@lifestreamdynamics/vault-cli 1.0.1 → 1.1.0

package/README.md

@@ -20,6 +20,7 @@ A powerful command-line interface for Lifestream Vault - the multi-user Markdown
   - [Team Commands](#team-commands)
   - [Sharing & Publishing](#sharing--publishing)
   - [Hooks & Webhooks](#hooks--webhooks)
+  - [Links & Backlinks](#links--backlinks)
   - [Admin Commands](#admin-commands)
 - [Sync & Watch Mode](#-sync--watch-mode)
 - [Configuration](#️-configuration)
@@ -372,6 +373,41 @@ lsvault webhooks create \
   --secret webhook_secret_key
 ```
 
+### Calendar
+
+| Command | Description |
+|---------|-------------|
+| `lsvault calendar view <vaultId>` | Browse calendar views and activity heatmap |
+| `lsvault calendar due <vaultId>` | List documents by due date |
+| `lsvault calendar events <vaultId>` | List calendar events |
+| `lsvault calendar create-event <vaultId>` | Create a calendar event |
+| `lsvault calendar update-event <vaultId> <eventId>` | Update a calendar event |
+| `lsvault calendar delete-event <vaultId> <eventId>` | Delete a calendar event |
+
+### Links & Backlinks
+
+| Command | Description |
+|---------|-------------|
+| `lsvault links list <vaultId> <path>` | List forward links from a document |
+| `lsvault links backlinks <vaultId> <path>` | List backlinks pointing to a document |
+| `lsvault links graph <vaultId>` | Get the link graph for a vault |
+| `lsvault links broken <vaultId>` | List unresolved (broken) links in a vault |
+
+**Example:**
+```bash
+# List forward links from a document
+lsvault links list vault_abc123 notes/index.md
+
+# Find all documents linking to a specific document
+lsvault links backlinks vault_abc123 notes/important.md
+
+# Get the full link graph for visualization
+lsvault links graph vault_abc123 --output json > graph.json
+
+# Find broken links
+lsvault links broken vault_abc123
+```
+
 ### Admin Commands
 
 **Note:** Admin commands require admin role.

package/dist/commands/auth.js

@@ -11,11 +11,13 @@ export function registerAuthCommands(program) {
         .option('--api-key <key>', 'API key (lsv_k_... prefix)')
         .option('--email <email>', 'Email address for password login')
         .option('--password <password>', 'Password (prompts interactively if omitted)')
+        .option('--mfa-code <code>', 'MFA code (TOTP or backup code) if account has MFA enabled')
         .option('--api-url <url>', 'API server URL (default: https://vault.lifestreamdynamics.com)')
         .addHelpText('after', `
 EXAMPLES
   lsvault auth login --api-key lsv_k_abc123
   lsvault auth login --email user@example.com
+  lsvault auth login --email user@example.com --mfa-code 123456
   lsvault auth login --email user@example.com --api-url https://api.example.com`)
         .action(async (opts) => {
         const cm = getCredentialManager();
@@ -42,7 +44,20 @@ EXAMPLES
             const apiUrl = opts.apiUrl ?? config.apiUrl;
             const spinner = ora('Authenticating...').start();
             try {
-                const { tokens, refreshToken } = await LifestreamVaultClient.login(apiUrl, opts.email, password);
+                const { tokens, refreshToken } = await LifestreamVaultClient.login(apiUrl, opts.email, password, {}, {
+                    mfaCode: opts.mfaCode,
+                    onMfaRequired: async (challenge) => {
+                        spinner.stop();
+                        console.log(chalk.yellow('MFA required for this account.'));
+                        console.log(`Available methods: ${challenge.methods.join(', ')}`);
+                        const code = await promptMfaCode();
+                        if (!code) {
+                            throw new Error('MFA code is required');
+                        }
+                        spinner.start('Verifying MFA code...');
+                        return { method: 'totp', code };
+                    },
+                });
                 // Save tokens to secure storage
                 await cm.saveCredentials({
                     accessToken: tokens.accessToken,
@@ -245,6 +260,57 @@ async function promptPassword() {
         process.stdin.resume();
     });
 }
+/**
+ * Prompt for an MFA code from stdin (6 digits, non-echoing).
+ * Returns the code or null if stdin is not a TTY.
