@lifestreamdynamics/vault-cli 1.0.1 → 1.2.0

package/dist/commands/custom-domains.js

@@ -0,0 +1,149 @@
+import chalk from 'chalk';
+import { getClientAsync } from '../client.js';
+import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
+import { createOutput, handleError } from '../utils/output.js';
+export function registerCustomDomainCommands(program) {
+    const domains = program.command('custom-domains').description('Manage custom domains for published vaults');
+    addGlobalFlags(domains.command('list')
+        .description('List custom domains'))
+        .action(async (_opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching custom domains...');
+        try {
+            const client = await getClientAsync();
+            const list = await client.customDomains.list();
+            out.stopSpinner();
+            out.list(list.map(d => ({ id: d.id, domain: d.domain, verified: d.verified ? 'yes' : 'no', createdAt: d.createdAt })), {
+                emptyMessage: 'No custom domains found.',
+                columns: [
+                    { key: 'id', header: 'ID' },
+                    { key: 'domain', header: 'Domain' },
+                    { key: 'verified', header: 'Verified' },
+                    { key: 'createdAt', header: 'Created' },
+                ],
+                textFn: (d) => `${chalk.cyan(String(d.domain))} — ${d.verified === 'yes' ? chalk.green('verified') : chalk.yellow('unverified')}`,
+            });
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch custom domains');
+        }
+    });
+    addGlobalFlags(domains.command('get')
+        .description('Get a custom domain')
+        .argument('<domainId>', 'Domain ID'))
+        .action(async (domainId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching custom domain...');
+        try {
+            const client = await getClientAsync();
+            const d = await client.customDomains.get(domainId);
+            out.stopSpinner();
+            out.record({ id: d.id, domain: d.domain, verified: d.verified, verificationToken: d.verificationToken, createdAt: d.createdAt });
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch custom domain');
+        }
+    });
+    addGlobalFlags(domains.command('add')
+        .description('Add a custom domain')
+        .argument('<domain>', 'Domain name (e.g., docs.example.com)'))
+        .action(async (domain, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Adding custom domain...');
+        try {
+            const client = await getClientAsync();
+            const d = await client.customDomains.create({ domain });
+            out.success(`Domain added: ${d.domain}`, { id: d.id, domain: d.domain, verificationToken: d.verificationToken });
+            if (flags.output !== 'json') {
+                process.stdout.write(`\nTo verify, add this DNS TXT record:\n`);
+                process.stdout.write(`  ${chalk.cyan('_lsvault-verification.' + d.domain)} TXT ${chalk.green(d.verificationToken)}\n`);
+                process.stdout.write(`\nThen run: lsvault custom-domains verify ${d.id}\n`);
+            }
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to add custom domain');
+        }
+    });
+    addGlobalFlags(domains.command('update')
+        .description('Update a custom domain')
+        .argument('<domainId>', 'Domain ID')
+        .requiredOption('--domain <domain>', 'New domain name'))
+        .action(async (domainId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Updating custom domain...');
+        try {
+            const client = await getClientAsync();
+            const d = await client.customDomains.update(domainId, { domain: _opts.domain });
+            out.success(`Domain updated: ${d.domain}`, { id: d.id, domain: d.domain });
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to update custom domain');
+        }
+    });
+    addGlobalFlags(domains.command('remove')
+        .description('Remove a custom domain')
+        .argument('<domainId>', 'Domain ID'))
+        .action(async (domainId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Removing custom domain...');
+        try {
+            const client = await getClientAsync();
+            await client.customDomains.delete(domainId);
+            out.success('Custom domain removed', { id: domainId });
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to remove custom domain');
+        }
+    });
+    addGlobalFlags(domains.command('verify')
+        .description('Verify a custom domain via DNS')
+        .argument('<domainId>', 'Domain ID'))
+        .action(async (domainId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Verifying custom domain...');
+        try {
+            const client = await getClientAsync();
+            const d = await client.customDomains.verify(domainId);
+            out.success(`Domain ${d.verified ? 'verified' : 'not yet verified'}: ${d.domain}`, { id: d.id, domain: d.domain, verified: d.verified });
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to verify custom domain');
+        }
+    });
+    addGlobalFlags(domains.command('check')
+        .description('Check DNS configuration for a custom domain')
+        .argument('<domainId>', 'Domain ID'))
+        .action(async (domainId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Checking DNS...');
+        try {
+            const client = await getClientAsync();
+            const result = await client.customDomains.checkDns(domainId);
+            out.stopSpinner();
+            out.record({
+                domain: result.domain,
+                resolved: result.resolved,
+                expectedValue: result.expectedValue,
+                actualValue: result.actualValue ?? 'N/A',
+            });
+            if (flags.output !== 'json') {
+                if (result.resolved) {
+                    process.stdout.write(chalk.green('\n✓ DNS configured correctly\n'));
+                }
+                else {
+                    process.stdout.write(chalk.yellow(`\n⚠ DNS not yet propagated. Expected: ${result.expectedValue}\n`));
+                }
+            }
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to check DNS');
+        }
+    });
+}

