f&&typeof f=="object"){let l=null,{deriveProjectKey:p,decryptSecretValue:y,resolveVaultPassphrase:w,decryptWorkloadKeyEnvelope:x}=(B(),C(D));for(let[h,S]of Object.entries(f))if(typeof S=="string"&&S.startsWith("{"))try{let v=JSON.parse(S);if(v.ciphertext&&v.iv){if(!l)if(a&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)l=x(a,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let ge=w(s,e);l=p(e,ge)}f[h]=y(v,l)}}catch(v){if(v.message&&v.message.includes("Zero-Knowledge"))throw v}}return f},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:a,encryptSecretValue:d,resolveVaultPassphrase:f}=(B(),C(D)),l=f(void 0,e),p=a(e,l),y={};for(let[x,h]of Object.entries(r))if(typeof h=="string"&&h.startsWith("{")&&h.includes("ciphertext"))y[x]=h;else{let S=d(h,p);y[x]=JSON.stringify(S)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:y,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,a)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:a})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=T(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=T(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data};L();var c=u(require("chalk")),ie=u(require("ora")),b=u(require("fs")),j=u(require("path")),pe=u(require("readline")),H=".env.local";function Re(){return O("localMode")===!0||process.env.XTRA_LOCAL_MODE==="true"}var _=new ce.Command("local").description("Toggle cloud/local mode for offline development").addHelpText("after",`
 In local mode, 'xtra run' reads secrets from .env.local instead of the cloud API.
 This allows fully offline development without any API calls.
 
@@ -8,9 +8,9 @@ Examples:
   $ xtra local off              # Disable \xE2\u20AC\u201D back to cloud mode
   $ xtra local sync             # Pull cloud secrets \xE2\u2020\u2019 .env.local
   $ xtra local sync -p proj -e production  # Pull production to .env.local
-`);y.command("status").description("Show current cloud/local mode").action(()=>{let e=Q(),t=d.join(process.cwd(),x),s=g.existsSync(t);console.log(a.default.bold(`
+`);_.command("status").description("Show current cloud/local mode").action(()=>{let e=Re(),t=j.join(process.cwd(),H),r=b.existsSync(t);console.log(c.default.bold(`
 Mode Status:
-`)),console.log(`  Mode        : ${e?a.default.yellow("\u{1F50C} LOCAL (offline)"):a.default.green("\u2601  CLOUD")}`),console.log(`  .env.local  : ${s?a.default.green("Found"):a.default.gray("Not found")}`),console.log(`  Config flag : ${a.default.gray(j("localMode")?"true":"false")}`),console.log(`  Env var     : ${a.default.gray(process.env.XTRA_LOCAL_MODE||"(not set)")}`),console.log(),e?(console.log(a.default.gray("  Run 'xtra local off' to switch back to cloud mode.")),s||console.log(a.default.yellow("  \u26A0 No .env.local file found. Run 'xtra local sync' to pull secrets."))):console.log(a.default.gray("  Run 'xtra local on' to switch to offline mode.")),console.log()});y.command("on").description("Enable local mode \xE2\u20AC\u201D secrets read from .env.local").action(()=>{S("localMode",!0),console.log(a.default.yellow("\u{1F50C} Local mode ENABLED.")),console.log(a.default.gray("   'xtra run' will now read from .env.local instead of the cloud."));let e=d.join(process.cwd(),x);g.existsSync(e)||console.log(a.default.yellow("   \u26A0 No .env.local file found. Run 'xtra local sync' to populate it."))});y.command("off").description("Disable local mode \xE2\u20AC\u201D secrets fetched from cloud again").action(()=>{S("localMode",!1),console.log(a.default.green("\xE2\u02DC\x81  Cloud mode ENABLED.")),console.log(a.default.gray("   'xtra run' will now fetch secrets from XtraSecurity Cloud."))});y.command("sync").description("Pull cloud secrets to .env.local for offline use").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment","development").option("-b, --branch <branch>","Branch","main").option("-o, --output <file>","Output file",x).option("--overwrite","Overwrite existing file without prompt",!1).action(async e=>{let{project:t,env:s,branch:r,output:o,overwrite:p}=e;s={dev:"development",stg:"staging",prod:"production"}[s]||s,t||(t=O().project),t||(console.error(a.default.red("Error: Project ID required. Use -p <id>.")),process.exit(1));let B=d.resolve(process.cwd(),o);if(s==="production"&&!p){console.log(a.default.red(`\u26A0  You are syncing PRODUCTION secrets to ${o}.`));let l=M.createInterface({input:process.stdin,output:process.stdout});if(!await new Promise(h=>{l.question(a.default.yellow("Type 'yes' to confirm: "),v=>{l.close(),h(v.trim().toLowerCase()==="yes")})})){console.log(a.default.gray("Sync cancelled."));return}}let b=(0,N.default)(`Fetching ${s} secrets from cloud...`).start();try{let l=await D.getSecrets(t,s,r);b.stop();let w=Object.keys(l).length;if(w===0){console.log(a.default.yellow("No secrets found."));return}let h=[`# xtra local sync \xE2\u20AC\u201D ${s}/${r}`,`# Generated: ${new Date().toISOString()}`,"# DO NOT COMMIT THIS FILE","",...Object.entries(l).map(([C,q])=>`${C}=${q}`)];g.writeFileSync(B,h.join(`