+ */
+async function promptMfaCode() {
+    // In non-interactive mode, cannot prompt
+    if (!process.stdin.isTTY) {
+        return null;
+    }
+    const readline = await import('node:readline');
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stderr,
+            terminal: true,
+        });
+        // Disable echoing
+        process.stderr.write('MFA code: ');
+        process.stdin.setRawMode?.(true);
+        let code = '';
+        const onData = (chunk) => {
+            const char = chunk.toString('utf-8');
+            if (char === '\n' || char === '\r' || char === '\u0004') {
+                process.stderr.write('\n');
+                process.stdin.setRawMode?.(false);
+                process.stdin.removeListener('data', onData);
+                rl.close();
+                resolve(code);
+            }
+            else if (char === '\u0003') {
+                // Ctrl+C
+                process.stderr.write('\n');
+                process.stdin.setRawMode?.(false);
+                process.stdin.removeListener('data', onData);
+                rl.close();
+                resolve(null);
+            }
+            else if (char === '\u007F' || char === '\b') {
+                // Backspace
+                if (code.length > 0) {
+                    code = code.slice(0, -1);
+                }
+            }
+            else {
+                code += char;
+            }
+        };
+        process.stdin.on('data', onData);
+        process.stdin.resume();
+    });
+}
 function formatMethod(method) {
     switch (method) {
         case 'keychain': return chalk.green('OS Keychain');

package/dist/commands/calendar.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerCalendarCommands(program: Command): void;

package/dist/commands/calendar.js

@@ -0,0 +1,167 @@
+import chalk from 'chalk';
+import { getClientAsync } from '../client.js';
+import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
+import { createOutput, handleError } from '../utils/output.js';
+export function registerCalendarCommands(program) {
+    const calendar = program.command('calendar').description('Document calendar and due date management');
+    // calendar view
+    addGlobalFlags(calendar.command('view')
+        .description('View calendar activity for a vault')
+        .argument('<vaultId>', 'Vault ID')
+        .option('--start <date>', 'Start date (YYYY-MM-DD)', getDefaultStart())
+        .option('--end <date>', 'End date (YYYY-MM-DD)', getDefaultEnd()))
+        .action(async (vaultId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Loading calendar...');
+        try {
+            const client = await getClientAsync();
+            const response = await client.calendar.getActivity(vaultId, {
+                start: _opts.start,
+                end: _opts.end,
+            });
+            out.stopSpinner();
+            if (flags.output === 'text') {
+                out.status(chalk.dim(`Activity from ${response.start} to ${response.end}:\n`));
+            }
+            out.list(response.days.map(d => ({
+                date: d.date,
+                created: String(d.created),
+                updated: String(d.updated),
+                deleted: String(d.deleted),
+                total: String(d.total),
+            })), {
+                emptyMessage: 'No activity in this period.',
+                columns: [
+                    { key: 'date', header: 'Date' },
+                    { key: 'created', header: 'Created' },
+                    { key: 'updated', header: 'Updated' },
+                    { key: 'deleted', header: 'Deleted' },
+                    { key: 'total', header: 'Total' },
+                ],
+                textFn: (d) => {
+                    const bar = '█'.repeat(Math.min(Number(d.total), 20));
+                    return `${chalk.dim(String(d.date))} ${chalk.green(bar)} ${chalk.bold(String(d.total))}`;
+                },
+            });
+        }
+        catch (err) {
+            handleError(out, err, 'Calendar view failed');
+        }
+    });
+    // calendar due
+    addGlobalFlags(calendar.command('due')
+        .description('List documents with due dates')
+        .argument('<vaultId>', 'Vault ID')
+        .option('--status <status>', 'Filter: overdue, upcoming, all', 'all'))
+        .action(async (vaultId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Loading due dates...');
+        try {
+            const client = await getClientAsync();
+            const docs = await client.calendar.getDueDates(vaultId, {
+                status: _opts.status,
+            });
+            out.stopSpinner();
+            out.list(docs.map(d => ({
+                title: d.title || d.path,
+                path: d.path,
+                dueAt: d.dueAt,
+                priority: d.priority || '-',
+                status: d.overdue ? 'OVERDUE' : d.completed ? 'Done' : 'Pending',
+            })), {
+                emptyMessage: 'No documents with due dates.',
+                columns: [
+                    { key: 'title', header: 'Title' },
+                    { key: 'dueAt', header: 'Due' },
+                    { key: 'priority', header: 'Priority' },
+                    { key: 'status', header: 'Status' },
+                ],
+                textFn: (d) => {
+                    const statusColor = d.status === 'OVERDUE' ? chalk.red : d.status === 'Done' ? chalk.green : chalk.yellow;