package/dist/commands/docs.js

@@ -191,4 +191,144 @@ EXAMPLES
             handleError(out, err, 'Failed to move document');
         }
     });
+    addGlobalFlags(docs.command('bulk-move')
+        .description('Move multiple documents to a target directory')
+        .argument('<vaultId>', 'Vault ID')
+        .requiredOption('--paths <csv>', 'Comma-separated list of document paths')
+        .requiredOption('--target <dir>', 'Target directory'))
+        .action(async (vaultId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Moving documents...');
+        try {
+            const client = await getClientAsync();
+            const paths = (String(_opts.paths)).split(',').map(p => p.trim()).filter(Boolean);
+            const result = await client.documents.bulkMove(vaultId, { paths, targetDirectory: _opts.target });
+            out.stopSpinner();
+            if (flags.output === 'json') {
+                out.raw(JSON.stringify(result, null, 2) + '\n');
+            }
+            else {
+                process.stdout.write(`Succeeded: ${result.succeeded.length}, Failed: ${result.failed.length}\n`);
+                if (result.failed.length > 0) {
+                    for (const f of result.failed)
+                        process.stdout.write(`  ${chalk.red('✗')} ${f.path}: ${f.error}\n`);
+                }
+            }
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to bulk move documents');
+        }
+    });
+    addGlobalFlags(docs.command('bulk-copy')
+        .description('Copy multiple documents to a target directory')
+        .argument('<vaultId>', 'Vault ID')
+        .requiredOption('--paths <csv>', 'Comma-separated list of document paths')
+        .requiredOption('--target <dir>', 'Target directory'))
+        .action(async (vaultId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Copying documents...');
+        try {
+            const client = await getClientAsync();
+            const paths = (String(_opts.paths)).split(',').map(p => p.trim()).filter(Boolean);
+            const result = await client.documents.bulkCopy(vaultId, { paths, targetDirectory: _opts.target });
+            out.stopSpinner();
+            if (flags.output === 'json') {
+                out.raw(JSON.stringify(result, null, 2) + '\n');
+            }
+            else {
+                process.stdout.write(`Succeeded: ${result.succeeded.length}, Failed: ${result.failed.length}\n`);
+                if (result.failed.length > 0) {
+                    for (const f of result.failed)
+                        process.stdout.write(`  ${chalk.red('✗')} ${f.path}: ${f.error}\n`);
+                }
+            }
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to bulk copy documents');
+        }
+    });
+    addGlobalFlags(docs.command('bulk-delete')
+        .description('Delete multiple documents')
+        .argument('<vaultId>', 'Vault ID')
+        .requiredOption('--paths <csv>', 'Comma-separated list of document paths'))
+        .action(async (vaultId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Deleting documents...');
+        try {
+            const client = await getClientAsync();
+            const paths = (String(_opts.paths)).split(',').map(p => p.trim()).filter(Boolean);