+`)),console.log(`  Mode        : ${e?c.default.yellow("\u{1F50C} LOCAL (offline)"):c.default.green("\u2601  CLOUD")}`),console.log(`  .env.local  : ${r?c.default.green("Found"):c.default.gray("Not found")}`),console.log(`  Config flag : ${c.default.gray(O("localMode")?"true":"false")}`),console.log(`  Env var     : ${c.default.gray(process.env.XTRA_LOCAL_MODE||"(not set)")}`),console.log(),e?(console.log(c.default.gray("  Run 'xtra local off' to switch back to cloud mode.")),r||console.log(c.default.yellow("  \u26A0 No .env.local file found. Run 'xtra local sync' to pull secrets."))):console.log(c.default.gray("  Run 'xtra local on' to switch to offline mode.")),console.log()});_.command("on").description("Enable local mode \xE2\u20AC\u201D secrets read from .env.local").action(()=>{V("localMode",!0),console.log(c.default.yellow("\u{1F50C} Local mode ENABLED.")),console.log(c.default.gray("   'xtra run' will now read from .env.local instead of the cloud."));let e=j.join(process.cwd(),H);b.existsSync(e)||console.log(c.default.yellow("   \u26A0 No .env.local file found. Run 'xtra local sync' to populate it."))});_.command("off").description("Disable local mode \xE2\u20AC\u201D secrets fetched from cloud again").action(()=>{V("localMode",!1),console.log(c.default.green("\xE2\u02DC\x81  Cloud mode ENABLED.")),console.log(c.default.gray("   'xtra run' will now fetch secrets from XtraSecurity Cloud."))});_.command("sync").description("Pull cloud secrets to .env.local for offline use").option("-p, --project <id>","Project ID").option("-e, --env <environment>","Environment","development").option("-b, --branch <branch>","Branch","main").option("-o, --output <file>","Output file",H).option("--overwrite","Overwrite existing file without prompt",!1).action(async e=>{let{project:t,env:r,branch:s,output:n,overwrite:a}=e;r={dev:"development",stg:"staging",prod:"production"}[r]||r,t||(t=X().project),t||(console.error(c.default.red("Error: Project ID required. Use -p <id>.")),process.exit(1));let f=j.resolve(process.cwd(),n);if(r==="production"&&!a){console.log(c.default.red(`\u26A0  You are syncing PRODUCTION secrets to ${n}.`));let p=pe.createInterface({input:process.stdin,output:process.stdout});if(!await new Promise(w=>{p.question(c.default.yellow("Type 'yes' to confirm: "),x=>{p.close(),w(x.trim().toLowerCase()==="yes")})})){console.log(c.default.gray("Sync cancelled."));return}}let l=(0,ie.default)(`Fetching ${r} secrets from cloud...`).start();try{let p=await ae.getSecrets(t,r,s);l.stop();let y=Object.keys(p).length;if(y===0){console.log(c.default.yellow("No secrets found."));return}let w=[`# xtra local sync \xE2\u20AC\u201D ${r}/${s}`,`# Generated: ${new Date().toISOString()}`,"# DO NOT COMMIT THIS FILE","",...Object.entries(p).map(([S,v])=>`${S}=${v}`)];b.writeFileSync(f,w.join(`
 `)+`
-`,"utf8"),console.log(a.default.green(`\u2705 Synced ${w} secrets to ${o}`)),console.log(a.default.gray("   Run 'xtra local on' to switch to local mode."));let v=d.join(process.cwd(),".gitignore"),k="";try{k=g.readFileSync(v,"utf8")}catch{}k.includes(o)||console.log(a.default.yellow(`
-  \u26A0 Remember to add '${o}' to your .gitignore!`))}catch(l){b.fail("Sync failed."),console.error(a.default.red(l?.response?.data?.error||l?.response?.data?.error||"An unexpected error occurred")),process.exit(1)}});0&&(module.exports={localCommand});
+`,"utf8"),console.log(c.default.green(`\u2705 Synced ${y} secrets to ${n}`)),console.log(c.default.gray("   Run 'xtra local on' to switch to local mode."));let x=j.join(process.cwd(),".gitignore"),h="";try{h=b.readFileSync(x,"utf8")}catch{}h.includes(n)||console.log(c.default.yellow(`
+  \u26A0 Remember to add '${n}' to your .gitignore!`))}catch(p){l.fail("Sync failed."),console.error(c.default.red(p?.response?.data?.error||p?.response?.data?.error||"An unexpected error occurred")),process.exit(1)}});0&&(module.exports={localCommand});

package/dist/commands/login.js

@@ -1,7 +1,7 @@
-var ae=Object.create;var $=Object.defineProperty;var ie=Object.getOwnPropertyDescriptor;var ce=Object.getOwnPropertyNames;var pe=Object.getPrototypeOf,ge=Object.prototype.hasOwnProperty;var x=(e,t)=>()=>(e&&(t=e(e=0)),t);var L=(e,t)=>{for(var s in t)$(e,s,{get:t[s],enumerable:!0})},K=(e,t,s,n)=>{if(t&&typeof t=="object"||typeof t=="function")for(let r of ce(t))!ge.call(e,r)&&r!==s&&$(e,r,{get:()=>t[r],enumerable:!(n=ie(t,r))||n.enumerable});return e};var c=(e,t,s)=>(s=e!=null?ae(pe(e)):{},K(t||!e||!e.__esModule?$(s,"default",{value:e,enumerable:!0}):s,e)),D=e=>K($({},"__esModule",{value:!0}),e);var q={};L(q,{clearConfig:()=>de,deleteConfig:()=>le,getAuthToken:()=>U,getBreakGlassSession:()=>ye,getConfig:()=>y,getConfigValue:()=>ue,getProjectConfig:()=>fe,getRcConfig:()=>he,setBreakGlassSession:()=>me,setConfig:()=>f});var J,l,R,C,i,G,y,ue,f,de,le,U,ye,me,fe,he,S=x(()=>{J=c(require("conf")),l=c(require("fs")),R=c(require("path")),C="https://www.xtrasecurity.in/api",i=new J.default({projectName:"xtra-cli",defaults:{apiUrl:C}}),G=i.get("apiUrl");G&&!process.env.XTRA_API_URL&&G.includes("xtra-security.vercel.app")&&i.set("apiUrl",C);y=()=>({...i.store,apiUrl:process.env.XTRA_API_URL||i.get("apiUrl")||C}),ue=e=>i.get(e),f=(e,t)=>{if(i.set(e,t),e==="token"&&process.platform!