+                    return `${chalk.cyan(String(d.title))} — due ${chalk.dim(String(d.dueAt))} ${statusColor(String(d.status))}`;
+                },
+            });
+        }
+        catch (err) {
+            handleError(out, err, 'Due dates failed');
+        }
+    });
+    // calendar set-due
+    addGlobalFlags(calendar.command('set-due')
+        .description('Set due date on a document')
+        .argument('<vaultId>', 'Vault ID')
+        .argument('<path>', 'Document path')
+        .requiredOption('--date <date>', 'Due date (YYYY-MM-DD or "clear")')
+        .option('--priority <priority>', 'Priority (low/medium/high)')
+        .option('--recurrence <recurrence>', 'Recurrence (daily/weekly/monthly/yearly)'))
+        .action(async (vaultId, path, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Setting due date...');
+        try {
+            const client = await getClientAsync();
+            const dateStr = _opts.date;
+            await client.calendar.setDocumentDue(vaultId, path, {
+                dueAt: dateStr === 'clear' ? null : new Date(dateStr).toISOString(),
+                priority: _opts.priority || null,
+                recurrence: _opts.recurrence || null,
+            });
+            out.stopSpinner();
+            out.status(dateStr === 'clear'
+                ? chalk.green(`Due date cleared for ${path}`)
+                : chalk.green(`Due date set to ${dateStr} for ${path}`));
+        }
+        catch (err) {
+            handleError(out, err, 'Set due date failed');
+        }
+    });
+    // calendar events
+    addGlobalFlags(calendar.command('events')
+        .description('List calendar events')
+        .argument('<vaultId>', 'Vault ID')
+        .option('--start <date>', 'Start date')
+        .option('--end <date>', 'End date'))
+        .action(async (vaultId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Loading events...');
+        try {
+            const client = await getClientAsync();
+            const events = await client.calendar.listEvents(vaultId, {
+                start: _opts.start,
+                end: _opts.end,
+            });
+            out.stopSpinner();
+            out.list(events.map(e => ({
+                title: e.title,
+                startDate: e.startDate,
+                priority: e.priority || '-',
+                completed: e.completed ? '✓' : '-',
+            })), {
+                emptyMessage: 'No calendar events.',
+                columns: [
+                    { key: 'title', header: 'Title' },
+                    { key: 'startDate', header: 'Date' },
+                    { key: 'priority', header: 'Priority' },
+                    { key: 'completed', header: 'Done' },
+                ],
+                textFn: (e) => `${chalk.cyan(String(e.title))} — ${chalk.dim(String(e.startDate))}`,
+            });
+        }
+        catch (err) {
+            handleError(out, err, 'Calendar events failed');
+        }
+    });
+}
+function getDefaultStart() {
+    const d = new Date();
+    d.setDate(1);
+    return d.toISOString().split('T')[0];
+}
+function getDefaultEnd() {
+    const d = new Date();
+    d.setMonth(d.getMonth() + 1, 0);
+    return d.toISOString().split('T')[0];
+}

package/dist/commands/links.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerLinkCommands(program: Command): void;

package/dist/commands/links.js

@@ -0,0 +1,126 @@
+import chalk from 'chalk';
+import { getClientAsync } from '../client.js';
+import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
+import { createOutput, handleError } from '../utils/output.js';
+export function registerLinkCommands(program) {
+    const links = program.command('links').description('Manage document links and backlinks');
+    // lsvault links list <vaultId> <path> — forward links
+    addGlobalFlags(links.command('list')
+        .description('List forward links from a document')
+        .argument('<vaultId>', 'Vault ID')
+        .argument('<path>', 'Document path'))
+        .action(async (vaultId, docPath, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching links...');
+        try {
+            const client = await getClientAsync();
+            const linkList = await client.documents.getLinks(vaultId, docPath);
+            out.stopSpinner();
+            out.list(linkList.map(link => ({
+                targetPath: link.targetPath,
+                linkText: link.linkText,
+                resolved: link.isResolved ? 'Yes' : 'No',
+            })), {
+                emptyMessage: 'No forward links found.',
+                columns: [
+                    { key: 'targetPath', header: 'Target' },
+                    { key: 'linkText', header: 'Link Text' },
+                    { key: 'resolved', header: 'Resolved' },
+                ],
+                textFn: (link) => {
+                    const resolved = link.resolved === 'Yes' ? chalk.green('✓') : chalk.red('✗');
+                    return `  ${resolved} [[${String(link.linkText)}]] → ${String(link.targetPath)}`;
+                },
+            });
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch links');
+        }
+    });
+    // lsvault links backlinks <vaultId> <path>
+    addGlobalFlags(links.command('backlinks')
+        .description('List backlinks pointing to a document')