+            const result = await client.documents.bulkDelete(vaultId, { paths });
+            out.stopSpinner();
+            if (flags.output === 'json') {
+                out.raw(JSON.stringify(result, null, 2) + '\n');
+            }
+            else {
+                process.stdout.write(`Succeeded: ${result.succeeded.length}, Failed: ${result.failed.length}\n`);
+                if (result.failed.length > 0) {
+                    for (const f of result.failed)
+                        process.stdout.write(`  ${chalk.red('✗')} ${f.path}: ${f.error}\n`);
+                }
+            }
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to bulk delete documents');
+        }
+    });
+    addGlobalFlags(docs.command('bulk-tag')
+        .description('Add or remove tags from multiple documents')
+        .argument('<vaultId>', 'Vault ID')
+        .requiredOption('--paths <csv>', 'Comma-separated list of document paths')
+        .option('--add <csv>', 'Tags to add (comma-separated)')
+        .option('--remove <csv>', 'Tags to remove (comma-separated)'))
+        .action(async (vaultId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        if (!_opts.add && !_opts.remove) {
+            out.error('At least one of --add or --remove must be specified');
+            process.exitCode = 1;
+            return;
+        }
+        out.startSpinner('Tagging documents...');
+        try {
+            const client = await getClientAsync();
+            const paths = (String(_opts.paths)).split(',').map(p => p.trim()).filter(Boolean);
+            const addTags = _opts.add ? (String(_opts.add)).split(',').map(t => t.trim()).filter(Boolean) : undefined;
+            const removeTags = _opts.remove ? (String(_opts.remove)).split(',').map(t => t.trim()).filter(Boolean) : undefined;
+            const result = await client.documents.bulkTag(vaultId, { paths, addTags, removeTags });
+            out.stopSpinner();
+            if (flags.output === 'json') {
+                out.raw(JSON.stringify(result, null, 2) + '\n');
+            }
+            else {
+                process.stdout.write(`Succeeded: ${result.succeeded.length}, Failed: ${result.failed.length}\n`);
+                if (result.failed.length > 0) {
+                    for (const f of result.failed)
+                        process.stdout.write(`  ${chalk.red('✗')} ${f.path}: ${f.error}\n`);
+                }
+            }
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to bulk tag documents');
+        }
+    });
+    addGlobalFlags(docs.command('mkdir')
+        .description('Create a directory in a vault')
+        .argument('<vaultId>', 'Vault ID')
+        .argument('<path>', 'Directory path to create'))
+        .action(async (vaultId, path, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Creating directory...');
+        try {
+            const client = await getClientAsync();
+            const result = await client.documents.createDirectory(vaultId, path);
+            out.success(`Directory ${result.created ? 'created' : 'already exists'}: ${result.path}`, { path: result.path, created: result.created });
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to create directory');
+        }
+    });
 }