=="win32"&&l.default.existsSync(i.path))try{l.default.chmodSync(i.path,384)}catch{}},de=()=>i.clear(),le=e=>i.delete(e),U=()=>i.get("token"),ye=()=>i.get("breakGlassSessionId"),me=e=>{e?i.set("breakGlassSessionId",e):i.delete("breakGlassSessionId")},fe=async()=>{try{let e=R.default.join(process.cwd(),"xtra.json");if(l.default.existsSync(e)){let t=l.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},he=()=>{let e={};try{let t=R.default.join(process.cwd(),".xtrarc");l.default.existsSync(t)&&(e=JSON.parse(l.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||i.get("project")||"",env:e.env||i.get("env")||"development",branch:e.branch||i.get("branch")||"main"}}});var F,H,V,we,o,k,O=x(()=>{F=c(require("axios"));S();H=c(require("fs")),V=c(require("path")),we=JSON.parse(H.readFileSync(V.join(__dirname,"../../package.json"),"utf-8")),o=()=>{let{apiUrl:e}=y(),t=U();return F.default.create({baseURL:e,headers:{"Content-Type":"application/json","X-CLI-Version":we.version,...t?{Authorization:`Bearer ${t}`}:{}}})},k={login:async(e,t,s)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:s})).data,getSecrets:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?branch=${s}`)).data,getSecretVersions:async(e,t,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${s}`)).data,setSecrets:async(e,t,s,n,r="main")=>(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:s,expectedVersions:n,branch:r})).data,getSecretDetails:async(e,t,s,n="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}?branch=${n}`)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,s,n,r,a)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:s,sourceProjectId:n,sourceEnv:r,sourceKey:a})).data,rotateSecret:async(e,t,s,n,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/rotate`,{strategy:n,parsedNewValue:r})).data,promoteSecret:async(e,t,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,s,n)=>{let r={format:e};return t&&(r.startDate=t),s&&(r.endDate=s),n&&(r.projectId=n),(await o().post("/audit/export",r,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,s,n)=>(await o().post("/access/request",{projectId:e,secretId:n,reason:t,duration:s})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=y(),s=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${s}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=y(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,s)=>(await o().post("/branch",{projectId:e,name:t,description:s})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,s)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:s})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let s=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${s}`)).data},getSecretHistory:async(e,t,s)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${s}/history`)).data,rollbackSecret:async(e,t,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${s}/history`,{version:n})).data,cloneEnvironment:async(e,t,s,n,r)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:s,overwrite:n,branch:r})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,s,n)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:s,expiresAt:n})).data,deleteServiceAccountKey:async(e,t,s)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${s}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});function Y(){let e=X.get("masterKey");e||(e=h.default.randomBytes(32).toString("hex"),X.set("masterKey",e));let t=(0,M.machineIdSync)();return h.default.createHash("sha256").update(e+t).digest()}var h,z,M,W,X,Q,Z,ee=x(()=>{h=c(require("crypto")),z=c(require("conf")),M=require("node-machine-id"),W="aes-256-gcm",X=new z.default({projectName:"xtra-cli-crypto"});Q=e=>{let t=h.default.randomBytes(16),s=Y(),n=h.default.createCipheriv(W,s,t),r=n.update(e,"utf8","hex");r+=n.final("hex");let a=n.getAuthTag();return{iv:t.toString("hex"),content:r,tag:a.toString("hex")}},Z=e=>{let t=Y(),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.tag,"hex"),r=h.default.createDecipheriv(W,t,s);r.setAuthTag(n);let a=r.update(e.content,"hex","utf8");return a+=r.final("utf8"),a}});var A={};L(A,{loadAuditLogs:()=>j,logAudit:()=>ke,saveAuditLogs:()=>b,syncAuditLogs:()=>ve});function Se(e){if(!e||typeof e!="object")return e;let t={...e},s=["password","token","secret","value","apiKey","secretValue"];for(let n of Object.keys(t))s.some(r=>n.toLowerCase().includes(r))&&(t[n]="[REDACTED]");return t}async function se(e){try{if(!y().token)return!1;let s={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:Se(e.details),timestamp:e.timestamp,projectId:e.projectId};return await k.post("/audit/cli-logs",{logs:[s]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function ke(e,t,s,n){let r={id:(0,te.v4)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:s,details:n,synced:!1},a=j();a.push(r),b(a),se(r).then(p=>{if(p){r.synced=!0;let g=j(),u=g.findIndex(d=>d.id===r.id);u!