+        .argument('<vaultId>', 'Vault ID')
+        .argument('<path>', 'Document path'))
+        .action(async (vaultId, docPath, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching backlinks...');
+        try {
+            const client = await getClientAsync();
+            const backlinks = await client.documents.getBacklinks(vaultId, docPath);
+            out.stopSpinner();
+            out.list(backlinks.map(bl => ({
+                source: bl.sourceDocument.title || bl.sourceDocument.path,
+                linkText: bl.linkText,
+                context: bl.contextSnippet || '',
+            })), {
+                emptyMessage: 'No backlinks found.',
+                columns: [
+                    { key: 'source', header: 'Source' },
+                    { key: 'linkText', header: 'Link Text' },
+                    { key: 'context', header: 'Context' },
+                ],
+                textFn: (bl) => {
+                    const lines = [chalk.cyan(`  ${String(bl.source)}`)];
+                    lines.push(`  Link: [[${String(bl.linkText)}]]`);
+                    if (bl.context)
+                        lines.push(`  Context: ...${String(bl.context)}...`);
+                    return lines.join('\n');
+                },
+            });
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch backlinks');
+        }
+    });
+    // lsvault links graph <vaultId>
+    addGlobalFlags(links.command('graph')
+        .description('Get the link graph for a vault')
+        .argument('<vaultId>', 'Vault ID'))
+        .action(async (vaultId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching link graph...');
+        try {
+            const client = await getClientAsync();
+            const graph = await client.vaults.getGraph(vaultId);
+            out.stopSpinner();
+            // For graph, output as JSON structure
+            process.stdout.write(JSON.stringify({ nodes: graph.nodes, edges: graph.edges }) + '\n');
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch link graph');
+        }
+    });
+    // lsvault links broken <vaultId>
+    addGlobalFlags(links.command('broken')
+        .description('List unresolved (broken) links in a vault')
+        .argument('<vaultId>', 'Vault ID'))
+        .action(async (vaultId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching unresolved links...');
+        try {
+            const client = await getClientAsync();
+            const unresolved = await client.vaults.getUnresolvedLinks(vaultId);
+            out.stopSpinner();
+            if (unresolved.length === 0) {
+                out.success('No broken links found!');
+                return;
+            }
+            // Format as grouped output
+            for (const group of unresolved) {
+                process.stdout.write(chalk.red(`  ✗ ${group.targetPath}`) + '\n');
+                for (const ref of group.references) {
+                    process.stdout.write(`    ← ${ref.sourcePath} (${chalk.dim(ref.linkText)})` + '\n');
+                }
+            }
+            process.stdout.write(`\n  ${chalk.yellow(`${unresolved.length} broken link target(s) found`)}` + '\n');
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch unresolved links');
+        }
+    });
+}

package/dist/commands/mfa.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerMfaCommands(program: Command): void;

package/dist/commands/mfa.js

@@ -0,0 +1,224 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { getClientAsync } from '../client.js';
+export function registerMfaCommands(program) {
+    const mfa = program.command('mfa').description('Multi-factor authentication management');
+    mfa.command('status')
+        .description('Show MFA status and configured methods')
+        .action(async () => {
+        const spinner = ora('Fetching MFA status...').start();
+        try {
+            const client = await getClientAsync();
+            const status = await client.mfa.getStatus();
+            spinner.stop();
+            console.log(chalk.bold('MFA Status'));
+            console.log(`  Enabled:              ${status.mfaEnabled ? chalk.green('Yes') : chalk.dim('No')}`);
+            console.log(`  TOTP Configured:      ${status.totpConfigured ? chalk.green('Yes') : chalk.dim('No')}`);
+            console.log(`  Passkeys Registered:  ${status.passkeyCount > 0 ? chalk.cyan(status.passkeyCount) : chalk.dim('0')}`);
+            console.log(`  Backup Codes Left:    ${status.backupCodesRemaining > 0 ? chalk.cyan(status.backupCodesRemaining) : chalk.yellow('0')}`);
+            if (status.passkeys.length > 0) {
+                console.log('');
+                console.log(chalk.bold('Registered Passkeys:'));
+                for (const passkey of status.passkeys) {
+                    const lastUsed = passkey.lastUsedAt
+                        ? new Date(passkey.lastUsedAt).toLocaleDateString()
+                        : chalk.dim('never');
+                    console.log(`  - ${chalk.cyan(passkey.name)} (last used: ${lastUsed})`);
+                }
+            }
+        }
+        catch (err) {
+            spinner.fail('Failed to fetch MFA status');
+            console.error(err instanceof Error ? err.message : String(err));
+        }
+    });
+    mfa.command('setup-totp')
+        .description('Set up TOTP authenticator app (Google Authenticator, Authy, etc.)')