package/dist/commands/links.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerLinkCommands(program: Command): void;

package/dist/commands/links.js

@@ -0,0 +1,126 @@
+import chalk from 'chalk';
+import { getClientAsync } from '../client.js';
+import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
+import { createOutput, handleError } from '../utils/output.js';
+export function registerLinkCommands(program) {
+    const links = program.command('links').description('Manage document links and backlinks');
+    // lsvault links list <vaultId> <path> — forward links
+    addGlobalFlags(links.command('list')
+        .description('List forward links from a document')
+        .argument('<vaultId>', 'Vault ID')
+        .argument('<path>', 'Document path'))
+        .action(async (vaultId, docPath, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching links...');
+        try {
+            const client = await getClientAsync();
+            const linkList = await client.documents.getLinks(vaultId, docPath);
+            out.stopSpinner();
+            out.list(linkList.map(link => ({
+                targetPath: link.targetPath,
+                linkText: link.linkText,
+                resolved: link.isResolved ? 'Yes' : 'No',
+            })), {
+                emptyMessage: 'No forward links found.',
+                columns: [
+                    { key: 'targetPath', header: 'Target' },
+                    { key: 'linkText', header: 'Link Text' },
+                    { key: 'resolved', header: 'Resolved' },
+                ],
+                textFn: (link) => {
+                    const resolved = link.resolved === 'Yes' ? chalk.green('✓') : chalk.red('✗');
+                    return `  ${resolved} [[${String(link.linkText)}]] → ${String(link.targetPath)}`;
+                },
+            });
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch links');
+        }
+    });
+    // lsvault links backlinks <vaultId> <path>
+    addGlobalFlags(links.command('backlinks')
+        .description('List backlinks pointing to a document')
+        .argument('<vaultId>', 'Vault ID')
+        .argument('<path>', 'Document path'))
+        .action(async (vaultId, docPath, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching backlinks...');
+        try {
+            const client = await getClientAsync();
+            const backlinks = await client.documents.getBacklinks(vaultId, docPath);
+            out.stopSpinner();
+            out.list(backlinks.map(bl => ({
+                source: bl.sourceDocument.title || bl.sourceDocument.path,
+                linkText: bl.linkText,
+                context: bl.contextSnippet || '',
+            })), {
+                emptyMessage: 'No backlinks found.',
+                columns: [
+                    { key: 'source', header: 'Source' },
+                    { key: 'linkText', header: 'Link Text' },
+                    { key: 'context', header: 'Context' },
+                ],
+                textFn: (bl) => {
+                    const lines = [chalk.cyan(`  ${String(bl.source)}`)];
+                    lines.push(`  Link: [[${String(bl.linkText)}]]`);
+                    if (bl.context)
+                        lines.push(`  Context: ...${String(bl.context)}...`);
+                    return lines.join('\n');
+                },
+            });
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch backlinks');
+        }
+    });
+    // lsvault links graph <vaultId>
+    addGlobalFlags(links.command('graph')
+        .description('Get the link graph for a vault')
+        .argument('<vaultId>', 'Vault ID'))
+        .action(async (vaultId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching link graph...');
+        try {
+            const client = await getClientAsync();
+            const graph = await client.vaults.getGraph(vaultId);
+            out.stopSpinner();
+            // For graph, output as JSON structure
+            process.stdout.write(JSON.stringify({ nodes: graph.nodes, edges: graph.edges }) + '\n');
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch link graph');
+        }
+    });
+    // lsvault links broken <vaultId>
+    addGlobalFlags(links.command('broken')
+        .description('List unresolved (broken) links in a vault')
+        .argument('<vaultId>', 'Vault ID'))
+        .action(async (vaultId, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching unresolved links...');
+        try {
+            const client = await getClientAsync();
+            const unresolved = await client.vaults.getUnresolvedLinks(vaultId);
+            out.stopSpinner();
+            if (unresolved.length === 0) {
+                out.success('No broken links found!');
+                return;
+            }
+            // Format as grouped output
+            for (const group of unresolved) {
+                process.stdout.write(chalk.red(`  ✗ ${group.targetPath}`) + '\n');
+                for (const ref of group.references) {
+                    process.stdout.write(`    ← ${ref.sourcePath} (${chalk.dim(ref.linkText)})` + '\n');
+                }
+            }
+            process.stdout.write(`\n  ${chalk.yellow(`${unresolved.length} broken link target(s) found`)}` + '\n');
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch unresolved links');
+        }
+    });
+}

package/dist/commands/mfa.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerMfaCommands(program: Command): void;