==-1&&(g[u].synced=!0,b(g))}}).catch(()=>{})}function j(){if(!w.default.existsSync(P))return[];try{let e=w.default.readFileSync(P,"utf-8"),t=JSON.parse(e),s=Z(t);return JSON.parse(s)}catch{return[]}}function b(e){w.default.existsSync(E)||w.default.mkdirSync(E,{recursive:!0});let t=JSON.stringify(e),s=Q(t);w.default.writeFileSync(P,JSON.stringify(s),"utf-8")}async function ve(){let e=j(),t=e.filter(n=>!n.synced);if(t.length===0)return 0;let s=0;for(let n of t)await se(n)&&(n.synced=!0,s++);return s>0&&b(e),s}var w,N,te,E,P,I=x(()=>{w=c(require("fs")),N=c(require("path")),te=require("uuid");ee();S();O();E=N.default.join(process.cwd(),".xtra"),P=N.default.join(E,"audit.enc")});var xe={};L(xe,{loginCommand:()=>$e});module.exports=D(xe);var oe=require("commander"),v=c(require("inquirer"));O();S();var m=c(require("chalk")),T=c(require("ora")),$e=new oe.Command("login").description("Authenticate with XtraSecurity").option("-k, --key <key>","Login using an Access Key").option("-e, --email <email>","Login using Email").option("--sso","Login via Web (SSO)").action(async e=>{try{if(!e.key&&!e.email&&!e.sso){let{method:t}=await v.default.prompt([{type:"list",name:"method",message:"How would you like to login?",choices:[{name:"Browser Login (SSO)",value:"sso"},{name:"Access Key",value:"key"},{name:"Email & Password",value:"email"}]}]);if(t==="sso"){await re();return}else if(t==="key"){let{key:s}=await v.default.prompt([{type:"password",name:"key",message:"Enter Access Key:"}]);await ne(s);return}}if(e.sso)await re();else if(e.key)await ne(e.key);else{let{email:t}=e;t||(t=(await v.default.prompt([{type:"input",name:"email",message:"Email:"}])).email);let n=(await v.default.prompt([{type:"password",name:"password",message:"Password:"}])).password,r=(0,T.default)("Authenticating...").start(),a=await k.login(t,n);f("token",a.token),r.succeed("Logged in successfully!");try{let{logAudit:p}=await Promise.resolve().then(()=>(I(),A));p("USER_LOGIN",null,null,{method:"email",email:t})}catch{}}}catch(t){t.response?console.error(m.default.red(`
-Error: ${t.response.data.error||"Login failed"}`)):console.error(m.default.red(`
-Error: ${t?.response?.data?.error||"An unexpected error occurred"}`)),process.exit(1)}});async function ne(e){let t=(0,T.default)("Authenticating with Access Key...").start(),s=await k.login(void 0,void 0,e);f("token",s.token),s.user&&console.log(m.default.green(`
-Logged in as ${s.user.email}`)),t.succeed("Logged in successfully!");try{let{logAudit:n}=await Promise.resolve().then(()=>(I(),A));n("USER_LOGIN",null,null,{method:"api_key",email:s.user?.email})}catch{}}async function re(){let e=require("http"),{default:t}=await import("open");return new Promise(s=>{let n=e.createServer(async(r,a)=>{let p=new URL(r.url,`http://${r.headers.host}`),g=p.searchParams.get("token"),u=p.searchParams.get("email"),d=p.searchParams.get("workspaceId"),_=p.searchParams.get("workspaceName");if(g){f("token",g),d&&f("workspace",d),a.writeHead(200,{"Content-Type":"text/html"}),a.write(`
+var ve=Object.create;var C=Object.defineProperty;var we=Object.getOwnPropertyDescriptor;var Se=Object.getOwnPropertyNames;var xe=Object.getPrototypeOf,ke=Object.prototype.hasOwnProperty;var B=(e,t)=>()=>(e&&(t=e(e=0)),t);var U=(e,t)=>{for(var r in t)C(e,r,{get:t[r],enumerable:!0})},te=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of Se(t))!ke.call(e,n)&&n!==r&&C(e,n,{get:()=>t[n],enumerable:!(s=we(t,n))||s.enumerable});return e};var d=(e,t,r)=>(r=e!=null?ve(xe(e)):{},te(t||!e||!e.__esModule?C(r,"default",{value:e,enumerable:!0}):r,e)),j=e=>te(C({},"__esModule",{value:!0}),e);var q={};U(q,{createWorkloadKeyEnvelope:()=>Te,decrypt:()=>D,decryptSecretValue:()=>je,decryptWorkloadKeyEnvelope:()=>Ke,deriveProjectKey:()=>Ae,encrypt:()=>N,encryptSecretValue:()=>be,hash:()=>$e,resolveVaultPassphrase:()=>ie,saveVaultPassphrase:()=>Pe,secureRead:()=>K,secureSave:()=>T});function oe(){if(O)return O;let e=V.get("masterKey");e||(e=c.default.randomBytes(32).toString("hex"),V.set("masterKey",e));let t="";try{t=(0,se.machineIdSync)()||""}catch{t=c.default.createHash("sha256").update(y.default.hostname()+(y.default.userInfo?.()?.username||"root")).digest("hex")}let r=y.default.platform(),s=y.default.userInfo?.()?.username||"default_user",n=`${r}:${s}:${t}:${e}`;return O=c.default.createHash("sha256").update(n).digest(),O}function Ae(e,t){t||(t=ie(void 0,e));let r=Buffer.from(`project_salt_${e}`),s=Buffer.from("xtra-e2ee-project-key-v2"),n=c.default.hkdfSync("sha256",Buffer.from(t),r,s,32);return Buffer.from(n).toString("hex")}function be(e,t){let r=c.default.randomBytes(12),s=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),n=c.default.createCipheriv("aes-256-gcm",s,r),i=n.update(e,"utf8","hex");i+=n.final("hex");let a=n.getAuthTag().toString("hex");return{ciphertext:i,iv:r.toString("hex"),authTag:a}}function je(e,t){let r=Buffer.from(t.slice(0,64).padEnd(64,"0"),"hex"),s=Buffer.from(e.iv,"hex"),n=Buffer.from(e.authTag,"hex"),i=c.default.createDecipheriv("aes-256-gcm",r,s);i.setAuthTag(n);let a=i.update(e.ciphertext,"hex","utf8");return a+=i.final("utf8"),a}function ie(e,t){if(e&&e.trim())return e.trim();if(process.env.XTRA_VAULT_PASSPHRASE&&process.env.XTRA_VAULT_PASSPHRASE.trim())return process.env.XTRA_VAULT_PASSPHRASE.trim();if(process.env.XTRA_MASTER_SECRET&&process.env.XTRA_MASTER_SECRET.trim())return process.env.XTRA_MASTER_SECRET.trim();try{if(t){let s=K(`vault_${t}`);if(s)return s}let r=K("vault_passphrase");if(r)return r}catch{}try{let{getRcConfig:r}=(k(),j(G)),s=r();if(s&&s.passphrase)return s.passphrase}catch{}throw new Error("Vault Passphrase or Master Secret is required for Zero-Knowledge E2EE encryption/decryption.")