+        .action(async () => {
+        const spinner = ora('Generating TOTP secret...').start();
+        try {
+            const client = await getClientAsync();
+            const setup = await client.mfa.setupTotp();
+            spinner.stop();
+            console.log(chalk.bold('TOTP Setup'));
+            console.log('');
+            console.log(`Secret:  ${chalk.cyan(setup.secret)}`);
+            console.log('');
+            console.log('Add this URI to your authenticator app:');
+            console.log(chalk.dim(setup.otpauthUri));
+            console.log('');
+            console.log(chalk.yellow('Note: QR codes cannot be displayed in the terminal.'));
+            console.log(chalk.yellow('      Copy the URI above to any authenticator app that supports otpauth:// URIs.'));
+            console.log('');
+            // Prompt for verification code
+            const code = await promptMfaCode();
+            if (!code) {
+                console.log(chalk.yellow('Setup cancelled.'));
+                return;
+            }
+            const verifySpinner = ora('Verifying code and enabling TOTP...').start();
+            const result = await client.mfa.verifyTotp(code);
+            verifySpinner.succeed('TOTP enabled successfully!');
+            console.log('');
+            console.log(chalk.bold.yellow('IMPORTANT: Save these backup codes securely!'));
+            console.log(chalk.dim('You can use them to access your account if you lose your authenticator device.'));
+            console.log('');
+            // Display backup codes in a grid (2 columns)
+            const codes = result.backupCodes;
+            for (let i = 0; i < codes.length; i += 2) {
+                const left = codes[i] || '';
+                const right = codes[i + 1] || '';
+                console.log(`  ${chalk.cyan(left.padEnd(20))}  ${chalk.cyan(right)}`);
+            }
+            console.log('');
+        }
+        catch (err) {
+            spinner.fail('TOTP setup failed');
+            console.error(err instanceof Error ? err.message : String(err));
+        }
+    });
+    mfa.command('disable-totp')
+        .description('Disable TOTP authentication (requires password)')
+        .action(async () => {
+        const password = await promptPassword();
+        if (!password) {
+            console.log(chalk.yellow('Operation cancelled.'));
+            return;
+        }
+        const spinner = ora('Disabling TOTP...').start();
+        try {
+            const client = await getClientAsync();
+            const result = await client.mfa.disableTotp(password);
+            spinner.succeed(result.message);
+        }
+        catch (err) {
+            spinner.fail('Failed to disable TOTP');
+            console.error(err instanceof Error ? err.message : String(err));
+        }
+    });
+    mfa.command('backup-codes')
+        .description('Show remaining backup code count or regenerate codes')
+        .option('--regenerate', 'Generate new backup codes (requires password, invalidates old codes)')
+        .action(async (opts) => {
+        if (opts.regenerate) {
+            // Regenerate backup codes
+            const password = await promptPassword();
+            if (!password) {
+                console.log(chalk.yellow('Operation cancelled.'));
+                return;
+            }
+            const spinner = ora('Regenerating backup codes...').start();
+            try {
+                const client = await getClientAsync();
+                const result = await client.mfa.regenerateBackupCodes(password);
+                spinner.succeed('Backup codes regenerated!');
+                console.log('');
+                console.log(chalk.bold.yellow('IMPORTANT: Save these new backup codes securely!'));
+                console.log(chalk.dim('All previous backup codes have been invalidated.'));
+                console.log('');
+                // Display backup codes in a grid (2 columns)
+                const codes = result.backupCodes;
+                for (let i = 0; i < codes.length; i += 2) {
+                    const left = codes[i] || '';
+                    const right = codes[i + 1] || '';
+                    console.log(`  ${chalk.cyan(left.padEnd(20))}  ${chalk.cyan(right)}`);
+                }
+                console.log('');
+            }
+            catch (err) {
+                spinner.fail('Failed to regenerate backup codes');
+                console.error(err instanceof Error ? err.message : String(err));
+            }
+        }
+        else {
+            // Show backup code count
+            const spinner = ora('Fetching backup code count...').start();
+            try {
+                const client = await getClientAsync();
+                const status = await client.mfa.getStatus();
+                spinner.stop();
+                console.log(chalk.bold('Backup Codes'));
+                console.log(`  Remaining: ${status.backupCodesRemaining > 0 ? chalk.cyan(status.backupCodesRemaining) : chalk.yellow('0')}`);
+                if (status.backupCodesRemaining === 0) {
+                    console.log('');
+                    console.log(chalk.yellow('You have no backup codes remaining.'));
+                    console.log(chalk.yellow('Run `lsvault mfa backup-codes --regenerate` to generate new codes.'));
+                }
+            }
+            catch (err) {
+                spinner.fail('Failed to fetch backup code count');
+                console.error(err instanceof Error ? err.message : String(err));
+            }
+        }
+    });
+}
+/**
+ * Prompt for a password from stdin (non-echoing).