package/dist/commands/mfa.js

@@ -0,0 +1,224 @@
+import chalk from 'chalk';
+import ora from 'ora';
+import { getClientAsync } from '../client.js';
+export function registerMfaCommands(program) {
+    const mfa = program.command('mfa').description('Multi-factor authentication management');
+    mfa.command('status')
+        .description('Show MFA status and configured methods')
+        .action(async () => {
+        const spinner = ora('Fetching MFA status...').start();
+        try {
+            const client = await getClientAsync();
+            const status = await client.mfa.getStatus();
+            spinner.stop();
+            console.log(chalk.bold('MFA Status'));
+            console.log(`  Enabled:              ${status.mfaEnabled ? chalk.green('Yes') : chalk.dim('No')}`);
+            console.log(`  TOTP Configured:      ${status.totpConfigured ? chalk.green('Yes') : chalk.dim('No')}`);
+            console.log(`  Passkeys Registered:  ${status.passkeyCount > 0 ? chalk.cyan(status.passkeyCount) : chalk.dim('0')}`);
+            console.log(`  Backup Codes Left:    ${status.backupCodesRemaining > 0 ? chalk.cyan(status.backupCodesRemaining) : chalk.yellow('0')}`);
+            if (status.passkeys.length > 0) {
+                console.log('');
+                console.log(chalk.bold('Registered Passkeys:'));
+                for (const passkey of status.passkeys) {
+                    const lastUsed = passkey.lastUsedAt
+                        ? new Date(passkey.lastUsedAt).toLocaleDateString()
+                        : chalk.dim('never');
+                    console.log(`  - ${chalk.cyan(passkey.name)} (last used: ${lastUsed})`);
+                }
+            }
+        }
+        catch (err) {
+            spinner.fail('Failed to fetch MFA status');
+            console.error(err instanceof Error ? err.message : String(err));
+        }
+    });
+    mfa.command('setup-totp')
+        .description('Set up TOTP authenticator app (Google Authenticator, Authy, etc.)')
+        .action(async () => {
+        const spinner = ora('Generating TOTP secret...').start();
+        try {
+            const client = await getClientAsync();
+            const setup = await client.mfa.setupTotp();
+            spinner.stop();
+            console.log(chalk.bold('TOTP Setup'));
+            console.log('');
+            console.log(`Secret:  ${chalk.cyan(setup.secret)}`);
+            console.log('');
+            console.log('Add this URI to your authenticator app:');
+            console.log(chalk.dim(setup.otpauthUri));
+            console.log('');
+            console.log(chalk.yellow('Note: QR codes cannot be displayed in the terminal.'));
+            console.log(chalk.yellow('      Copy the URI above to any authenticator app that supports otpauth:// URIs.'));
+            console.log('');
+            // Prompt for verification code
+            const code = await promptMfaCode();
+            if (!code) {
+                console.log(chalk.yellow('Setup cancelled.'));
+                return;
+            }
+            const verifySpinner = ora('Verifying code and enabling TOTP...').start();
+            const result = await client.mfa.verifyTotp(code);
+            verifySpinner.succeed('TOTP enabled successfully!');
+            console.log('');
+            console.log(chalk.bold.yellow('IMPORTANT: Save these backup codes securely!'));
+            console.log(chalk.dim('You can use them to access your account if you lose your authenticator device.'));
+            console.log('');
+            // Display backup codes in a grid (2 columns)
+            const codes = result.backupCodes;
+            for (let i = 0; i < codes.length; i += 2) {
+                const left = codes[i] || '';
+                const right = codes[i + 1] || '';
+                console.log(`  ${chalk.cyan(left.padEnd(20))}  ${chalk.cyan(right)}`);
+            }
+            console.log('');
+        }
+        catch (err) {
+            spinner.fail('TOTP setup failed');
+            console.error(err instanceof Error ? err.message : String(err));
+        }
+    });
+    mfa.command('disable-totp')
+        .description('Disable TOTP authentication (requires password)')
+        .action(async () => {
+        const password = await promptPassword();
+        if (!password) {
+            console.log(chalk.yellow('Operation cancelled.'));
+            return;
+        }
+        const spinner = ora('Disabling TOTP...').start();
+        try {
+            const client = await getClientAsync();
+            const result = await client.mfa.disableTotp(password);
+            spinner.succeed(result.message);
+        }
+        catch (err) {
+            spinner.fail('Failed to disable TOTP');
+            console.error(err instanceof Error ? err.message : String(err));
+        }
+    });
+    mfa.command('backup-codes')
+        .description('Show remaining backup code count or regenerate codes')