}function Pe(e,t){t&&T(`vault_${t}`,e),T("vault_passphrase",e)}function Te(e,t){let{publicKey:r,privateKey:s}=c.default.generateKeyPairSync("x25519"),n=r.export({type:"spki",format:"pem"}).toString(),i=c.default.createPublicKey(t),a=c.default.diffieHellman({privateKey:s,publicKey:i}),g=Buffer.from(c.default.hkdfSync("sha256",a,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),p=c.default.randomBytes(12),u=c.default.createCipheriv("aes-256-gcm",g,p),f=u.update(e,"utf8","hex");f+=u.final("hex");let m=u.getAuthTag().toString("hex");return{targetPublicKey:t,ephemeralPublicKey:n,encryptedProjectKey:f,iv:p.toString("hex"),authTag:m}}function Ke(e,t){let r=c.default.createPrivateKey(t),s=c.default.createPublicKey(e.ephemeralPublicKey),n=c.default.diffieHellman({privateKey:r,publicKey:s}),i=Buffer.from(c.default.hkdfSync("sha256",n,Buffer.alloc(0),Buffer.from("xtra-workload-envelope"),32)),a=Buffer.from(e.iv,"hex"),g=Buffer.from(e.authTag,"hex"),p=c.default.createDecipheriv("aes-256-gcm",i,a);p.setAuthTag(g);let u=p.update(e.encryptedProjectKey,"hex","utf8");return u+=p.final("utf8"),u}var c,y,re,se,P,ne,V,O,N,D,$e,T,K,R=B(()=>{c=d(require("crypto")),y=d(require("os")),re=d(require("conf")),se=require("node-machine-id"),P=require("child_process"),ne="aes-256-gcm",V=new re.default({projectName:"xtra-cli-crypto"}),O=null;N=e=>{let t=c.default.randomBytes(12),r=oe(),s=c.default.createCipheriv(ne,r,t),n=s.update(e,"utf8","hex");n+=s.final("hex");let i=s.getAuthTag();return{iv:t.toString("hex"),content:n,tag:i.toString("hex")}},D=e=>{let t=oe(),r=Buffer.from(e.iv,"hex"),s=Buffer.from(e.tag,"hex"),n=c.default.createDecipheriv(ne,t,r);n.setAuthTag(s);let i=n.update(e.content,"hex","utf8");return i+=n.final("utf8"),i},$e=e=>c.default.createHash("sha256").update(e).digest("hex"),T=(e,t)=>{try{let s="XtraSecurityCLI",n=e;if(y.default.platform()==="darwin"){(0,P.execFileSync)("security",["add-generic-password","-s",s,"-a",n,"-w",t,"-U"],{stdio:"ignore"});return}else if(y.default.platform()!=="win32"){if(y.default.platform()==="linux")try{(0,P.execFileSync)("secret-tool",["store","--label",s,"service",s,"account",n],{input:t,stdio:["pipe","ignore","ignore"]});return}catch{}}}catch{}let r=N(t);V.set(`secure_${e}`,JSON.stringify(r))},K=e=>{try{let t="XtraSecurityCLI",r=e;if(y.default.platform()==="darwin")return(0,P.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(y.default.platform()!=="win32"){if(y.default.platform()==="linux")try{return(0,P.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=V.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return D(r)}catch{return null}}});var G={};U(G,{clearConfig:()=>_e,deleteConfig:()=>Ee,getAuthToken:()=>_,getBreakGlassSession:()=>Ie,getConfig:()=>S,getConfigValue:()=>Re,getProjectConfig:()=>Ce,getRcConfig:()=>Be,setBreakGlassSession:()=>Le,setConfig:()=>$});var ce,w,F,M,l,ae,S,Re,$,_e,Ee,_,Ie,Le,Ce,Be,k=B(()=>{ce=d(require("conf")),w=d(require("fs")),F=d(require("path"));R();M="https://www.xtrasecurity.in/api",l=new ce.default({projectName:"xtra-cli",defaults:{apiUrl:M}}),ae=l.get("apiUrl");ae&&!process.env.XTRA_API_URL&&ae.includes("xtra-security.vercel.app")&&l.set("apiUrl",M);S=()=>({...l.store,token:_(),apiUrl:process.env.XTRA_API_URL||l.get("apiUrl")||M}),Re=e=>e==="token"?_():l.get(e),$=(e,t)=>{if(e==="token"&&t&&T("token",t),l.set(e,t),e==="token"&&process.platform!=="win32"&&w.default.existsSync(l.path))try{w.default.chmodSync(l.path,384)}catch{}},_e=()=>l.clear(),Ee=e=>l.delete(e),_=()=>K("token")||l.get("token"),Ie=()=>l.get("breakGlassSessionId"),Le=e=>{e?l.set("breakGlassSessionId",e):l.delete("breakGlassSessionId")},Ce=async()=>{try{let e=F.default.join(process.cwd(),"xtra.json");if(w.default.existsSync(e)){let t=w.default.readFileSync(e,"utf-8");return JSON.parse(t)}return null}catch{return null}},Be=()=>{let e={};try{let t=F.default.join(process.cwd(),".xtrarc");w.default.existsSync(t)&&(e=JSON.parse(w.default.readFileSync(t,"utf-8")))}catch{}return{project:e.project||l.get("project")||"",env:e.env||l.get("env")||"development",branch:e.branch||l.get("branch")||"main"}}});var pe,ge,ue,Ue,o,E,z=B(()=>{pe=d(require("axios"));k();ge=d(require("fs")),ue=d(require("path")),Ue=JSON.parse(ge.readFileSync(ue.join(__dirname,"../../package.json"),"utf-8")),o=e=>{let{apiUrl:t}=S(),r=e||_();return pe.default.create({baseURL:t,headers:{"Content-Type":"application/json","X-CLI-Version":Ue.version,...r?