+ * Returns the password or null if stdin is not a TTY.
+ */
+async function promptPassword() {
+    if (!process.stdin.isTTY) {
+        return null;
+    }
+    const readline = await import('node:readline');
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stderr,
+            terminal: true,
+        });
+        process.stderr.write('Password: ');
+        process.stdin.setRawMode?.(true);
+        let password = '';
+        const onData = (chunk) => {
+            const char = chunk.toString('utf-8');
+            if (char === '\n' || char === '\r' || char === '\u0004') {
+                process.stderr.write('\n');
+                process.stdin.setRawMode?.(false);
+                process.stdin.removeListener('data', onData);
+                rl.close();
+                resolve(password);
+            }
+            else if (char === '\u0003') {
+                // Ctrl+C
+                process.stderr.write('\n');
+                process.stdin.setRawMode?.(false);
+                process.stdin.removeListener('data', onData);
+                rl.close();
+                resolve(null);
+            }
+            else if (char === '\u007F' || char === '\b') {
+                // Backspace
+                if (password.length > 0) {
+                    password = password.slice(0, -1);
+                }
+            }
+            else {
+                password += char;
+            }
+        };
+        process.stdin.on('data', onData);
+        process.stdin.resume();
+    });
+}
+/**
+ * Prompt for an MFA code from stdin (6 digits, echoed for visibility).
+ * Returns the code or null if stdin is not a TTY.
+ */
+async function promptMfaCode() {
+    if (!process.stdin.isTTY) {
+        return null;
+    }
+    const readline = await import('node:readline');
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stderr,
+            terminal: true,
+        });
+        rl.question('Enter 6-digit code from authenticator app: ', (answer) => {
+            rl.close();
+            resolve(answer.trim() || null);
+        });
+    });
+}

package/dist/commands/search.js

@@ -9,26 +9,31 @@ export function registerSearchCommands(program) {
         .option('--vault <vaultId>', 'Limit search to a specific vault')
         .option('--tags <tags>', 'Filter by tags (comma-separated)')
         .option('--limit <n>', 'Maximum number of results', '20')
+        .option('--mode <mode>', 'Search mode: text, semantic, hybrid', 'text')
         .addHelpText('after', `
 EXAMPLES
   lsvault search "meeting notes"
   lsvault search "project plan" --vault abc123
-  lsvault search "typescript" --tags dev,code --limit 5`))
+  lsvault search "typescript" --tags dev,code --limit 5
+  lsvault search "machine learning" --mode semantic`))
         .action(async (query, _opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);
         out.startSpinner('Searching...');
         try {
             const client = await getClientAsync();
+            const mode = _opts.mode;
             const response = await client.search.search({
                 q: query,
                 vault: _opts.vault,
                 tags: _opts.tags,
                 limit: parseInt(String(_opts.limit || '20'), 10),
+                mode: mode,
             });
             out.stopSpinner();
             if (flags.output === 'text') {
-                out.status(chalk.dim(`${response.total} result(s) for "${response.query}":\n`));
+                const modeInfo = mode && mode !== 'text' ? `[${mode}] ` : '';
+                out.status(chalk.dim(`${modeInfo}${response.total} result(s) for "${response.query}":\n`));
             }
             out.list(response.results.map(r => ({
                 title: r.title || r.path,

package/dist/commands/subscription.js

@@ -32,7 +32,7 @@ export function registerSubscriptionCommands(program) {
                 process.stdout.write(chalk.dim('Usage:') + '\n');
                 process.stdout.write(`  Vaults:            ${data.usage.vaultCount}\n`);
                 process.stdout.write(`  Storage:           ${formatBytes(data.usage.totalStorageBytes)}\n`);
-                process.stdout.write(`  API calls today:   ${data.usage.apiCallsToday}\n`);