+        .option('--regenerate', 'Generate new backup codes (requires password, invalidates old codes)')
+        .action(async (opts) => {
+        if (opts.regenerate) {
+            // Regenerate backup codes
+            const password = await promptPassword();
+            if (!password) {
+                console.log(chalk.yellow('Operation cancelled.'));
+                return;
+            }
+            const spinner = ora('Regenerating backup codes...').start();
+            try {
+                const client = await getClientAsync();
+                const result = await client.mfa.regenerateBackupCodes(password);
+                spinner.succeed('Backup codes regenerated!');
+                console.log('');
+                console.log(chalk.bold.yellow('IMPORTANT: Save these new backup codes securely!'));
+                console.log(chalk.dim('All previous backup codes have been invalidated.'));
+                console.log('');
+                // Display backup codes in a grid (2 columns)
+                const codes = result.backupCodes;
+                for (let i = 0; i < codes.length; i += 2) {
+                    const left = codes[i] || '';
+                    const right = codes[i + 1] || '';
+                    console.log(`  ${chalk.cyan(left.padEnd(20))}  ${chalk.cyan(right)}`);
+                }
+                console.log('');
+            }
+            catch (err) {
+                spinner.fail('Failed to regenerate backup codes');
+                console.error(err instanceof Error ? err.message : String(err));
+            }
+        }
+        else {
+            // Show backup code count
+            const spinner = ora('Fetching backup code count...').start();
+            try {
+                const client = await getClientAsync();
+                const status = await client.mfa.getStatus();
+                spinner.stop();
+                console.log(chalk.bold('Backup Codes'));
+                console.log(`  Remaining: ${status.backupCodesRemaining > 0 ? chalk.cyan(status.backupCodesRemaining) : chalk.yellow('0')}`);
+                if (status.backupCodesRemaining === 0) {
+                    console.log('');
+                    console.log(chalk.yellow('You have no backup codes remaining.'));
+                    console.log(chalk.yellow('Run `lsvault mfa backup-codes --regenerate` to generate new codes.'));
+                }
+            }
+            catch (err) {
+                spinner.fail('Failed to fetch backup code count');
+                console.error(err instanceof Error ? err.message : String(err));
+            }
+        }
+    });
+}
+/**
+ * Prompt for a password from stdin (non-echoing).
+ * Returns the password or null if stdin is not a TTY.
+ */
+async function promptPassword() {
+    if (!process.stdin.isTTY) {
+        return null;
+    }
+    const readline = await import('node:readline');
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stderr,
+            terminal: true,
+        });
+        process.stderr.write('Password: ');
+        process.stdin.setRawMode?.(true);
+        let password = '';
+        const onData = (chunk) => {
+            const char = chunk.toString('utf-8');
+            if (char === '\n' || char === '\r' || char === '\u0004') {
+                process.stderr.write('\n');
+                process.stdin.setRawMode?.(false);
+                process.stdin.removeListener('data', onData);
+                rl.close();
+                resolve(password);
+            }
+            else if (char === '\u0003') {
+                // Ctrl+C
+                process.stderr.write('\n');
+                process.stdin.setRawMode?.(false);
+                process.stdin.removeListener('data', onData);
+                rl.close();
+                resolve(null);
+            }
+            else if (char === '\u007F' || char === '\b') {
+                // Backspace
+                if (password.length > 0) {
+                    password = password.slice(0, -1);
+                }
+            }
+            else {
+                password += char;
+            }
+        };
+        process.stdin.on('data', onData);
+        process.stdin.resume();
+    });
+}
+/**
+ * Prompt for an MFA code from stdin (6 digits, echoed for visibility).
+ * Returns the code or null if stdin is not a TTY.
+ */
+async function promptMfaCode() {
+    if (!process.stdin.isTTY) {
+        return null;
+    }
+    const readline = await import('node:readline');
+    return new Promise((resolve) => {
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stderr,
+            terminal: true,
+        });
+        rl.question('Enter 6-digit code from authenticator app: ', (answer) => {
+            rl.close();
+            resolve(answer.trim() || null);
+        });
+    });
+}

package/dist/commands/publish-vault.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerPublishVaultCommands(program: Command): void;