{Authorization:`Bearer ${r}`}:{}}})},E={login:async(e,t,r)=>(await o().post("/auth/cli-login",{email:e,password:t,apiKey:r})).data,exchangeOidcToken:async(e,t)=>{let r=await o().post("/v2/auth/oidc/token",{provider:e,token:t});return{accessToken:r.data.access_token,envelope:r.data.envelope}},spawnAgentContext:async e=>(await o().post("/agents/ephemeral-context",e)).data,getSecrets:async(e,t,r="main",s,n,i)=>{let g=(await o(n).get(`/projects/${e}/envs/${t}/secrets?branch=${r}`)).data;if(g&&typeof g=="object"){let p=null,{deriveProjectKey:u,decryptSecretValue:f,resolveVaultPassphrase:m,decryptWorkloadKeyEnvelope:L}=(R(),j(q));for(let[h,b]of Object.entries(g))if(typeof b=="string"&&b.startsWith("{"))try{let v=JSON.parse(b);if(v.ciphertext&&v.iv){if(!p)if(i&&process.env.XTRA_WORKLOAD_PRIVATE_KEY)p=L(i,process.env.XTRA_WORKLOAD_PRIVATE_KEY);else{let he=m(s,e);p=u(e,he)}g[h]=f(v,p)}}catch(v){if(v.message&&v.message.includes("Zero-Knowledge"))throw v}}return g},getSecretVersions:async(e,t,r="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets?includeVersions=true&branch=${r}`)).data,setSecrets:async(e,t,r,s,n="main")=>{let{deriveProjectKey:i,encryptSecretValue:a,resolveVaultPassphrase:g}=(R(),j(q)),p=g(void 0,e),u=i(e,p),f={};for(let[L,h]of Object.entries(r))if(typeof h=="string"&&h.startsWith("{")&&h.includes("ciphertext"))f[L]=h;else{let b=a(h,u);f[L]=JSON.stringify(b)}return(await o().post(`/projects/${e}/envs/${t}/secrets`,{secrets:f,expectedVersions:s,branch:n})).data},getSecretDetails:async(e,t,r,s="main")=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}?branch=${s}`)).data,getSecretsV2:async(e,t)=>{let r=t?`&branchId=${t}`:"";return(await o().get(`/v2/secret?projectId=${e}${r}`)).data},createSecretV2:async e=>(await o().post("/v2/secret",e)).data,updateSecretV2:async e=>(await o().put(`/v2/secret?id=${e.id}`,e)).data,deleteSecretV2:async e=>(await o().delete(`/v2/secret?id=${e}`)).data,bulkImportV2:async e=>(await o().post("/v2/secret/bulk",e)).data,syncLogs:async e=>(await o().post("/audit/cli-logs",{logs:e})).data,linkSecret:async(e,t,r,s,n,i)=>(await o().post(`/projects/${e}/envs/${t}/secrets/link`,{key:r,sourceProjectId:s,sourceEnv:n,sourceKey:i})).data,rotateSecret:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/rotate`,{strategy:s,parsedNewValue:n})).data,promoteSecret:async(e,t,r)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/promote`,{})).data,verifyAuditLogs:async()=>(await o().get("/audit/verify")).data,exportAuditLogs:async(e,t,r,s)=>{let n={format:e};return t&&(n.startDate=t),r&&(n.endDate=r),s&&(n.projectId=s),(await o().post("/audit/export",n,{responseType:e==="csv"?"text":"json"})).data},requestAccess:async(e,t,r,s)=>(await o().post("/access/request",{projectId:e,secretId:s,reason:t,duration:r})).data,approveAccess:async(e,t)=>(await o().post("/access/approve",{requestId:e,decision:t})).data,listAccessRequests:async e=>{let{workspace:t}=S(),r=t?`&workspaceId=${t}`:"";return(await o().get(`/access/list?mode=${e}${r}`)).data},getAccessRequestStatus:async e=>(await o().get(`/access/request?id=${e}`)).data,getProjects:async()=>{let{workspace:e}=S(),t=e?`/project?workspaceId=${e}`:"/project";return(await o().get(t)).data},getBranches:async e=>(await o().get(`/branch?projectId=${e}`)).data,createBranch:async(e,t,r)=>(await o().post("/branch",{projectId:e,name:t,description:r})).data,deleteBranch:async e=>(await o().delete(`/branch/${e}`)).data,updateBranch:async(e,t)=>(await o().put("/branch",{id:e,...t})).data,getRoles:async()=>(await o().get("/admin/roles")).data,getUsers:async e=>{let t=e?`?teamId=${e}`:"";return(await o().get(`/admin/users${t}`)).data},setUserRole:async(e,t,r)=>(await o().put("/admin/users/role",{email:e,role:t,teamId:r})).data,getIntegrationStatus:async e=>(await o().get(`/integrations/${e}`)).data,getIntegrationRepos:async e=>(await o().get(`/integrations/${e}/sync`)).data.repos,syncSecretsToGithub:async e=>(await o().post("/integrations/github/sync",e)).data,exportKubernetesSecret:async(e,t)=>{let r=new URLSearchParams(t).toString();return(await o().get(`/projects/${e}/kubernetes?${r}`)).data},getSecretHistory:async(e,t,r)=>(await o().get(`/projects/${e}/envs/${t}/secrets/${r}/history`)).data,rollbackSecret:async(e,t,r,s)=>(await o().post(`/projects/${e}/envs/${t}/secrets/${r}/history`,{version:s})).data,cloneEnvironment:async(e,t,r,s,n)=>(await o().post(`/projects/${e}/envs/clone`,{fromEnv:t,toEnv:r,overwrite:s,branch:n})).data,generateJitLink:async e=>(await o().post("/jit/generate",e)).data,claimJitLink:async e=>(await o().post("/jit/claim",{token:e})).data,getJitInfo:async e=>(await o().get(`/jit/${e}`)).data,getServiceAccounts:async e=>(await o().get(`/projects/${e}/service-accounts`)).data,createServiceAccount:async(e,t)=>(await o().post(`/projects/${e}/service-accounts`,t)).data,deleteServiceAccount:async(e,t)=>(await o().delete(`/projects/${e}/service-accounts/${t}`)).data,getServiceAccountKeys:async(e,t)=>(await o().get(`/projects/${e}/service-accounts/${t}/keys`)).data,createServiceAccountKey:async(e,t,r,s)=>(await o().post(`/projects/${e}/service-accounts/${t}/keys`,{label:r,expiresAt:s})).data,deleteServiceAccountKey:async(e,t,r)=>(await o().delete(`/projects/${e}/service-accounts/${t}/keys/${r}`)).data,post:async(e,t)=>(await o().post(e,t)).data}});var J={};U(J,{loadAuditLogs:()=>H,logAudit:()=>Ve,saveAuditLogs:()=>X,syncAuditLogs:()=>Ne});function Oe(e){if(!e||typeof e!