+                process.stdout.write(`  API calls this month: ${data.usage.apiCallsThisMonth}\n`);
                 process.stdout.write(`  AI tokens:         ${data.usage.aiTokens}\n`);
                 process.stdout.write(`  Hook executions:   ${data.usage.hookExecutions}\n`);
                 process.stdout.write(`  Webhook deliveries: ${data.usage.webhookDeliveries}\n`);

package/dist/commands/sync.js

@@ -501,8 +501,11 @@ export function registerSyncCommands(program) {
         const out = createOutput(flags);
         try {
             const logFile = _opts.logFile;
-            const pid = startDaemon(logFile);
+            const { pid, lingerWarning } = startDaemon(logFile);
             out.success('Daemon started', { pid, status: 'running' });
+            if (lingerWarning) {
+                out.warn(`Warning: ${lingerWarning}`);
+            }
         }
         catch (err) {
             handleError(out, err, 'Failed to start daemon');

package/dist/index.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
 import { registerAuthCommands } from './commands/auth.js';
+import { registerMfaCommands } from './commands/mfa.js';
 import { registerVaultCommands } from './commands/vaults.js';
 import { registerDocCommands } from './commands/docs.js';
 import { registerSearchCommands } from './commands/search.js';
@@ -18,6 +19,8 @@ import { registerWebhookCommands } from './commands/webhooks.js';
 import { registerConfigCommands } from './commands/config.js';
 import { registerSyncCommands } from './commands/sync.js';
 import { registerVersionCommands } from './commands/versions.js';
+import { registerLinkCommands } from './commands/links.js';
+import { registerCalendarCommands } from './commands/calendar.js';
 const program = new Command();
 program
     .name('lsvault')
@@ -43,6 +46,7 @@ LEARN MORE
   lsvault <command> --help                   Show help for a command
   lsvault <command> <subcommand> --help      Show help for a subcommand`);
 registerAuthCommands(program);
+registerMfaCommands(program);
 registerVaultCommands(program);
 registerDocCommands(program);
 registerSearchCommands(program);
@@ -60,4 +64,6 @@ registerWebhookCommands(program);
 registerConfigCommands(program);
 registerSyncCommands(program);
 registerVersionCommands(program);
+registerLinkCommands(program);
+registerCalendarCommands(program);
 program.parse();

package/dist/sync/daemon-worker.js

@@ -10,6 +10,8 @@ import { createRemotePoller } from './remote-poller.js';
 import { removePid } from './daemon.js';
 import { loadConfig } from '../config.js';
 import { LifestreamVaultClient } from '@lifestreamdynamics/vault-sdk';
+import { scanLocalFiles, scanRemoteFiles, computePushDiff, computePullDiff, executePush, executePull } from './engine.js';
+import { loadSyncState } from './state.js';
 const managed = [];
 function log(msg) {
     const ts = new Date().toISOString();
@@ -35,6 +37,66 @@ async function start() {
     }
     log(`Found ${configs.length} auto-sync configuration(s)`);
     const client = createClient();
+    // Startup reconciliation: catch changes made while daemon was stopped
+    for (const config of configs) {
+        try {
+            log(`Reconciling ${config.id.slice(0, 8)} (${config.mode} mode)...`);
+            const ignorePatterns = resolveIgnorePatterns(config.ignore, config.localPath);
+            const lastState = loadSyncState(config.id);
+            const localFiles = scanLocalFiles(config.localPath, ignorePatterns);
+            const remoteFiles = await scanRemoteFiles(client, config.vaultId, ignorePatterns);
+            let pushed = 0;
+            let pulled = 0;
+            let deleted = 0;
+            if (config.mode === 'push' || config.mode === 'sync') {
+                const pushDiff = computePushDiff(localFiles, remoteFiles, lastState);
+                const pushOps = pushDiff.uploads.length + pushDiff.deletes.length;
+                if (pushOps > 0) {
+                    const result = await executePush(client, config, pushDiff);
+                    pushed = result.filesUploaded;
+                    deleted += result.filesDeleted;
+                    if (result.errors.length > 0) {
+                        for (const err of result.errors) {
+                            log(`  Push error: ${err.path}: ${err.error}`);
+                        }
+                    }
+                }
+            }
+            if (config.mode === 'pull' || config.mode === 'sync') {
+                const pullDiff = computePullDiff(localFiles, remoteFiles, lastState);
+                const pullOps = pullDiff.downloads.length + pullDiff.deletes.length;
+                if (pullOps > 0) {
+                    const result = await executePull(client, config, pullDiff);
+                    pulled = result.filesDownloaded;
+                    deleted += result.filesDeleted;
+                    if (result.errors.length > 0) {
+                        for (const err of result.errors) {
+                            log(`  Pull error: ${err.path}: ${err.error}`);
+                        }
+                    }
+                }
+            }
+            const total = pushed + pulled + deleted;
+            if (total > 0) {
+                const parts = [];
+                if (pushed > 0)
+                    parts.push(`${pushed} uploaded`);
+                if (pulled > 0)
+                    parts.push(`${pulled} downloaded`);
+                if (deleted > 0)
+                    parts.push(`${deleted} deleted`);
+                log(`Reconciled ${config.id.slice(0, 8)}: ${parts.join(', ')}`);
+            }
+            else {
+                log(`Reconciled ${config.id.slice(0, 8)}: up to date`);
+            }
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            log(`Reconciliation failed for ${config.id.slice(0, 8)}: ${msg}`);
+            // Continue — still start the watcher even if reconciliation fails
+        }
+    }
     for (const config of configs) {
         try {
             const ignorePatterns = resolveIgnorePatterns(config.ignore, config.localPath);

package/dist/sync/daemon.d.ts

@@ -36,9 +36,17 @@ export declare function rotateLogIfNeeded(logFile?: string): void;
  * Start the daemon as a detached child process.
  * Returns the PID of the spawned process.
  */
-export declare function startDaemon(logFile?: string): number;
+export declare function startDaemon(logFile?: string): {
+    pid: number;
+    lingerWarning?: string;
+};
 /**
  * Stop the running daemon.
  */
 export declare function stopDaemon(): boolean;
+/**
+ * Check if systemd linger is enabled for the current user (Linux only).
+ * When linger is disabled, user services stop when the SSH session ends.
+ */
+export declare function checkLingerStatus(): 'enabled' | 'disabled' | 'unknown';
 export { DAEMON_DIR, PID_FILE, LOG_FILE };

package/dist/sync/daemon.js

@@ -150,7 +150,12 @@ export function startDaemon(logFile) {
     writePid(child.pid);
     child.unref();
     fs.closeSync(logFd);
-    return child.pid;
+    const result = { pid: child.pid };
+    const lingerStatus = checkLingerStatus();
+    if (lingerStatus === 'disabled') {
+        result.lingerWarning = 'systemd lingering is not enabled for your user. The daemon will stop when you log out. To fix:\n  sudo loginctl enable-linger $(whoami)';
+    }
+    return result;
 }
 /**
  * Stop the running daemon.
@@ -171,4 +176,20 @@ export function stopDaemon() {
         return false;
     }
 }
+/**
+ * Check if systemd linger is enabled for the current user (Linux only).
+ * When linger is disabled, user services stop when the SSH session ends.
+ */
+export function checkLingerStatus() {
+    if (process.platform !== 'linux')
+        return 'unknown';
+    try {
+        const username = os.userInfo().username;
+        const lingerFile = `/var/lib/systemd/linger/${username}`;
+        return fs.existsSync(lingerFile) ? 'enabled' : 'disabled';
+    }
+    catch {
+        return 'unknown';
+    }
+}
 export { DAEMON_DIR, PID_FILE, LOG_FILE };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lifestreamdynamics/vault-cli",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Command-line interface for Lifestream Vault",
   "engines": {
     "node": ">=20"
@@ -44,7 +44,7 @@
     "prepublishOnly": "npm run build && npm test"
   },
   "dependencies": {
-    "@lifestreamdynamics/vault-sdk": "^1.0.0",
+    "@lifestreamdynamics/vault-sdk": "^1.1.0",
     "chalk": "^5.4.0",
     "chokidar": "^4.0.3",
     "commander": "^13.0.0",