="object")return e;let t={...e},r=["password","token","secret","value","apiKey","secretValue"];for(let s of Object.keys(t))r.some(n=>s.toLowerCase().includes(n))&&(t[s]="[REDACTED]");return t}async function de(e){try{if(!S().token)return!1;let r={action:e.action,entity:"cli-project",entityId:e.projectId||"global",details:Oe(e.details),timestamp:e.timestamp,projectId:e.projectId};return await E.post("/audit/cli-logs",{logs:[r]}),!0}catch(t){return process.env.DEBUG&&console.error("Failed to send audit log to backend:",t),!1}}function Ve(e,t,r,s){let n={id:(0,le.randomUUID)(),timestamp:new Date().toISOString(),action:e,projectId:t,environment:r,details:s,synced:!1},i=H();i.push(n),X(i),de(n).then(a=>{if(a){n.synced=!0;let g=H(),p=g.findIndex(u=>u.id===n.id);p!==-1&&(g[p].synced=!0,X(g))}}).catch(()=>{})}function H(){if(!A.default.existsSync(Z))return[];try{let e=A.default.readFileSync(Z,"utf-8"),t=JSON.parse(e),r=D(t);return JSON.parse(r)}catch{return[]}}function X(e){A.default.existsSync(Y)||A.default.mkdirSync(Y,{recursive:!0});let t=JSON.stringify(e),r=N(t);A.default.writeFileSync(Z,JSON.stringify(r),"utf-8")}async function Ne(){let e=H(),t=e.filter(s=>!s.synced);if(t.length===0)return 0;let r=0;for(let s of t)await de(s)&&(s.synced=!0,r++);return r>0&&X(e),r}var A,Q,le,Y,Z,W=B(()=>{A=d(require("fs")),Q=d(require("path")),le=require("crypto");R();k();z();Y=Q.default.join(process.cwd(),".xtra"),Z=Q.default.join(Y,"audit.enc")});var He={};U(He,{loginCommand:()=>De});module.exports=j(He);var me=require("commander"),I=d(require("inquirer"));z();k();var x=d(require("chalk")),ee=d(require("ora")),De=new me.Command("login").description("Authenticate with XtraSecurity").option("-k, --key <key>","Login using an Access Key").option("-e, --email <email>","Login using Email").option("--sso","Login via Web (SSO)").action(async e=>{try{if(!e.key&&!e.email&&!e.sso){let{method:t}=await I.default.prompt([{type:"list",name:"method",message:"How would you like to login?",choices:[{name:"Browser Login (SSO)",value:"sso"},{name:"Access Key",value:"key"},{name:"Email & Password",value:"email"}]}]);if(t==="sso"){await ye();return}else if(t==="key"){let{key:r}=await I.default.prompt([{type:"password",name:"key",message:"Enter Access Key:"}]);await fe(r);return}}if(e.sso)await ye();else if(e.key)await fe(e.key);else{let{email:t}=e;t||(t=(await I.default.prompt([{type:"input",name:"email",message:"Email:"}])).email);let s=(await I.default.prompt([{type:"password",name:"password",message:"Password:"}])).password,n=(0,ee.default)("Authenticating...").start(),i=await E.login(t,s);$("token",i.token),n.succeed("Logged in successfully!");try{let{logAudit:a}=await Promise.resolve().then(()=>(W(),J));a("USER_LOGIN",null,null,{method:"email",email:t})}catch{}}}catch(t){t.response?console.error(x.default.red(`
+Error: ${t.response.data.error||"Login failed"}`)):console.error(x.default.red(`
+Error: ${t?.response?.data?.error||"An unexpected error occurred"}`)),process.exit(1)}});async function fe(e){let t=(0,ee.default)("Authenticating with Access Key...").start(),r=await E.login(void 0,void 0,e);$("token",r.token),r.user&&console.log(x.default.green(`
+Logged in as ${r.user.email}`)),t.succeed("Logged in successfully!");try{let{logAudit:s}=await Promise.resolve().then(()=>(W(),J));s("USER_LOGIN",null,null,{method:"api_key",email:r.user?.email})}catch{}}async function ye(){let e=require("http"),{default:t}=await import("open");return new Promise(r=>{let s=e.createServer(async(n,i)=>{let a=new URL(n.url,`http://${n.headers.host}`),g=a.searchParams.get("token"),p=a.searchParams.get("email"),u=a.searchParams.get("workspaceId"),f=a.searchParams.get("workspaceName");if(g){$("token",g),u&&$("workspace",u),i.writeHead(200,{"Content-Type":"text/html"}),i.write(`
                 <html>
                     <body style="background:#111;color:#eee;font-family:sans-serif;text-align:center;padding:50px;">
                         <h1>Login Successful</h1>
@@ -12,5 +12,5 @@ Logged in as ${s.user.email}`)),t.succeed("Logged in successfully!");try{let{log
                         </script>
                     </body>
                 </html>
-                `),console.log(m.default.green(`
-\u2714 SS0 Login Successful! Logged in as ${u}`)),d&&console.log(m.default.dim(`Selected Workspace: ${_} (${d})`));try{let{logAudit:B}=await Promise.resolve().then(()=>(I(),A));B("USER_LOGIN","global","cli",{method:"sso",email:u,workspaceId:d,workspaceName:_})}catch{}a.end(()=>{n.close(),setTimeout(()=>{process.exit(0)},1e3)})}else a.writeHead(400),a.end("Missing token")});n.listen(0,async()=>{let r=n.address(),p=`http://localhost:${typeof r=="string"?0:r?.port}`,{apiUrl:g}=(S(),D(q)).getConfig(),u=`${g}/auth/cli/sso?callbackUrl=${encodeURIComponent(p)}`;console.log(m.default.blue(`Waiting for browser login... (Opening ${u})`)),await t(u)})})}0&&(module.exports={loginCommand});
+                `),console.log(x.default.green(`
+\u2714 SS0 Login Successful! Logged in as ${p}`)),u&&console.log(x.default.dim(`Selected Workspace: ${f} (${u})`));try{let{logAudit:m}=await Promise.resolve().then(()=>(W(),J));m("USER_LOGIN","global","cli",{method:"sso",email:p,workspaceId:u,workspaceName:f})}catch{}i.end(()=>{s.close(),setTimeout(()=>{process.exit(0)},1e3)})}else i.writeHead(400),i.end("Missing token")});s.listen(0,async()=>{let n=s.address(),a=`http://localhost:${typeof n=="string"?0:n?.port}`,{apiUrl:g}=(k(),j(G)).getConfig(),p=`${g}/auth/cli/sso?callbackUrl=${encodeURIComponent(a)}`;console.log(x.default.blue(`Waiting for browser login... (Opening ${p})`)),await t(p)})})}0&&(module.exports={loginCommand});

package/dist/commands/logout.js

@@ -1 +1 @@
-var y=Object.create;var c=Object.defineProperty;var x=Object.getOwnPropertyDescriptor;var k=Object.getOwnPropertyNames;var S=Object.getPrototypeOf,C=Object.prototype.hasOwnProperty;var b=(e,t)=>{for(var r in t)c(e,r,{get:t[r],enumerable:!0})},p=(e,t,r,s)=>{if(t&&typeof t=="object"||typeof t=="function")for(let o of k(t))!C.call(e,o)&&o!==r&&c(e,o,{get:()=>t[o],enumerable:!(s=x(t,o))||s.enumerable});return e};var i=(e,t,r)=>(r=e!=null?y(S(e)):{},p(t||!e||!e.__esModule?c(r,"default",{value:e,enumerable:!0}):r,e)),j=e=>p(c({},"__esModule",{value:!0}),e);var v={};b(v,{logoutCommand:()=>U});module.exports=j(v);var u=require("commander"),a=i(require("chalk")),m=i(require("ora"));var d=i(require("conf"));var g="https://www.xtrasecurity.in/api",n=new d.default({projectName:"xtra-cli",defaults:{apiUrl:g}}),f=n.get("apiUrl");f&&!process.env.XTRA_API_URL&&f.includes("xtra-security.vercel.app")&&n.set("apiUrl",g);var h=()=>({...n.store,apiUrl:process.env.XTRA_API_URL||n.get("apiUrl")||g});var l=e=>n.delete(e);var U=new u.Command("logout").description("Logout and clear all local credentials and caches").action(async()=>{let e=(0,m.default)("Logging out...").start();try{l("token");let t=h(),s=Object.keys(t).filter(o=>o.startsWith("cache."));for(let o of s)l(o);e.succeed(a.default.green("\u2714 Successfully logged out.")),console.log(a.default.gray("Local authentication token and secret caches have been purged."))}catch(t){e.fail(a.default.red(`Logout failed: ${t?.response?.data?.error||"An unexpected error occurred"}`))}});0&&(module.exports={logoutCommand});
+var b=Object.create;var f=Object.defineProperty;var w=Object.getOwnPropertyDescriptor;var R=Object.getOwnPropertyNames;var E=Object.getPrototypeOf,j=Object.prototype.hasOwnProperty;var y=(e,t)=>()=>(e&&(t=e(e=0)),t);var U=(e,t)=>{for(var r in t)f(e,r,{get:t[r],enumerable:!0})},x=(e,t,r,o)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of R(t))!j.call(e,n)&&n!==r&&f(e,n,{get:()=>t[n],enumerable:!(o=w(t,n))||o.enumerable});return e};var i=(e,t,r)=>(r=e!=null?b(E(e)):{},x(t||!e||!e.__esModule?f(r,"default",{value:e,enumerable:!0}):r,e)),L=e=>x(f({},"__esModule",{value:!0}),e);function H(){if(p)return p;let e=l.get("masterKey");e||(e=a.default.randomBytes(32).toString("hex"),l.set("masterKey",e));let t="";try{t=(0,S.machineIdSync)()||""}catch{t=a.default.createHash("sha256").update(s.default.hostname()+(s.default.userInfo?.()?.username||"root")).digest("hex")}let r=s.default.platform(),o=s.default.userInfo?.()?.username||"default_user",n=`${r}:${o}:${t}:${e}`;return p=a.default.createHash("sha256").update(n).digest(),p}var a,s,v,S,h,I,l,p,X,k,P=y(()=>{a=i(require("crypto")),s=i(require("os")),v=i(require("conf")),S=require("node-machine-id"),h=require("child_process"),I="aes-256-gcm",l=new v.default({projectName:"xtra-cli-crypto"}),p=null;X=e=>{let t=H(),r=Buffer.from(e.iv,"hex"),o=Buffer.from(e.tag,"hex"),n=a.default.createDecipheriv(I,t,r);n.setAuthTag(o);let g=n.update(e.content,"hex","utf8");return g+=n.final("utf8"),g},k=e=>{try{let t="XtraSecurityCLI",r=e;if(s.default.platform()==="darwin")return(0,h.execFileSync)("security",["find-generic-password","-s",t,"-a",r,"-w"],{stdio:["ignore","pipe","ignore"]}).toString().trim();if(s.default.platform()!=="win32"){if(s.default.platform()==="linux")try{return(0,h.execFileSync)("secret-tool",["lookup","service",t,"account",r],{stdio:["ignore","pipe","ignore"]}).toString().trim()}catch{}}}catch{}try{let t=l.get(`secure_${e}`);if(!t)return null;let r=JSON.parse(t);return X(r)}catch{return null}}});var T,d,c,K,_,m,$,A=y(()=>{T=i(require("conf"));P();d="https://www.xtrasecurity.in/api",c=new T.default({projectName:"xtra-cli",defaults:{apiUrl:d}}),K=c.get("apiUrl");K&&!process.env.XTRA_API_URL&&K.includes("xtra-security.vercel.app")&&c.set("apiUrl",d);_=()=>({...c.store,token:$(),apiUrl:process.env.XTRA_API_URL||c.get("apiUrl")||d}),m=e=>c.delete(e),$=()=>k("token")||c.get("token")});var G={};U(G,{logoutCommand:()=>V});module.exports=L(G);var B=require("commander"),u=i(require("chalk")),C=i(require("ora"));A();var V=new B.Command("logout").description("Logout and clear all local credentials and caches").action(async()=>{let e=(0,C.default)("Logging out...").start();try{m("token");let t=_(),o=Object.keys(t).filter(n=>n.startsWith("cache."));for(let n of o)m(n);e.succeed(u.default.green("\u2714 Successfully logged out.")),console.log(u.default.gray("Local authentication token and secret caches have been purged."))}catch(t){e.fail(u.default.red(`Logout failed: ${t?.response?.data?.error||"An unexpected error occurred"}`))}});0&&(module.exports={logoutCommand});